This brief tutorial assumes you already have an SSH public key you want to use
-
Install chocolatey via Powershell
Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
-
Close Powershell
-
Open a new Powershell session
-
Install OpenSSH using Chocolatey
choco install openssh -params '"/SSHServerFeature /KeyBasedAuthenticationFeature /SSHAgentFeature"'
-
then enter:
cd $env:USERPROFILE mkdir .ssh
-
Open up notepad, using CRLF line endings (if you're using an older version of Windows 10, you will likely need to use a text editor like Notepad++, Visual Studio Code or Github's ATOM), paste in your SSH public key, save the file to
.ssh\authorized_keys
(the name must match for it to be used) -
From Windows explorer, remove the .txt extension from .ssh\authorized_keys.txt
-
Attempt to SSH in to your Windows computer and be amazed at how easy it really is
-
Generate an OpenSSH key pair (the -b flag denotes the bits, in this example 4096 is used which may be excessive):
ssh-keygen -t rsa -b 4096
-
You will then receive the following prompt, enter the path and name you would like to use for the key:
Enter file in which to save the key (C:\Users\myusername/.ssh/id_rsa):
-
You will then be prompted to enter a passphrase, note the password before entering it in your password manager OR live dangerously and not use a password.
-
From the command line, type in:
cd $env:USERPROFILE notepad .ssh\config
-
Update your ssh config as per usual
-
Remove the .txt extension from
.ssh\config
by using Windows Explorer -
Save the file (CTRL+S)
-
Run the following to list the users with access
icacls .ssh/config
-
Run the following for each user in the list except your own:
icacls .ssh/config /remove BUILTIN\Administrators icacls .ssh/config /remove NT AUTHORITY\SYSTEM
-
Now you can copy your public key to the machines you want to connect to by copying the contents of your public key into their respective
.ssh/authorized_keys
file 11.Attempt to connect to one of the hosts you copied the key to-it should work properly