Setting Up OpenSSH Server on Windows

Install OpenSSH Server

Check whether OpenSSH Server is already installed. If it is not, install it using the following commands:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Start the SSH service

Start the sshd service and configure it to start automatically whenever the system boots:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Allow SSH connections

OpenSSH Server listens on TCP port 22. Windows normally creates a firewall rule automatically when the capability is installed. Verify that the rule exists, or create it if its missing:

Get-NetFirewallRule -Name *ssh*
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

The auto-created rule is normally scoped to the Domain and Private firewall profiles only. If the host is reached over its public IP, Windows classifies that interface as the Public profile, and the rule will silently not apply. Check the rule’s profile and add Public if needed:

Get-NetFirewallRule -Name sshd | Select-Object Profile
Set-NetFirewallRule -Name sshd -Profile Any

Also open port 22 at the network/firewall level (cloud security group, VPC firewall, etc.), in addition to the Windows Firewall rule above.

Authorize a dedicated SSH key

Generate a dedicated SSH keypair for PCP rather than relying on password authentication. For accounts that are members of the local Administrators group, keys are read from a dedicated file rather than the user’s own .ssh folder:

notepad C:\ProgramData\ssh\administrators_authorized_keys

Add the public key on its own line, save, then restrict the file’s permissions. SSH will silently ignore the file if permissions are too permissive:

icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "SYSTEM:F"

Test the connection

Before pasting the private key into Plakar Control Plane, confirm the key and network path both work:

eval `ssh-agent`
ssh-add /path/to/private_key
ssh Administrator@<host>

A successful, passwordless login confirms the key is authorized correctly and that the network path (firewall, security group, sshd) is open.

If this is the first time connecting to this host over SSH, you will be prompted to accept its host key. This is expected; type yes to continue. To skip the prompt, connect with:

ssh -o StrictHostKeyChecking=accept-new Administrator@<host>

To verify the fingerprint instead of trusting it blindly, retrieve it directly from the Windows host, where OpenSSH Server stores its host keys under C:\ProgramData\ssh:

ssh-keygen -lf C:\ProgramData\ssh\ssh_host_ed25519_key.pub

Compare its output against the fingerprint shown in the SSH prompt before accepting.

Community integrations: SSH host key verification

The community integrations use the known_hosts file of the account running plakar to verify the Windows host. Before running a backup, you must establish this trust yourself.

On the Windows host, display the fingerprint of its SSH host key:

ssh-keygen -lf C:\ProgramData\ssh\ssh_host_ed25519_key.pub

Then, from the machine running plakar, connect to the Windows host using the account that will run the backup. Compare the fingerprint presented by the SSH client with the fingerprint shown above. Accept the host key only when the fingerprints match.

This records the verified host key in that account’s known_hosts file, which the community integrations use for subsequent connections.