Listed here are Windows specific details that supplement or override the original sshd configuration manual documented in OpenBSD manual. If you don't see a configuration entry here, the original man page reference holds true.
In Windows, sshd reads configuration data from %programdata%\ssh\sshd_config (or the file specified with -f on the command line). If this file is absent, sshd will generate one with the default configuration on a service start.
To override the default shell (cmd.exe) used for command invocations, follow steps here
The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.
See PATTERNS in ssh_config for more information on patterns.
User and group names are case insensitive in Windows (unlike in Unix). You should always use lower case while specifying these irrespective of their original case.
Note the following for domain accounts:
Prior to v18.104.22.168, there was no well defined way to specify domain principals (users and groups). To account for a domain principal in various forms, it is recommended to use the following format while configuring user/group based rules -
user?domain* - note the
? instead of
@ to avoid conflict with
username@host format and
* added to cover FQDNs.
From v22.214.171.124 on wards, work group users/groups and internet-connected accounts are strictly resolved to their local account name (no domain part, similar to standard Unix names). Domain users and groups are strictly resolved to NameSamCompatible format - domain_short_name\user_name. All user/group based configuration rules need to adhere to this format.
- Ex. for domain users and groups
DenyUsers contoso\firstname.lastname@example.org: blocks contoso\admin from 192.168.2.23
DenyUsers contoso\*: blocks all users from contoso domain
AllowGroups contoso\sshusers: only allow users from contoso\sshusers group
AllowGroups "contoso\ssh users": only allow users from "contoso\ssh users" group
- Ex. for local users and groups
Note that user and group names are in lower case
Available authentication methods are "password" and "publickey".
The default is “.ssh/authorized_keys .ssh/authorized_keys2”. If the path is not absolute, it is taken relative to user's home directory (or profile image path). Ex. c:\users\user.
From v126.96.36.199 on wards, following is the default location of AuthorizedKeysFile for all users in Administrators group
Support added in v188.8.131.52
This directive is only supported with sftp sessions. A remote session into cmd.exe wouldn't honor this. To setup a sftp-only chroot server, set ForceCommand to
internal-sftp. You may also set up scp with chroot, by implementing a custom shell that would only allow scp and sftp.
Support for Kerberos authentication via GSSAPI is added in v184.108.40.206.
The defaults are %programdata%/ssh/ssh_host_ecdsa_key, %programdata%/ssh/ssh_host_ed25519_key and %programdata%/ssh/ssh_host_rsa_key. If the defaults are not present, sshd will automatically generate these on a service start.
Note that pattern rules in this section. User and group names should be in lower case.
Not applicable in Windows. To prevent administrator login, use Administrators with DenyGroups directive.
If you need file based logging, use LOCAL0. Logs will be generated under %programdata%\ssh\logs.
Any other value, including the default value AUTH directs logging to ETW. For more info see Logging Facilities in Windows.