Win32-OpenSSH VS openssh-sk-winhello

A request for an official answer on CALs for Microsofts' SSH port is about to turn 6 years old:

https://github.com/PowerShell/Win32-OpenSSH/issues/926

I have automated some things "normally" on Windows successfully after installing OpenSSH-win32; https://github.com/PowerShell/Win32-OpenSSH/releases

Are there any other ssh clients that support FIDO2 on windows besides Win32-OpenSSH?

If you're on windows, you need openssh 8.9 to use fido for ssh. https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v8.9.1.0p1-Beta

Unlike Linux, Windows does not come with any tools for setting up an SFTP server. Even FileZilla Server, one of the most popular programs for setting up a FTP server, doesn't support SFTP out of the box. So, are there any other ways to set up an SFTP on Windows? Yes, of course. OpenSSH is a suite of programs for establishing secure connections to the server. sftp-server is one of the utility programs provided by OpenSSH, so this article will walk you through how to set up an SFTP server on Windows using OpenSSH. Originally, OpenSSH was only available on Linux, but Microsoft has ported it to Windows, so you can now use OpenSSH by downloading the zip file from here.

It is mentioned in Win32-OpenSSH's scope that it does not support "VPN Forwarding". Is it the same thing as local/remote port forwarding (ssh -L, and ssh -R)? Can I forward port to and from Windows with Win32-OpenSSH installed on both client and server?

So, personally, I haven't been able to get FIDO2 keys to work at all on Windows, but I didn't try very hard because I'm set-up just fine with GPG for SSH. Apparently there have been a few bugs reported (ref, and linked issue.

For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.".

0: https://github.com/tavrez/openssh-sk-winhello

0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)."

1: https://github.com/tavrez/openssh-sk-winhello/issues

2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

Awesome article! Also found this tool (tavrez/OpenSsh-sk-winhello) for windows that lets you do this without admin access

Which is also how they are generated when retrieving them on a new computer via ssh-keygen -K since I used the application=ssh:yubikey_5 flag when first generating them. So something like ssh-keygen -t ed25519-sk -O resident -O application=ssh:yubikey_5c, but because I am on Windows I also had the -w winhello.dll flag (In case anyone stumbles on this question)

This is what i used but YMMV https://github.com/tavrez/openssh-sk-winhello/releases/tag/v2.0.0

> Because AFAIK, (Fido) yubikey support is still missing.

Correct, hopefully Microsoft will provide an updated SSH client soon. It only requires recompiling OpenSSH with the correct flags.

Alternatively, use these build instruction for openssh with FIDO for windows:

https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a...

> Using either the PKCS#11 support or the gpg applet requires some extra piece of software

For those wanting to do that, here are some ways:

Using a premade dll:

https://github-wiki-see.page/m/mooltipass/minible/wiki/Setti...

Or with a middleware:

https://github.com/mgbowen/windows-fido-bridge

Using the Hello API:

https://github.com/tavrez/openssh-sk-winhello

Given how many people came with their own ways, I believe there's enough demand for Microsoft to fix that.

My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also.

[1] https://github.com/tavrez/openssh-sk-winhello