Long-time reader, first-time question-asker.

I followed the instructions in this answer:

How can I SSH into “Bash on Ubuntu on Windows 10”?

I'm attempting to SSH from PuTTY in Windows on the same machine. Using Port 22, which matches my config file. Tried both and However, I'm still getting "access denied":

enter image description here

Ultimately I'm hoping to set up a Visual Studio remote build, but I've been thus far unable to get in remotely at all. What next steps should I take?

Process Hacker shows this for port 22 (not sure what this means):

enter image description here

Here are the contents of /etc/ssh/sshd_config:

# Package generated configuration file
# See the sshd_config(5) manpage for details

# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
#Privilege Separation is turned on for security
UsePrivilegeSeparation no

# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 1024

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 120
PermitRootLogin no
AllowUsers basel
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile     %h/.ssh/authorized_keys

# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosGetAFSToken no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

Subsystem sftp /usr/lib/openssh/sftp-server

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
  • An "Access Denied" means you are providing the incorrect password to the account base1 – Ramhound Sep 12 '16 at 14:26
  • 3
    I'm definitely not providing the incorrect password. I've changed it and retried a few times just to make sure. – Basel Alghanem Sep 12 '16 at 14:32
  • Did you try looking around? – Matt Clark Sep 12 '16 at 14:37
  • 1
    I absolutely did try looking around, for a couple hours this morning. Unfortunately I'm generally unknowledgeable in this area. I tried commenting out the line as suggested in an answer, and that didn't help. Do you think trying key-based auth might work? – Basel Alghanem Sep 12 '16 at 15:09
  • 1
    Switched to port 2200 (line 5 in sshd_config) and was able to successfully log into WSL. I guess Windows was using port 22 so Linux couldn't? Additionally, sshd showed up in Process Hacker as listening to port 2200, where it didn't show up at all before. Do I submit this as an answer to my question? – Basel Alghanem Sep 12 '16 at 16:40

Change the 22 port to a other one,such as 2222,in the file /etc/ssh/sshd_config,then restart the ssh service by the commond sudo service ssh --full-restart,you will successfully login.But I don't know the reason.

I also try use it as a remote gdb server for visual studio by VisualGDB,it not works well. VisualGDB will support it in the next version as the offical website shows.The link is https://sysprogs.com/w/forums/topic/visualgdb-with-windows-10-anniversary-update-linux-support/#post-9274

  • Now,the VisualGDB support it,more details to visualgdb.com/tutorials/linux/win10 – nul lun Oct 26 '16 at 3:25
  • 4
    This is because Windows might run SSH Server Broker on port 22. Unless you know for sure that you need it, it can be safely disabled. It is used for some procedures during development. – ᄂ ᄀ Mar 6 '17 at 20:44
  • 4
    Don't forget to open up the port in the Windows Firewall. – dthor Nov 7 '17 at 22:18
  • 6
    Probably, you'll also need to change the authentication. By default it requires ssh keys to the client. If you want the classic user/password login, set this configuration in /etc/ssh/sshd_config: PubkeyAuthentication no PasswordAuthentication yes – Tonatio Jan 29 '18 at 11:55
  • 1
    I had to enable firewall rule like @dthor mentioned and enable password auth like Tonatio mentioned then it worked. – user351764 Apr 14 '18 at 8:35

Port 22 does not work because Windows comes with a built in SSH server.

Windows 10 comes with an SSH server, and it will either need to be disabled or the port that will be used for SSH on WSL will need to be changed. I chose to do the latter and use port 2200 for WSL SSH.

Source: https://virtualizationreview.com/articles/2017/02/08/graphical-programs-on-windows-subsystem-on-linux.aspx

  • 2
    This is actually the only correct answer to this question, even the accepted answer, hints at this being the reason the port had to be changed. I am going to award this answer a bounty in 24 hours. – Ramhound Nov 13 '19 at 4:00

When you login, use your Windows Microsoft Account password, not your WSL Linux user password. You will be logged into your Windows home directory running cmd.exe. Enter command /windows/system32/bash.exe ~ --login to log into your WSL home directory and execute your .profile.


Contrary to the accepted and other answers here. The port does not have to be changed. I was able to successfully connect on port 22 to my OpenSSH server runnin inside Ubuntu 18.04 WSL on port 22. It seems that in addition to the user explicitly running the Windows OpenSSH server explcitly, Windows can also run the OpenSSH server in the background without the user explicitly enabling it, this happens when you enable "Developer Mode" in the new settings.

If you are trying to login to your WSL OpenSSH server, but you are ending up at a batch/cmd prompt in your Windows home folder, then Windows is running an OpenSSH server on port 22 in the background and is not letting WSL use it for outbound traffic.

If you want to connect on port 22 to your OpenSSH sever in WSL then try the following steps:

  1. Start not logged into SSH.

  2. If you don't have one already, open Windows Firewall, select Add Rule and configure it to allow incoming traffic on port 22.

  3. Open the new Windows 10 "Settings" app, navigate to "Updates & Security" and to the section "For developers"

  4. Turn off the option for "Device Discovery -- Make your device visible to USB connections and your local network."

After doing this, I was able to connect to the openssh-server inside of my WSL instance on port 22.

Reference Article:


  • Not sure what you mean by "fails to point out simply disabling this feature would have allowed OpenSSH within WSL (on port 22)".... That's pretty much the gist of the whole answer, no? But specifically I think step 3 listed above gets at that point pretty well... XD. As for answering on an old thread, surely you don't think StackExchange went through all the trouble of creating a "Necromancer" badge, just so they'd never have a chance to award it, do you? I've got lots of 'em on SO. ;) – Cory Gross Apr 5 '20 at 2:15
  • And regarding Windows version, just to clarify, I had the issue described on an install of Windows 10 that was up to date at the time the answer was wriitten. And these are the steps that solved the issue for me. – Cory Gross Apr 5 '20 at 2:24
  • M$ SSH Server was not installed by default when I enabled developer mode. Systemd background tasks do not start with the computer... devblogs.microsoft.com/commandline/… I would recommend installing the M$ SSH Server to have full access to the machine and not just the WSL containerd. – Ray Foss May 11 '20 at 1:50
  • There is no systemd in WSL1, but there are plenty of other mechanisms to start the WSL OpenSSH server up at boot. Indeed, I do have full access to the machine when connecting to the WSL OpenSSH server. Windows volumes are mounted under /mnt and you can also execute cmd.exe from within WSL and drop right into a batch prompt if desired. – Cory Gross May 12 '20 at 3:34
  • Also, the "OpenSSH Server for Windows" is not "installed" when enabling developer mode, but the "Microsoft SSH Server for Windows" is! Yes that's right. This is an entirely different server that runs when you enable development mode: noise.paulos.cz/post/windows10-14352-ssh-server danielsellers.com/blog/2017/2/10/… – Cory Gross May 12 '20 at 3:44

What I did was sudo ssh-keygen instead of ssh-keygen.

I ran into some earlier problems with files not writing correctly and this fixed it for me.


WSL: Also look out for UsePrivilegeSeparation no

Otherwise, running the server in the console (/usr/sbin/sshd -Dddde) will fail with:

PrivilegeSeparation not implemented ...

  • 2
    UsePrivilegeSeparation is deprecated – mFeinstein Aug 27 '19 at 22:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.