ssh — Open a secure shell on a remote host or run a remote command across all 5 shells
Equivalents in every shell
Bashunix
ssh user@hostZshunix
ssh user@hostFishunix
ssh user@hostPowerShellwindows
ssh user@hostOpenSSH Client ships on by default in Windows 10 (1809+), Windows 11, and Windows Server 2019+. On older versions install via Settings → Apps → Optional features.
cmd.exewindows
ssh user@hostSame OpenSSH Client as PowerShell — runs from cmd.exe identically once the optional feature is installed.
Worked examples
Connect on a non-default port
Bash
ssh -p 2222 user@hostFish
ssh -p 2222 user@hostPowerShell
ssh -p 2222 user@hostcmd.exe
ssh -p 2222 user@hostRun one remote command and exit
Bash
ssh user@host "uname -a"Fish
ssh user@host "uname -a"PowerShell
ssh user@host "uname -a"Local port-forward 8080 → remote 80
Bash
ssh -L 8080:localhost:80 user@hostFish
ssh -L 8080:localhost:80 user@hostPowerShell
ssh -L 8080:localhost:80 user@hostGotchas
- On Windows, OpenSSH stores config and keys in `%USERPROFILE%\.ssh\` — not the WSL `~/.ssh`. They are separate trust stores; copy `id_ed25519` between them as needed.
- `StrictHostKeyChecking` defaults to `accept-new` on recent OpenSSH (≥ 7.6) and `ask` on older builds. Scripts that need unattended connections should set `-o StrictHostKeyChecking=accept-new` and a known_hosts file explicitly.
- On Windows the OpenSSH `ssh-agent` runs as a Windows service (Set-Service ssh-agent -StartupType Automatic). Linux/macOS shells start their own per-session agent — different lifecycle, different `SSH_AUTH_SOCK`.
- Public-key permissions matter on Unix: `~/.ssh` must be 700 and `id_ed25519` must be 600 or sshd will refuse the key. On Windows NTFS, the equivalent check is that the key file's ACL must grant access only to the current user.
- `ssh -t` forces TTY allocation for remote commands that need a terminal (vim, top); without it, some commands print 'not a tty' and exit.
WSL & PowerShell Core notes
pwshPowerShell Core does not bundle ssh — it calls the system `ssh.exe`. On Windows that is the OpenSSH Client optional feature; on Linux/macOS pwsh it is `/usr/bin/ssh`. The CLI surface is identical.
WSLWSL runs its own OpenSSH client with a separate `~/.ssh`. To share keys with Windows OpenSSH, either symlink (`ln -s /mnt/c/Users/$USER/.ssh ~/.ssh`) or copy keys over and `chmod 600` them — DrvFs metadata must be enabled for the permission check to pass.