OpenSSH的安裝及運(yùn)行
使用powershell安裝openSSH
以管理員身份運(yùn)行powershell唾琼，運(yùn)行以下指令：
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
已安裝的服務(wù)輸出 "Installed"，未安裝輸出"NotPresent"匣砖，如下：
根據(jù)需要安裝的組件運(yùn)行以下命令：
# Install the OpenSSH Client
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
# Install the OpenSSH Server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
如安裝成功帮匾，控制臺將輸出以下內(nèi)容：
Path :
Online : True
RestartNeeded : False
重啟電腦添加服務(wù)偏灿，啟動并配置OpenSSH服務(wù)
管理員身份運(yùn)行powershell扣蜻，然后運(yùn)行以下命令啟動sshd service：
# Start the sshd service
Start-Service sshd
# OPTIONAL but recommended:
Set-Service -Name sshd -StartupType 'Automatic'
# Confirm the Firewall rule is configured. It should be created automatically by setup. Run the following to verify
if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
} else {
Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
}
客戶機(jī)登錄測試（此部分運(yùn)行在客戶機(jī)），此部分過于簡單尺棋，不做詳細(xì)演示
ssh username@ip
#輸入密碼
在服務(wù)器上部署rsa密鑰
客戶機(jī)生成密鑰（此部分運(yùn)行在客戶機(jī)）
ssh-keygen -t rsa
#一路enter
此時客戶機(jī)目錄 ~/.ssh下將生成id_rsa和id_rsa.pub封锉，將id_rsa.pub改名為administrators_authorized_keys，粘貼至服務(wù)器的C:\ProgramData\ssh目錄
修改服務(wù)器的ssh配置文件
#目錄C:\ProgramData\ssh\sshd_config
內(nèi)容如下
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
RSAAuthentication yes
PubkeyAuthentication yes
PermitRootLogin yes
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
#PubkeyAuthentication yes
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile .ssh/authorized_keys
#AuthorizedPrincipalsFile none
# For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes
# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication no
#PermitEmptyPasswords no
# GSSAPI options
#GSSAPIAuthentication no
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# override default of no subsystems
Subsystem sftp sftp-server.exe
# Example of overriding settings on a per-user basis
#Match User anoncvs
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server
Match Group administrators
AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
管理員身份運(yùn)行powershell膘螟，提升文件administrators_authorized_keys權(quán)限
icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
客戶機(jī)以rsa連接服務(wù)器
ssh -i ~\.ssh\id_rsa username@ip
