Walkthrough installing Cygwin SSH Daemon on AWS EC2 instances
Mar 30, 2016
One of the challenges we face at Mozilla is supporting Windows in an
organisational environment which is predominantly *nix oriented. Furthermore,
historically our build and test infrastructure has only provided a very limited
ssh daemon, with an antiquated shell, and outdated unix tools.
With the move to hosting Windows environments in AWS EC2, the opportunity arose
to review our current SSH daemon, and see if we couldn’t do something a little
When creating Windows environments in EC2, it is possible to launch a “vanilla”
Windows instance, from an AMI created by Amazon. This instance is based on a
standard installation of a given version of Windows, with a couple of AWS EC2
One of the features of the preinstalled tools, is that they allow you to
specify powershell and/or batch script snippets inside the instance User Data,
that will be executed upon launch.
This makes it quite trivial to customise a Windows environment, by providing
all of the customisation steps as a PowerShell snippet in the instance User
In this Walkthrough, we will set up a Windows 2012 R2 Windows machine, with the
cygwin ssh daemon preinstalled. In order to follow this walkthrough, you will
need an AWS account, and the ability to spawn an instance.
Install AWS CLI
Although all of these steps can be performed via the web console, typically we
would want to automate them. Therefore in this walkthrough, I’m using the AWS
CLI to perform all of the actions, to make it easier should you want to script
any of the setup.
The following command line will find you the latest Windows 2012 R2 stock
image, provided by AWS, in your default region.
Now we can see what the current AMI is, in our default region, with:
Note, the actual AMI provided by AWS changes from week to week, and from region
to region, so don’t be surprised if you get a different result to the one
Create a Security Group
We need our instance to be in a security group that allows us to SSH onto it.
First create a security group:
And then update it to only allow inbound SSH traffic:
Create a unique Client Token
We should create a unique client token that will allow us to make idempotent
requests, should there be any failures. We will also use this as our “name”
for the instance until we get the real instance name back.
Create a dedicated Key Pair
We’ll need to specify a key pair in order to retrieve the Windows Password.
Let’s create a dedicated one just for this instance.
Create custom post-installation script
Typically, you’ll want to customise the cygwin environment, for example:
Changing the bash prompt
Setting vim options
Adding ssh authorized keys
Let’s do this in a post installation bash script, which we can download as
part of the installation.
In order to be able to authenticate with our new key, we’ll need to get
the public part. Note, we could generate separate keys for ssh’ing to
our machine, but we might as well reuse the key we just created.
Create User Data
The AWS Windows
advises us that Windows PowerShell commands can be executed if supplied as part
of the EC2 User Data. We’ll use this userdata to install cygwin and the ssh
daemon from scratch.
Create a file userdata to store the User Data:
Fix SSH key
We need to replace the SSH public key placeholder we just referenced in userdata
with the actual public key
Launch new instance
We’re now finally ready to launch the instance. We can do this with the