@echo off
setlocal
title Install OpenSSH Server from zip

fltmc >nul 2>&1
if errorlevel 1 (
    echo Please right-click this file and choose "Run as administrator".
    pause
    exit /b 1
)

set "ZIP="
for %%Z in ("%~dp0OpenSSH-*.zip") do set "ZIP=%%~fZ"
if not defined ZIP (
    echo No OpenSSH-*.zip was found next to this file.
    pause
    exit /b 1
)

echo Installing the OpenSSH Server from %ZIP%...
if not exist "%ProgramFiles%\OpenSSH\install-sshd.ps1" (
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^
        "$t = Join-Path $env:TEMP 'openssh'; Remove-Item $t -Recurse -Force -ErrorAction SilentlyContinue; Expand-Archive -LiteralPath $env:ZIP -DestinationPath $t; Remove-Item (Join-Path $env:ProgramFiles 'OpenSSH') -Recurse -Force -ErrorAction SilentlyContinue; Move-Item (Get-ChildItem $t -Directory | Select-Object -First 1).FullName (Join-Path $env:ProgramFiles 'OpenSSH'); Remove-Item $t -Recurse -Force"
    if errorlevel 1 (
        echo Extracting the zip failed.
        pause
        exit /b 1
    )
)
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%ProgramFiles%\OpenSSH\install-sshd.ps1"
if errorlevel 1 (
    echo install-sshd.ps1 failed.
    pause
    exit /b 1
)

echo Starting the sshd service...
sc.exe config sshd start= auto
net.exe start sshd >nul 2>&1
sc.exe query sshd | find "RUNNING" >nul
if errorlevel 1 (
    echo The sshd service is not running.
    pause
    exit /b 1
)

netsh.exe advfirewall firewall show rule name="OpenSSH-Server-In-TCP" >nul 2>&1
if errorlevel 1 (
    netsh.exe advfirewall firewall add rule name="OpenSSH-Server-In-TCP" ^
        dir=in action=allow protocol=TCP localport=22 profile=private,public
)

echo Installing the administrator authorized key...
set "KEYFILE=%ProgramData%\ssh\administrators_authorized_keys"
> "%KEYFILE%" echo ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwsF2ZDSHDaXM9BdDq3Vxkp6T+DJEakKaVZQJUEHexS34mbrxYAxmGBUPCrddfE01dS31kGS4XHVBa+wGUYodY+nPwnrfD1Q4phKVSzXr65K1Y/sCcjSiANBPWpv2Xd7IMOfLlrdLtmf5QcKWroIqO2LaIDGECwzUUHrfprgeaF9N0FGcmrgbmm23JUk+f6guRQ4br88L4rWIWEBvL9bTdwErNkdfsYE2F/U8aIFpMcVy2eJIOgy8ZjZvkGdm4r730YkTDL1VmAjiHH3/m2R1EOvwLzFhyWKoa4ULk/IQW+8iNnG42QEcaWRM+hMwlVdnNhPJP6WzS+fAEbibD3zM0q2X/4ex+cXRNOCd2/0KhnD2+3p1BM5QeFTzDappkk8W2meQkDE3hvTjtIQCzygFO6LNWtEEa7BTvvlMqF3CZWh88J9XiP750SjESe3Ge5o9A0T2hcJa+KZ1LxVEmNt4nD6E/OD4EymoaLIJZ1fH5ksSFjHzJ+mJouSVjc/H/VSE= guofang@GUOFANG-OFFICE
icacls.exe "%KEYFILE%" /inheritance:r /grant "*S-1-5-32-544:F" /grant "*S-1-5-18:F" >nul
if errorlevel 1 (
    echo icacls exited with code %ERRORLEVEL%.
    pause
    exit /b 1
)

echo Done. SSH is available on port 22 of this machine.
pause
exit /b 0