Configuration of the Windows Server 2025 SSH Node

[dmatej]

For testing of the #25291 I needed some test environment, as I use Linux and GitHub Actions too don't support TestContainers with Windows containers. So these tests have to be done manually.

Generate the authentication key without a passphrase on Linux host:

ssh-keygen -b 4096 -t rsa -f /home/${USER}/.ssh/id_rsa_nopassphrase -q -N ""

Enable Ping on Windows

https://www.rootusers.com/how-to-enable-ping-in-windows-server-2022-firewall/

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

Enable SSH on Windows

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui&pivots=windows-server-2025

(New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

• must return true

Start the sshd service on Windows

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
} else {
    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
}

Set the sshd service to be started automatically on Windows

Get-Service -Name sshd | Set-Service -StartupType Automatic

Now start the sshd service on Windows

Start-Service sshd
ssh-keygen -t ecdsa
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Program "C:\Windows\System32\OpenSSH\sshd.exe"

Add the public key to Windows

Create the authorized keys file in C:\ProgramData\ssh\administrators_authorized_keys , add the pub key from the admin server /home/${USER}/.ssh/id_rsa_nopassphrase.pub and fix its security access
https://serverfault.com/a/1042829/180132

$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, $false)
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRule($systemRule)
$acl | Set-Acl

Try to Connect from the domain server to the node server

ssh -l vboxuser -vvvvv -o PasswordAuthentication=no -i /home/dmatej/.ssh/id_rsa_nopassphrase 192.168.56.101
sshpass -P "passphrase" -p '' ssh -o PasswordAuthentication=no -i /home/dmatej/.ssh/id_rsa_nopassphrase [email protected]

Install JDK21 to Windows

Manually download Temurin JDK21 for Windows and follow the installer.

Configure Firewall

New-NetFirewallRule -DisplayName "GlassFish HTTP Port 28080" -Direction Inbound -Protocol TCP -LocalPort 28080 -Action Allow
New-NetFirewallRule -DisplayName "GlassFish Admin Port 24848" -Direction Inbound -Protocol TCP -LocalPort 24848 -Action Allow
New-NetFirewallRule -DisplayName "GlassFish JMS Port 27676" -Direction Inbound -Protocol TCP -LocalPort 27676 -Action Allow

Install GlassFish to the DAS host on Linux

cd /app/appservers
unzip glassfish....zip
/app/appservers/glassfish7/bin/asadmin start-domain
/app/appservers/glassfish7/bin/asadmin change-admin-password
/app/appservers/glassfish7/bin/asadmin enable-secure-admin
/app/appservers/glassfish7/bin/asadmin restart-domain

Create Node, Cluster and Instances

Note: the vboxuser is created automatically when you install Windows Server 2025 to VirtualBox.

/app/appservers/glassfish7/bin/asadmin --user admin create-node-ssh --nodehost 192.168.56.101 --installdir '/Users/vboxuser/glassfish7' --sshuser vboxuser --sshkeyfile /home/dmatej/.ssh/id_rsa_nopassphrase --install true win2025
/app/appservers/glassfish7/bin/asadmin --user admin create-cluster ClusterOne
/app/appservers/glassfish7/bin/asadmin --user admin create-instance --cluster ClusterOne --node win2025 InstanceWin2025
/app/appservers/glassfish7/bin/asadmin --user admin create-instance --cluster ClusterOne --node localhost-domain1 InstanceLin2025
/app/appservers/glassfish7/bin/asadmin --user admin start-cluster ClusterOne

THEN

• Watch logs, visit Admin UI and check if everything works.
• If DAS cannot resolve state of the SSH node, the most probable issue is the host resolution and port accessibility. You can do some experiments with VirtualBox networking.