How-to guide

Enable SSH on a Windows computer.

SSH is an alternative channel Octotor can use to manage Windows computers. Windows 10/11 and Windows Server 2019+ ship an OpenSSH server — it just isn't switched on. Three PowerShell commands turn it on: install, start, open the firewall.

Before you begin

What you need

An Administrator account on the computer, and — if you restrict access — your Octotor server's IP address. The example server address below is 172.20.101.5 — substitute your own. Everything runs in PowerShell opened as Administrator on that computer.

This guide shows one proven configuration. For detailed and up-to-date instructions on OpenSSH for Windows, see Microsoft's official documentation.

This is a per-machine setup. Unlike the WinRM Group Policy guide, these commands configure one computer at a time.

1Install the OpenSSH Server feature

Windows carries OpenSSH as an optional feature — this installs it:

PS>Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

What you should see: a progress bar, then Online : True in the result.

2Start the sshd service — and keep it started

Start the SSH server now, then set it to start automatically on every boot:

PS>Start-Service sshd

What you should see: no output — the service is running.

PS>Set-Service -Name sshd -StartupType 'Automatic'

What you should see: no output — the service now starts on boot.

3Allow SSH in the firewall

SSH listens on TCP port 22. Run one of the three commands below — pick the one that matches how your Octotor server reaches this computer. All three create the same rule, so running a second one fails with "already exists".

AOpen port 22 to any address (simplest):

PS>

New-NetFirewallRule -Name "_Allow_TCP22" -DisplayName "_Allow_TCP22" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

What you should see: a rule summary ending with Status: The operation completed successfully.

BRestrict access to the Octotor server only (recommended):

PS>

New-NetFirewallRule -Name "_Allow_TCP22" -DisplayName "_Allow_TCP22" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -RemoteAddress 172.20.101.5

What you should see: the same rule summary. Replace 172.20.101.5 with your Octotor server's IP address.

CAllow the Tailscale network (when Octotor reaches this computer over Tailscale):

PS>

New-NetFirewallRule -Name "_Allow_TCP22" -DisplayName "_Allow_TCP22" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -RemoteAddress 100.64.0.0/10

What you should see: the same rule summary. 100.64.0.0/10 is the address range Tailscale uses.

If you chose B or C: installing OpenSSH may also create Windows' own built-in rule ("OpenSSH SSH Server"), which is open to any address — and firewall allow rules add up. For the restriction to actually hold, disable the built-in rule: Windows Defender Firewall with Advanced Security → Inbound Rules → OpenSSH SSH Server → right-click → Disable Rule.

✓Prove it works

From another machine that's allowed by your firewall rule, run ssh youruser@that-computer — a password prompt means SSH is on.

Done when: the computer answers SSH — in Octotor, run the chain check against it (Setup Guide, Step 10) with the protocol set to SSH, and the output ends with the success banner.

Part of the Setup Guide. This page is part of the Octotor Setup Guide.