How to install OpenSSH

How to install OpenSSH


According to some cygwin gods, the only official document that you should use is /usr/share/doc/Cygwin/openssh.README which is probably valid, but it seems to aim at users with a fair bit of Linux/Unix knowledge.
The purpose of this tutorial is for Windows users who are perhaps less familiar with Unix commands wanting to try out the famous Open Source ssh server (openSSH) on a desktop Windows XP
(Windows Vista is relatively new, so information presented here is beta only).

The behavior of Windows 2003 Server is different. Follow this link to install OpenSSH on Windows 2003 Server, by Stephen Pillinger of the School of Computer Science, University of Brimingham. Or this link to install Cygwin SSH server on Windows 2003 Server, by Kevin Scully at the University of Waterloo, Ontario, Canada.

There seems to be some problems when using cygwin ssh with McAfee 8.0i. A work around to that problem is available below.

---

How to install a ssh server (called sshd, from OpenSSH) on a Windows 2000 or XP
How to install a sftp server on a Windows 2000 or XP

If you need a PDF converter, the post powerful pdf converter package available is Investintech's pdf server software bundle.

The ssh server is an emulation of the UNIX environment and OpenSSH for Windows, by Redhat, called cygwin

(1a) Login as Administrator
Windows XP - login as a user with Administrator privilege;
Windows 2003 Server: login as local admin, it will not work for domain users or domain admin.

(1b) Make sure the current admin/user has a Windows password set.
If not, use Control Panel...User Accounts to create a password.
Just to be on the safe side, after you created a password, logoff and then log in again.

(2a) Create a folder c:\cygwin

(2b) Download cygwin's setup.exe from http://www.cygwin.com/ and save setup.exe in c:\cygwin

Cygwin's setup.exe has some uncommon properties, click here to find out more.

Click Start...Run...and type c:\cygwin\setup.exe

If you are asked to select "Just Me" or "All Users", choose "All Users"

When it asks for "Local Package Directory", type c:\cygwin

Choose a download site that is "close" to you.
When a selection screen comes up (you can resize the windows to see better),
click the little View button for "Full" view ,
find the package "openssh", click on the word "skip" so that an appears in Column B,
see this illustration.
find the package "tcp_wrappers", click on the word "skip" so that an appears in Column B,
find the package "zlib", click on the word "skip" (it should be already selected) so that an appears in Column B.

Note:
tcp_wrappers provides host-based access control.
zlib is the compression and decompression library that is used by many programs.

Click to start installing cygwin and ssh.
Size of the basic cygwin system is more than 40 Meg, this may take a while.

Take a coffee break.

(3) Right click My Computer, Properties, Advanced, Environment Variables
See this illustration (red dots)
Click the "New" button to add a new entry to System variables:
variable name is CYGWIN
variable value is ntsec tty

(4) Right click My Computer, Properties, Advanced, Environment Variables
See this illustration (green dots)
Select the Path variable and click the "Edit" button:
append ;c:\cygwin\bin to the end of the existing variable string.

(5)

For Windows Vista significant revisions to this page is needed. In the interim, click here for how to install cygwin sshd under Vista.

For Windows XP , open a cygwin window by double clicking the icon; a black screen pops open,
For Windows Vista , right click the icon and choose "run as administrator"; a black screen pops open, type
ssh-host-config -y (on slower computers, it may take several minutes to generate the dsa security keys)
If the script asks you about "privilege separation", answer yes
If the script asks about "create a local user sshd on this machine", answer yes
If the script asks you about "install sshd as a service", answer yes

Windows Vista
If Vista asks "create a new local account ssh_server which has the required privileges" answer yes

When the script stops and asks you for "environment variable CYGWIN=" your answer is ntsec tty
(click here for an explanation of ntsec)
(click here for an explanation of tty )
(thanks to Peter Reutemann of New Zealand and Ron Dozier of University of Delaware)
(thanks to Mike and Michael Pechner for the Windows Vista tip)
(thanks to Kevin Hilton on the Vista tips in the ssh-host-config section)

See Note 25 near the end of this web page if you need to run ssh-host-config again.

(6) While you are still in the (black) cygwin screen, start the sshd service, type
net start sshd
or
cygrunsrv --start sshd

Click here on how to stop the sshd service.

(7) Make sure every Windows user has a password set, if not,
go to Control Panel....User Accounts and create a password.

(7a) Make sure every Windows user has done the following at least once:
Login in as the Windows user, pop a console command screen by clicking Start...Run....cmd
Thanks to Magno Corrêa of Brazil for the tip in (7a)

(8) Pop a cygwin window, harmonize Windows user information with cygwin, otherwise they cannot login
mkpasswd -cl > /etc/passwd
mkgroup --local > /etc/group

If your XP logs on to a domain, you most likely have to manually edit /etc/group. See this page.

If your XP logs on to a domain, you may want to edit /etc/passwd to replace /home/username by //unc_server/path_to_home
(thanks to Geoff Thomas)

mkpasswd creates a password file from Windows' user list, click here for more details.
mkgroup creates a group file from Windows' user list, click here for more details.
Thanks to John Skiggn of Cingular Wireless in Redmond, Washington for his tweak on domain user /etc/group

---

Test to see if sshd is working, pop a cygwin window (note: the command below is case sensitive)
whoami
ssh localhost
or
ssh -vvv localhost
or
ssh "$USERNAME@127.0.0.1"

if ssh complains "The authenticity of host xx.xx.xx.xx can't be established .... Are you sure you want to continue connecting (yes/no)?" Answer yes (Thanks to Daniel Griscom of Suitable Systems)

If you get an error message like "ssh-exchange-identification: Connection closed by remote host",
it is probably caused by McAfee 8.0i, see this page about the fix. (Thanks to Ron Dozier of University of Delaware, USA)

If you get an error message like "entry point _getreent", or "QuerryService Status: Win32 error 1062", it is probably
caused by the existance of an older version of "cygwin1.dll" located in the search path.
Do a full serarch of "cygwin1.dll" and remove the old version, except the current version at c:\cygwin\bin (Thanks to Joe britton)

If you get a prompt without error messages, type
cd /cygdrive/c
ls
if you see a directory listing, success!
(type exit to end the cygwin ssh session)
Thanks to Roger Pack for his tips clarifying between Microsoft's ls.exe (installed by MS compilers) and cygwin's ls.exe

If you have a Windows username that contains space, expand the space into \ [space],
e.g. if the Windows login name is Mickey mouse
ssh Mickey\ mouse@127.0.0.1

If you have a Unix system that does not know what to do with TERM cygwin, add these scripts to .login

If you have troubles ssh into the server, try run ssh-user-config

Thanks to Jared Kilgour for above $USERNAME variable substitution.
Thanks to Justin Kerk for the tip on quotes around $USERNAME to allow for spaces in username.
Thanks to Ron Dozier of University of Delaware for the Unix .login tweak.

---

Windows XP SP2 open the Windows Firewall to allow TCP port 22 through

Click Start...Control Panel....Security Centre....Manage Security Settings for Windows Firewall....Exceptions tab....Add Port...
"Name of port" is ssh "Port number" is 22 (check the "TCP" checkbox)
(Thanks to Stefano of Sardegna, Italy for his Windows Firewall reminder)

If you don't have sufficient privileges to open port 22 above, possible due to a group policy or other reasons,
you can create an exception for SSHD.
Click Start.. Control Panel...Security Center ... Windows Firewall...select the "Exception" tab.
Click "Add Program" button .. Browse to c:\cygwin\bin\sshd.exe
(Thanks to Thomas Johnson for this work around)

If you previously used Windows XP SP1 and installed sshd service, then upgraded to Windows XP SP2,
The upgrade disables the sshd service and deletes the CYGWIN environment variable.
Re-enter the environment variables and path.
Click Start...Control Panel....Security Centre....Manage Security Settings for Windows Firewall....Exceptions tab....Add Port...
"Name of port" is ssh "Port number" is 22 (check the "TCP" checkbox)
(Thanks to Chris Davitt of New Zealand for this SP1 to SP2 problem)

---

Multiple Windows users

Create other Windows users using the Control Panel...User Accounts.
After you created (or removed) Windows users
pop a cygwin windows to harmonize Windows user information with cygwin, otherwise they cannot login
mkpasswd --local > /etc/passwd
mkgroup --local > /etc/group


Don't get too carry away with multiple users, if a user can successfully ssh into the box, he can "cd" to just about any directory.

Note: The behaviors of Windows 2003 Server is different.
Follow this link to install OpenSSH on Windows 2003 Server, by Stephen Pillinger of the School of Computer Science, University of Birmingham.

---

Users from the internal network (geeks call this a LAN) can
ssh usersname@ip_address (e.g. ssh john@192.168.0.100)

On Unix/Linux systems, user names do not contains spaces. On Windows system, user names can have spaces.
If you have a Windows username that contains spaces, expand each space into \ [space],
e.g. if the Windows username is mickey mouse
ssh mickey\ mouse@192.168.0.100

---

If you have a NAT firewall, port forward (D-link calls this Virtual Server) TCP port 22 to the (internal) IP address
of the Windows box where the sshd server is running. See above diagram.

Users from the outside (geeks call this a WAN) can
ssh username@external_ip_address (e.g. ssh john@64.64.64.64 )
ssh mickey\ mouse@external_ip_address (e.g. ssh mickey\ mouse@64.64.64.64 )

Caveat Emptor :
-assuming you have an IP address that is accessible by the outside world, some ISP do not give out outside-accessible IP address.
-assuming your ISP does not suffer from extreme paranoia, he/she allows "port 22 TCP" traffic through their network.
-assuming your firewall allows TCP port 22 and port forwards to the computer running the ssh server.

If you want to use TCP port 443 as the sshd listening port (instead of the default SSH port 22), see this page.
(Why? Port 443 is normally assigned to https traffic, even severely paranoia IT geeks will leave this port open. Some IT geeks will even intercept TCP port 443 traffic and redirect them to a proxy server, these are the extreme total control freaks).

---

As a bonus, openssh includes sftp and sftp-server for doing encrypted file transfers.
These two programs function much like the familiar ftp-client and ftp-server.

For example, from a remote laptop, you can transfer (send and retrieve) files to your home computer (see above diagram).
sftp username@ip_address (e.g. sftp john@32.97.166.74 )
sftp username@hostname (e.g. sftp john@supercompuer.ibm.com )
openSSH [which uses openSSL] has strong encryption capability.
The encryption used by openSSH can be either AES-128, AES-192, AES-256, 3DES, Blowfish, cast-128, arcfour (RC4)
The default encryption algorithm (cipher) is AES-128-CBC.
You can force a particular encryption algorithm preference (cipher) by adding a directive such as
Ciphers blowfish-cbc,aes128-cbc,3des-cbc to /etc/sshd_config for faster transfer.
The sftp client I like best is Filezilla.

Caveat Emptor :
-assuming you have an IP address that is accessible by the outside world, some ISP do not give out outside-accessible IP address.
-assuming your ISP does not suffer from extreme paranoia, he/she allows "port 22 TCP" traffic through their network.
-assuming your firewall allows TCP port 22 and port forwards to the computer running the ssh server.

---

After you establish a ssh or sftp connection into the Windows box,
changing directory is rather painful, for example, to change to "my documents", type
cd "/cygdrive/c/documents and settings/$USERNAME/my documents"

Similarly, to change directory to d: drive
cd /cygdrive/d

To reduce pain, use a graphical sftp client such as Filezilla.

---

Where can you find a ssh or sftp client ?
(1) Putty is the best ssh client for Windows, it also has psftp.exe which is a console mode sftp client.
(2) Commercial software vendors such as VanDyke Software.
(3) Filezilla, a free, GNU (GPL) licensed sftp client.

If you prefer to use a graphical client to do sftp file transfers,
purchase a high quality commercial software called SecureFX
from VanDyke Software in Albuquerque, New Mexico, USA
or use Filezilla, a free, GNU (GPL) licensed sftp client,
or use WinSCP, a free, GNU (GPL) licensed sftp and scp client.
Also, ftp.ssh.com in their /pub/ssh directory, there is a Windows version of ssh and sftp client for non-commercial use,
thanks to Stephan of Rutgers State University of New Jersey for the link.

---

Other very, very useful things you can do with ssh is to tunnel (wrap) pure tcp applications under the
ssh protocol, giving them a strong cryptographic protection while traveling over the insecure public network.

openSSH [which uses openSSL] has strong encryption capability.
The encryption used by openSSH can be either AES-128, AES-192, AES-256, 3DES, Blowfish, cast-128, arcfour (RC4)
The default encryption algorithm (cipher) is AES-128-CBC.
You can force a particular encryption algorithm preference (cipher) by adding a line such as
Ciphers blowfish-cbc,aes128-cbc,3des-cbc to /etc/sshd_config (Blowfish runs faster than AES-128)

Below are some popular plain-text, pure TCP protocols that are unfortunately still in common use today.
Fortunately these protocols can benefit from the protection of a ssh tunnel:
POP3 (tcp port 110)
IMAP (tcp port 143)
SMTP (tcp port 25)
TELNET (tcp port 21)
VNC (tcp port 5900)
Print server traffic (typically tcp port 9100)
Windows Share, or Samba Share, SMB protocol (tcp port 445)

Note:
The world is moving away (rather slowly) from plain text protocols by hardening them with TLS or SSL:
newer versions of POP3 servers have TLS support at port 110; and SSL support at port 995
newer versions of IMAP servers have TLS support at port 143; and SSL support at port 993
newer versions of SMTP servers have TLS support at port 25
A version of "smtps" uses port 465 with SSL support, now it becomes legacy (depreciated).
SMTP can also use port 587 in plain text or TLS.
newer versions of telnet servers have SSL support at port 992

See this page on how to tunnel VNC traffic under ssh.
See this page on how to tunnel TCP applications under ssh.
See this page on how to set up a dedicated PPTP VPN server at your home office or main office.
See this page on how to tunnel SMB traffic under ssh.

Sometimes, there are applications such as mid-night back-up of files to a remote Linux server using "rsync encrypted with ssh",
you want to be able to ssh from one machine to another machine without a person sitting at the console to type the password.
See this page on how to ssh from one machine into another machine without typing a password, i.e,
how to use public key authentication.

Once you can ssh from one machine to another machine without typing a password, your task of doing rsync over ssh
is practically 90% done. Furthermore, create a batch file and invoke this batch file from Control Panel's "Schedule Tasks"
will do secure backup automatically. In Linux world, add a cron job to do the "rsync -e ssh"

---

How to install a ssh client (called ssh)
Click here for a tutorial on how to setup a ssh client on Windows 2000 or Windows XP

How to install a smtp server [exim] on a Windows machine
Click here for a tutorial on how to setup exim, a mail transfer agent
on Windows 2000 or Windows XP as a learning exercise.

Note 25: if you run ssh-host-config when sshd is installed, ssh-host-config will not ask for the CYGWIN value.
In that case, stop and remove the sshd service, then run the ssh-host-config script again, see below.

cygrunsrv --stop sshd
cygrunsrv --remove sshd
ssh-host-config
cygrunsrv --start sshd

Go to Control Panel, Classic View, Administrative Tools, Computer Management,
or click Start...Run...compmgmt.msc
delete the sshd user account.

Thanks to Dave Abrahams of Boost Consulting for the sshd user account deletion hint.

---

Reference: http://cygwin.com/cygwin-ug-net/

copSSH by ITeF!x is another implementation of cygwin-openssh server for Windows.

Thanks to Mike Skallas for his tips on "privilege separation" during the setup script.
Thanks to Jan Haul of Hamburg, Germany for his WinSCP link.
Thanks to Brad Erdman, Institute for Advanced Computer Studies, University of Maryland, USA
for his confirmation of cygwin-sshd working on Windows Server 2003
Thanks to Richard Goodman of UK for his tips on the order of CYGWIN variable.
http://www.lns.cornell.edu/public/COMP/cygwin/cyg_inst_net.html is the link to install Cygwin with Xfree86. Thanks to Richard Ward for this link.

Disclaimer

© 2003-2008 Nicholas Fong

Last revised: March 17, 2008