Connecting Through SSH

OpenSSH is a tool used to create a secure SSH connection to a remote system. Use the following steps to install OpenSSH on your system, create a user and group to be able to create a secure connection and prevent access from unauthorized users, and set up your PowerShell or Linux client in it.

1. Install OpenSSH

1. Install the sshd server:

   Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
   

2. Verify that the OpenSSH server is installed.

   Get-WindowsCapability -Online | ? Name -like 'OpenSSH.Server*'
   

   You must see the following message:

   Name : OpenSSH.Server~~~~0.0.1.0
   State : Installed
   

3. Set the firewall to allow the following:
   Connection Direction: Inbound
   Protocol type: TCP
   Port: Default value: 22

   New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
   

4. Start the sshd service and ssh-agent:

   Start-Service sshd
   Set-Service -Name sshd -StartupType 'Automatic'
   Start-Service ‘ssh-agent’
   Set-Service -Name ‘ssh-agent’ -StartupType 'Automatic'
   

2. Create a Hevo user and group

1. Add a local Hevo user:

   net user Hevo <password> /add /comment:"User for connecting to Hevo using SSH." /passwordchg:no /passwordreq:no /logonpasswordchg:no
   

   Note: Replace the <password> in the command above with the password of your choice.

2. Add a Hevo group:

   net localgroup Hevo-group /comment:"Group for connecting to Hevo using SSH." /add
   

   Note: The user and group must have different names.

3. On the Windows command prompt, change the directory to SSH server:

   cd C:\ProgramData\ssh\ && start notepad .\sshd_config
   

4. Allow password authentication for the Hevo user:

   PasswordAuthentication yes
   

5. In the sshd_config file, do the following:

   1. Add the following line to the file to allow the Hevo user to connect to the SSH server:

      AllowUsers Hevo
      

   2. Comment out the following lines, if your Windows version is 1809 or later:

      # Match Group administrators
      # AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
      

   3. Save the file.

6. Restart the ssh-agent and the sshd service for the changes to be reflected:

   Restart-Service ssh-agent; Restart-Service sshd
   

3. Set up your SSH client

1. Enter the following command on the command prompt to log in to the SSH server using your Windows virtual machine:

   ssh Hevo@<Public IPv4 DNS>
   

   Note: Replace the <Public IPv4 DNS> in the command above with your own IP address.

2. Specify your password.

3. Create an .ssh folder in your home directory:

   mkdir .ssh
   

4. Add the Hevo public key to the authorized_keys file, in one of the following ways:

   • If you are setting up a Windows PowerShell client:

     type nul > authorized_keys
     echo <Hevo-public-key> >> authorized_keys
     icacls C:\Users\Hevo\.ssh\authorized_keys /inheritance:r
     

     If you are using a non-elevated PowerShell, refer to step 5 for the additional steps to set up the client.

     Note: The elevated PowerShell displays Administrator: Windows PowerShell on the top of the window.

   • If you are setting up a Linux client:

     touch authorized_keys
     chmod 600 authorized_keys
     echo <Hevo-public-key> >> authorized_keys
     

     Note: Replace the <Hevo-public-key> in the commands above with the public key displayed on the Hevo UI.

5. (For non-elevated PowerShell users only) Perform the following steps to setup the client:

   1. Enable public key authentication.

      PubkeyAuthentication yes
      

   2. Disable password authentication.

      PasswordAuthentication no
      PermitEmptyPasswords no
      

   3. Save the sshd_config file.

   4. Verify that inheritance is disabled and remove Administrator permissions to prevent the created user (Hevo) from inheriting administrative level permissions. To do this:

      1. Right click on the authorized_keys file.

      2. Click Properties.

      3. Click Security.

      4. Click Advanced.

      5. Verify that Enable Inheritance is visible on the bottom left. This means that inheritance is disabled.

      6. Remove Administrator from the file security permissions.

   5. Restart the ssh-agent and the sshd service for the changes to be reflected.

      Restart-Service ssh-agent; Restart-Service sshd
      

PuTTY and KiTTY are tools that allow you to set up a remote SSH client environment. Use the following steps to install PuTTY and KiTTY on your system, generate a private key, and set up your SSH connection with it.

1. Generate the public and private keys

1. Download PuTTY and launch PuTTYgen.

2. In the Actions section, click Generate to obtain the keys.

   

   The OpenSSH public key appears in the top box.

3. Copy the OpenSSH public key, and save it securely like any other password.

   

4. Click Save private key, and save the .ppk file on your desktop.

   

2. Configure your SSH connection

1. Run kitty-0.74.4.7.exe on your desktop to launch KiTTY.

2. Configure your session using the following:

   • Host Name: Hevo@<Your Public IPv4 DNS>. For example, Hevo@192.4.7.146.

   • Port: Default value: 22.

3. In the left navigation pane, under Connection, SSH, Auth, click Credentials.

4. In the Private key file for authentication field, specify the private key that you downloaded, and click Tunnels.

5. In the Port forwarding section, do the following:

   1. Select the following check boxes, if not selected already:

      • Local ports accept connections from other hosts

      • Remote ports do the same

   2. In the Source port field, specify the port assigned for your connection. Default value: 55432.

   3. In the Destination field, add your Destination address and its corresponding port. For example, localhost:55432 for a server hosted on the same virtual machine.

   4. Ensure that Remote is selected, and click Add.

6. In the left navigation pane, click Connection, and set the value for seconds between keepalives to 5.

7. Select both Reconnect options.

8. Return to the Tunnels page.

9. In the Saved Sessions/New Folder field, specify a name for the connection, and click Save.
   Another session is created in the bottom box.

10. Click Open, and leave the window open.