OpenSSH Configuration<\/h2>\n
First, the Ansible OpenSSH for Windows documentation <\/a>is pretty solid. It’s not enough to just turn on OpenSSH, you also need to change what it’s default shell is. Here, as in the documentation, I’m setting it to be powershell. This way when Ansible connects and attempts to do work it will happen via PowerShell rather than cmd.exe:<\/p>\n I had to additionally adjust the firewall beyond what the Ansible documentation showed to allow remote hosts to access OpenSSH:<\/p>\n In AAP I have to tell it what communication method to talk to my Windows host with. I could assign these options directly on the host, but for this special group of Windows hosts I’ve created an inventory group named “windows-openssh” with the following values:<\/p>\n ansible_remote_tmp: Here you can see I setup a temp directory where files will be temporarily stored on the remote host so Ansible can execute them. This isn’t specific to OpenSSH on Windows, but rather something that is a gotcha for folks. If you are doing privilege escalation “become: true”<\/em> on Windows you will need to instruct Ansible how to properly do it. In your credential, be sure to set the “Privilege Escalation Method” to “runas”. You’ll likely need to set the Escalation Username information too. Well, it’s not too crazy to get it all setup, but again, your milage may vary. I wholly expect support to just keep getting better. Well, good luck and happy OpenSSH’n to your Windows hosts \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":" The tried and true method to connect to a Windows host using Ansible has been WinRM since the inception of Ansible. Now this upstart\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[49,13,15],"tags":[],"class_list":["post-7828","post","type-post","status-publish","format-standard","hentry","category-ansible","category-server","category-windows"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/7828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7828"}],"version-history":[{"count":3,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/7828\/revisions"}],"predecessor-version":[{"id":7832,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/7828\/revisions\/7832"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7828"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nUsing the instructions to turn on and enable worked well:<\/p>\nGet-WindowsCapability -Name OpenSSH.Server* -Online |\r\n Add-WindowsCapability -Online\r\nSet-Service -Name sshd -StartupType Automatic -Status Running\r\n\r\n$firewallParams = @{\r\n Name = 'sshd-Server-In-TCP'\r\n DisplayName = 'Inbound rule for OpenSSH Server (sshd) on TCP port 22'\r\n Action = 'Allow'\r\n Direction = 'Inbound'\r\n Enabled = 'True' # This is not a boolean but an enum\r\n Profile = 'Any'\r\n Protocol = 'TCP'\r\n LocalPort = 22\r\n}\r\nNew-NetFirewallRule @firewallParams\r\n\r\n$shellParams = @{\r\n Path = 'HKLM:\\SOFTWARE\\OpenSSH'\r\n Name = 'DefaultShell'\r\n Value = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\r\n PropertyType = 'String'\r\n Force = $true\r\n}\r\nNew-ItemProperty @shellParams<\/code><\/pre>\n# Set default to powershell.exe\r\n$shellParams = @{\r\n Path = 'HKLM:\\SOFTWARE\\OpenSSH'\r\n Name = 'DefaultShell'\r\n Value = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\r\n PropertyType = 'String'\r\n Force = $true\r\n}\r\nNew-ItemProperty @shellParams<\/code><\/pre>\nSet-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -Enabled True -Profile Domain,Private,Public<\/code><\/pre>\nConfigure AAP<\/h2>\n
ansible_remote_tmp: C:\\Windows\\Temp\\ansible\r\nansible_pipelining: true\r\nansible_connection: ssh<\/code><\/pre>\n
\nThe remaining are optional.
\nansible_pipelining: Tries to issue multiple commands without having to create multiple connections.
\nansible_connection: This is defining ssh as the connection type, which is the default option, this isn’t needed. Since most folks utilize WinRM I spell it out here for documentation. <\/p>\nPrivilege Escalation Windows<\/h2>\n
\n![\"\"](\"https:\/\/gregsowell.com\/wp-content\/uploads\/2025\/11\/win-priv-300x64.png\")
<\/a><\/p>\nConclusion<\/h2>\n