37

I'm experiencing certain issues with the built-in OpenSSH client that, according to the Win32-OpenSSH Github page, seem resolved in newer versions. The newest version is v7.9 while the preinstalled client is in version 7.6p1.

PS C:\> ssh -V
OpenSSH_for_Windows_7.6p1, LibreSSL 2.6.4

I understand it's possible to install OpenSSH both as an optional feature in the "apps & features" settings page, or using Powershell. That seems futile in my situation as the client clearly already is installed.

PS C:\>  Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

Name  : OpenSSH.Client~~~~0.0.1.0
State : Installed

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

Unfortunately, it doesn't seem possible to update the client this way and the Github page doesn't seem to publish binaries. Does this mean I have to make the binaries myself if I want to use newer versions, and would they even work as a replacement not being signed or anything? Is there maybe a simpler way?

1
  • I had the same problem. Since I have the Windows Subsystem for Linux installed, I just switched to using wsl -e ssh instead of ssh, which executes the (newer) version of ssh inside the Linux subsystem.
    – Heinzi
    Nov 3, 2021 at 9:57

4 Answers 4

16

This page gives the steps to follow using Powershell to install the latest packages.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = 'https://github.com/PowerShell/Win32-OpenSSH/releases/latest/'
$request = [System.Net.WebRequest]::Create($url)
$request.AllowAutoRedirect=$false
$response=$request.GetResponse()
$([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win64.zip'  
$([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win32.zip'

If you use Chocolatey, then type the following in the command prompt as shown here:

choco upgrade openssh
3
  • 4
    You will likely want to use the instructions on this page to install the update. However, I would perform test within a virtual machine, to verify what actually happens. Unless there is a vulnerability you are specifically worried about, you might not want to attempt to manually update the install, and instead, remove the built-in version and use the above installation instructions.
    – Ramhound
    Jan 19, 2019 at 0:54
  • I needed to change $request.AllowAutoRedirect=$false to $request.AllowAutoRedirect=$true
    – JPvRiel
    Dec 11, 2020 at 11:46
  • 3
    Both don't do much, at least don't give any output and afterwards (even after opening a new shell) ssh -V just gives me the same output: OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
    – jaques-sam
    Jul 8, 2021 at 7:40
15

The answer to overwrite the files works:

Download the latest and update them in C:\Windows\System32.

However, this is easier said than done due to how Windows restricts permissions to modify/write files in System32. Running PowerShell as Administrator was not sufficient to modify files. I had to change ownership and add full control permissions to get it done as follows:

# Download upstream bins
$url = 'https://github.com/PowerShell/Win32-OpenSSH/releases/latest/'
$request = [System.Net.WebRequest]::Create($url)
$request.AllowAutoRedirect=$false
$response=$request.GetResponse()
$source = $([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win64.zip'
(New-Object System.Net.WebClient).DownloadFile($source, 'OpenSSH-Win64.zip')



# Overwrite windows installed bins
$openSshBins = (Get-ChildItem 'C:\WINDOWS\System32\OpenSSH\').Name
Expand-Archive -Path .\OpenSSH-Win64.zip -DestinationPath .
takeown.exe /a /r /f C:\Windows\System32\OpenSSH\
icacls.exe 'C:\Windows\System32\OpenSSH' /grant 'BUILTIN\Administrators:(OI)(CI)F'
icacls.exe 'C:\Windows\System32\OpenSSH' /grant 'BUILTIN\Administrators:F' /t
Stop-Service ssh-agent
$openSshBins | %{ Copy-Item -Path .\OpenSSH-Win64\$_ -Destination C:\Windows\System32\OpenSSH\ }
Start-Service ssh-agent

Note, to auotmate the download, you need to permit redirects.

6
  • 1
    download automation is broken again :( Mar 2, 2021 at 22:15
  • Thanks, corrected and disabled redirects again. Not sure why, could swear that last time I had to have redirects enabled for it to work for me.
    – JPvRiel
    Mar 4, 2021 at 18:21
  • I got the following on the last command: Start-Service : Service 'OpenSSH Authentication Agent (ssh-agent)' cannot be started due to the following error: Cannot start service ssh-agent on computer '.'. At line:1 char:1 + Start-Service ssh-agent + ~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
    – Steven Lu
    Apr 18, 2021 at 7:16
  • @StevenLu That error is probably caused by startup type is disabled for ssh authentication agent. see github.com/PowerShell/Win32-OpenSSH/issues/1625
    – kakoni
    Jan 20, 2022 at 12:45
  • 1
    "Download upstream bins" part fails. After downloading OpenSSH-Win64.zip from github.com/PowerShell/Win32-OpenSSH/releases/tag/…, use the "# Overwrite windows installed bins" part works. (write that part to a file like any_name.ps1, in pwsh as admin , issue & any_name.ps1 )
    – Good Pen
    May 9, 2022 at 4:15
14
  1. Remove the default version of OpenSSH:
Remove-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
  1. Install the recent version:
  1. Add it to path:
[Environment]::SetEnvironmentVariable("Path", 
$env:Path + ';' + ${Env:ProgramFiles} + '\OpenSSH', 
[System.EnvironmentVariableTarget]::Machine)
4
  • 1
    To avoid installing the server (sshd), add an installation argument: winget install Microsoft.OpenSSH.Beta --override ADDLOCAL=Client --- Note Microsoft.OpenSSH.Beta is the full name of the package. Sep 17, 2022 at 13:17
  • Just found out, when installing client only, the ssh-agent service is also unavailable.
    – w5l
    Nov 14, 2022 at 6:56
  • 1
    The package id is Microsoft.OpenSSH.Beta and the moniker is openssh-beta.
    – momvart
    Jul 10, 2023 at 2:49
  • Running Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0 adds the latest OpenSSH. Keep in mind that it has an issue that have a workaround.
    – Stoinov
    Nov 30, 2023 at 19:59
6

The binaries are now on GitHub. Download the latest and update them in C:\Windows\System32.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .