The built-in SSH client appeared in Windows 10 and Windows Server 2019. Ssh.exe can be used to securely connect to Linux/UNIX servers, VMWare ESXi hosts and other devices instead of Putty, MTPuTTY and other third-party SSH clients. The native Windows SSH client is based on the?OpenSSH?port and is preinstalled in Windows starting from Windows 10 build 1809.

How to Enable (Install) the OpenSSH Client on Windows 10?

The OpenSSH client is included in Windows 10?Features on Demand?(like?RSAT). The SSH client is installed by default on Windows Server 2019, Windows 10 1809 and newer builds.

Check that the SSH client is installed:

Get-WindowsCapability -Online | ? Name -like 'OpenSSH.Client*'

In our example, the OpenSSH client is installed (State: Installed).

If not (State: Not Present), you can install it using:

• The PowerShell command:?Add-WindowsCapability -Online -Name OpenSSH.Client*
• With DISM:?dism /Online /Add-Capability /CapabilityName:OpenSSH.Server~~~~0.0.1.0
• Via Settings -> Apps -> Optional features -> Add a feature. Find OpenSSH client in the list and click Install.

OpenSSH binary files are located in c:\Windows\System32\OpenSSH\.

• ssh.exe – the SSH client executable;
• scp.exe – tool for copying files in an SSH session;
• ssh-keygen.exe – tool to generate RSA SSH authentication keys;
• ssh-agent.exe – used to manage RSA keys;
• ssh-add.exe – adds a key to the SSH agent database.

Using a Native SSH Client on Windows 10

To start the SSH client, run the?PowerShell?or?cmd.exe prompt. You can list the available options and syntax for ssh.exe:

ssh

usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
[-D [bind_address:]port] [-E log_file] [-e escape_char]
[-F configfile] [-I pkcs11] [-i identity_file]
[-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]
[-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]
[-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
destination [command]

In order to connect to a remote server using SSH, use the following command:

ssh username@host

If your SSH server is running on a port different from the standard TCP/22, specify the port number:

ssh username@host -p port

For example, to connect to a Linux host with the IP address 192.168.1.102 as root, run this command:

ssh [email protected]

At the first connection, you will see a request to add the host key to the trusted list. Type yes and press ENTER. Then the host key fingerprint is added to the?C:\Users\username\.ssh\known_hosts file.

You will be prompted for a password. Specify your root password, and your remote Linux server’s console should open (in my example, CentOS is installed on the remote server).

If you use the SSH authentication with RSA keys (see an example on how to configure SSH authentication using keys in Windows), you can specify a path to the private key file in your SSH client as follows:

ssh [email protected] -i "C:\Users\username\.ssh\id_rsa"

You can also add a private key to SSH-Agent. First, enable the ssh-agent service and configure automatic startup for it.

set-service ssh-agent StartupType 'Automatic'
Start-Service ssh-agent