Make Powershell default ssh shell in Windows

[manojampalam]

[benkevan]

Rather this should be configurable and not statically set. I'd prefer it to be opened in cmd as my profile.ps1 is pretty heavy.

[aduzsardi]

this can be solved by adding
ForceCommand powershell.exe in your sshd_config , you can also do

Match User user1 user2 ...
    ForceCommand powershell.exe

or Match Group for groups

[taynes13]

@aduzsardi using ForceCommand powershell.exe will help just to interactive session but it breaks things like SFTP. Try to do SFTP connection to server which has ForceCommand enabled, SFTP won't be happy with powershell logo message :-)

[nkrepo]

Is there workaround for getting sftp work when powershell is the default ssh shell?

[bagajjal]

We couldn't find a perfect solution.

Here is our current proposal,

1. Read the default SSH shell from an user environment variable that has the full path (ex - C:\Windows\System32\cmd.exe)

2. Check if the default SSH shell is trusted,
   a) If the executable is from system32 path (ex - C:\Windows\System32)
   (or)
   b) If the executable is published from a trusted source (ex - Microsoft).

3. If step 2 succeeds then launch the default SSH shell.
   If step 2 fails then launch the cmd.exe

Issue with this proposal,
If a user has unpublished powershell.exe, step-2 will fail and we end up launching cmd.exe..

We would like to hear from the community, alternative proposals or any suggestions..

[lucastheisen]

Anything that can be done to make powershell the default will be good for me, but I wonder how the SSH shell from an user environment variable will get set... I usually set environment variables in my user profile, but the won't get executed until powershell starts...

[DarwinJS]

Looks like powershell.exe from powershell core is not signed by Microsoft (at least beta 4), so does that mean it would have to be installed under system32 to work with OpenSSH?

What does "trusted" mean in this context?

In the past Microsoft has considered "Program Files" locations more trustworthy than user writable locations because it takes admin permissions to place something there.

[manojampalam]

The intention here is address the security concern around "sshd launching malware injected arbitrary session process". Sticking with cmd.exe keeps it plain simple.

Otherwise we are trying to understand if there are any specific requirements mandating Powershell by default (apart from the convenience aspect). I see a drawback - its difficult to adjust Powershell session prompt (PS:>) to make it identify a remote session (like we do for cmd.exe).

BTW, Powershell could be launched straight away as follows
ssh.exe -t user@target powershell