Windows OpenSSH 免交互（密码）操作

Overview

Enable non-interactive SSH operations against remote servers from Windows using only the
OS-bundled OpenSSH client. The Windows port of ssh.exe/scp.exe/sftp.exe does not read
the password from a redirected stdin pipe, so this skill uses OpenSSH's built-in
SSH_ASKPASS mechanism instead: a small helper (a temp .cmd askpass generated at runtime)
prints the password from the SSH_PASS environment variable, and SSH_ASKPASS_REQUIRE=force makes
OpenSSH call it for the password. This authenticates without sshpass, plink, PuTTY, or WSL.

Three wrapped operations are provided:
- Run a remote command — scripts/ssh_exec.ps1
- Transfer files (upload/download, recursive) — scripts/ssh_scp.ps1
- SFTP batch operations — scripts/ssh_sftp.ps1

For the underlying mechanism, options, security notes, and troubleshooting, load
references/ssh_windows.md when needed.

When to Use

Use this skill when the user asks to:
- SSH into a Linux/Unix server from Windows and run one or more commands non-interactively.
- Upload or download files/directories over SSH without an interactive prompt.
- Perform SFTP operations (put/get/mkdir/ls/rm) in batch, automated fashion.
- Automate remote server administration from a Windows host using built-in tooling only.

Do NOT use for: key-based auth workflows (no extra tooling needed — call ssh.exe directly
with -i), or when a third-party SSH tool (PuTTY/plink) is explicitly preferred.

Prerequisites

• Windows 10/11 or Windows Server 2019+ with the OpenSSH Client feature enabled.
  Verify with Get-Command ssh.exe; enable if missing:
  Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0 (run as Administrator).
• The target server must accept password (or keyboard-interactive) authentication.
• The scripts are PowerShell (.ps1) and must be run via the PowerShell tool or
  powershell -NoProfile -File <script> ....

Workflow

1. Run a remote command

Invoke scripts/ssh_exec.ps1. Prefer supplying the password via the SSH_PASS environment
variable (set it in the PowerShell session before the call) so it never appears in the
powershell.exe command line. Pass -Password only when the env var is unavailable.

$env:SSH_PASS = 'S3cret'
powershell -File scripts/ssh_exec.ps1 -HostName 192.168.1.10 -User admin `
    -Command "uname -a; uptime; df -h" -TimeoutSec 60

Key parameters: -HostName, -User, -Command (mandatory); -Port (default 22),
-TimeoutSec, -Insecure (skip host-key checking — trusted networks only),
-Options (extra raw -o options, e.g. "-o ConnectTimeout=10").

2. Transfer files

Invoke scripts/ssh_scp.ps1 with -Direction up (local→remote) or down (remote→local).
Add -Recursive to copy directories.

# upload
powershell -File scripts/ssh_scp.ps1 -HostName 192.168.1.10 -User admin `
    -LocalPath ./app.tar.gz -RemotePath /tmp/ -Direction up

# download a directory recursively
powershell -File scripts/ssh_scp.ps1 -HostName 192.168.1.10 -User admin `
    -LocalPath ./logs -RemotePath /var/log/app -Direction down -Recursive

Note: scp uses the uppercase -P port flag internally (ssh uses lowercase -p); the
script handles this, so just pass -Port.

3. SFTP batch operations

Invoke scripts/ssh_sftp.ps1. Supply commands via -BatchCommands (a single string;
commands separated by newlines or ;, and bye is appended automatically) or -BatchFile
(path to an existing SFTP script).

# -BatchCommands is ONE string split on newlines/semicolons. Do NOT pass a PowerShell array
# to `powershell -File` — arrays get flattened and mis-bind elements to other parameters.
powershell -File scripts/ssh_sftp.ps1 -HostName 192.168.1.10 -User admin `
    -BatchCommands "mkdir /tmp/deploy; put ./app.tar.gz /tmp/deploy/; ls /tmp/deploy; bye"

Reusable Resources

• scripts/ssh_exec.ps1 — non-interactive remote command execution.
• scripts/ssh_scp.ps1 — non-interactive file upload/download (supports -Recursive).
• scripts/ssh_sftp.ps1 — non-interactive SFTP batch mode (inline commands or batch file).
• references/ssh_windows.md — mechanism explanation, option reference, security guidance,
  and troubleshooting. Load when diagnosing failures or explaining behavior.

Notes & Guardrails

• The password is supplied to OpenSSH through the SSH_ASKPASS helper and the SSH_PASS
  environment variable, scoped to the ssh/scp/sftp child process. It does not appear
  in their process argument lists. Still prefer SSH_PASS over -Password to keep it out of
  the powershell.exe command line as well.
• Requires Windows OpenSSH ≥ 8.4 for SSH_ASKPASS_REQUIRE=force (current Windows 10/11 builds
  satisfy this). On older builds set DISPLAY=:0 (already set by the scripts) as the fallback.
• Use -Insecure only on trusted networks (it disables host-key verification).
• After a successful run, Windows OpenSSH may print a benign close - IO is still pending on closed socket notice on stderr during teardown; it does not affect output or the exit code.
• If a server allows it, key-based auth is more robust — out of scope here but trivially
  doable with ssh.exe -i <key>.