Install OpenSSH Server during Windows setup

Install it at first logon from the Win32-OpenSSH zip on the seed ISO via
Configure-Windows.ps1 -InstallOpenSSH, replacing the manual 05/06 batch
files. The administrator public key now comes from the host
(SSH_PUBLIC_KEY_FILE or ~/.ssh/id_*.pub) instead of being hardcoded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

seediso/windows11/Configure-Windows.ps1

@@ -3,6 +3,7 @@ param(
     [switch]$EnableAutomaticLogon,
     [switch]$DisableAutoUpdate,
     [switch]$CopyInstallers,
+    [switch]$InstallOpenSSH,
     [switch]$NoPause
 )
 
@@ -151,11 +152,52 @@ function Copy-InstallerScripts {
     $target = Join-Path ([Environment]::GetFolderPath('Desktop')) 'Installers'
     New-Item -ItemType Directory -Path $target -Force | Out-Null
     Copy-Item -Path $scripts.FullName -Destination $target -Force
+}
 
-    # 05-Install-OpenSSH-Admin.bat installs from this zip when it is present.
-    $zips = @(Get-ChildItem -Path $PSScriptRoot -Filter 'OpenSSH-*.zip' -File)
-    if ($zips.Count -gt 0) {
-        Copy-Item -Path $zips.FullName -Destination $target -Force
+# Installs the OpenSSH Server from the Win32-OpenSSH zip on the answer media,
+# so no Windows Update download is needed.
+function Install-OpenSSHServer {
+    $zip = Get-ChildItem -Path $PSScriptRoot -Filter 'OpenSSH-*.zip' -File |
+        Select-Object -First 1
+    if (-not $zip) {
+        throw "No OpenSSH-*.zip was found next to $PSCommandPath."
+    }
+
+    $installDir = Join-Path $env:ProgramFiles 'OpenSSH'
+    if (-not (Test-Path -LiteralPath (Join-Path $installDir 'install-sshd.ps1'))) {
+        $temp = Join-Path $env:TEMP 'openssh'
+        Remove-Item $temp -Recurse -Force -ErrorAction SilentlyContinue
+        Expand-Archive -LiteralPath $zip.FullName -DestinationPath $temp
+        Remove-Item $installDir -Recurse -Force -ErrorAction SilentlyContinue
+        Move-Item (Get-ChildItem $temp -Directory | Select-Object -First 1).FullName $installDir
+        Remove-Item $temp -Recurse -Force
+    }
+
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $installDir 'install-sshd.ps1') | Out-Host
+    if ($LASTEXITCODE -ne 0) {
+        throw "install-sshd.ps1 failed (exit code $LASTEXITCODE)."
+    }
+
+    Set-Service -Name sshd -StartupType Automatic
+    Start-Service -Name sshd
+
+    if (-not (Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue)) {
+        New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' `
+            -Direction Inbound -Action Allow -Protocol TCP -LocalPort 22 -Profile Private, Public | Out-Null
+    }
+
+    # build-seed.sh puts the host's public key on the media; without it, only
+    # password login works.
+    $key = Join-Path $PSScriptRoot 'authorized_keys'
+    if (-not (Test-Path -LiteralPath $key)) {
+        Write-Warning "No authorized_keys was found next to $PSCommandPath; skipping the administrator key."
+        return
+    }
+    $keyFile = Join-Path $env:ProgramData 'ssh\administrators_authorized_keys'
+    Copy-Item -LiteralPath $key -Destination $keyFile -Force
+    & icacls.exe $keyFile /inheritance:r /grant '*S-1-5-32-544:F' /grant '*S-1-5-18:F' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "icacls failed (exit code $LASTEXITCODE)."
     }
 }
 
@@ -173,6 +215,9 @@ try {
     if ($CopyInstallers) {
         Copy-InstallerScripts
     }
+    if ($InstallOpenSSH) {
+        Install-OpenSSHServer
+    }
     Write-Host 'Done.' -ForegroundColor Green
 }
 catch {