Command Line Access to Azure VMs – SSH

Article
08/09/2011

In a previous post I showed how to configure a service to allow for remote access using PowerShell Remoting. Another way of achieving the same goal is to use SSH.

SSH is capable of more than just remote access – copying files and tunneling are a few of the extra features. I’ll show how to get a SSH daemon working and how to connect to it for a remote session. I haven’t tested other features, let me know if you try anything else.

Cygwin

There are many SSH servers available for Windows. I will use the OpenSSH from Cygwin in this post.

The first task is to install Cygwin. It’s better to install it locally and package Cygwin in the Azure deployment package or create a zip file of the local installation and upload it to your Azure Storage account. The only extra package required is “openssh”.

Role Configuration

There are a few steps to configure a role to run the SSH service. I’ll describe only the main ones here, refer to the sample project at the bottom of the post for a complete working example.

1. Endpoint

The default SSH port is 22 hence the role must define the following endpoint:

   <Endpoints>
    <InputEndpoint name="SSH" protocol="tcp" port="22" localPort="22" />
  </Endpoints>

2. Create a user

You need an account to log in via SSH. Since this account will also be used to run the SSH Windows Service it must be in the Administrators Group.

   net user <username> <password> /add
  net localgroup Administrators <username> /add

3. Grant Privileges

The user account you created must have the required privileges to be used by a Windows Service. I used ntright.exe^[2] for granting the SeServiceLogonRight privilege.

4. Fix Unix File Permissions

Because Cygwin was copied to the VM instead of installed the Unix permissions for a few critical files must be fixed. This must be done from within Cygwin via a script.

5. Add the New User to Cygwin

The user account you previously created must be added to the Cygwin users list. Once again this must be done from the Cygwin environment.

6. Create and Start the Service

Cygwin includes a script to configure SSH as a Windows Service - ssh-host-config. After running this script a new service will be available and can be started the regular way or using the cygrunsrv command from Cygwin. These commands must be run using the account created in step 2 ^[1].

Remote Access

With the SSH enabled service deployed it’s time to connect to it. Using PuTTY simply enter the DNS name of your deployment in the Host Name field:

And if you want to avoid being disconnected because of timeouts you can set PuTTY to keep a heartbeat using any value under 60 seconds:

Then opening a connection will get you access to the VM:

SSH will actually allow you to connect to a service with multiple instances. You will not be able to specify the exact instance though, every new connection will be established to any one of the instances in the service.

Sample Project

This project creates a service with SSH enabled. It expects to find a zip file called cygwin.zip in your storage account. The zip file should contain the Cygwin install directory (e.g. C:\Cygwin).

Before you publish the project you must edit the EnableSSH.cmd and startSSH.sh files and enter the new username and password at the top of both files. There was no easy way to share that information between the Windows batch and the Shell script so it must be entered twice. You must also edit the DownloadBlob.ps1 file and enter your storage account information in the second to last line. You will also need to enter the container name in the same line.

References

Comments

Anonymous
September 11, 2011
i try and could not get to work. can you provide detail step
Anonymous
February 01, 2012
The comment has been removed
Anonymous
February 03, 2012
Since you can't connect locally I would suspect your SSHd install, you might want to run it locally on your desktop first. Another thought is to confirm the password you are using for the SSH user conforms with the complexity requirements. The remote user won't be created otherwise.
Anonymous
October 22, 2014
We were looking for a free ssh server for Windows so we could use Packer and Chef Solo to bake new machine images. We tried FreeSSHD but it does not work on Windows Server 2012 R2. It is no longer being maintained. We used OpenSSH downloaded from this site: www.mls-software.com/opensshd.html. Follow the notes for using sshd with public key exchange that is in the side bar. In particular note the following:

With setupssh-6.7p1-1.exe we only needed to change StrictModes no in etcsshd_config
OpenSSH service must be run as Administrator (the user intending to logon. As this was for configuration we used Administrator)
Place the public key in c:usersadministrator.sshauthorized_keys
When you ssh in, use case sensitive user name and explicitly specify the key file unless you used id_rsa for the private key. ssh 12.34.56.78 -l Administrator -i my-keypair.pem

Share via