Source
r/ansible•
Heteronymous

ssh for Windows for Ansible

FYI and hopeful enjoyment and use(fulness): https://github.com/illudium/ssh_install_and_secure_config_for_windows

I was just taking some time to watch on of u/geerlingguy's fantastic videos about Ansible for Devops - Ansible 101 - Episode 14 - Ansible and Windows,
and noticed that talks about downloading OpenSSH from Github. Certainly possible but not at all the only way to go.
I've been using powershell to install OpenSSH via Microsoft's announced availability and method here,
https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
and wanted to share some additional steps I've put together for automating and steps to secure such a setup.

Posted Jul 8, 2020, 1:10 AM UTC

1712
geerlingguy•

Nice find! As I said in the video, I’m not primarily a Windows user, so there are plenty of others who can extend my work much further.

5
HeteronymousOP•

Thanks, that's my work/posting. Hopefully you find it useful.

3
0ni0nrings•

thanks for sharing

2
Rorixrebel•

Did this the other day, my problem was copying the ssh keys over to my control node running the playbook. Ssh in windows lacks the ssh-copy-id utility which is a bummer.

2
billingsgate-homily•

I was just thinking about this as I read the readme, I'm pretty new at SSH, do you think using aws AWS or secure parameter store is a good substitute?

1
HeteronymousOP•

Yes. If your chosen/designated admin account is pre-populated - eg via your chosen imaging tool(s), that works as expected (no need to use ssh-copy-id).

1
mmagee80•

I was literally just getting ssh on windows setup for this. I got it to work, but by no means is it properly configured. I will check this out. Thank for sharing.

2
Sprocket45•

What version is installed via that method? I have been going the GitHub win32_openssh install route to install to get Kerberos support

1
HeteronymousOP•

OpenSSH_for_Windows_7.7p1

Interesting to note that "Even though the version appears from the command to be 0.0.1.0, the most recent supported version will be installed"
I re-ran it just now on one client (and restarted the service) and the version remained the same.

1
Sprocket45•

Kerberos support was introduced in 7.9

1
HeteronymousOP•

This setup obviates the need for Kerberos.

But, given that this is supposed to install the latest supported version it means that Microsoft hasn’t updated their source, and they need to get their act together. Should be more current.

1
jborean93•

This is the problem with installing from Microsoft. The version included by Windows is quite old and missing a few features that are present in the git distributed version. This is typically by design as Windows is a long lived version with just bug fixes and only new features are added in new Windows versions.

1