To connect to an OpenSSH server on Windows using PowerShell, you must first ensure the SSH client feature is enabled and that the necessary firewall rules allow inbound traffic. Once the environment is prepared, you can establish a secure connection by running the standard
ssh command with your username and server address. This process leverages the built-in OpenSSH capabilities available in modern Windows versions, providing a reliable and encrypted channel for remote administration without requiring third-party tools like PuTTY.
Verifying OpenSSH Client Installation
Before attempting any connections, it is critical to confirm that the OpenSSH Client component is installed on your local machine. While many recent builds of Windows 10 and Windows 11 include this feature by default, it may not be active if the system was customized or if specific updates were skipped. You can verify the installation status by opening PowerShell as an administrator and checking the optional features list.
Run the following command to query the installed features:
Get-WindowsOptionalFeature -Online -FeatureName OpenSSH.Client
If the output shows the State as
Enabled, you are ready to proceed. If the state is
Disabled or
Unavailable, you need to install the feature manually. To do this, execute the installation command below:
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
This command downloads and registers the SSH client binaries into your system path. After execution, verify again that the feature is now enabled. This step ensures that the
ssh.exe executable is accessible from any directory in your terminal, preventing common "command not found" errors during subsequent connection attempts.
Configuring Firewall Rules
A successful connection depends heavily on network permissions. Even if your SSH server is running correctly, Windows Defender Firewall or a corporate network policy might block the incoming requests on port 22. It is essential to create an inbound rule that allows TCP traffic on this specific port. Without this configuration, your connection attempts will time out or be actively refused by the host.
You can automate the creation of this rule using PowerShell. Run the following script to add a new firewall rule named
OpenSSH-Server-In-TCP:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
This command explicitly permits inbound TCP connections on port 22. If you are connecting to a remote server rather than hosting one locally, you should also ensure that outbound rules allow your client to reach the target IP address. However, for most direct client-to-server scenarios, the inbound rule on the server side is the primary concern. If you are unsure about your current firewall status, you can review existing rules by running
Get-NetFirewallRule | Where-Object { $_.DisplayName -like "*ssh*" }.
Establishing the Connection
With the client installed and firewall rules adjusted, you can now initiate the connection. The syntax for the SSH command is straightforward and consistent across Linux, macOS, and Windows environments. You need to specify the username associated with the account on the remote server, followed by the server's hostname or IP address.
Use the following format in your PowerShell window:
ssh username@server_address
Replace
username with your actual remote user account name and
server_address with the target machine's identifier. For example, if your user is
admin and the server IP is
192.168.1.50, the command would be
ssh [email protected]. Upon the first connection to a new host, you will see a security prompt asking if you want to continue connecting. This is a standard fingerprint verification mechanism to prevent man-in-the-middle attacks. Type
yes and press Enter to accept the host key and save it to your known hosts file.
You will then be prompted for your password. Note that when typing your password in PowerShell, no characters will appear on the screen for security reasons. This is normal behavior for terminal-based password entry. Once authenticated, you will gain access to the remote shell session.
Troubleshooting Common Issues
Despite following the standard procedures, users often encounter connectivity issues due to misconfigurations or permission errors. One frequent problem arises when the SSH service on the remote machine is not running. Ensure that the
OpenSSH Server service is started on the target Windows machine. You can check this by logging into the server and running
Get-Service sshd. If the status is stopped, start it using
Start-Service sshd.
Another common issue involves authentication failures. If you receive a "Permission denied" error, verify that the user account has the appropriate privileges and that password authentication is enabled in the
sshd_config file on the server. Additionally, ensure that the private keys used for key-based authentication have the correct permissions. On Windows, SSH keys stored in the
%USERPROFILE%\.ssh directory should not be world-readable.
For more advanced configurations, such as setting up PowerShell as the default shell within the SSH session, consider reviewing our guide on configuring PowerShell for OpenSSH. This ensures that your remote sessions utilize the full power of PowerShell remoting rather than falling back to legacy command prompts. You can find detailed instructions at
Configure PowerShell for OpenSSH.
Security Best Practices
Always prioritize security when managing remote servers. Disable password authentication if possible and rely exclusively on public-key authentication. This method is significantly more resistant to brute-force attacks. Generate a strong key pair using
ssh-keygen and distribute the public key to the server's
authorized_keys file. Furthermore, keep your Windows updates current to patch any vulnerabilities in the OpenSSH implementation. Regularly audit your firewall rules to ensure no unnecessary ports are exposed to the internet.
Frequently Asked Questions
What if I get a 'Connection Refused' error?
This error typically indicates that the SSH service is not running on the target machine or that a firewall is blocking the request. Verify that the
sshd service is active on the server and check that port 22 is open in the firewall settings.
Can I use SSH keys instead of passwords?
Yes, Windows supports public-key authentication seamlessly. You can generate a key pair using
ssh-keygen and copy the public key to the server. This method is more secure and convenient for automated scripts.
How do I change the default port for SSH?
By default, SSH uses port 22. To change this, you must modify the
sshd_config file on the server to listen on a different port. You will also need to update your firewall rules and adjust your client command to specify the new port using the
-p flag.
Why does my password prompt not show any characters?
This is standard security behavior in almost all terminal emulators, including PowerShell. The system hides input to prevent shoulder surfing or keyloggers from capturing your password visually. Simply type your password blindly and press Enter.
Is OpenSSH included in all versions of Windows 10?
Most modern builds of Windows 10 and 11 include the OpenSSH client as an optional feature. However, older builds or enterprise images may require manual installation via the Settings menu or PowerShell commands provided in this article.