Windows powershell ssh copy id

At the moment, Windows 10’s implementation of the OpenSSH client does not have the ssh-copy-id command available. However, a PowerShell one-line command can mimic the ssh-copy-id command and allow you to copy an SSH public key generated by the ssh-keygen command to a remote Linux device for passwordless login.

Generate an SSH Key

Note: If you have already generated an SSH keypair that you would like to use, skip this section and proceed to the Copy SSH Key to Remote Linux Device section.

First, open a new PowerShell window (not a Command Prompt window!) and generate a new SSH keypair with the ssh-keygen command. By default, the public and private keys will be placed in the %USERPROFILE%/.ssh/ directory. The public key file we are interested in is named id_rsa.pub.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

PS C:\Users\Christopher> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (C:\Users\Christopher/.ssh/id_rsa):
Created directory 'C:\Users\Christopher/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\Christopher/.ssh/id_rsa.
Your public key has been saved in C:\Users\Christopher/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:/mjkrJOQbRzCAwlSPYVBNcuxntm/Ms5/MMC15dCRrMc christopher@Christopher-Win10-VM-01
The key's randomart image is:
+---[RSA 2048]----+
|oo.+o==    o.o   |
|. o +. =  o =    |
|   o .+. . B     |
|    +..+o o E    |
|     *+.S. .     |
|    o +...o      |
|     o =. .o     |
|      o.*o ..    |
|      .=+++.     |
+----[SHA256]-----+
PS C:\Users\Christopher>

Copy SSH Key to Remote Linux Device

Next, we use the below PowerShell one-line command to copy the contents of the id_rsa.pub public key to a remote Linux device. Replace the {IP-ADDRESS-OR-FQDN} with the IP address or FQDN (Fully Qualified Domain Name) of the remote Linux device you would like to copy the public key to.

1

type $env:USERPROFILE\.ssh\id_rsa.pub | ssh {IP-ADDRESS-OR-FQDN} "cat >> .ssh/authorized_keys"

An example of this command is shown below. In this example, I am copying the contents of the id_rsa.pub public key to a remote Linux device at IP address 192.168.30.31.

1
2
3
4
5
6
7

PS C:\Users\Christopher> type $env:USERPROFILE\.ssh\id_rsa.pub | ssh 192.168.30.31 "cat >> .ssh/authorized_keys"
The authenticity of host '192.168.30.31 (192.168.30.31)' can't be established.
ECDSA key fingerprint is SHA256:mTD0/WNCVZ/p/PFSkNDmLJtzIGb5eD7qj6erOQkomjM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.30.31' (ECDSA) to the list of known hosts.
[email protected]'s password:
PS C:\Users\Christopher>

Test Passwordless SSH Connectivity to Remote Linux Device

Finally, verify that you can SSH to the remote Linux device with the ssh command. An example to a remote Linux device at IP address 192.168.30.31 is shown below. Note how a password did not need to be entered in order for us to establish SSH connectivity to the remote Linux device.

1
2
3
4

PS C:\Users\Christopher> ssh 192.168.30.31
Last login: Sat May 23 12:44:51 2020 from 192.168.10.139
[christopher@linux ~]$ who
christopher pts/0        2020-05-24 19:35 (192.168.10.113)

References

The instructions for this blog post were heavily inspired by Scott Hanselman’s blog post on the subject.

This post is licensed under CC BY-NC-SA by the author.

The `ssh-copy-id` command is used to install your SSH public key on a remote server, allowing for passwordless authentication when connecting via SSH.

ssh-copy-id user@remote_host

Understanding SSH Key Authentication

What are SSH Keys?

SSH keys are a pair of cryptographic keys used to authenticate a secure connection between a client and a server. Each pair consists of a public key and a private key. The public key is stored on the server in a special file, while the private key remains with the client. This method enhances security by allowing users to connect to remote servers without needing to transmit passwords over the network.

Benefits of Key-Based Authentication

Using SSH keys provides numerous advantages:

• Enhanced Security: The encryption provided by SSH keys makes unauthorized access considerably more difficult compared to traditional password authentication.
• Convenience: Once set up, key-based authentication allows for seamless logins without entering passwords. This is particularly beneficial for automated scripts and routines.
• Prevention of Brute Force Attacks: Since SSH keys are virtually impossible to guess or crack, they effectively fend off brute force attacks aimed at password-protected logins.

Картинка с сайта: powershellcommands.com

Mastering PowerShell SSH Commands: A Quick Guide

Setting Up PowerShell for SSH

Installing OpenSSH

To utilize the `powershell ssh-copy-id` functionality, you need to ensure that OpenSSH is installed on your Windows system. You can do this through the Settings app:

1. Open Settings > Apps > Optional features.
2. Look for OpenSSH Client. If it’s not listed, click on Add a feature, search for OpenSSH Client, and install it.

After installation, verify it by executing the following command in PowerShell:

ssh -V

This command will display the version of SSH installed, confirming a successful installation.

Generating SSH Keys

The first step in setting up key-based authentication is to generate SSH keys. You can do this by using the `ssh-keygen` command in PowerShell. Follow these steps:

1. Open PowerShell.
2. Enter the following command to generate a new SSH key pair:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

This command will generate two files in the default location (`%USERPROFILE%\.ssh\`):

• `id_rsa`: Your private key (keep this secure and do not share it).
• `id_rsa.pub`: Your public key (this is what you’ll send to servers for authentication).

Where to Find SSH Keys

You can locate your SSH keys in the `.ssh` directory within your user profile:

C:\Users\YourUsername\.ssh\

Картинка с сайта: powershellcommands.com

Effortless File Transfers: PowerShell Copy-Item -Exclude

Introduction to `ssh-copy-id`

What is `ssh-copy-id`?

The `ssh-copy-id` command is a convenient utility to install your public key onto a remote server’s authorized keys. By doing so, you can establish a password-less SSH connection to that server.

Limitations of `ssh-copy-id` in PowerShell

While `ssh-copy-id` is a native command in Unix-like systems, PowerShell does not support it directly. However, you can simulate its functionality through a manual approach in PowerShell, which we’ll explore next.

Картинка с сайта: powershellcommands.com

Mastering PowerShell SSH -i for Seamless Connections

Using `ssh-copy-id` in PowerShell

Simulating `ssh-copy-id` Functionality

To implement the functionality of `ssh-copy-id` in PowerShell, you need to manually copy the public key to the remote server. The command below demonstrates this process:

cat ~/.ssh/id_rsa.pub | ssh user@remote_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Explanation of Each Command in the Snippet:

• `cat ~/.ssh/id_rsa.pub`: Reads your public key file.
• `|`: Pipes the output of the previous command into the next one.
• `ssh user@remote_host`: Initiates an SSH session to the specified user and host.
• `»mkdir -p ~/.ssh»`: Creates the `.ssh` directory on the remote server (if it does not exist).
• `cat >> ~/.ssh/authorized_keys`: Appends the public key to the `authorized_keys` file, allowing for key-based authentication.

Verifying Key-Based Authentication

After copying the SSH key, test the connection to ensure that it works without a password prompt. You can do this by executing:

ssh user@remote_host

If everything is set up correctly, you should be logged in without requiring a password. If you encounter issues, check for common mistakes such as incorrect permissions or misconfiguration.

Картинка с сайта: powershellcommands.com

PowerShell Copy-Item: Create Folder Made Easy

Practical Examples

Example Scenario: Copying Keys to a Remote Server

Assuming you have a remote server (`remote_host`) and a user (`user`), use the provided command to transfer your key:

cat ~/.ssh/id_rsa.pub | ssh user@remote_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Once executed, you’ll be prompted for your password for the last time. Upon successful connection, verifying key-based authentication should grant you password-less access.

Example Scenario: Automating Key Copy with PowerShell Scripts

To further streamline the process, you can automate the key copying with a PowerShell script. Below is a sample script:

# Save as Copy-SSHKeys.ps1
param (
    [string]$User,
    [string]$Host
)

$keyPath = "$HOME\.ssh\id_rsa.pub"
if (Test-Path $keyPath) {
    $key = Get-Content $keyPath
    ssh $User@$Host "mkdir -p ~/.ssh && echo $key >> ~/.ssh/authorized_keys"
} else {
    Write-Error "SSH public key not found!"
}

Explanation of the Script:

• `param`: Accepts parameters for the username and host to which the key is being copied.
• `Test-Path`: Checks if the public key file exists.
• `Get-Content`: Reads the public key from the specified file.
• `ssh $User@$Host`: Executes the SSH command to append the key.

Картинка с сайта: powershellcommands.com

Mastering PowerShell Split: A Quick Guide to Strings

Troubleshooting Common Issues

Common Errors with SSH Key Authentication

While setting up SSH key authentication, you may encounter various errors, such as:

• Permission denied errors: Often occurs due to incorrect permissions on the `.ssh` directory or the `authorized_keys` file.
• SSH key not recognized: This can happen if the public key isn’t properly added or has incorrect formatting.

Fixing Permissions of `.ssh` Directory

To ensure proper permissions, you can set the correct permissions directly on the remote server using:

ssh user@remote_host "chmod 700 ~/.ssh; chmod 600 ~/.ssh/authorized_keys"

This command makes the `.ssh` directory accessible only to the user and secures the `authorized_keys` file.

Картинка с сайта: powershellcommands.com

Mastering PowerShell Select-Object in a Nutshell

Tips and Best Practices

Protecting Your SSH Keys

Managing your SSH keys securely is crucial. Consider implementing the following practices:

• Use a Passphrase: Protect your private key with a strong passphrase to add an extra security layer.
• Backup Your Keys: Always keep a secure backup of your SSH keys in a safe location.

Rotating SSH Keys Regularly

Regularly updating and rotating your SSH keys is essential to maintaining a robust security posture. Implement this practice as part of your routine system maintenance.

Using SSH Config File for Convenience

You can simplify your SSH connection methods by using an SSH config file (`~/.ssh/config`). Here’s an example entry:

Host myserver
    HostName remote_host
    User user
    IdentityFile ~/.ssh/id_rsa

This configuration allows you to connect using a shorthand command (`ssh myserver`), improving efficiency.

Картинка с сайта: powershellcommands.com

Mastering PowerShell Get-Credential: A Quick Guide

Conclusion

In this article, we explored how to implement `powershell ssh-copy-id` functionality. By leveraging the PowerShell commands and understanding SSH key authentication mechanisms, you can enhance your network operations and secure your connections effectively. Start applying these principles today for a more secure SSH experience!

Картинка с сайта: powershellcommands.com

PowerShell Shutdown: Quick Commands for Instant Reboot

Resources

For further reading, consider checking the official PowerShell and OpenSSH documentation. Engaging with community forums can also provide additional support and insights as you deepen your understanding and skills in using PowerShell and SSH.

<#

.SYNOPSIS

Copy ssh public key to remote account

.DESCRIPTION

Copies public key to target machine

Default is .ssh\id_rsa.pub

See copyright notice at end of script

If this script won’t run, then run this command once

Set-ExecutionPolicy RemoteSigned CurrentUser

refer to https://go.microsoft.com/fwlink/?LinkID=135170

#>

[CmdletBinding()]

param(

[Parameter(Position = 0, Mandatory = $True)]

[string]$Target <# SSH compatible Name of Target machine #>,

[Parameter( Position = 1, Mandatory = $False)]

[string]$IdentityFile = «id_rsa« <#Identity File, must be in .ssh directory #>,

[switch]$Save = $False <# Save script used #>

)

$IdentityPath = Join-Path (Join-Path $env:USERPROFILE .ssh) $IdentityFile

if (-not (Test-Path —Path $IdentityPath —PathType Leaf)) {

Write-Host Key file $IdentityFile does not exist, use ssh—keygen

exit(1)

}

$PUBLIC_KEY = get-content «${IdentityPath}.pub«

$SCRIPT = @»

#!/bin/bash

#

PUBLIC_KEY=»$PUBLIC_KEY«

umask 0077

[ -d ~/.ssh ]||mkdir -p ~/.ssh

[ -f ~/.ssh/authorized_keys ]|| touch ~/.ssh/authorized_keys

grep —quiet —fixed-strings «`$PUBLIC_KEY» ~/.ssh/authorized_keys

if [ `$? -ne 0 ]

then

echo «`$PUBLIC_KEY» >> ~/.ssh/authorized_keys

else

echo Key already exists, no update performed.

fi

«@

if ($Save) {

Set-Content .\ssh—copy-id.sh —Value $SCRIPT

}

# The sed step is to convert crlf to lf for bash — it’s fussy

$SCRIPT | ssh $Target —o StrictHostKeyChecking=no «sed ‘s/\r//’ | bash«

if ($?) {

Write-Output «You should be able to login to $Target without a password using $IdentityFile key«

}

else {

Write-Host «Could not connect to $Target — Terminating« —ForegroundColor Red

}

<#

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or

distribute this software, either in source code form or as a compiled

binary, for any purpose, commercial or non-commercial, and by any

means.

In jurisdictions that recognize copyright laws, the author or authors

of this software dedicate any and all copyright interest in the

software to the public domain. We make this dedication for the benefit

of the public at large and to the detriment of our heirs and

successors. We intend this dedication to be an overt act of

relinquishment in perpetuity of all present and future rights to this

software under copyright law.

THE SOFTWARE IS PROVIDED «AS IS», WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR

OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR

OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <https://unlicense.org>

#>

21 Feb 2023 |
Create ssh-copy-id script for Windows |

Картинка с сайта: www.abrandao.com

Those of us who use linux with keyless logins and ssh , usually find the utility ssh-copy-id as a convenient way to copy the ssh ke into the authorized keys files of the destination server. This works great on Linux systems, but windows (and also Mac) don’t have a native version fo ssh-copy-id, of course you could find scripts online that do this.. but many are overkill basically re-creating the entire ssh client in code just for the purpose of copying over a single key. Also since this is a securtity realted operation , you want to be confident those scripts are only doing what they say they’re doing.

With that said I hope to address these issues in this post and show you a quick, short and most importantly easy to modify powershell script that you can use in any modern version of Windows.

Security and Concerns

Finally there’s security concerns about using these scripts, unless you go over everly line of of code you’re never really sure what they’re doing with your key. Because of this the code velow is short, in native powershell and very easy to use, you litterally can read the code in this post and res-assured it’s only doing what it’s supposed to.

SSH-COPY-ID in Powershell

Windows Powershell is the defacto Widnows command line programming language replacing the traditional DOS batch files, and has been in available since around Windows 7 (circa 2007) . You can find a useful Powershell cheat sheet here:

param (
    [Parameter(Mandatory=$true)]
    [string]$connectionString,

    [Parameter(Mandatory=$true)]
    [string]$publicKeyFile
)

$connectionParts = $connectionString.Split('@')
if ($connectionParts.Length -ne 2) {
    throw "Invalid connection string format. Must be in the format 'user@hostname:port'"
}
$username = $connectionParts[0]
$hostParts = $connectionParts[1].Split(':')
$hostname = $hostParts[0]
if ($hostParts.Length -gt 1) {
    $port = $hostParts[1]
} else {
    $port = 22
}

$sshDir = "$env:USERPROFILE\.ssh"
if (!(Test-Path -Path $sshDir)) {
    New-Item -ItemType Directory -Path $sshDir | Out-Null
}

$sshPubKey = Get-Content $publicKeyFile
$sshPubKeyFileName = Split-Path $publicKeyFile -Leaf
$sshAuthorizedKeysFile = "$sshDir\authorized_keys"

$sshConnection = New-SSHSession -ComputerName $hostname -Credential $username -Port $port
$sshAuthorizedKeys = Invoke-SSHCommand -SessionId $sshConnection.SessionId -Command "cat $sshAuthorizedKeysFile" | Select-Object -ExpandProperty Output
if ($sshAuthorizedKeys -notcontains $sshPubKey) {
    Invoke-SSHCommand -SessionId $sshConnection.SessionId -Command "echo `"$sshPubKey`" >> $sshAuthorizedKeysFile"
}

Write-Output "Public key added to $hostname authorized_keys file"
?

This script requires the New-SSHSession and Invoke-SSHCommand cmdlets, which are available in the PowershellSSH module. You can install this module by running Install-Module -Name PowershellSSH.

How it works

The script takes three parameters: the username on the remote host, the hostname or IP address of the remote host, and the path to the public key file. The script then creates the ~/.ssh directory on the remote host if it doesn’t exist, reads the public key from the specified file, and adds it to the authorized_keys file on the remote host if it’s not already there. Finally, the script outputs a message indicating that the public key was added to the authorized_keys file.

To use this script, save it to a file with a .ps1 extension, and then run it with the required parameters. For example:

.\ssh-copy-id.ps1 user@remotehost:port -publicKeyFile C:\Users\myuser\.ssh\id_rsa.pub