How to Connect to WSL via SSH

Currently, if someone wants to connect to WSL from another machine via SSH, there are mainly two solutions:

1. Register port forwarding via netsh.
2. Execute wsl.exe after establishing an SSH connection to Windows.

The first solution will not work if you have not logged in to Windows, and it would require a script to keep WSL running. It also does not track IP changes if the WSL instance reboots. On the other hand, the second solution lacks mouse reporting, as OpenSSH for Windows does not support mouse event reporting yet. This means you will not be able to scroll in the terminal, nor use it to move your cursor in programs such as Vim. In addition, since it is not connected to the WSL instance via SSH, anything that is more than a TTY (e.g. SFTP) does not quite work like a native connection.

Prerequisites

In a perfect solution, the SSH connection should:

1. Support mouse event reporting.
2. Work with other SSH features such as SFTP and port forwarding.
3. Still be reachable after the IP of the WSL instance changes.
4. Be able to connect as long as the Windows machine is turned on.

Analysis

In order to solve requirements 1 and 2, we need to actually connect to the SSH server inside WSL and not just provide a terminal. Since Windows forwards the WSL port to the same port on the Windows host, we can connect to the SSH server in WSL via Windows, using it as an SSH jump host, which satisfies requirement 3. To achieve the last requirement, we need to run a program that keeps the WSL instance open for the duration of the SSH connection. This can be achieved with Task Scheduler or by running a command via the RemoteCommand option. However, using a RemoteCommand would conflict with the previous jump host approach, as an SSH connection cannot both act as a jump host and execute a remote command. Using Task Scheduler means you need to wait until the next time the scheduled task is executed for the VM to be booted.

The Perfect Solution

Before SSH natively provided the jump host feature, jump hosts were usually achieved by specifying a ProxyCommand in the ~/.ssh/config file, where the jump host runs netcat (nc), which opens a TCP connection to the real host and forwards it via stdin and stdout. If we use wsl.exe to execute nc to forward localhost:22, then we are able to achieve an SSH connection satisfying all the above requirements without any major drawbacks.

First, we need to install the OpenSSH server inside the WSL instance and enable it to start when the WSL instance starts.

$ sudo nala install openssh-server
$ sudo systemctl enable --now ssh

We can then configure the SSH server in the WSL instance as usual. If you are new to setting up OpenSSH on a Linux/UNIX server, you can refer to this Ubuntu guide on setting up an SSH server on Linux.

After the SSH server is set up and enabled as a systemd service, in order for wsl.exe to forward the traffic as a ProxyCommand, we also need to install netcat.

$ sudo nala install netcat-openbsd

After the SSH server is installed in the WSL instance, we also need to enable the OpenSSH server on Windows. Unlike Linux/UNIX, authorised keys are managed differently on Windows. If you are not familiar with setting up OpenSSH on Windows, you can check out this guide from Microsoft.

After the OpenSSH server on the Windows host is set up, we can verify the connection with the following command:

$ ssh Windows-Desktop ver

Microsoft Windows [Version 10.0.26100.3915]
Connection to windows-desktop.local closed.

Once we are able to connect to the Windows host via SSH, the last step is to configure the SSH client so that it connects to the WSL VM using wsl.exe and nc as the ProxyCommand.

On the computer where you will use the SSH client, set the SSH config as follows:

Host WSL-Ubuntu
HostName does-not-matter.dummy # Since we are using a proxy command, we can use any value.
Port 22 # Same as above, we can use any value.
User futursolo # This should be your username in WSL
IdentityFile ~/.ssh/id_wsl_ubuntu # This should be the SSH key you set for your WSL VM.
ProxyCommand ssh Windows-Desktop C:\\WINDOWS\\System32\\wsl.exe -- nc localhost 22

Host Windows-Desktop
HostName windows-desktop.local # This should be the IP / hostname of your Windows machine.
Port 22 # This should be the port of the OpenSSH Server on Windows.
User futursolo # This should be your username on Windows.
IdentityFile ~/.ssh/id_windows # This should be the SSH key you set for your Windows PC.

Now we should be able to connect to the WSL machine using the ssh command.

$ ssh WSL-Ubuntu uname -r
5.15.167.4-microsoft-standard-WSL2
Connection to does-not-matter.dummy closed.

Enjoy!