Starting the SSH daemon via PowerShell on Linux requires using the WSL2 bridge to execute system commands. You must invoke bash or wsl with elevated privileges to bypass permission restrictions that prevent direct execution of systemd services from the Windows shell.
The Core Interaction Problem
The primary reason you cannot start sshd directly from a standard PowerShell window is architectural. PowerShell runs in the Windows NT kernel environment, while sshd and its service manager (systemd) run inside the Linux subsystem. There is no direct binary compatibility for starting Linux services from the Windows command line without an intermediary. When you attempt to run a Linux command natively, PowerShell often fails because it does not have access to the Linux file system namespaces or the necessary inter-process communication channels required by systemd.
This disconnect creates a scenario where the service works perfectly when launched from within the Linux terminal but appears "unstartable" from PowerShell. The error messages are often misleading, suggesting permission issues or missing binaries, when the real issue is simply that PowerShell is trying to talk to the wrong kernel. To resolve this, you must explicitly route your command through the WSL2 interface.
Distinguishing Direct Execution vs. Bridge Execution
A common mistake is assuming that typing sudo systemctl start ssh in PowerShell will work. It will not. PowerShell interprets sudo as a Windows alias or fails to find it entirely. Even if you use the wsl.exe launcher, you must ensure that the command string is correctly passed to the Linux interpreter. The syntax matters significantly here. You need to pass the entire Linux command sequence as a single argument to the bash or wsl executable.
Correct Syntax for Starting SSHD
To successfully start the SSH daemon, you must use one of two methods depending on your WSL version and configuration. The most robust method involves invoking the bash shell explicitly with root privileges.
- Open PowerShell as Administrator: Right-click the Start menu and select Terminal (Admin) or Windows PowerShell (Admin). This ensures you have the necessary rights to interact with the virtualization layer.
- Execute the Command: Run the following command exactly:
Note that some newer versions of WSL may require you to specify the distribution name if you have multiple installed:wsl sudo systemctl start sshwsl -d Ubuntu sudo systemctl start ssh - Verify Status: Check if the service is running using:
wsl sudo systemctl status ssh
If you encounter permission denied errors during this process, it indicates that your current Windows user account is not mapped to a sudo-enabled user in Linux. In this case, you may need to adjust your WSL user configuration or use the runas command within the Linux context.
Troubleshooting Permission Errors
Even with the correct syntax, you might face errors related to file permissions or SELinux contexts, particularly if you are running a customized Linux distribution. The SSH daemon requires specific ownership of host keys and configuration files. If PowerShell reports that it cannot start the service, check the logs inside WSL.
Run the following to view recent log entries:
wsl sudo journalctl -u ssh -n 50If the logs indicate permission issues on /etc/ssh/ssh_host_rsa_key, you can fix this by entering the Linux environment and correcting ownership:
wsl sudo chown root:root /etc/ssh/ssh_host_*_keyAfter adjusting permissions, try starting the service again using the PowerShell bridge. This step is crucial because Windows file permissions do not automatically translate to Linux POSIX permissions, leading to silent failures that only appear in the journal logs.
Ensuring Persistence Across Reboots
One of the biggest frustrations for developers working across both environments is having to manually start SSH after every reboot. While you can automate the start command in PowerShell, it is more reliable to enable the service at the Linux level. This ensures that whenever WSL starts, the SSH daemon initializes itself.
Enable the service using the same bridge method:
wsl sudo systemctl enable sshThis command creates the necessary symlinks in the systemd directory, ensuring that sshd starts automatically when the Linux distribution boots. You can verify this state by checking the enabled status:
wsl sudo systemctl is-enabled sshIf you prefer to manage the service lifecycle entirely from Windows, you can create a scheduled task in Windows Task Scheduler that triggers on login. However, this approach is generally discouraged because it adds complexity and potential race conditions where the network interface might not be ready before SSH attempts to bind to it. Sticking to the native systemd enablement is the most stable solution.
Related Resources
If you are experiencing other connectivity issues alongside SSH startup problems, you might want to review how local servers are exposed to external networks. For more details on preserving client IPs when exposing services, see Expose Local Server on VPS Preserving Real Client IPs (OS Level). Additionally, if you need to reset authentication credentials due to failed login attempts, refer to Reset Bash Password in WSL (PowerShell, Win11).
Frequently Asked Questions
Why does 'sudo' fail in PowerShell?
Sudo is a Linux command, not a Windows command. PowerShell does not recognize it unless you are already inside a Linux shell or invoking it via the WSL bridge. Always prefix Linux-specific administrative commands with wsl or bash when running them from the Windows terminal.
Can I start SSHD without using sudo?
No, starting system services like SSHD requires root privileges. Attempting to run it as a standard user will result in permission denied errors because the daemon needs to bind to port 22 and access sensitive host keys located in protected directories.
How do I stop the SSH service from PowerShell?
You can stop the service using the same bridge syntax: wsl sudo systemctl stop ssh. This sends the stop signal to the systemd manager inside the Linux distribution, gracefully terminating the SSH daemon process.
What if WSL is not installed?
If the wsl command is not recognized, you likely do not have the Windows Subsystem for Linux feature enabled. You can install it by running wsl --install in PowerShell as an administrator, which sets up the default Linux distribution and the necessary virtualization components.
Does enabling SSH affect Windows security?
Enabling SSH in WSL does not expose your Windows installation directly. The SSH server listens on a virtual network adapter created by WSL. Access is restricted to clients connecting to that specific IP address, provided your firewall rules allow it. It is isolated from the main Windows network stack.