Skip to content

ssh.md

Latest commit

 

History

History
111 lines (84 loc) · 3.47 KB

ssh.md

File metadata and controls

111 lines (84 loc) · 3.47 KB
Raw

SSH — Mac to Windows

Windows runs the OpenSSH Server optional feature so the MacBook can reach it over the trusted LAN, the same way it reaches Fedora (../system/ssh.md). Because Fedora and Windows are one physical machine that only ever runs one OS at a time, they are reached through two separate client aliases with distinct host-key identities.

Server (Windows)

Setting Value
Feature OpenSSH Server (Add-WindowsCapability)
Service sshd, startup Automatic
Port 22
Authentication public key only; password login disabled
Default shell PowerShell 7 (DefaultShell registry value)
Exposure LAN only; no internet port forward

Enable and lock down:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service -Name sshd -StartupType Automatic
Start-Service sshd

# Force key-only auth in %ProgramData%\ssh\sshd_config:
#   PubkeyAuthentication yes
#   PasswordAuthentication no
Restart-Service sshd

The Mac's public key goes in %ProgramData%\ssh\administrators_authorized_keys (for an administrator account), permissions restricted to Administrators and SYSTEM. Key material is not published here.

Firewall — LAN only

OpenSSH Server adds an inbound rule for TCP 22. Scope it to the local network and never forward the port from the router:

Get-NetFirewallRule -DisplayName 'OpenSSH SSH Server (sshd)' |
  Set-NetFirewallRule -Profile Private -RemoteAddress LocalSubnet

Principles (identical to the Fedora side):

  • Port 22 is reachable on the trusted LAN only.
  • The router forwards nothing from the internet to this machine.
  • Remote access from outside the LAN, if ever needed, goes through a VPN or an authenticated tunnel — not a port forward.

Client (macOS)

Windows and Fedora share the desktop's LAN address, so the Mac keeps one alias per OS with its own key and its own HostKeyAlias:

Host desktop
    HostName <desktop-lan-address>
    User raioviajante
    IdentityFile ~/.ssh/<windows-client-key>
    IdentitiesOnly yes
    HostKeyAlias desktop-windows

Host fedora
    HostName fedora.local
    User raioviajante
    IdentityFile ~/.ssh/<fedora-client-key>
    IdentitiesOnly yes

ssh desktop connects to Windows, ssh fedora to Fedora. <desktop-lan-address> is the desktop's address on the home LAN (or a .local name if mDNS is available); the real value stays in the Mac's config, not in this repo.

Why the aliases are separate

Windows and Fedora present different SSH host keys on the same address. Without distinct HostKeyAlias values (or distinct hostnames), switching OSes makes the client see a changed key for a known host and refuse to connect:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

With HostKeyAlias desktop-windows for desktop and a separate identity for fedora, each OS's key is pinned under its own name in ~/.ssh/known_hosts and the two never collide. Do not delete the Fedora host-key entry while Windows is running, or vice versa.

Troubleshooting

On Windows (PowerShell):

Get-Service sshd
Get-NetTCPConnection -LocalPort 22 -State Listen
Get-NetFirewallRule | Where-Object DisplayName -Match 'SSH|OpenSSH'

On the Mac:

ssh -vvv desktop

If the host key ever changes unexpectedly, verify it over a trusted local channel (console access to the desktop) before removing the old known_hosts line. Never paste fingerprints into documentation.