$ProgressPreference='SilentlyContinue'; $ErrorActionPreference='Stop'
$url='https://github.com/PowerShell/Win32-OpenSSH/releases/download/10.4.0.0p1-Preview/OpenSSH-Win64-v10.4.0.0.msi'
$sha='788d8643464a01eb63640a2fd746f9ed23d106b5a901a35f88dc8cd40e446ac9'
$m="$env:TEMP\OpenSSH-Win64-v10.4.0.0.msi"
"== 1. download"; Invoke-WebRequest $url -OutFile $m -UseBasicParsing
"== 2. verify"; $h=(Get-FileHash $m -Algorithm SHA256).Hash.ToLower(); $sig=Get-AuthenticodeSignature $m; "sha256 $h"; "signature $($sig.Status) / $($sig.SignerCertificate.Subject)"
if($h -ne $sha -or $sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'O=Microsoft Corporation'){ "STOP: hash or signature check failed, nothing installed"; return }
"== 3. install"; Start-Process msiexec.exe -Wait -ArgumentList "/i `"$m`" /qn /norestart"
"== 4. sshd"; Set-Service sshd -StartupType Automatic; Start-Service sshd
"== 5. firewall (tailnet only)"; Get-NetFirewallRule -EA SilentlyContinue | ?{ $_.DisplayName -match 'OpenSSH' -and $_.Direction -eq 'Inbound' } | Disable-NetFirewallRule
Remove-NetFirewallRule -Name 'PodoAI-SSH-Tailnet','PodoAI-ICMP-Tailnet' -EA SilentlyContinue
New-NetFirewallRule -Name 'PodoAI-SSH-Tailnet' -DisplayName 'PodoAI SSH tailnet only' -Direction Inbound -Protocol TCP -LocalPort 22 -RemoteAddress 100.64.0.0/10 -Action Allow -Profile Any | Out-Null
New-NetFirewallRule -Name 'PodoAI-ICMP-Tailnet' -DisplayName 'PodoAI ping tailnet only' -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress 100.64.0.0/10 -Action Allow -Profile Any | Out-Null
"== 6. key"; $k='C:\ProgramData\ssh\administrators_authorized_keys'; if(-not (Test-Path $k)){ New-Item -ItemType File -Force $k | Out-Null }
if(-not (Select-String -Path $k -SimpleMatch 'AAAAC3NzaC1lZDI1NTE5AAAAIGuo2SMZMgfBmG9klbsGex4HwOQy7vp2QOiPjq8RsjjC' -Quiet)){ Add-Content -Path $k -Value 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGuo2SMZMgfBmG9klbsGex4HwOQy7vp2QOiPjq8RsjjC podoai-ops' }
icacls.exe $k /inheritance:r /grant 'Administrators:F' /grant 'SYSTEM:F' | Out-Null
Restart-Service sshd
"== 7. result"; Get-Service sshd; hostname; whoami