How to Configure SSH Password-Free Login from Mac OS to Windows?

To configure password-free SSH login from macOS to Windows, you must generate an RSA key pair on the Mac, copy the public key to the Windows machine, and ensure the OpenSSH server is properly configured to accept public key authentication. This process eliminates the need for manual password entry while maintaining secure access between the two operating systems.

Prerequisites and Server Setup

Before generating keys, you need a functioning SSH server on your Windows machine. Modern versions of Windows 10 and 11 include the OpenSSH Server as an optional feature. You can verify its installation by opening PowerShell as Administrator and running Get-WindowsCapability -Online | Where-Name -Like OpenSSH.Server. If it is not installed, run Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.

Once installed, start the service using Start-Service sshd. To ensure it starts automatically upon reboot, set the startup type with Set-Service -Name sshd -StartupType 'Automatic'. It is crucial to verify that the firewall allows inbound connections on port 22. You can check this by running Test-NetConnection -ComputerName localhost -Port 22 from the Windows machine itself. If the test fails, you may need to create an inbound rule allowing TCP traffic on port 22 through Windows Defender Firewall.

Generating Keys on macOS

The next step occurs on your Mac. Open Terminal and generate a new SSH key pair. While Ed25519 is modern and secure, RSA remains widely compatible with older Windows OpenSSH implementations. Run the following command:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

You will be prompted to specify a file location. Press Enter to accept the default path ~/.ssh/id_rsa. Next, you will be asked for a passphrase. For true password-less login, you can leave this empty by pressing Enter twice. However, note that leaving the passphrase empty reduces security if your local machine is compromised. If you prefer added security, enter a strong passphrase; you will then need to use an SSH agent to avoid typing it repeatedly.

After generation, verify that both id_rsa (private) and id_rsa.pub (public) exist in your ~/.ssh/ directory. The private key must remain secret and never leave your Mac.

Transferring the Public Key to Windows

You now need to place the public key into the correct directory on the Windows machine. The standard location for user-specific keys is C:\Users\YourUsername\.ssh\authorized_keys. Note that this directory might not exist yet. You can create it manually via PowerShell or Command Prompt.

First, ensure the .ssh folder exists: New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\.ssh"

Next, you must transfer the content of your Mac's id_rsa.pub file to the Windows machine. You can do this securely using SCP from your Mac terminal:

scp ~/.ssh/id_rsa.pub user@windows_ip:C:\Users\YourUsername\.ssh\authorized_keys

If you are copying from Mac to Windows, ensure you replace user with your actual Windows username and windows_ip with the IP address of the Windows machine. You will be prompted for your Windows password during this transfer. Once copied, the file should contain a single line starting with ssh-rsa followed by a long string of characters.

Permissions Are Critical

Unlike Linux, where permissions are strictly enforced by default, Windows OpenSSH can sometimes ignore improperly secured files. However, best practices still apply. Ensure that the .ssh folder and the authorized_keys file are only accessible by your user account. In PowerShell, you can adjust permissions using icacls. The owner should have full control, and other users should have no access. Incorrect permissions often result in the server silently rejecting the key.

Configuring the SSH Daemon

On the Windows machine, open the SSH daemon configuration file located at C:\ProgramData\ssh\sshd_config. This is a system-wide configuration file. Edit it using Notepad or VS Code with administrator privileges. Look for the following directives:

• PubkeyAuthentication yes: Ensure this is set to yes. It is usually enabled by default in recent versions.
• PasswordAuthentication no: Optional. Set this to no if you want to enforce key-only login, disabling password logins entirely.
• AuthorizedKeysFile .ssh/authorized_keys: Verify this points to the correct path.

After making changes, save the file and restart the SSH service to apply them: Restart-Service sshd.

Testing the Connection

Return to your Mac terminal and attempt to connect: ssh user@windows_ip. If everything is configured correctly, you should gain immediate access without a password prompt. If you are prompted for a password, check the following:

1. Verify the public key was pasted correctly into authorized_keys with no extra spaces or line breaks.
2. Check the Windows Event Viewer under Applications and Services Logs > Microsoft > Windows > OpenSSH > Operational for detailed error messages regarding authentication failures.
3. Ensure the authorized_keys file has the correct permissions and ownership.

This setup provides a seamless and secure way to manage your Windows environment from your Mac. For further troubleshooting on connectivity issues, consider reviewing network configurations.

Frequently Asked Questions

What if I get a permission denied error after transferring the key?

This usually indicates incorrect file permissions on the Windows side. Ensure that the authorized_keys file is owned by the user and not readable by others. Use icacls to restrict access so only the specific user can read the file.

Can I use Ed25519 keys instead of RSA?

Yes, Ed25519 is supported by modern OpenSSH servers on Windows. Generate the key using ssh-keygen -t ed25519 on your Mac and follow the same steps to transfer the public key to the authorized_keys file.

Why am I still asked for a password even though the key is correct?

Check the PubkeyAuthentication setting in sshd_config on Windows. Additionally, verify that the SSH service was restarted after any configuration changes. Silent failures often occur due to cached configurations or service state issues.

Is it safe to leave the SSH key passphrase empty?

Leaving the passphrase empty means anyone who gains physical or remote access to your Mac can also access the Windows server. It is safer to use a passphrase and an SSH agent, but for automated scripts, an empty passphrase may be necessary.

How do I reset the SSH configuration on Windows if I break it?

You can revert sshd_config to its default state by uninstalling and reinstalling the OpenSSH Server feature via PowerShell. Alternatively, restore a backup of the config file if one exists before making changes.