OpenSSH Server¶
Windows 11 and Server 2022 include an OpenSSH server as an optional feature. Its configuration file uses the same directives as Linux, so this page applies to both.
Is it installed and needed?¶
Get-WindowsCapability -Online | Where Name -like "OpenSSH.Server*"
Get-Service sshd -ErrorAction SilentlyContinue | Select Status, StartType
If the README doesn't call for SSH, remove it:
Stop-Service sshd; Set-Service sshd -StartupType Disabled
Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
If it does, keep the service running and harden the config.
The config file¶
C:\ProgramData\ssh\sshd_config. Open it as administrator in Notepad. Lines starting with # are comments; a directive takes effect only when uncommented. Every setting below has a reason.
| Directive | Value | Why |
|---|---|---|
PasswordAuthentication |
no |
Public keys can't be guessed or phished. Set up keys for authorized users first, then turn this off. |
PubkeyAuthentication |
yes |
|
PermitEmptyPasswords |
no |
|
PermitRootLogin |
no |
No effect on Windows, but expected in any hardened config |
MaxAuthTries |
3 |
Guesses allowed per connection (2 to 5 is reasonable) |
LoginGraceTime |
60 |
Seconds to complete login before the connection is dropped (30 to 120) |
ClientAliveInterval |
300 |
Seconds of idle before the server checks the client (60 to 600) |
ClientAliveCountMax |
2 |
Checks that can fail before disconnect |
X11Forwarding |
no |
Not used on Windows; a tunnel an attacker can abuse |
AllowTcpForwarding |
no |
Stops SSH being used as a proxy into the network |
AllowAgentForwarding |
no |
Stops a compromised server using the client's keys |
PermitTunnel |
no |
No VPN-style tunnels |
PermitUserEnvironment |
no |
Users can't inject environment variables into the login |
StrictModes |
yes |
Refuses key files with sloppy permissions |
LogLevel |
VERBOSE |
Logs key fingerprints. Never QUIET. |
AllowUsers |
alice bob |
Only these accounts can SSH in (optional but strong) |
Apply and test¶
Restart-Service sshd
Test from another window before closing your current one. If the config has a syntax error, sshd won't start and you'll be locked out of SSH (but not the console).
Verify¶
Select-String -Path C:\ProgramData\ssh\sshd_config -Pattern "^(PasswordAuthentication|PermitEmptyPasswords|MaxAuthTries|LoginGraceTime|ClientAliveInterval|X11Forwarding|AllowTcpForwarding|AllowAgentForwarding|PermitTunnel|PermitUserEnvironment|StrictModes|LogLevel)"
Each should appear once, uncommented, with the value from the table.
Example¶
sshd_config has PasswordAuthentication yes, MaxAuthTries 100, LogLevel QUIET. An attacker gets 100 guesses per connection and nothing is logged. Set the three values, restart sshd, and confirm with the Select-String above.