Support for Windows OpenSSH Server?

[fdcastel]

I’ve been using opkssh on Windows clients to connect to Linux servers for a while. Thanks for the excellent work! 🚀

Now... Since Windows Server 2019 and Windows 10, Microsoft has provided native support for OpenSSH Server:

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse

Are there any plans to support opkssh on Windows Server?

Has any work already started in this direction? If not, I’d be interested in contributing (assuming there are no major blockers).

---

Essentially, I want this:

https://github.com/openpubkey/opkssh?tab=readme-ov-file#installing-on-a-server

but for Windows systems that already have running the official OpenSSH Server.

[EthanHeilman]

I haven't done much looking into windows OpenSSH server, but it doesn't seem like it would be hard to build. Windows OpenSSH supports AuthorizedKeysCommand. It seems like three things would need to be build:

1. A windows installer. Could be a powershell script. This would install and configure the opkssh verifier and configure OpenSSH to use opkssh.
2. A windows integration test. A windows docker file that installs and tests opkssh on windows.

I don't have the bandwidth to add this in October through December as I have other features I'm working on adding. If you or someone else be interested in building this out, I'd be glad to merge it and happy to help.

Long term I would like to add Windows OpenSSH server support but I won't have until 2026.

[fdcastel]

@EthanHeilman I'd be happy to help with a few PRs, if that works for you.

I have VMs for local testing and can also use GitHub Actions (which I see is already in place).

Just need a quick overview of the codebase and priorities.

[EthanHeilman]

That's great to hear. Let me know if there is anyway I can help. I've assigned the issue to you.

[fdcastel]

A little teaser… 👀 😄

PS C:\Users\administrator> ssh -v administrator@10.10.2.73 "echo Hello, World && ver"

OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
debug1: Connecting to 10.10.2.73 [10.10.2.73] port 22.
debug1: Connection established.
debug1: identity file C:\\Users\\administrator/.ssh/id_rsa type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_rsa-cert type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_dsa type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_dsa-cert type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_ecdsa type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_ecdsa-cert type 6
debug1: identity file C:\\Users\\administrator/.ssh/id_ed25519 type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_ed25519-cert type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_xmss type -1
debug1: identity file C:\\Users\\administrator/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_for_Windows_9.5
debug1: match: OpenSSH_for_Windows_9.5 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.10.2.73:22 as 'administrator'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:TfDMdNEKJRjtGtkq3ByDLpp5/TrhuQrFbOjUpV2vQlk
debug1: Host '10.10.2.73' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\administrator/.ssh/known_hosts:3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_rsa
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_dsa
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_ecdsa
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_ecdsa ECDSA-CERT SHA256:ZKrmXmW4NNwR7B5GxqPDP/Xs8tpLPPC6PPB7u0nYCGo
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_ed25519
debug1: Will attempt key: C:\\Users\\administrator/.ssh/id_xmss
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,ssh-dss,ssh-rsa,rsa-sha2-256,rsa-sha2-512>
debug1: kex_input_ext_info: publickey-hostbound@openssh.com (unrecognised)
debug1: kex_input_ext_info: ping@openssh.com (unrecognised)
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: C:\\Users\\administrator/.ssh/id_rsa
debug1: Trying private key: C:\\Users\\administrator/.ssh/id_dsa
debug1: Trying private key: C:\\Users\\administrator/.ssh/id_ecdsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Offering public key: C:\\Users\\administrator/.ssh/id_ecdsa ECDSA-CERT SHA256:ZKrmXmW4NNwR7B5GxqPDP/Xs8tpLPPC6PPB7u0nYCGo
debug1: Server accepts key: C:\\Users\\administrator/.ssh/id_ecdsa ECDSA-CERT SHA256:ZKrmXmW4NNwR7B5GxqPDP/Xs8tpLPPC6PPB7u0nYCGo
debug1: Authentication succeeded (publickey).
Authenticated to 10.10.2.73 ([10.10.2.73]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending command: echo Hello, World && ver
Hello, World

Microsoft Windows [Version 10.0.26100.6905]
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 6968, received 5044 bytes, in 0.1 seconds
Bytes per second: sent 110740.3, received 80162.7
debug1: Exit status 0

[EthanHeilman]

@fdcastel Oh nice!