how to install CYGWIN

Advanced
Disclaimer

How to install a ssh server (called sshd, from OpenSSH) on a Windows 2000, XP or Windows Server 2003
How to install a sftp server on a Windows 2000,  XP or Windows Server 2003 

The ssh server is an emulation of the UNIX environment and OpenSSH for Windows, by Redhat, called cygwin

(1a) Login as Administrator (Windows XP - login as a user with Administrator privilege).

(1b) Make sure the current admin/user has a Windows password set.
If not, use Control Panel...User Accounts to create a password.

(2a) Create a folder c:/cygwin

(2b) Download cygwin's setup.exe from http://www.cygwin.com/ and save setup.exe in c:/cygwin
Click Start...Run...and type c:/cygwin/setup.exe

If you are asked about "Just Me" or "All Users", choose "All Users"

When it asks for "Local Package Directory", type c:/cygwin
When a selection screen comes up, (you can resize the windows to see better)
click the little View button for "Full" view  ,
find the package "openssh", click on the word "skip" so that an appears in Column B,
see this illustration.

Click to start installing cygwin and ssh.
Size of the basic cygwin system is about 40 Meg, this may take a while.

Take a coffee break. 

(3) Right click My Computer, Properties, Advanced, Environment Variables
See this illustration (red dots)
Click the "New" button to add a new entry to system variables:
variable name is CYGWIN
variable value is ntsec

(4) Right click My Computer, Properties, Advanced, Environment Variables
See this illustration (green dots)
Select the Path variable and click the "Edit" button:
append  ;c:/cygwin/bin   to the end of the existing variable string.

(5) Open a cygwin window (by double clicking the icon), a black screen pops open, type
ssh-host-config      (on slower computers, it may take several minutes to generate the dsa keys)
When the script asks you about "privilege separation", answer yes
When the script asks about "create local user sshd", answer yes
When the script asks you about "install sshd as a service", answer yes
When the script asks you for "CYGWIN="     your answer is ntsec

See Note 5 below if you need to run ssh-host-config again.

(6) While you are still in the (black) cygwin screen, start the sshd service
net start sshd
or
cygrunsrv  --start  sshd

Note: if you need to stop the sshd service, pop open a cygwin window
net stop sshd   or   cygrunsrv  --stop  sshd

(7) Make sure every Windows user has a password set, if not, 
go to  Control Panel....User Accounts and create a password.

(8) Pop a cygwin window, harmonize Windows user information with cygwin, otherwise they cannot login
mkpasswd   --local   >   /etc/passwd
mkgroup   --local    >   /etc/group

---

Test to see if sshd is working, pop a cygwin window (note: the command below is case sensitive)
whoami
ssh    localhost
or
ssh    "[email protected]"

If you get a prompt without error messages, type
ls  -lh  /cygdrive/c
if you see a directory listing, success!  
(type exit to end the cygwin ssh session) 

If you have a Windows username that contain space, expand the space into / [space],
e.g. if the Windows login name is  mickey mouse
ssh  mickey/  [email protected]

Thanks to Jared Kilgour for above $USERNAME variable substitution.
Thanks to Justin Kerk for the tip on quotes around $USERNAME to allow for spaces in username.

---

Windows XP SP2 - open the Windows Firewall to allow TCP port 22 through

Click Start...Control Panel....Security Centre....Manage Security Settings for Windows Firewall....Exceptions tab....Add Port...
"Name of port" is ssh    "Port number" is 22
(Thanks to Stefano of Sardegna, Italy for his Windows XP Firewall reminder)

If you previously used Windows XP SP1 and installed sshd service, then upgraded to Windows XP SP2,
note that the SP2 disables the sshd service and deletes the CYGWIN environment variable
Re-enter the environment variables and path.
Click Start...Control Panel....Security Centre....Manage Security Settings for Windows Firewall....Exceptions tab....Add Port...
"Name of port" is ssh    "Port number" is 22
(Thanks to Chris Davitt of New Zealand   for this SP1 SP2 glitch)

---

Multiple Windows users

Create other Windows users using the Control Panel... User Accounts.
After you created (or removed) Windows users
pop a cygwin windows to harmonize Windows user information with cygwin, otherwise they cannot login
mkpasswd   --local   >   /etc/passwd
mkgroup   --local    >   /etc/group


Don't get too carry away with multiple users, if a user successfully ssh into the box, he or she can cd to just about any directory.

---

Users from the internal network (geeks call this a LAN) can
ssh  usersname@ip_address   (e.g. ssh   [email protected])

On Unix/Linux systems, user names generally do not contain spaces. On Windows system, user names can have spaces.
If you have a Windows username that contain spaces, expand each space into / [space],
e.g. if the Windows username is  mickey mouse
ssh  mickey/  [email protected]

---

If you have a NAT firewall, port forward (D-link calls it Virtual Server) TCP port 22 to the IP address
of the Windows box with the sshd server. See above diagram.

Users from the outside (geeks call this a WAN) can
ssh  username@external_ip_address   (e.g. ssh   [email protected] )
ssh  mickey/   mouse@external_ip_address  (e.g.  ssh  mickey/  [email protected] )
(assuming you have an IP address that is accessible from the outside world, some ISP do not give an outside accessible IP address)
(assuming your firewall opens TCP port 22 and forwards it to the box running ssh server)

---

 sshd includes sftp and sftp-server for encrypted file transfers.
These two programs function like the familiar ftp-client and ftp-server.

For example, from a remote laptop, you can do file transfers to your home base (see above diagram).
sftp   username@ip_address   (e.g.  sftp  [email protected] )
sftp   username@hostname   (e.g. sftp  [email protected] )
openssh [which uses openssl] has strong encryption capability.
The encryption used by openssh can be either AES-128, AES-192, AES-256, 3DES, Blowfish, cast-128

---

After you establish a ssh or sftp connection into the Windows box,
changing directory is a bit more difficult, for example, to change to "my documents"
cd    "/cygdrive/c/documents and settings/$USERNAME/my documents"

Similarly, to change directory to d: drive
cd    /cygdrive/d

---

Where else can you find a sftp client ?
(1) Putty has psftp.exe, it runs from a command console.
(2) Commercial software vendors such as VanDyke Software.
(3) Filezilla, a free, GNU (GPL) licensed, ftp and sftp client.

---

If you prefer to use a graphical client to do sftp file transfers,
purchase a high quality commercial software called SecureFX
from VanDyke Software in Albuquerque, New Mexico, USA
or use Filezilla, a free, GNU (GPL) licensed, ftp and sftp client,
or use WinSCP, a free, GNU (GPL) licensed sftp and scp client.
Also, ftp.ssh.com in their /pub/ssh directory, there is a Windows version of ssh and sftp client for non-commercial use,
thanks to Stephan of Rutgers State University of New Jersey for the link.

---

Other very, very useful things you can do with ssh is to tunnel (wrap) pure tcp applications under the
ssh protocol, giving them a strong cryptographic protection while traveling over the insecure public network.
The encryption used by openssh can be either AES-128, AES-192, AES-256, 3DES, Blowfish, cast-128  

Below are some popular plain-text TCP protocols that can benefit from the protection of a ssh tunnel:
POP3 (tcp port 110) 
SMTP (tcp port 25) 
IMAP (tcp port 143) 
TELNET (tcp port 21) 
VNC (tcp port 5900)
Print server traffic (tcp port 9100)

Note: The world is moving away from plain text protocols by hardening them with TLS or SSL:
newer versions of POP3 has TLS support at port 110, and SSL support at port 995
newer versions of SMTP has TLS support at port 25
a version of "smtps" uses port 465 with SLL support, now becomes legacy
newer versions of IMAP has TLS support at port 143, and SSL support at port 993
newer versions of telnet has SSL support at port 992

See this page on how to tunnel VNC traffic under ssh.
See this page on how to tunnel TCP applications under ssh.

Sometimes, there are applications such as mid-night back-up of files to a remote Linux server using "rsync encrypted with ssh", 
you want to be able to ssh from one machine to another machine without a person sitting at the console to type a password.
See this page on how to ssh from one machine into another machine without typing a password, i.e, use public-key authentication.

---

How to install a ssh client (called ssh)
Click here for a tutorial on how to setup a ssh client on Windows 2000 or Windows XP

How to install a smtp server [exim] on a Windows machine
Click here for a tutorial on how to setup exim, a mail transfer agent
on Windows 2000 or Windows XP as a learning exercise. 

Note 5: if you run ssh-host-config when sshd is installed, ssh-host-config will not ask for CYGWIN value.
In that case,  stop and remove the sshd service, then run the ssh-host-config script again.

cygrunsrv  --stop  sshd
cygrunsrv  --remove sshd
ssh-host-config
cygrunsrv  --start sshd

---

Reference: http://cygwin.com/cygwin-ug-net/

Thanks to Mike Skallas for his tips on "privilege separation" during the setup script.
Thanks to Jan Haul of Hamburg, Germany for his WinSCP link.
Thanks to Brad Erdman, Institute for Advanced Computer Studies, University of Maryland, USA
for his confirmation of cygwin-sshd working on Windows Server 2003
Thanks to Richard Goodman of UK  for his tips on the order of CYGWIN variable.
You can also use sshwindows from Sourceforge to install ssh and sshd on Windows without the full cygwin package.
http://www.lns.cornell.edu/public/COMP/cygwin/cyg_inst_net.html is the link to install Cygwin with Xfree86. Thanks to Richard Ward fo this link.

Disclaimer

© 2003-2006 Nicholas Fong

HTML Editor used to generate this page is Nvu.

Last revised:  March 19, 2006