# Kites: enable the built-in OpenSSH server for the automation channel (loopback only, key-only).
$key = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrMSSCCsvXAMKSB7RmBQY4eiRFl0VnBnHDqT1vPnpAK kites-automation'
if (-not (Get-Service sshd -ErrorAction SilentlyContinue)) { Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null }
Start-Service sshd; Stop-Service sshd
$cfg = 'C:\ProgramData\ssh\sshd_config'
$rest = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*(ListenAddress|PasswordAuthentication|PubkeyAuthentication)\s' }
@('ListenAddress 127.0.0.1', 'PasswordAuthentication no', 'PubkeyAuthentication yes') + $rest | Set-Content $cfg -Encoding ascii
$auth = 'C:\ProgramData\ssh\administrators_authorized_keys'
Set-Content $auth $key -Encoding ascii
icacls $auth /inheritance:r /grant '*S-1-5-32-544:F' /grant 'SYSTEM:F' | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Program Files\PowerShell\7\pwsh.exe' -PropertyType String -Force | Out-Null
Set-Service sshd -StartupType Automatic; Start-Service sshd
"sshd: $((Get-Service sshd).Status) on $((Get-NetTCPConnection -LocalPort 22 -State Listen).LocalAddress -join ','), key-only"