112

In my spare time I remotely support my wife's office via VPN into a Windows Server. I am about to purchase a wireless broadband service which doesn't support VPN.

I don't want to open up the remote desktop ports directly, and I would like to set up an SSH tunnel into the network, and if necessary then VPN over the top of that.

What is the best windows SSH Server implementation to use on a Windows 2003 Server, or should I just be using sshwindows?

splattne
  • 28,348
  • 19
  • 97
  • 147
Bruce McLeod
  • 1,738
  • 2
  • 14
  • 12
  • Shopping Questions and product recommendations are Off-Topic on any of the [se] sites. See [Q and A is hard, lets go Shopping](http://blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping) and the [FAQ] for more details. – Mark Henderson Aug 27 '12 at 22:02

9 Answers9

50

We've been using Bitvise WinSSHD for a few years now and have been very happy with it. It's free for "Non-Commercial/Personal" use, but even the for-pay version is not terribly expensive. It's nice because it's designed specifically for Windows and supports just about any type of authentication you would throw at it (AD, Kerberos, self-contained user db, etc). Installation and Upgrades are a breeze. Initial config has a nice GUI and I believe most of the config is also scriptable as well. Their site gives a more complete feature list.

*Edit: Looks like Bitvise decided to rename the product to Bitvise SSH Server

Ryan Bolger
  • 16,472
  • 3
  • 40
  • 59
  • 2
    It is very impressive solution and pricing is reasonable: free for personal use and $100 USD per production server. The public key encryption supports public keys from OpenSSH. It is fast and light. The GUI exposes powerful tweakery and there is an automation API. Very nice product. (And unlike cygwin/openssh or interix/openssh it works correctly with powershell.) – Brian Reiter Jun 19 '09 at 13:04
  • 2
    Just installed it for cross platform development. Now I work from Linux machine all the time. Was up and running in 5 minutes. – ScrollerBlaster Feb 17 '12 at 00:34
  • Just installed on Win7 sp1 - works fine. – Bill Ruppert Apr 08 '12 at 15:10
  • @BrianReiter Do you know if this software runs each client session in the user accounts security context? Or does it suffer from the same issue as your comment above on the accepted answer? – Tyson May 09 '12 at 01:32
  • @Tyson If the user logging in is a real windows local/domain account, it uses that security context. If it's a "virtual" user, it runs in whatever security context that virtual user has been configured against. It's also configurable what type of login is used (i.e. Network or Interactive). More info available in the docs. – Ryan Bolger May 09 '12 at 05:24
  • Thanks for sharing this! I'm trying it right now and I'm loving it! Looks exactly like what I was looking for. :-) – Francisco Zarabozo May 16 '13 at 11:51
40

I've been using FreeSSHd on my home Windows box, and have not run into any limitations. Highly recommended.

Dave K
  • 2,751
  • 2
  • 21
  • 17
  • 19
    FreeSSHd starts your sessions in the security context of the service itself. That means that while you are authenticated by one of several mechanisms, your actual security context is whatever the serer is running as (eg local system). I think this is a serious weakness of the FreeSSHd design. – Brian Reiter Jun 15 '09 at 21:17
  • 2
    FreeSSHD has problems being installed and run on Windows 7, if it is done by elevating from Standard User to Administrator. – Ashwin Nanjappa Aug 04 '10 at 09:29
  • Tried this one and it works!!! Was testing some c# SSH local file upload code – Julius A Jun 06 '11 at 15:07
  • Based on my experience, FreeSSH is not able to deal with `~/.ssh/authorized_keys` file. – sorin May 14 '13 at 10:07
  • It doesn't necessarily need the authorized_keys file. Its not optimal but for every user you would add their pub key. And the name of the pub key must match the user name EXACTLY. What hung me up was trying to drop `vagrant.pub` for a user named `vagrant`. The key ultimately needs to be named `vagrant` to match the user. – ferventcoder Sep 13 '13 at 17:22
14

I have been evaluating KpyM SSH Server and it looks pretty good and is BSD-licensed with source. It is based on cryptlib fundementally and creates a Window Station for each session which is why it is one of the few open source SSH solutions that works correctly with PowerShell.

We have been using OpenSSH compiled for Interix/SFU/SUA for the last several years. The downside is that OpenSSH doesn't play all that nicely with PowerShell which is an annoyance and it requires the full POSIX subsystem from Services for Unix 3.5 or the Subsystem for Unix Applications (Win2k3 R2 and later).

Years ago we used to use Vandyke and it worked well.

Bitvise WinSSHD is very nice. Supports aes256 and aes128 out of the box. It is not open source but it is free (with AD integration crippled) for personal use and very reasonable $100 USD per server for commercial use. Can be configured to use powershell as the default shell and powershell works correctly. WinSSHD has very granular configuration per-account and per-group and per client IP and per client DNS. There are logon and logoff actions that can be configured per account or group. Supports OpenSSH public key files. Exposes an automation API. Write logs to the Windows event log and/or text file. Still has a small and light service process.

Brian Reiter
  • 860
  • 5
  • 8
9

CopSSH is nice. It wraps a Cygwin OpenSSH in an installer and makes it very quick and easy to get things configured.

sherbang
  • 361
  • 3
  • 6
8

I would use the one from cygwin.

This is not directly answering your question, but I think that SSL is as secure as SSH and you could also use stunnel or socat ( http://www.dest-unreach.org/socat/ ) to open a certifacte-authenticated ssl-encrypted port for remote desktop. Socat would authenticate using ssl client certificates and forward the traffice towards the rdp port. On your machine you would do the same in reverse. The man page has samples for this and socat is available for windows

Christian
  • 1,033
  • 5
  • 16
  • 24
  • I've used Cygwin successfully on many different machines. – GreenKiwi May 20 '09 at 18:34
  • 2
    I like OpenSSH but I find it frustrating that it doesn't play nice with nicely with PowerShell. Maybe that's PowerShell's fault but it is still very annoying. You have to do "powershell -noexit -command -" or it will hang loading powershell. And then you get a wierd shell that has no prompt. It seems like the SSH servers designed for Windows that create a Window Station for eahc session don't have this problem. – Brian Reiter Jun 15 '09 at 21:20
  • After trying most of the free suggestions in this thread (KpyM lacks documentation, FreeSSHd will not launch even when run as administrator, OpenSSH is hard to configure), Cygwin was the only one I got working successfully. It also helps that there are plenty of tutorials for it, [like this one](http://www.howtogeek.com/howto/41560/how-to-get-ssh-command-line-access-to-windows-7-using-cygwin/) – Pakman Apr 18 '14 at 15:35
7

One option is OpenSSH for Windows:

OpenSSH for Windows is a free package that installs a minimal OpenSSH server and client utilities in the Cygwin package without needing the full Cygwin installation.

The OpenSSH for Windows package provides full SSH/SCP/SFTP support. SSH terminal support provides a familiar Windows Command prompt, while retaining Unix/Cygwin-style paths for SCP and SFTP.

splattne
  • 28,348
  • 19
  • 97
  • 147
  • 5
    any security concerns with this one? the sourceforge project hasn't been updated since 2004 – russau Oct 01 '10 at 06:48
2

I have always had good experiences with Van Dyke's software (they make IMO the best Windows SSH client). For Windows SSH server use, they have what they call VShell Server.

http://www.vandyke.com/products/vshell/index.html

Jauder Ho
  • 5,337
  • 2
  • 18
  • 17
2

Personally, I'd avoid the Cygwin variants. I've had problems with OpenSSH running as a service blocking windows updates. Fine for non-production servers, but not something you want to rely on for your remote access solution if you're trying to apply those very updates.

JoshRivers
  • 245
  • 1
  • 4
  • 10
2

I have found FortressSSH to be a fast and reliable solution. They have even been through Microsoft certification for Windows

http://pragmasys.com/FortressSSHServer.asp

Jeffrey
  • 61
  • 1
  • At $700 + maintenance, it's expensive, but you can't argue with FIPS-140-2 certification. These guys seem to know what they're doing :-) – Alan Donnelly Nov 14 '12 at 07:13