Establish a secure SSH connection between Windows 10 and Linux servers by leveraging the built-in OpenSSH client included in modern Windows versions. This guide details how to generate RSA keys on your local machine, configure the remote server for key-based authentication, and execute seamless login commands without password prompts. By following these steps, you ensure encrypted communication and enhanced security for your remote administration tasks.
Prerequisites and Verification
Before configuring keys, verify that both systems are ready for SSH communication. Windows 10 (version 1809 and later) includes an OpenSSH Client by default, though it may need manual activation. On the Linux side, ensure the
openssh-server package is installed and running.
To check if the SSH client is available on Windows, open PowerShell or Command Prompt and run:
ssh -V
If the command returns a version number, the client is installed. If not, navigate to Settings > Apps > Optional Features > Add a Feature, search for "OpenSSH Client," and install it. On the Linux server, verify the service status with:
sudo systemctl status sshd
Ensure the service is active and listening on port 22. If you encounter connectivity issues similar to those described in
Troubleshooting SSH WSL Machine: Can't Connect to Localhost, check your firewall settings on both machines to allow inbound traffic on the SSH port.
Generating SSH Keys on Windows
Key-based authentication relies on a public-private key pair. The private key stays on your Windows machine, while the public key is copied to the Linux server. Generate this pair using PowerShell.
Run the following command to create a new RSA key pair:
ssh-keygen -t rsa -b 4096 -C "[email protected]"
You will be prompted to specify a file location. Press Enter to accept the default path (
C:\Users\\.ssh\id_rsa). Next, you can choose to set a passphrase for extra security. While optional, a strong passphrase adds a layer of protection if your private key is compromised. Once completed, two files will appear in the
.ssh directory:
id_rsa (private) and
id_rsa.pub (public).
Copying the Public Key to Linux
The most efficient way to transfer the public key is using the
ssh-copy-id utility, which is often available via Git Bash or WSL on Windows. If you do not have this tool, you can manually append the key content.
Using
ssh-copy-id:
ssh-copy-id username@linux_server_ip
Replace
username with your Linux user account and
linux_server_ip with the server's IP address. You will be asked to enter the Linux user's password one last time. This command automatically creates the
.ssh directory and
authorized_keys file on the remote server if they do not exist, and appends your public key.
For manual installation, view your public key with:
cat ~/.ssh/id_rsa.pub
Copy the output, then on the Linux server, ensure the
.ssh directory exists and has correct permissions:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "PASTE_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
Incorrect permissions are a common cause of failure. Ensure the
.ssh folder is
700 and
authorized_keys is
600. If you face permission denied errors, review
Vagrant Fails to Connect to SSH on Linux Host, Works Fine on Windows Host for insights into host-specific permission configurations.
Configuring the SSH Server
To enforce key-based authentication and disable password logins, edit the SSH daemon configuration file on the Linux server. Use a text editor like
nano or
vim:
sudo nano /etc/ssh/sshd_config
Locate the following directives and modify them:
- PasswordAuthentication: Set to
no.
- PubkeyAuthentication: Set to
yes.
- PermitRootLogin: Set to
no if you wish to prevent root login entirely.
After making changes, save the file and restart the SSH service to apply the new configuration:
sudo systemctl restart sshd
This step significantly hardens your server against brute-force attacks. However, before disabling password authentication, ensure you have successfully tested key-based access. If you lose access due to misconfiguration, you may need physical console access or a recovery mode to revert changes. For scenarios involving automated scripts passing passwords, consider reviewing
Pass pw for remote user in bash line when ssh from linux to windows for alternative automation methods.
Connecting and Testing
Once configured, connect to your Linux server from Windows using the standard
ssh command:
ssh username@linux_server_ip
If you set a passphrase earlier, you will be prompted to enter it. If no passphrase was used, the connection should establish immediately. Verify the connection by running a simple command like
whoami or
uname -a.
For persistent connections or complex setups, you can define aliases in your Windows SSH config file located at
C:\Users\\.ssh\config. This allows you to use short names instead of full IP addresses and manage multiple keys efficiently. Remember that troubleshooting network timeouts, such as those seen in
Unable to Connect Ubuntu 20.04 VM to Windows, often requires checking NAT rules or router port forwarding if connecting over the internet rather than a local network.
Frequently Asked Questions
What if I forget my SSH key passphrase?
Unfortunately, there is no way to recover a forgotten passphrase because it is derived from your input and not stored anywhere. You must generate a new key pair and update the
authorized_keys file on the server. Always store passphrases securely using a password manager.
Can I use SSH keys with older versions of Windows 10?
Yes, but you need to manually install the OpenSSH Client feature through the Control Panel or PowerShell. Older builds did not include SSH tools out-of-the-box, so ensuring the component is added is the first critical step before generating keys.
Why does SSH still ask for a password after copying the key?
This usually indicates incorrect file permissions on the Linux server. The
.ssh directory must be owned by the user and have permissions set to 700, while the
authorized_keys file must be 600. Additionally, check the SSH server logs on Linux for specific denial reasons.
Is it safe to leave the private key without a passphrase?
While convenient, leaving the private key unprotected is risky if your Windows machine is compromised. An attacker could use the key to access any server where it is authorized. Using a passphrase encrypts the key locally, requiring you to enter it each time, which adds significant security.
How do I troubleshoot connection timeouts?
Timeouts are often caused by firewalls blocking port 22 or incorrect routing. Test basic connectivity using
ping or
telnet linux_server_ip 22. If the port is unreachable, check your router's port forwarding rules or cloud provider security groups to ensure inbound traffic is allowed.