SSH Config Editor

The SSH config file allows you to create different profiles for different host configurations. There is no limit to such profiles and you may add as many as possible. So, if you connect to multiple remote systems via SSH, creating SSH profiles will be a good move to save your time. Let me show you how to. SSH Config Editor is a handy tool for manage your OpenSSH client-configuration file. You can add or edit identity files, port forwardings (with handy graphical preview), and any other SSH config option. Add/change identity files by choosing them in file dialog; Add/edit port-forwarding options with graphical help. The SSH configuration file on your Unix system controls how secure shell operates. It can be used to make the ssh command easier to use, configure specific user-desired functions, or harden security against potential attacks.

-->

This topic covers the Windows-specific configuration for OpenSSH Server (sshd).

OpenSSH maintains detailed documentation for configuration options online at OpenSSH.com, which is not duplicated in this documentation set.

Configuring the default shell for OpenSSH in Windows

The default command shell provides the experience a user sees when connecting to the server using SSH.The initial default Windows is the Windows Command shell (cmd.exe).Windows also includes PowerShell and Bash, and third party command shells are also available for Windows and may be configured as the default shell for a server.

To set the default command shell, first confirm that the OpenSSH installation folder is on the system path.For Windows, the default installation folder is SystemDrive:WindowsDirectorySystem32openssh.The following commands shows the current path setting, and add the default OpenSSH installation folder to it.

Command shellCommand to use
Commandpath
PowerShell$env:path

Configuring the default ssh shell is done in the Windows registry by adding the full path to the shell executable to ComputerHKEY_LOCAL_MACHINESOFTWAREOpenSSH in the string value DefaultShell.

As an example, the following Powershell command sets the default shell to be PowerShell.exe:

Windows Configurations in sshd_config

In Windows, sshd reads configuration data from %programdata%sshsshd_config by default, or a different configuration file may be specified by launching sshd.exe with the -f parameter.If the file is absent, sshd generates one with the default configuration when the service is started.

The elements listed below provide Windows-specific configuration possible through entries in sshd_config.There are other configuration settings possible in that are not listed here, as they are covered in detail in the online Win32 OpenSSH documentation.

AllowGroups, AllowUsers, DenyGroups, DenyUsers

Controlling which users and groups can connect to the server is done using the AllowGroups, AllowUsers, DenyGroups and DenyUsers directives.The allow/deny directives are processed in the following order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.All account names must be specified in lower case.See PATTERNS in ssh_config for more information on patterns for wildcards.

When configuring user/group based rules with a domain user or group, use the following format: user?domain*.Windows allows multiple of formats for specifying domain principals, but many conflict with standard Linux patterns.For that reason, * is added to cover FQDNs.Also, this approach uses '?', instead of @, to avoid conflicts with the [email protected] format.

Work group users/groups and internet-connected accounts are always resolved to their local account name (no domain part, similar to standard Unix names).Domain users and groups are strictly resolved to NameSamCompatible format - domain_short_nameuser_name.All user/group based configuration rules need to adhere to this format.

Examples for domain users and groups

Examples for local users and groups

AuthenticationMethods

For Windows OpenSSH, the only available authentication methods are 'password' and 'publickey'.

AuthorizedKeysFile

The default is '.ssh/authorized_keys .ssh/authorized_keys2'. If the path is not absolute, it is taken relative to user's home directory (or profile image path). Ex. c:usersuser. Note that if the user belongs to the administrator group, %programdata%/ssh/administrators_authorized_keys is used instead.

Mac

ChrootDirectory (Support added in v7.7.0.0)

This directive is only supported with sftp sessions. A remote session into cmd.exe wouldn't honor this. To setup a sftp-only chroot server, set ForceCommand to internal-sftp. You may also set up scp with chroot, by implementing a custom shell that would only allow scp and sftp.

HostKey

The defaults are %programdata%/ssh/ssh_host_ecdsa_key, %programdata%/ssh/ssh_host_ed25519_key, %programdata%/ssh/ssh_host_dsa_key, and %programdata%/ssh/ssh_host_rsa_key. If the defaults are not present, sshd automatically generates these on a service start.

Match

Note that pattern rules in this section. User and group names should be in lower case.

PermitRootLogin

Not applicable in Windows. To prevent administrator login, use Administrators with DenyGroups directive.

SyslogFacility

If you need file based logging, use LOCAL0. Logs are generated under %programdata%sshlogs.For any other value, including the default value, AUTH directs logging to ETW. For more info, see Logging Facilities in Windows.

Not supported

The following configuration options are not available in the OpenSSH version that ships in Windows Server 2019 and Windows 10 1809:

  • AcceptEnv
  • AllowStreamLocalForwarding
  • AuthorizedKeysCommand
  • AuthorizedKeysCommandUser
  • AuthorizedPrincipalsCommand
  • AuthorizedPrincipalsCommandUser
  • Compression
  • ExposeAuthInfo
  • GSSAPIAuthentication
  • GSSAPICleanupCredentials
  • GSSAPIStrictAcceptorCheck
  • HostbasedAcceptedKeyTypes
  • HostbasedAuthentication
  • HostbasedUsesNameFromPacketOnly
  • IgnoreRhosts
  • IgnoreUserKnownHosts
  • KbdInteractiveAuthentication
  • KerberosAuthentication
  • KerberosGetAFSToken
  • KerberosOrLocalPasswd
  • KerberosTicketCleanup
  • PermitTunnel
  • PermitUserEnvironment
  • PermitUserRC
  • PidFile
  • PrintLastLog
  • RDomain
  • StreamLocalBindMask
  • StreamLocalBindUnlink
  • StrictModes
  • X11DisplayOffset
  • X11Forwarding
  • X11UseLocalhost
  • XAuthLocation

Enabling SSH (Secure Shell) allows remote connection to the Raspberry Pi. This provides a means for adding roms, changing configuration, updates, and other convienient procedures by using SSH and SFTP clients to connect to the Raspberry Pi. For this instruction and for the sake of simplicity, this guide assumes that both the Raspberry Pi and the computer you are using to remotely connect to it are on the same local network.

NOTE: Your Raspberry Pi needs to be connected to the same network/router (either via Ethernet or Wifi Dongle) as the computer you are accessing it from.

Cisco ssh config

Here are a few (free) popular clients to try. These need to be installed on the PC, Mac, or other computer you are using to connect to the Raspberry Pi:

  • Windows:
    • Putty - Very simplistic access to allow for console commands, but does not feature the ease of drag & drop for ROMs and other files.
    • WinSCP - An SFTP client that features an easy way to drag & drop files. Console commands are also possible (and even integrates with Putty) but is a secondary user interface found in the Commands > Open Terminal or Commands > Open in Putty menus.
    • MobaXterm - A feature-rich console commands and drag & drop client that includes most ways to remotely connect to another computer, including SSH, SFTP, and even VNC (allows viewing the screen of another computer).
  • Mac:

Enable SSH

NOTE: Starting with RetroPie 4.2, in order to keep the default image secure, SSH is disabled by default. You will not be able to remotely connect to it until it has been enabled using ONE of the instructions below.

(Option 1) From the SD Card

If your computer has an SD-card reader or a special USB stick that allows inserting an SD card, plug it into your computer, open the new drive to access your SD-card's boot partition, and create an empty file called ssh or ssh.txt in the root directory. Ignore any warnings about the drive needing to be repaired.

(Option 2) From the RetroPie menu

  1. Select raspi-config from the RetroPie menu after booting up.
  2. Select Interface Options
  3. Select SSH
  4. Choose Yes
  5. Select Ok
  6. Choose Finish

(Option 3) When using BerryBoot

When using RetroPie with BerryBoot you cannot use raspi-config. There is a workaround to enable SSH:

  1. Boot to RetroPie (via BerryBoot)
  2. Enter shell by pressing Ctrl + F4
  3. cd /boot
  4. sudo touch ssh
  5. sudo reboot now
  6. Done!

Connecting

Ssh Configuration Cisco Router

Four credentials are needed to remotely connect to your Raspberry Pi: IP address, port, username, and password. These will be the same with any client (WinSCP, Putty, MobaXterm, etc).

Default Login

In your chosen client, enter the following:

  • IP address: See below note
  • Port: 22
  • Username: pi
  • Password: raspberry

Globe geography 3d. Note: The IP address is unique to your local network, and can be found by selecting the Show IP option in the RetroPie menu after booting up your Raspberry Pi.

Example using Putty:

Ssh Config Editor Online

Example using WinSCP:

Root Access

Warning! Root access is meant for advanced users only, and only for functions not possible with the pi user. Do not use root when transferring ROMs or other tasks available to the default pi user.

For more advanced users, root access can more easily allow for editing protected files such as the config.txt when overclocking. This allows users to remotely make changes, reboot, and instantly view performance changes.

See here if you wish to log in as root.

Common Terminal Commands:

Reboot:

Shutdown:

Change Directory

list Files in Current Directory

Retropie Setup Script:

Edit Files with Nano:

Change owner to Pi:

Change owner of folder and all files in folder to Pi:

Make shell script executable:

Extra Configurations

If you find that you are getting weird characters on the dialog gui for the RetroPie Setup script you can change the font encoding to make it look pretty again.