55 ms·

Looking Forward: Support for Secure Shell

828 points by BryantD 11y ago

Someone1234 11y ago
Wonderful. I am a big supporter of Powershell, and while Powershell has supported remoting since almost day one, it will never enjoy quite as much support as SSH already receives (e.g. third party tools, firewall support, etc). It is also nice that they're looking into using something fairly "proven" secure, OpenSSH is exposed to the internet a lot (even if, yes, that is not best practice) so we can reasonably expect it to withstand day to day attacks. In general people really are starting to run out of reasons to "hate" Microsoft. It will be interesting to see what they come up with in the future... PS - I really hope later they expand this to SFTP support. SFTP is significantly better than either FTP or FTPS, and something Windows has lacked since forever.
- insertnickname 11y ago
  >OpenSSH is exposed to the internet a lot (even if, yes, that is not best practice) Please elaborate.
  - eropple 11y ago
    A VPN with sshd exposed only inside the private network is a much smarter way of handling remote access. (But it's initially harder, so lots of people don't do it.)
    - munin 11y ago
      the code for the VPN is better because...?
      - tjohns 11y ago
        It's not necessarily better. But now you have two layers of security (VPN + SSH), rather than just one. And as others have mentioned, either way it's still good practice to disable password auth, so that you can only connect to SSH using a public/private keypair.
        baldfat 11y ago
        Even better don't use default ports. Or have a second ssh that doesn't except any IP address at port 22 and than have your non-standard port with keys and limited user names and if possible a white list of your IP addresses.
        eropple 11y ago
        Not using default ports will mildly confuse automated scans and do absolutely nothing to a determined attacker. Or somebody with nmap, which is not the same thing. If you're whitelisting IPs, you may as well run it on port 22.
        baldfat 11y ago
        No it makes it harder and more of a pain. Trust me I have a friend who loves breaking into my personal server. That one trick two ssh running on different ports screwed with him for a long, long time. He is a genius of a hacker and has been doing it for a living for years. When he finally got in he was so pissed that threw him.
        eropple 11y ago
        You are describing an anecdotal instance of a person whose capabilities are not established being thrown by something that nmap will catch on a normal scan. Color me skeptical. I shall decline to "trust you."
        baldfat 11y ago
        nmap the whole internet isn't very fast
      - jarman 11y ago
        If VPN is broken, you still need to break SSH
      - CHY872 11y ago
        The reason that no one has given yet is that you can monitor more carefully when you have a VPN. With a VPN, you can follow the bastion model; the VPN server runs only the VPN code and nothing else (with as much crap removed as possible), with a really restrictive SELinux policy, every tiny error logged and forwarded. So now, since any attack has to be through the bastion, and all bastion errors are looked at by a human (because there should be only a few of them), then you're more likely to notice a breach more quickly because it won't become caught up in your general logs. It should be noted that it's as easily possible to have the bastion server run an SSH server, and allow SSH access to other servers on your network.
    - e40 11y ago
      You're just trading sshd bugs for VPN bugs, in that case. Which are more likely? From what I know, I think I'll put my lot in with sshd. Perhaps I'm not well informed, though. Also, sshd + fwknop (port knocking) is a very secure combo, IMO.
      - smhenderson 11y ago
        PubkeyAuthentication and disabling password logins helps a lot too. I've also been using deny_hosts a lot over the last couple years as an extra layer.
      - hammerandtongs 11y ago
        With openvpn (which is just ssl) you can simply not respond when someone presents a bad key. openssh always responds (unless I've missed a recent feature) thus exposing which port its listening on and that you sent a bad key. The silent failure is preferable for this application. Port knocking gives you a roughly equivalent layer.
        XorNot 11y ago
        And both these things you never do in production because it takes little effort to establish there must be a port open, whereas the cumulative time you'll spend tracking down whether its a network issue or bad/wrong keys is just not worth it. Not to mention: nobody's going to be brute-forcing properly generated keys remotely. And if they're not properly generated, you have much bigger problems.
        beagle3 11y ago
        openvpn, which is just ssl, was vulnerable to heartbleed. Like the GP said - you're trading VPN bugs for SSH bugs - and experience shows that betting on SSH is generally wiser. If you only need TCP/DNS and not a full-blown VPN, a program called sshuttle uses ssh+python to provide excellent seamless poor man's VPN. It's not perfect - e.g., you lose the ip src address on the forwarded connections - but it works amazingly well, much better than e.g. openvpn and most other vpn products I've used.
      - eropple 11y ago
- joshstrange 11y ago
  > In general people really are starting to run out of reasons to "hate" Microsoft. It will be interesting to see what they come up with in the future... I agree with you overall, MS has made GREAT strides in the last year towards moving my needle from "Wouldn't touch if my life depended on it" to "Huh, that's actually pretty interesting". The old MS still shows through with things like how they are handling Win 10 (Both in versions and cost) but overall they are looking up. That said MS still has a long ways to go and I still wouldn't use Windows for anything (other than gaming) but some other stuff MS has done does interest me.
  - daeken 11y ago
    > how they are handling Win 10 (Both in versions and cost) I'm a bit confused by this. It's free for any genuine Windows 7 or 8 user, and $99 to $199 for anyone else. There are two SKUs (Home and Pro), rather than the multitude with XP or Vista. How is this not a reasonable approach? Especially since Windows 10 is supposed to be the last Windows release of this kind.
    - nogridbag 11y ago
      I believe they also have Windows 10 Enterprise, Windows 10 education and if we include the phone OS: Windows 10 mobile and Windows 10 mobile enterprise.
      - wvenable 11y ago
        The versions are all pretty reasonable and not significantly different outside of the one thing that defines their SKU.
      - pezh0re 11y ago
        Enterprise is understandable - businesses may prefer not to use Pro. I don't believe that you can count Windows 10 Mobile/Mobile Enterprise against the count as they are merely part of Microsoft's effort to combine all their platforms under one operating system.
      - 11y ago
- freehunter 11y ago
  SYSLOG! For the love of god, please support syslog! I work as a consultant supporting a SIEM, and the amount of hoops we need to jump through to get logs from Windows servers is crazy compared to changing one line in a syslog.conf file. I actually dread when a client says "we're an all Windows environment" because wow initial setup just got that much harder. And if we want to install a syslog forwarder on their domain controllers... no one ever trusts software installed on their domain controllers. Everyone trusts a single line in syslog.conf.
  - darklajid 11y ago
    You CAN export the event log data of course, even remotely. But it's rather ugly and I agree that some standard aggregation (syslog or anything) would be great.
    - mhurron 11y ago
      Even the choice of outputs (of which remote syslog should be one) would be a great addition to the Windows event log.
      - sudioStudio64 11y ago
        Microsoft has supported event forwarding since 2003. You can set the machines to push events or have them pulled.
  - hamburglar 11y ago
    Hilarious thought: how much stuff like syslog support would microsoft have to add to start attracting systemd refugees? :D
  - sudioStudio64 11y ago
    MS has supported event forwarding since 2003. You can set machines to forward events or have them pulled. The events are XML that conform to a published schema. There is a WMI call that call pull the aggregated events off the collection servers. I heard this kind of thing from a vendor the other day. It's like people don't even try to learn how it works. Why are they different? The event log has some transactional guarantees that were required for a specific kind of security evaluation...C2? I can't remember the rest. The thing is...you don't have to install a client on the domain controllers. You can setup forwarding to some log hosts and collect them there.
- bad_user 11y ago
  I've been historically what can be described a Microsoft hater and I have to tell you, missing official SSH support has never been a hate generator and insinuating otherwise is insulting. The first reason for which I have historically hated Microsoft is because of how they fought open standards. I can't believe that Microsoft changed in any meaningful way when I can't get a Lumia phone or Outlook to work with CalDAV / CardDAV. And that's just one current annoyance, as we can always talk about ODF, OpenGL and others. The second reason for why I hated Microsoft is for their funding of SCO's lawsuit for the ownership of Unix. That was a long time ago, they must have changed right? Except that currently they are behaving like a patent troll, extracting profit out of Android through what can be described as racketeering, more profit than they do from Windows Phone. The third reason for why I now hate Microsoft is for how they are (again) pushing for Trusted Computing. It's basically what happens when the OS provider becomes the gatekeeper of what you can install and do with your own computer. I never took this as a threat to personal computing, except that now Apple has made it acceptable. Things like insisting on logging in with Microsoft accounts, or only being able to install "modern apps" through their store (while taking a revenue cut of course) would have been unthinkable only 10 years ago. So thanks Apple for shifting the overton window, thanks Microsoft for delivering it to PCs. Of course, "hate" is a strong word. I don't really hate them, I just speak against them. But given how people fill the forums lately with messages of the second coming, I'm wondering what the heck are these people smoking, because I want some.
  - ksk 11y ago
    If lawsuits and not supporting something you like makes you dislike a company, I'd guess that almost all corporations would be on your 'hate' list. My dislike of MS is quite simple. I simply don't like their products. That doesn't mean I automatically love OSX or Linux. IMO OSX is a mediocre product with a polished user experience and Linux as a desktop is just broken. Unfortunately, I can't say there is a single OS that I like at the moment.
    - pjc50 11y ago
      I'd guess that almost all corporations would be on your 'hate' list. This is a popular position, yes. But Microsoft in particular have tried to make Linux impossible on a number of occasions over a period of decades, so it'll take a while for the guerillas to come out of the jungle and stop fighting them. But now they're in competition with the platform that want to annex all your personal data and the platform that want a veto over all applications, so they're not necessarily the most hated party in the room any more.
- totony 11y ago
  Why is SFTP > FTPS? Any place I could look for some info on this? Are you talking about firewall easy-to-setup?
  - scrollaway 11y ago
    SFTP is file transfer over ssh. FTPS is FTP over SSL. FTPS being FTP-based, and FTP being a terrible protocol, SFTP > FTPS definitely. You get all the advantages and security of SSH with SFTP.
    - totony 11y ago
      From what I have seen FTPS seems as secure as SFTP if well configured (i.e. no fallback), why do you say FTP is such a bad protocol? I have tried to look it up, but the answers seem to revolve around firewall being hard to setup and FTP being not secure (which is resolved by encapsuling it in SSL). Also my search suggests than ssh provides an additional overhead compared to using ssl for file transfer (i.e. http://serverfault.com/questions/131240/ftp-v-s-sftp-v-s-ftps http://serverfault.com/questions/131240/ftp-v-s-sftp-v-s-ftp...)
jadeddrag 11y ago
I'm looking forward to MS just dropping their OS entirely and using linux as their back-end. Basically, Microsoft might be better off creating their own linux distribution running a "microsoft windows" windows manager.
- UK-AL 11y ago
  Why? The windows core is a perfectly good alternative to Linux. It's always good to have competition.
  - jadeddrag 11y ago
    How would we know unless we can read (and compile) the source code?
    - Someone1234 11y ago
      Considering how few people read and compile the Linux source code, how do you know on Linux? Most distributions are binary, not source.
      - lelandbatey 11y ago
        While that's true, I still know people who compile their own OS from scratch; I've gone through the experience of compiling my entire system from source via Linux From Scratch[0]. There are many thousands of people who have done the same thing, and this gives us a "web of trust". And if you don't want to trust anyone, you can always compile it yourself. That's the difference: I have the freedom to learn and study anything and everything. It might not be likely, and it might not be convenient, but it is possible. [0] - http://www.linuxfromscratch.org/lfs/view/stable/ http://www.linuxfromscratch.org/lfs/view/stable/
      - schoen 11y ago
        Fortunately that will change for Debian, and, we can hope, Debian-based distributions. https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds (I gave a talk about this at CCC. The status quo is a reason why free software doesn't have some of the transparency benefits over proprietary software we might expect, if you fear some developer is attacking you or someone is attacking some developers' infrastructure.)
techdragon 11y ago
Wow. Just wow. This is something I never expected to come from Microsoft. They may in fact be changing for the better.
insulanian 11y ago
Well... all I can say is RESPECT!!! But don't get lazy! We still need state of the art terminal!
- zokier 11y ago
  Isn't ISE pretty ok? At least it has decent enough copy and paste...
  - hasenj 11y ago
    What is ISE? A link would be nice too (please?)
    - vmarsy 11y ago
      Powershell ISE? https://technet.microsoft.com/en-us/library/dd315244.aspx https://technet.microsoft.com/en-us/library/dd315244.aspx
AdmiralAsshat 11y ago
I happily await the day when I no longer need to install PuTTY on all of my fresh Windows installs.
- zhengyi13 11y ago
  Or worse, Cygwin, because of some obscure process that needs to connect via ssh to your Windows server...
  - smhenderson 11y ago
    Cygwin comes with openssh-server [1]. I'll admit cygwin is quirky and not the best option always but I've used it to host ssh server on Windows in the past. [1] https://cygwin.com/faq.html#faq.using.sshd-in-domain https://cygwin.com/faq.html#faq.using.sshd-in-domain
  - yellowapple 11y ago
    Agreed here. Installing and configuring Cygwin has traditionally been a royal pain; Microsoft offering some equivalent as an officially-supported Windows add-on (or just part of the core Windows) would be a godsend.
- Someone1234 11y ago
  They really need to announce a conhost replacement. The "experiments" in Windows 10 are undeniably improvements for when we still use things like cmd, but Powershell needs a modern terminal window and there needs to be a native answer to Putty for both SSH and Powershell remoting. I'd say after SSH this should be a priority for the Powershell team. Conhost is holding them back. A lot.
  - zokier 11y ago
    Isn't ISE pretty much what you are asking for?
    - eropple 11y ago
jsingleton 11y ago
Good news! WinRM is a massive pain. The hoops you have to go through to bootstrap a fresh Windows image to get to the point you can run PowerShell is crazy.
- j_s 11y ago
  Until SSH support arrives, be sure to check out how BoxStarter does things! http://boxstarter.org/ http://boxstarter.org/
- sudioStudio64 11y ago
  I've never had that experience...but then I'm using domain joined machines.
ahmetmsft 11y ago
This has been my long time dream. There's so little that prevents this from happening theoretically (obviously there's a lot of coding will be done, but hey that's the fun part). I am very glad Microsoft is taking all the right steps to bring two world closer: Linux and Windows. With all the announcements around stuff like Docker for Windows Server Containers and cross platform .NET, this was nearly inevitable. Now the server management also steers in the right direction. Disclaimer: ms employee doing tons of open source.
baby 11y ago
Getting there slowly... For the moment I use `babun` and everything works well. http://babun.github.io/ http://babun.github.io/
- unexistance 11y ago
  thanks for the link :D looks great, as I am currently STILL using UnxUtils plus other stuff
yuhong 11y ago
It is interesting that this is part of PowerShell and not Windows, unlike Telnet.
atonse 11y ago
> Given our changes in leadership and culture, we decided to give it another try and this time, because we are able to show the clear and compelling customer value, the company is very supportive. Is that code for Ballmer's regime vs Nadella's regime?
- dtech 11y ago
  It's pretty much a public secret that Ballmer was one of the last reasons why Microsoft did not participate much in the OSS community even though a lot of employees wanted it. To give a concrete example of the changes (heard from a former Microsoft employee): Under Ballmer they were not allowed to touch anything open-source. Pretty soon after he left that was changed to a policy that a BSD/MIT open-source solution must be used if it is available unless there's a damned good reason.
  - joshstrange 11y ago
    Ballmer has a BAD case of "Not invented here". I remember reading a story about him calling out and mocking an employee in a meeting b/c they has an iPhone (this was around 2008 I think). First off it's a VERY GOOD IDEA to use your competitors products if only to see how they stack up (Spoiler: They blew away MS's mobile offerings in 2008 and still do to this day). Second, what a way to make all of your employees yes-men who live in their own world shut off from what was happening in real world. He was douche all around from what I can tell and him leaving is one of the best things that could have happened to MS. Ballmer took over MS soon after I really got into computers and let it stagnate (XP/IE6) which lead me to switch to Linux/OSX and I've never looked back. I'm not saying it's all his fault but I think he was extremely influential in decisions that ultimately pushed me away from MS.
    - rogeryu 11y ago
      I moved away in 1999 to the Mac, and because of the incredible expensive Macs nowadays, I'm probably going to make another move, to Ubuntu. Still, Steve Jobs was not an easy guy either. I don't know if he would mock an employee for having an Android phone? Not unlikely given how anti-Android he was.
joshrivers 11y ago
Oh thank god!
shmerl 11y ago
MS is finally waking up. I guess new CEO has some positive effect.
deleted 11y ago
[deleted]
homulilly 11y ago
This is great but I'm still sticking to MinTTY/Cygwin for SSH until Windows gets a decent terminal program.
2close4comfort 11y ago
WOW that is a huge step for M$ maybe there is still some surprises left for the new order within Microsoft. I for one welcome a replacement to PuTTY.
kstrauser 11y ago
OH THANK GOD. I'm using Ansible to manage Windows, and today that means fooling around with WinRM. For example, that involved adding Kerberos support to Ansible so that it could authenticate against Windows domain accounts, because those are authed differently from local machine accounts. Assuming the project succeeds this time around, it's going to be way easier to incorporate Windows servers into Unix-centric management systems. That's a huge benefit to DevOps and Microsoft. Thanks!
- pbowyer 11y ago
  Is there any noise about being able to use Windows as an Ansible host? I like Ansible far more than the alternatives, but I can't make developers I work with keep a Linux VM running just to run Ansible to provision a development VM. That would be... crazy.
  - kstrauser 11y ago
    Not that I've heard, but I'm just a regular contributor and not a maintainer. The last I heard, the chances were somewhere between "when pigs fly" and "LOL no". Then again, at one point the idea of supporting Windows hosts was unlikely and yet here we are. That said, I wonder how well it'd run under Cygwin. I've never even attempted this experiment so I don't have the foggiest.
haosdent 11y ago
+1
cturner 11y ago
For all Balmer's thing of dancing on a stage and chanting "developers", there was no point under Gates or he at which Microsoft felt like a pro-developer company. That has completely changed in the last eighteen months. Each time I think "wouldn't it be cool if" I'm finding a few weeks later that someone at Microsoft is well ahead of me. How much easier it will be to ship my sucky roguelikes to Windows users in this new world! Hmm. They can now have a path to obsolete cmd. As long as they ship a decent ssh client with the system, users will become accustomed to ssh-ing to their own box instead of using cmd. Wishlist: tmux, emacs, vi, netcat, shell option for vi-mode, rc-file with preferences, ncurses library, something simpler than curses, zip and unzip. 256 colour is fine, although 24-bit would be impressive. /proc would be cool, but also a big ask I assume. They already have a strong compiler. Make it really easy to find the hex fingerprint required to log on to the sshd-server. Something like inetd could be useful, too.
- baldfat 11y ago
  Wishlist: mobaxterm - http://mobaxterm.mobatek.net/ http://mobaxterm.mobatek.net/
- astazangasta 11y ago
  Cygwin has all of those things and ssh server support.
  - cturner 11y ago
    Fair. But I couldn't target my crappy roguelikes at cygwin - requires complicated third-party installs. I ran cygwin-with-ssh heavily for a while in 2003. It was a hell of a thing to get it going. Then I had trouble getting it to work on a new computer and gave up. Shouldn't be surprised that it got good again.
    - nacs 11y ago
      Try Babun [1] for a pre-configured Cygwin setup with an easy install. I've been using it for the past month or so and it works great. [1]: http://babun.github.io/ http://babun.github.io/
malkia 11y ago
Born Again Microsoft! Great stuff!
- lucb1e 11y ago
  Is this a reference to the bash shell? (Bourne Again SHell)
outworlder 11y ago
YES! Now, can we please get a proper terminal? :)
- 72deluxe 11y ago
  PowerShell? Unless you mean the normal Unix terminal, which is 40 years old? I jest, somewhat. You oddly never get BASH users complaining about the lack of Batch file support, but it is always vocal the other way around.
mixmastamyk 11y ago
Hallelujah... new package manager, modular install, and now ssh? What's left? Perhaps a real terminal? To bad this won't make it into Win 10, unless I misunderstood something. Looks like my days of sneering at Windows as a toy are numbered... end of an era, and it makes me a bit sad, sniff.
- sz4kerto 11y ago
  Well, Win10 is the 'last Windows' according to MS, so this will probably arrive as an update later.
  - higherpurpose 11y ago
    If this is like "OS X", then it doesn't mean anything. You'll still have to pay to buy "Windows 10.1" or "Windows 10 Redstone" or whatever they will call it. "Last version of Windows" is nothing but marketing, just like the overhyped "one Windows" idea. There isn't actually just "one" Windows 10, is there? Most versions of Windows 10 are not even within 10% of each other in terms of differences. There's a much larger gap between them. Windows 10 IoT Core isn't actually Windows 10, just like Brillo isn't actually Android.
    - umanwizard 11y ago
      OS X updates are free. I have installed a few since getting my Mac.
      - heartbreak 11y ago
        They were not always free; that's a recent change.
        umanwizard 11y ago
        I know that. Regardless, they are free now, so it's not unreasonable (given the competitive nature of the software industry) to think Microsoft's will be too.
ninjaoxygen 11y ago
This would be great if they implement an SSH server, but I'm guessing the shell it connects to is PowerShell, rather than a sh derivative, so many tools many not work with it?
- yellowapple 11y ago
  It wouldn't be much different than, say, Cisco switches/routers, which (IIRC) also are managed over SSH but implement an atypical shell oriented around network configuration. So yeah, most tools would need to be adapted to manage Windows. A first-party Cygwin equivalent would be a good next step to ease that particular pain point, but said pain point is much easier than, say, having to install an SSH server yourself.
Yaggo 11y ago
Seems that Windows is adopting more and more * nix stuff. I wonder why one uses Windows in the first place if * nix stuff is what she needs?
- krylon 11y ago
  As a Windows admin and long time GNU/Linux / BSD user, I would totally love to replace every single Windows at our company with a Unixoid system. But there's a lot of software we use that either is not available on non-Windows platforms, where no decent replacement exists and/or migration is considered to expensive. If, say, Autodesk ported their software to some free Unixoid system, that would go a long way. But AFAIK, that is not going to happen anytime soon.
  - 72deluxe 11y ago
    This is very true. The Windows software market is colossal, and the ability to run software from decades ago is a feature not found on any other OS group (Linux + OSX included). I know we all like to think and strangely wish that we could replace Windows server with Linux boxes and Windows desktops with Linux desktops but the sad truth is that there is no good replacement for Exchange or Active Directory (and the myriad of extensions that you can install into it; even writing one isn't that hard), including all the mobile OS support for mail on it (and calendars), nor is there a Linux desktop that would be instantly comfortable and navigable to 90% of Windows users. My mum would be lost, for certain. I would be lost under Unity or GNOME3 (only with blind rage I feel). It's a bit of a pipe dream, or very unrealistic. And I say this as a fan and user of all the major systems (and having been Linux and Windows sysadmin in the past).
    - krylon 11y ago
      Well, as far as Active Directory goes, I think it is possible to run a "Windows" domain using Samba. But apart from that, I tend to agree. I still want to believe it is possible to get Windows users comfortable on a Unix desktop, it works with OS X, after all. But practically speaking, you are right.
boomlinde 11y ago
I've been doing something similar using a virtual machine running Windows 7 and a whole host of really stupid VPN solutions to connect to customer networks. I ran sshd via Cygwin, which logged me into /bin/sh, from which I could actually start cmd.exe. Presumably, I could also have started PowerShell had I tried it. It's nice to see that they are offering an official way to do this.
yellowapple 11y ago
The only thing left for them to do is to include Cygwin (or some equivalent) as a built-in Windows feature. Hell's not only freezing over, but freezing everything else with it. What a time to be alive.
- 72deluxe 11y ago
  Lots of people keep saying this on this thread, but why would you want GNU tools on Windows ? Have you ever wanted to put Apple's runtime on your Linux box? Or MSVC runtimes on your Linux machine? Weirdly, everyone wants the opposite.
  - yellowapple 11y ago
    I'm not interested specifically with GNU's tools, just standard Unix tools in general; Microsoft could easily use Cygwin (for example) as a reference point for porting/packaging the BSD userland to/for Windows, for example. > Have you ever wanted to put Apple's runtime on your Linux box? Not in that sense, but a Linux + BSD userland would be neat. Apple's runtime is basically that minus Linux plus Mach/XNU plus Cocoa. > Or MSVC runtimes on your Linux machine? Good God no. > Weirdly, everyone wants the opposite. Not universally true if you count Wine as "MSVC runtimes on your Linux machine".
    - 72deluxe 11y ago
      Out of interest, what's wrong with MSVC runtimes? Plenty of software has been written using it. Doesn't Wine basically implement MSVC runtimes?
      - yellowapple 11y ago
        And said software is typicaly bloated and buggy relative to its Unix counterparts. The MVSC runtimes are popular solely because Windows is popular. Wine is a stopgap for software that's still reliant on Windows. The preferred approach would be for that software to instead be properly ported, which would include using a proper libc and executable package format (like ELF). That said, my opinions aren't representative of everyone in the world. There are projects like Wine and (more interestingly) winelib that implement the MSVC, and those are popular projects (the former more popular, though the latter closer to being solely MSVC on Linux).
krylon 11y ago
Finally! PowerShell Remoting just plain sucks, at least it has for me. I've always wondered why the PowerShell developer(s?) would do something so needlessly contrived when SSH has been around for, like, twenty years or so. This will definitely make my job easier! Or at least more convenient.
- bigdubs 11y ago
  "I've always wondered why the PowerShell developers ..." Think about the beginning of that sentence. They invented a new console language, when bash has been around forever and C# is a better programming language generally and can be run as a scripted language with a little finagling. I don't think the PS team is bad (or PS itself for that matter), I just think there was a lot of re-inventing of the wheel for no reason, and that started way upstream of remoting.
  - hyperliner 11y ago
    This a good point. The internal incentives of the previous ranking model used by HR there create these behaviors. More here: https://news.ycombinator.com/item?id=9598015 https://news.ycombinator.com/item?id=9598015
  - krylon 11y ago
    Well, either way, I'm glad they have finally decided to go for SSH. I'm still not sure I really like PowerShell, but whether one likes it or not, it has become too useful to ignore. And even on days when I really dislike it, it is still a huge improvement on cmd and vbs. I still do a lot of my Windows scripting in Perl, mostly because I am familiar with it, CPAN still rules, and I am not sure I want to learn the .Net framework just so I can do some admin-type scripting. But it's good to have options.
  - parkovski 11y ago
    They didn't reinvent the wheel. Bash was intended for a Unix environment with all the corresponding utilities. PowerShell was designed for a Windows/.NET environment, which is undeniably different, and they also took the opportunity to create an object oriented shell instead of a text oriented one. I also like C# but I do feel it makes a pretty poor scripting/shell language. I do think SSH is long overdue, but based on the post it looks like the developers have always been on the right track - management just wouldn't let them do it. Really glad this is changing.
jjcm 11y ago
This is a big step, I'd love some MOSH support too though.
SwellJoe 11y ago
About damn time.
finnh 11y ago
not to be too snarky, but perhaps "looking backward" would be a better title =) (don't get me wrong, I love my ssh and am glad to see msft supporting it for real)
ised 11y ago
http://www.microsoft.com/en-us/download/details.aspx?id=2391 http://www.microsoft.com/en-us/download/details.aspx?id=2391 If I am forced to use Windows in an Enterprise setting, then I just go to Control Panel and enable the POSIX layer ("SUA"), then download the SDK and install. With some minor changes to the %Path, it just works. SUA has older versions of tcsh, ksh, vi and many other utilities, including an older Perl and an old GCC toolchain that does work. It is 4.2BSD based. If you are at home on BSD, it is like going back in time. netcat, tmux, emacs, etc. you would have compile yourself. Maybe OpenSSH would compile and run. I have not tried. Perhaps an alternative to Cygwin, etc. Not "better" but different. It generally "seems" faster and I find it's more difficult to "break" than Cygwin which in my experience can be very "delicate". The SUA White Paper says SUA comes to within 10% of the speed of native Windows. The main advantage though, for me, is that this is not "unauthorized third party software" to the extent it comes with Windows and the SDK download comes from Microsoft's Akamai account.
- zokier 11y ago
  Afaik SUA is pretty much dead, so do not carry too much hope in seeing improvements for it.
- wvenable 11y ago
  I just download GnuWin which gives you most Unix tools compiled natively for Win32. Includes OpenSSH too. http://gnuwin32.sourceforge.net/ http://gnuwin32.sourceforge.net/
  - jsalit 11y ago
    from the look of the website, GnuWin is terribly out of date and packages like OpenSSL (I don't seen OpenSSH listed) will have lots of known security vulnerabilities..
- rbanffy 11y ago
  When I am forced to use Windows, I immediately download Cygwin. I am almost tempted to congratulate Microsoft and welcome them to 1995, although I am quite sure Cygwin didn't have ssh back then.
lucaspottersky 11y ago
yeah, never too late i guess? it took more than a decade to make such a move...
tammer 11y ago
I made an uncomfortably audible gasp of shock upon seeing this. Server versions of Windows have been heading in a console-only direction for a while now but the complexity of PowerShell remoting really didn't make it feel like a feasible solution. This completely changes the windows admin game.
neil_s 11y ago
TIL that the Windows Dev team have a forum for engaging with users about console features: https://wpdev.uservoice.com/forums/266908-command-prompt https://wpdev.uservoice.com/forums/266908-command-prompt Back when I interned at MS in 2013, people were alarmed when I spoke to users on some forums about their complaints because I was designing a related feature. We had to check with legal whether I would have to delete all my posts!
nsxwolf 11y ago
How about a terminal window you can resize with the mouse, and effortlessly cut and paste text, and with tab completion that doesn't do weird inexplicable things? Do they have that yet?
- jevgeni 11y ago
  Apart from unconstrained resizing, everything else is part of Powershell.
  - jyrkesh 11y ago
    No, actually. Ctrl+V and Ctrl+C are implemented in PSReadline, but those features have also been added to the Windows 10 console host (i.e. they work with cmd.exe). The other big one for me that's been added to the console host is "line wrapping selection". You can actually highlight text now correctly as opposed to copying a rectangular block of text (though the latter is sometimes useful, just hold Alt when you're highlighting).
    - jevgeni 11y ago
      True on line wrapping. You can copy-paste using right click, though.
- McGlockenshire 11y ago
  There are dramatic improvements in the command prompt windows in Win10: http://www.hanselman.com/blog/Windows10GetsAFreshCommandPromptAndLotsOfHotkeys.aspx http://www.hanselman.com/blog/Windows10GetsAFreshCommandProm...
  - nsxwolf 11y ago
    Just tried it in a VM install. Seems pretty good. A long time coming. Could use tabbed views, though.
w8rbt 11y ago
I hope that Microsoft donates money to OpenSSH/OpenBSD. The way I read this, they indicated that they would. "I’m pleased to announce that the PowerShell team will support and contribute to the OpenSSH community."
graffitici 11y ago
I wish Windows just became a POSIX compliant OS. I think that would solve a lot of these smaller issues in an elegant way. Apple did a very smart job with Mac OS X, to the point where even I switched to a Mac after having Linux for so many years. It's incredible how I can install packages using homebrew and friends.. Come on Microsoft, go all the way!
- 72deluxe 11y ago
  I think homebrew and MacPorts are niche though. Your "normal" OSX user wouldn't install them. Heck, I ran Linux for years and years and I haven't even installed them under OSX because if I wanted to run BSD or Linux, I'd have installed BSD or Linux. It's like installing all those GNU tools on Windows to make it more like Linux, and putting Homebrew etc. on OSX to make it more like Linux. Why not just use Linux or BSD? I never understand it. Also, the lack of proper Quartz windowing support from X11 apps makes using them painful.
  - graffitici 11y ago
    I think the key point here is this: you're right that regular users don't need homebrew; developers certainly do. By having an analog of homebrew for Windows, Microsoft can attract more developers, which then would translate into a better app infrastructure for Windows. This would then clearly benefit regular users as well. I haven't used Windows in a very long time, but whenever I sit by a friend's computer, I find it astonishing how badly designed Windows apps are. Certainly Apple's fixation with design created a culture of beautiful apps. But having more developers would also probably improve the situation
    - rectangletangle 11y ago
      I think that's their long-term strategy. Attract more devs to the platform, new applications will follow, then finally customers. I'm definitely paying attention.
    - 72deluxe 11y ago
      I'm a developer (I develop on OSX and Windows every day for my day job and at home for myself) and I do not use homebrew. There is not anything I am really missing, but I write C++/Obj-C and you might write something different. It is interesting regarding the state of app design as most of the BSD or Linux software looks odd to me! I agree that Windows has some odd looking software but they do typically offer more features - you don't get MDI under OSX.
deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]
  - deleted 11y ago
    [deleted]
mrweasel 11y ago
Wonderful, and I am a bit interested in seeing how well the Microsoft guys and the OpenBSD/OpenSSH team is going to interact. I have no doubt the the Microsoft developers are nothing but professional, but still the OpenSSH people seem to have pretty high standard.
geff82 11y ago
Hell is freezing over at 0K. Oh my god. Wow.
baconhigh 11y ago
so windows users might finally be able to download a verifiable/signed and maybe "trusted" application to use ssh with? (https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...)
- rbanffy 11y ago
  Cygwin has the terminal part of PuTTY built from source. Install Cygwin with MinTTY and you get ssh with bash (and a whole lot of Unix-like niceties) for free.
gionn 11y ago
First they ignore you, then they laugh at you, then they fight you, then you win.
noveltyaccount 11y ago
What's next? Powershell for Linux? Powershell for Mac? (Pretty please?) Powershell's piping of .NET objects is so brilliant compared to Bash piping and parsing of text.
- tacticus 11y ago
  Why not just use one of the many other languages available. You could use ipython if you wanted object handling. Now i wonder what would have happened if they didn't have gates or ballmer upstairs and they wanted to implement a new shell.
owenfi 11y ago
As an only occasional Windows user, I wasn't sure what PowerShell was (sounds 3rd party to me, a la Cygwin). Turns out it is a 1st party command line tool and scripting engine. From a glance it looks to use similar syntax to CMD.exe, but sits side-by-side with it, not built on top.
- dspillett 11y ago
  Looking at it from a Unix-a-like background Powershell provides a script capable shell (ala bash and friends) including built-ins that do useful stuff in some of the posix and gnu externals commonly called from shell scripts. Rather than working primarily on text and streams like most unix-a-like shells it is object based. Through the relevant modules and the objects they provide it allows pretty complete interaction with the Windows management infrastructure so in the right hands it can be very powerful. See http://en.wikipedia.org/wiki/Windows_PowerShell http://en.wikipedia.org/wiki/Windows_PowerShell. On any Windows machine that isn't obsolete or close to (the 2003 editions fall out of support very soon and XP already has, anything newer had PS integrated) you'll find at least v2, usually v3 or higher. I keep meaning to find a good book or online reference and spend some time properly learning how to use the thing... For some things it'll replace my need to have cygwin installed everywhere, and it might allow me to do some stuff "better".
pldimitrov 11y ago
rip putty
libraryatnight 11y ago
I spend a good majority of my day doing administrative tasks in Windows and o365 where PowerShell is a god send. There have been more than a few occasions where I wished for SSH capability, so this news is fantastic.
sandGorgon 11y ago
I dont know if anyone has used Git Shell on Windows. I do a lot of Python programming on windows and git shell is spectacular - inbuilt ssh, git, vim and a full linux userland.
squiguy7 11y ago
A tweet from the OpenSSH developers: https://twitter.com/damienmiller/status/605865246016692225 https://twitter.com/damienmiller/status/605865246016692225
fapjacks 11y ago
I guess better late than never, eh?
PaulRobinson 11y ago
"Those who don't understand Unix are condemned to reinvent it, poorly." – Henry Spencer Basically, bit by bit it seems Microsoft are realising there is a ton of stuff they need to take from the unix environment. The comments here about how awesome PowerShell and the other tools within all are seem to focus on everything being an object rather than being text. So, we could fix that by basically providing a "Ruby shell" in one sweep. You go through the standard utilities you have on unix systems, provide them as Ruby methods on various objects (the Ruby stdlib has a great many) and provide a means to navigate a file system easily, and basically you have the beginnings of an object-orientated shell with the support of the traditional 30+ year old command line utilities. What is it I am missing? This feels all a little reminiscent of when Microsoft got all giddy about providing symbolic links... well... yeah... I mean... what?
grogenaut 11y ago
If but I could send this moment (and recent ones) back in time to the slashdot of 2005...

828 points by BryantD 11y ago

Wonderful. I am a big supporter of Powershell, and while Powershell has supported remoting since almost day one, it will never enjoy quite as much support as SSH already receives (e.g. third party tools, firewall support, etc). It is also nice that they're looking into using something fairly "proven" secure, OpenSSH is exposed to the internet a lot (even if, yes, that is not best practice) so we can reasonably expect it to withstand day to day attacks. In general people really are starting to run out of reasons to "hate" Microsoft. It will be interesting to see what they come up with in the future... PS - I really hope later they expand this to SFTP support. SFTP is significantly better than either FTP or FTPS, and something Windows has lacked since forever.

insertnickname 11y ago
>OpenSSH is exposed to the internet a lot (even if, yes, that is not best practice) Please elaborate.
- eropple 11y ago
  A VPN with sshd exposed only inside the private network is a much smarter way of handling remote access. (But it's initially harder, so lots of people don't do it.)
  - munin 11y ago
    the code for the VPN is better because...?
    - tjohns 11y ago
      It's not necessarily better. But now you have two layers of security (VPN + SSH), rather than just one. And as others have mentioned, either way it's still good practice to disable password auth, so that you can only connect to SSH using a public/private keypair.
      - baldfat 11y ago
        Even better don't use default ports. Or have a second ssh that doesn't except any IP address at port 22 and than have your non-standard port with keys and limited user names and if possible a white list of your IP addresses.
        eropple 11y ago
        Not using default ports will mildly confuse automated scans and do absolutely nothing to a determined attacker. Or somebody with nmap, which is not the same thing. If you're whitelisting IPs, you may as well run it on port 22.
        baldfat 11y ago
        No it makes it harder and more of a pain. Trust me I have a friend who loves breaking into my personal server. That one trick two ssh running on different ports screwed with him for a long, long time. He is a genius of a hacker and has been doing it for a living for years. When he finally got in he was so pissed that threw him.
        eropple 11y ago
        You are describing an anecdotal instance of a person whose capabilities are not established being thrown by something that nmap will catch on a normal scan. Color me skeptical. I shall decline to "trust you."
        baldfat 11y ago
        nmap the whole internet isn't very fast
    - jarman 11y ago
      If VPN is broken, you still need to break SSH
    - CHY872 11y ago
      The reason that no one has given yet is that you can monitor more carefully when you have a VPN. With a VPN, you can follow the bastion model; the VPN server runs only the VPN code and nothing else (with as much crap removed as possible), with a really restrictive SELinux policy, every tiny error logged and forwarded. So now, since any attack has to be through the bastion, and all bastion errors are looked at by a human (because there should be only a few of them), then you're more likely to notice a breach more quickly because it won't become caught up in your general logs. It should be noted that it's as easily possible to have the bastion server run an SSH server, and allow SSH access to other servers on your network.
  - e40 11y ago
    You're just trading sshd bugs for VPN bugs, in that case. Which are more likely? From what I know, I think I'll put my lot in with sshd. Perhaps I'm not well informed, though. Also, sshd + fwknop (port knocking) is a very secure combo, IMO.
    - smhenderson 11y ago
      PubkeyAuthentication and disabling password logins helps a lot too. I've also been using deny_hosts a lot over the last couple years as an extra layer.
    - hammerandtongs 11y ago
      With openvpn (which is just ssl) you can simply not respond when someone presents a bad key. openssh always responds (unless I've missed a recent feature) thus exposing which port its listening on and that you sent a bad key. The silent failure is preferable for this application. Port knocking gives you a roughly equivalent layer.
      - XorNot 11y ago
        And both these things you never do in production because it takes little effort to establish there must be a port open, whereas the cumulative time you'll spend tracking down whether its a network issue or bad/wrong keys is just not worth it. Not to mention: nobody's going to be brute-forcing properly generated keys remotely. And if they're not properly generated, you have much bigger problems.
      - beagle3 11y ago
        openvpn, which is just ssl, was vulnerable to heartbleed. Like the GP said - you're trading VPN bugs for SSH bugs - and experience shows that betting on SSH is generally wiser. If you only need TCP/DNS and not a full-blown VPN, a program called sshuttle uses ssh+python to provide excellent seamless poor man's VPN. It's not perfect - e.g., you lose the ip src address on the forwarded connections - but it works amazingly well, much better than e.g. openvpn and most other vpn products I've used.
    - eropple 11y ago
joshstrange 11y ago
> In general people really are starting to run out of reasons to "hate" Microsoft. It will be interesting to see what they come up with in the future... I agree with you overall, MS has made GREAT strides in the last year towards moving my needle from "Wouldn't touch if my life depended on it" to "Huh, that's actually pretty interesting". The old MS still shows through with things like how they are handling Win 10 (Both in versions and cost) but overall they are looking up. That said MS still has a long ways to go and I still wouldn't use Windows for anything (other than gaming) but some other stuff MS has done does interest me.
- daeken 11y ago
  > how they are handling Win 10 (Both in versions and cost) I'm a bit confused by this. It's free for any genuine Windows 7 or 8 user, and $99 to $199 for anyone else. There are two SKUs (Home and Pro), rather than the multitude with XP or Vista. How is this not a reasonable approach? Especially since Windows 10 is supposed to be the last Windows release of this kind.
  - nogridbag 11y ago
    I believe they also have Windows 10 Enterprise, Windows 10 education and if we include the phone OS: Windows 10 mobile and Windows 10 mobile enterprise.
    - wvenable 11y ago
      The versions are all pretty reasonable and not significantly different outside of the one thing that defines their SKU.
    - pezh0re 11y ago
      Enterprise is understandable - businesses may prefer not to use Pro. I don't believe that you can count Windows 10 Mobile/Mobile Enterprise against the count as they are merely part of Microsoft's effort to combine all their platforms under one operating system.
    - 11y ago
freehunter 11y ago
SYSLOG! For the love of god, please support syslog! I work as a consultant supporting a SIEM, and the amount of hoops we need to jump through to get logs from Windows servers is crazy compared to changing one line in a syslog.conf file. I actually dread when a client says "we're an all Windows environment" because wow initial setup just got that much harder. And if we want to install a syslog forwarder on their domain controllers... no one ever trusts software installed on their domain controllers. Everyone trusts a single line in syslog.conf.
- darklajid 11y ago
  You CAN export the event log data of course, even remotely. But it's rather ugly and I agree that some standard aggregation (syslog or anything) would be great.
  - mhurron 11y ago
    Even the choice of outputs (of which remote syslog should be one) would be a great addition to the Windows event log.
    - sudioStudio64 11y ago
      Microsoft has supported event forwarding since 2003. You can set the machines to push events or have them pulled.
- hamburglar 11y ago
  Hilarious thought: how much stuff like syslog support would microsoft have to add to start attracting systemd refugees? :D
- sudioStudio64 11y ago
  MS has supported event forwarding since 2003. You can set machines to forward events or have them pulled. The events are XML that conform to a published schema. There is a WMI call that call pull the aggregated events off the collection servers. I heard this kind of thing from a vendor the other day. It's like people don't even try to learn how it works. Why are they different? The event log has some transactional guarantees that were required for a specific kind of security evaluation...C2? I can't remember the rest. The thing is...you don't have to install a client on the domain controllers. You can setup forwarding to some log hosts and collect them there.
bad_user 11y ago
I've been historically what can be described a Microsoft hater and I have to tell you, missing official SSH support has never been a hate generator and insinuating otherwise is insulting. The first reason for which I have historically hated Microsoft is because of how they fought open standards. I can't believe that Microsoft changed in any meaningful way when I can't get a Lumia phone or Outlook to work with CalDAV / CardDAV. And that's just one current annoyance, as we can always talk about ODF, OpenGL and others. The second reason for why I hated Microsoft is for their funding of SCO's lawsuit for the ownership of Unix. That was a long time ago, they must have changed right? Except that currently they are behaving like a patent troll, extracting profit out of Android through what can be described as racketeering, more profit than they do from Windows Phone. The third reason for why I now hate Microsoft is for how they are (again) pushing for Trusted Computing. It's basically what happens when the OS provider becomes the gatekeeper of what you can install and do with your own computer. I never took this as a threat to personal computing, except that now Apple has made it acceptable. Things like insisting on logging in with Microsoft accounts, or only being able to install "modern apps" through their store (while taking a revenue cut of course) would have been unthinkable only 10 years ago. So thanks Apple for shifting the overton window, thanks Microsoft for delivering it to PCs. Of course, "hate" is a strong word. I don't really hate them, I just speak against them. But given how people fill the forums lately with messages of the second coming, I'm wondering what the heck are these people smoking, because I want some.
- ksk 11y ago
  If lawsuits and not supporting something you like makes you dislike a company, I'd guess that almost all corporations would be on your 'hate' list. My dislike of MS is quite simple. I simply don't like their products. That doesn't mean I automatically love OSX or Linux. IMO OSX is a mediocre product with a polished user experience and Linux as a desktop is just broken. Unfortunately, I can't say there is a single OS that I like at the moment.
  - pjc50 11y ago
    I'd guess that almost all corporations would be on your 'hate' list. This is a popular position, yes. But Microsoft in particular have tried to make Linux impossible on a number of occasions over a period of decades, so it'll take a while for the guerillas to come out of the jungle and stop fighting them. But now they're in competition with the platform that want to annex all your personal data and the platform that want a veto over all applications, so they're not necessarily the most hated party in the room any more.
totony 11y ago
Why is SFTP > FTPS? Any place I could look for some info on this? Are you talking about firewall easy-to-setup?
- scrollaway 11y ago
  SFTP is file transfer over ssh. FTPS is FTP over SSL. FTPS being FTP-based, and FTP being a terrible protocol, SFTP > FTPS definitely. You get all the advantages and security of SSH with SFTP.
  - totony 11y ago
    From what I have seen FTPS seems as secure as SFTP if well configured (i.e. no fallback), why do you say FTP is such a bad protocol? I have tried to look it up, but the answers seem to revolve around firewall being hard to setup and FTP being not secure (which is resolved by encapsuling it in SSL). Also my search suggests than ssh provides an additional overhead compared to using ssl for file transfer (i.e. http://serverfault.com/questions/131240/ftp-v-s-sftp-v-s-ftps http://serverfault.com/questions/131240/ftp-v-s-sftp-v-s-ftp...)

jadeddrag 11y ago

I'm looking forward to MS just dropping their OS entirely and using linux as their back-end. Basically, Microsoft might be better off creating their own linux distribution running a "microsoft windows" windows manager.

UK-AL 11y ago
Why? The windows core is a perfectly good alternative to Linux. It's always good to have competition.
- jadeddrag 11y ago
  How would we know unless we can read (and compile) the source code?
  - Someone1234 11y ago
    Considering how few people read and compile the Linux source code, how do you know on Linux? Most distributions are binary, not source.
    - lelandbatey 11y ago
      While that's true, I still know people who compile their own OS from scratch; I've gone through the experience of compiling my entire system from source via Linux From Scratch[0]. There are many thousands of people who have done the same thing, and this gives us a "web of trust". And if you don't want to trust anyone, you can always compile it yourself. That's the difference: I have the freedom to learn and study anything and everything. It might not be likely, and it might not be convenient, but it is possible. [0] - http://www.linuxfromscratch.org/lfs/view/stable/ http://www.linuxfromscratch.org/lfs/view/stable/
    - schoen 11y ago
      Fortunately that will change for Debian, and, we can hope, Debian-based distributions. https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds (I gave a talk about this at CCC. The status quo is a reason why free software doesn't have some of the transparency benefits over proprietary software we might expect, if you fear some developer is attacking you or someone is attacking some developers' infrastructure.)

techdragon 11y ago

Wow. Just wow. This is something I never expected to come from Microsoft. They may in fact be changing for the better.

insulanian 11y ago

Well... all I can say is RESPECT!!! But don't get lazy! We still need state of the art terminal!

zokier 11y ago
Isn't ISE pretty ok? At least it has decent enough copy and paste...
- hasenj 11y ago
  What is ISE? A link would be nice too (please?)
  - vmarsy 11y ago
    Powershell ISE? https://technet.microsoft.com/en-us/library/dd315244.aspx https://technet.microsoft.com/en-us/library/dd315244.aspx

AdmiralAsshat 11y ago

I happily await the day when I no longer need to install PuTTY on all of my fresh Windows installs.

zhengyi13 11y ago
Or worse, Cygwin, because of some obscure process that needs to connect via ssh to your Windows server...
- smhenderson 11y ago
  Cygwin comes with openssh-server [1]. I'll admit cygwin is quirky and not the best option always but I've used it to host ssh server on Windows in the past. [1] https://cygwin.com/faq.html#faq.using.sshd-in-domain https://cygwin.com/faq.html#faq.using.sshd-in-domain
- yellowapple 11y ago
  Agreed here. Installing and configuring Cygwin has traditionally been a royal pain; Microsoft offering some equivalent as an officially-supported Windows add-on (or just part of the core Windows) would be a godsend.
Someone1234 11y ago
They really need to announce a conhost replacement. The "experiments" in Windows 10 are undeniably improvements for when we still use things like cmd, but Powershell needs a modern terminal window and there needs to be a native answer to Putty for both SSH and Powershell remoting. I'd say after SSH this should be a priority for the Powershell team. Conhost is holding them back. A lot.
- zokier 11y ago
  Isn't ISE pretty much what you are asking for?
  - eropple 11y ago

jsingleton 11y ago

Good news! WinRM is a massive pain. The hoops you have to go through to bootstrap a fresh Windows image to get to the point you can run PowerShell is crazy.

j_s 11y ago
Until SSH support arrives, be sure to check out how BoxStarter does things! http://boxstarter.org/ http://boxstarter.org/
sudioStudio64 11y ago
I've never had that experience...but then I'm using domain joined machines.

ahmetmsft 11y ago

This has been my long time dream. There's so little that prevents this from happening theoretically (obviously there's a lot of coding will be done, but hey that's the fun part). I am very glad Microsoft is taking all the right steps to bring two world closer: Linux and Windows. With all the announcements around stuff like Docker for Windows Server Containers and cross platform .NET, this was nearly inevitable. Now the server management also steers in the right direction. Disclaimer: ms employee doing tons of open source.

baby 11y ago

Getting there slowly... For the moment I use `babun` and everything works well. http://babun.github.io/ http://babun.github.io/

unexistance 11y ago
thanks for the link :D looks great, as I am currently STILL using UnxUtils plus other stuff

yuhong 11y ago

It is interesting that this is part of PowerShell and not Windows, unlike Telnet.

atonse 11y ago

> Given our changes in leadership and culture, we decided to give it another try and this time, because we are able to show the clear and compelling customer value, the company is very supportive. Is that code for Ballmer's regime vs Nadella's regime?

dtech 11y ago
It's pretty much a public secret that Ballmer was one of the last reasons why Microsoft did not participate much in the OSS community even though a lot of employees wanted it. To give a concrete example of the changes (heard from a former Microsoft employee): Under Ballmer they were not allowed to touch anything open-source. Pretty soon after he left that was changed to a policy that a BSD/MIT open-source solution must be used if it is available unless there's a damned good reason.
- joshstrange 11y ago
  Ballmer has a BAD case of "Not invented here". I remember reading a story about him calling out and mocking an employee in a meeting b/c they has an iPhone (this was around 2008 I think). First off it's a VERY GOOD IDEA to use your competitors products if only to see how they stack up (Spoiler: They blew away MS's mobile offerings in 2008 and still do to this day). Second, what a way to make all of your employees yes-men who live in their own world shut off from what was happening in real world. He was douche all around from what I can tell and him leaving is one of the best things that could have happened to MS. Ballmer took over MS soon after I really got into computers and let it stagnate (XP/IE6) which lead me to switch to Linux/OSX and I've never looked back. I'm not saying it's all his fault but I think he was extremely influential in decisions that ultimately pushed me away from MS.
  - rogeryu 11y ago
    I moved away in 1999 to the Mac, and because of the incredible expensive Macs nowadays, I'm probably going to make another move, to Ubuntu. Still, Steve Jobs was not an easy guy either. I don't know if he would mock an employee for having an Android phone? Not unlikely given how anti-Android he was.

joshrivers 11y ago

Oh thank god!

shmerl 11y ago

MS is finally waking up. I guess new CEO has some positive effect.

deleted 11y ago

[deleted]

homulilly 11y ago

This is great but I'm still sticking to MinTTY/Cygwin for SSH until Windows gets a decent terminal program.

2close4comfort 11y ago

WOW that is a huge step for M$ maybe there is still some surprises left for the new order within Microsoft. I for one welcome a replacement to PuTTY.

kstrauser 11y ago

OH THANK GOD. I'm using Ansible to manage Windows, and today that means fooling around with WinRM. For example, that involved adding Kerberos support to Ansible so that it could authenticate against Windows domain accounts, because those are authed differently from local machine accounts. Assuming the project succeeds this time around, it's going to be way easier to incorporate Windows servers into Unix-centric management systems. That's a huge benefit to DevOps and Microsoft. Thanks!

pbowyer 11y ago
Is there any noise about being able to use Windows as an Ansible host? I like Ansible far more than the alternatives, but I can't make developers I work with keep a Linux VM running just to run Ansible to provision a development VM. That would be... crazy.
- kstrauser 11y ago
  Not that I've heard, but I'm just a regular contributor and not a maintainer. The last I heard, the chances were somewhere between "when pigs fly" and "LOL no". Then again, at one point the idea of supporting Windows hosts was unlikely and yet here we are. That said, I wonder how well it'd run under Cygwin. I've never even attempted this experiment so I don't have the foggiest.

haosdent 11y ago

cturner 11y ago

For all Balmer's thing of dancing on a stage and chanting "developers", there was no point under Gates or he at which Microsoft felt like a pro-developer company. That has completely changed in the last eighteen months. Each time I think "wouldn't it be cool if" I'm finding a few weeks later that someone at Microsoft is well ahead of me. How much easier it will be to ship my sucky roguelikes to Windows users in this new world! Hmm. They can now have a path to obsolete cmd. As long as they ship a decent ssh client with the system, users will become accustomed to ssh-ing to their own box instead of using cmd. Wishlist: tmux, emacs, vi, netcat, shell option for vi-mode, rc-file with preferences, ncurses library, something simpler than curses, zip and unzip. 256 colour is fine, although 24-bit would be impressive. /proc would be cool, but also a big ask I assume. They already have a strong compiler. Make it really easy to find the hex fingerprint required to log on to the sshd-server. Something like inetd could be useful, too.

baldfat 11y ago
Wishlist: mobaxterm - http://mobaxterm.mobatek.net/ http://mobaxterm.mobatek.net/
astazangasta 11y ago
Cygwin has all of those things and ssh server support.
- cturner 11y ago
  Fair. But I couldn't target my crappy roguelikes at cygwin - requires complicated third-party installs. I ran cygwin-with-ssh heavily for a while in 2003. It was a hell of a thing to get it going. Then I had trouble getting it to work on a new computer and gave up. Shouldn't be surprised that it got good again.
  - nacs 11y ago
    Try Babun [1] for a pre-configured Cygwin setup with an easy install. I've been using it for the past month or so and it works great. [1]: http://babun.github.io/ http://babun.github.io/

malkia 11y ago

Born Again Microsoft! Great stuff!

lucb1e 11y ago
Is this a reference to the bash shell? (Bourne Again SHell)

outworlder 11y ago

YES! Now, can we please get a proper terminal? :)

72deluxe 11y ago
PowerShell? Unless you mean the normal Unix terminal, which is 40 years old? I jest, somewhat. You oddly never get BASH users complaining about the lack of Batch file support, but it is always vocal the other way around.

mixmastamyk 11y ago

Hallelujah... new package manager, modular install, and now ssh? What's left? Perhaps a real terminal? To bad this won't make it into Win 10, unless I misunderstood something. Looks like my days of sneering at Windows as a toy are numbered... end of an era, and it makes me a bit sad, sniff.

sz4kerto 11y ago
Well, Win10 is the 'last Windows' according to MS, so this will probably arrive as an update later.
- higherpurpose 11y ago
  If this is like "OS X", then it doesn't mean anything. You'll still have to pay to buy "Windows 10.1" or "Windows 10 Redstone" or whatever they will call it. "Last version of Windows" is nothing but marketing, just like the overhyped "one Windows" idea. There isn't actually just "one" Windows 10, is there? Most versions of Windows 10 are not even within 10% of each other in terms of differences. There's a much larger gap between them. Windows 10 IoT Core isn't actually Windows 10, just like Brillo isn't actually Android.
  - umanwizard 11y ago
    OS X updates are free. I have installed a few since getting my Mac.
    - heartbreak 11y ago
      They were not always free; that's a recent change.
      - umanwizard 11y ago
        I know that. Regardless, they are free now, so it's not unreasonable (given the competitive nature of the software industry) to think Microsoft's will be too.

ninjaoxygen 11y ago

This would be great if they implement an SSH server, but I'm guessing the shell it connects to is PowerShell, rather than a sh derivative, so many tools many not work with it?

yellowapple 11y ago
It wouldn't be much different than, say, Cisco switches/routers, which (IIRC) also are managed over SSH but implement an atypical shell oriented around network configuration. So yeah, most tools would need to be adapted to manage Windows. A first-party Cygwin equivalent would be a good next step to ease that particular pain point, but said pain point is much easier than, say, having to install an SSH server yourself.

Yaggo 11y ago

Seems that Windows is adopting more and more * nix stuff. I wonder why one uses Windows in the first place if * nix stuff is what she needs?

krylon 11y ago
As a Windows admin and long time GNU/Linux / BSD user, I would totally love to replace every single Windows at our company with a Unixoid system. But there's a lot of software we use that either is not available on non-Windows platforms, where no decent replacement exists and/or migration is considered to expensive. If, say, Autodesk ported their software to some free Unixoid system, that would go a long way. But AFAIK, that is not going to happen anytime soon.
- 72deluxe 11y ago
  This is very true. The Windows software market is colossal, and the ability to run software from decades ago is a feature not found on any other OS group (Linux + OSX included). I know we all like to think and strangely wish that we could replace Windows server with Linux boxes and Windows desktops with Linux desktops but the sad truth is that there is no good replacement for Exchange or Active Directory (and the myriad of extensions that you can install into it; even writing one isn't that hard), including all the mobile OS support for mail on it (and calendars), nor is there a Linux desktop that would be instantly comfortable and navigable to 90% of Windows users. My mum would be lost, for certain. I would be lost under Unity or GNOME3 (only with blind rage I feel). It's a bit of a pipe dream, or very unrealistic. And I say this as a fan and user of all the major systems (and having been Linux and Windows sysadmin in the past).
  - krylon 11y ago
    Well, as far as Active Directory goes, I think it is possible to run a "Windows" domain using Samba. But apart from that, I tend to agree. I still want to believe it is possible to get Windows users comfortable on a Unix desktop, it works with OS X, after all. But practically speaking, you are right.

boomlinde 11y ago

I've been doing something similar using a virtual machine running Windows 7 and a whole host of really stupid VPN solutions to connect to customer networks. I ran sshd via Cygwin, which logged me into /bin/sh, from which I could actually start cmd.exe. Presumably, I could also have started PowerShell had I tried it. It's nice to see that they are offering an official way to do this.

yellowapple 11y ago

The only thing left for them to do is to include Cygwin (or some equivalent) as a built-in Windows feature. Hell's not only freezing over, but freezing everything else with it. What a time to be alive.

72deluxe 11y ago
Lots of people keep saying this on this thread, but why would you want GNU tools on Windows ? Have you ever wanted to put Apple's runtime on your Linux box? Or MSVC runtimes on your Linux machine? Weirdly, everyone wants the opposite.
- yellowapple 11y ago
  I'm not interested specifically with GNU's tools, just standard Unix tools in general; Microsoft could easily use Cygwin (for example) as a reference point for porting/packaging the BSD userland to/for Windows, for example. > Have you ever wanted to put Apple's runtime on your Linux box? Not in that sense, but a Linux + BSD userland would be neat. Apple's runtime is basically that minus Linux plus Mach/XNU plus Cocoa. > Or MSVC runtimes on your Linux machine? Good God no. > Weirdly, everyone wants the opposite. Not universally true if you count Wine as "MSVC runtimes on your Linux machine".
  - 72deluxe 11y ago
    Out of interest, what's wrong with MSVC runtimes? Plenty of software has been written using it. Doesn't Wine basically implement MSVC runtimes?
    - yellowapple 11y ago
      And said software is typicaly bloated and buggy relative to its Unix counterparts. The MVSC runtimes are popular solely because Windows is popular. Wine is a stopgap for software that's still reliant on Windows. The preferred approach would be for that software to instead be properly ported, which would include using a proper libc and executable package format (like ELF). That said, my opinions aren't representative of everyone in the world. There are projects like Wine and (more interestingly) winelib that implement the MSVC, and those are popular projects (the former more popular, though the latter closer to being solely MSVC on Linux).

krylon 11y ago

Finally! PowerShell Remoting just plain sucks, at least it has for me. I've always wondered why the PowerShell developer(s?) would do something so needlessly contrived when SSH has been around for, like, twenty years or so. This will definitely make my job easier! Or at least more convenient.

bigdubs 11y ago
"I've always wondered why the PowerShell developers ..." Think about the beginning of that sentence. They invented a new console language, when bash has been around forever and C# is a better programming language generally and can be run as a scripted language with a little finagling. I don't think the PS team is bad (or PS itself for that matter), I just think there was a lot of re-inventing of the wheel for no reason, and that started way upstream of remoting.
- hyperliner 11y ago
  This a good point. The internal incentives of the previous ranking model used by HR there create these behaviors. More here: https://news.ycombinator.com/item?id=9598015 https://news.ycombinator.com/item?id=9598015
- krylon 11y ago
  Well, either way, I'm glad they have finally decided to go for SSH. I'm still not sure I really like PowerShell, but whether one likes it or not, it has become too useful to ignore. And even on days when I really dislike it, it is still a huge improvement on cmd and vbs. I still do a lot of my Windows scripting in Perl, mostly because I am familiar with it, CPAN still rules, and I am not sure I want to learn the .Net framework just so I can do some admin-type scripting. But it's good to have options.
- parkovski 11y ago
  They didn't reinvent the wheel. Bash was intended for a Unix environment with all the corresponding utilities. PowerShell was designed for a Windows/.NET environment, which is undeniably different, and they also took the opportunity to create an object oriented shell instead of a text oriented one. I also like C# but I do feel it makes a pretty poor scripting/shell language. I do think SSH is long overdue, but based on the post it looks like the developers have always been on the right track - management just wouldn't let them do it. Really glad this is changing.

jjcm 11y ago

This is a big step, I'd love some MOSH support too though.

SwellJoe 11y ago

About damn time.

finnh 11y ago

not to be too snarky, but perhaps "looking backward" would be a better title =) (don't get me wrong, I love my ssh and am glad to see msft supporting it for real)

ised 11y ago

http://www.microsoft.com/en-us/download/details.aspx?id=2391 http://www.microsoft.com/en-us/download/details.aspx?id=2391 If I am forced to use Windows in an Enterprise setting, then I just go to Control Panel and enable the POSIX layer ("SUA"), then download the SDK and install. With some minor changes to the %Path, it just works. SUA has older versions of tcsh, ksh, vi and many other utilities, including an older Perl and an old GCC toolchain that does work. It is 4.2BSD based. If you are at home on BSD, it is like going back in time. netcat, tmux, emacs, etc. you would have compile yourself. Maybe OpenSSH would compile and run. I have not tried. Perhaps an alternative to Cygwin, etc. Not "better" but different. It generally "seems" faster and I find it's more difficult to "break" than Cygwin which in my experience can be very "delicate". The SUA White Paper says SUA comes to within 10% of the speed of native Windows. The main advantage though, for me, is that this is not "unauthorized third party software" to the extent it comes with Windows and the SDK download comes from Microsoft's Akamai account.

zokier 11y ago
Afaik SUA is pretty much dead, so do not carry too much hope in seeing improvements for it.
wvenable 11y ago
I just download GnuWin which gives you most Unix tools compiled natively for Win32. Includes OpenSSH too. http://gnuwin32.sourceforge.net/ http://gnuwin32.sourceforge.net/
- jsalit 11y ago
  from the look of the website, GnuWin is terribly out of date and packages like OpenSSL (I don't seen OpenSSH listed) will have lots of known security vulnerabilities..
rbanffy 11y ago
When I am forced to use Windows, I immediately download Cygwin. I am almost tempted to congratulate Microsoft and welcome them to 1995, although I am quite sure Cygwin didn't have ssh back then.

lucaspottersky 11y ago

yeah, never too late i guess? it took more than a decade to make such a move...

tammer 11y ago

I made an uncomfortably audible gasp of shock upon seeing this. Server versions of Windows have been heading in a console-only direction for a while now but the complexity of PowerShell remoting really didn't make it feel like a feasible solution. This completely changes the windows admin game.

neil_s 11y ago

TIL that the Windows Dev team have a forum for engaging with users about console features: https://wpdev.uservoice.com/forums/266908-command-prompt https://wpdev.uservoice.com/forums/266908-command-prompt Back when I interned at MS in 2013, people were alarmed when I spoke to users on some forums about their complaints because I was designing a related feature. We had to check with legal whether I would have to delete all my posts!

nsxwolf 11y ago

How about a terminal window you can resize with the mouse, and effortlessly cut and paste text, and with tab completion that doesn't do weird inexplicable things? Do they have that yet?

jevgeni 11y ago
Apart from unconstrained resizing, everything else is part of Powershell.
- jyrkesh 11y ago
  No, actually. Ctrl+V and Ctrl+C are implemented in PSReadline, but those features have also been added to the Windows 10 console host (i.e. they work with cmd.exe). The other big one for me that's been added to the console host is "line wrapping selection". You can actually highlight text now correctly as opposed to copying a rectangular block of text (though the latter is sometimes useful, just hold Alt when you're highlighting).
  - jevgeni 11y ago
    True on line wrapping. You can copy-paste using right click, though.
McGlockenshire 11y ago
There are dramatic improvements in the command prompt windows in Win10: http://www.hanselman.com/blog/Windows10GetsAFreshCommandPromptAndLotsOfHotkeys.aspx http://www.hanselman.com/blog/Windows10GetsAFreshCommandProm...
- nsxwolf 11y ago
  Just tried it in a VM install. Seems pretty good. A long time coming. Could use tabbed views, though.

w8rbt 11y ago

I hope that Microsoft donates money to OpenSSH/OpenBSD. The way I read this, they indicated that they would. "I’m pleased to announce that the PowerShell team will support and contribute to the OpenSSH community."

graffitici 11y ago

I wish Windows just became a POSIX compliant OS. I think that would solve a lot of these smaller issues in an elegant way. Apple did a very smart job with Mac OS X, to the point where even I switched to a Mac after having Linux for so many years. It's incredible how I can install packages using homebrew and friends.. Come on Microsoft, go all the way!

72deluxe 11y ago
I think homebrew and MacPorts are niche though. Your "normal" OSX user wouldn't install them. Heck, I ran Linux for years and years and I haven't even installed them under OSX because if I wanted to run BSD or Linux, I'd have installed BSD or Linux. It's like installing all those GNU tools on Windows to make it more like Linux, and putting Homebrew etc. on OSX to make it more like Linux. Why not just use Linux or BSD? I never understand it. Also, the lack of proper Quartz windowing support from X11 apps makes using them painful.
- graffitici 11y ago
  I think the key point here is this: you're right that regular users don't need homebrew; developers certainly do. By having an analog of homebrew for Windows, Microsoft can attract more developers, which then would translate into a better app infrastructure for Windows. This would then clearly benefit regular users as well. I haven't used Windows in a very long time, but whenever I sit by a friend's computer, I find it astonishing how badly designed Windows apps are. Certainly Apple's fixation with design created a culture of beautiful apps. But having more developers would also probably improve the situation
  - rectangletangle 11y ago
    I think that's their long-term strategy. Attract more devs to the platform, new applications will follow, then finally customers. I'm definitely paying attention.
  - 72deluxe 11y ago
    I'm a developer (I develop on OSX and Windows every day for my day job and at home for myself) and I do not use homebrew. There is not anything I am really missing, but I write C++/Obj-C and you might write something different. It is interesting regarding the state of app design as most of the BSD or Linux software looks odd to me! I agree that Windows has some odd looking software but they do typically offer more features - you don't get MDI under OSX.

deleted 11y ago

[deleted]

deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]

mrweasel 11y ago

Wonderful, and I am a bit interested in seeing how well the Microsoft guys and the OpenBSD/OpenSSH team is going to interact. I have no doubt the the Microsoft developers are nothing but professional, but still the OpenSSH people seem to have pretty high standard.

geff82 11y ago

Hell is freezing over at 0K. Oh my god. Wow.

baconhigh 11y ago

so windows users might finally be able to download a verifiable/signed and maybe "trusted" application to use ssh with? (https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...)

rbanffy 11y ago
Cygwin has the terminal part of PuTTY built from source. Install Cygwin with MinTTY and you get ssh with bash (and a whole lot of Unix-like niceties) for free.

gionn 11y ago

First they ignore you, then they laugh at you, then they fight you, then you win.

noveltyaccount 11y ago

What's next? Powershell for Linux? Powershell for Mac? (Pretty please?) Powershell's piping of .NET objects is so brilliant compared to Bash piping and parsing of text.

tacticus 11y ago
Why not just use one of the many other languages available. You could use ipython if you wanted object handling. Now i wonder what would have happened if they didn't have gates or ballmer upstairs and they wanted to implement a new shell.

owenfi 11y ago

As an only occasional Windows user, I wasn't sure what PowerShell was (sounds 3rd party to me, a la Cygwin). Turns out it is a 1st party command line tool and scripting engine. From a glance it looks to use similar syntax to CMD.exe, but sits side-by-side with it, not built on top.

dspillett 11y ago
Looking at it from a Unix-a-like background Powershell provides a script capable shell (ala bash and friends) including built-ins that do useful stuff in some of the posix and gnu externals commonly called from shell scripts. Rather than working primarily on text and streams like most unix-a-like shells it is object based. Through the relevant modules and the objects they provide it allows pretty complete interaction with the Windows management infrastructure so in the right hands it can be very powerful. See http://en.wikipedia.org/wiki/Windows_PowerShell http://en.wikipedia.org/wiki/Windows_PowerShell. On any Windows machine that isn't obsolete or close to (the 2003 editions fall out of support very soon and XP already has, anything newer had PS integrated) you'll find at least v2, usually v3 or higher. I keep meaning to find a good book or online reference and spend some time properly learning how to use the thing... For some things it'll replace my need to have cygwin installed everywhere, and it might allow me to do some stuff "better".

pldimitrov 11y ago

rip putty

libraryatnight 11y ago

I spend a good majority of my day doing administrative tasks in Windows and o365 where PowerShell is a god send. There have been more than a few occasions where I wished for SSH capability, so this news is fantastic.

sandGorgon 11y ago

I dont know if anyone has used Git Shell on Windows. I do a lot of Python programming on windows and git shell is spectacular - inbuilt ssh, git, vim and a full linux userland.

squiguy7 11y ago

A tweet from the OpenSSH developers: https://twitter.com/damienmiller/status/605865246016692225 https://twitter.com/damienmiller/status/605865246016692225

fapjacks 11y ago

I guess better late than never, eh?

PaulRobinson 11y ago

"Those who don't understand Unix are condemned to reinvent it, poorly." – Henry Spencer Basically, bit by bit it seems Microsoft are realising there is a ton of stuff they need to take from the unix environment. The comments here about how awesome PowerShell and the other tools within all are seem to focus on everything being an object rather than being text. So, we could fix that by basically providing a "Ruby shell" in one sweep. You go through the standard utilities you have on unix systems, provide them as Ruby methods on various objects (the Ruby stdlib has a great many) and provide a means to navigate a file system easily, and basically you have the beginnings of an object-orientated shell with the support of the traditional 30+ year old command line utilities. What is it I am missing? This feels all a little reminiscent of when Microsoft got all giddy about providing symbolic links... well... yeah... I mean... what?

grogenaut 11y ago

If but I could send this moment (and recent ones) back in time to the slashdot of 2005...