Automatic service management and Windows Firewall rules

- Service auto-start and start now happen automatically (no switches)
- Windows Firewall rules created automatically per profile (Domain, Private, Public)
- Dynamic profile enumeration using [Microsoft.PowerShell.Cmdletization.GeneratedTypes.NetSecurity.Profile]
- Added -SSHPort parameter for custom port (default: 22)
- Idempotent firewall rule creation with update support
- Removed -EnableService and -StartService switches (now automatic)

README.md

@@ -44,8 +44,7 @@ cd Invoke-OpenSSHConfiguration
 | `-CAInclusionExpression` | String | Regex to filter CAs by Subject or Thumbprint (include matches) |
 | `-CAExclusionExpression` | String | Regex to filter CAs by Subject or Thumbprint (exclude matches) |
 | `-SFTPSubsystemPath` | String | Custom SFTP server path (default: `sftp-server.exe`, configured automatically) |
-| `-EnableService` | Switch | Set sshd service to automatic startup |
-| `-StartService` | Switch | Start sshd service if not running |
+| `-SSHPort` | Int | SSH port number (default: `22`, used for firewall rules) |
 | `-LogDirectory` | DirectoryInfo | Custom log directory path |
 | `-ContinueOnError` | Switch | Continue execution on non-fatal errors |
 
@@ -105,8 +104,6 @@ This exports all unexpired Root and Intermediate CA certificates from the Window
     -EnableCertificateAuthentication `
     -EnablePubkeyAuthentication `
     -DisablePasswordAuthentication `
-    -EnableService `
-    -StartService `
     -LogDirectory 'C:\Logs\OpenSSH'
 ```
 
@@ -115,9 +112,7 @@ This exports all unexpired Root and Intermediate CA certificates from the Window
 ```powershell
 .\Invoke-OpenSSHConfiguration.ps1 -Mode Server `
     -EnablePubkeyAuthentication `
-    -DisablePasswordAuthentication `
-    -EnableService `
-    -StartService
+    -DisablePasswordAuthentication
 ```
 
 ### Selective CA Trust (Regex Filtering)
@@ -203,14 +198,12 @@ The toolkit includes reusable functions in `Toolkit\Functions\`:
 ### Current Gaps (Not Yet Implemented)
 
 **Server Configuration**
-- Port configuration (change from default 22)
 - User/group restrictions (AllowUsers, AllowGroups)
 - SSH banner/MOTD configuration
 - ListenAddress binding to specific interfaces
 
 **Security**
 - No automatic ACL/permission setting on generated keys
-- No Windows Firewall rule creation
 
 **Management**
 - No uninstall/rollback capability
@@ -218,7 +211,9 @@ The toolkit includes reusable functions in `Toolkit\Functions\`:
 
 ### Features Implemented
 - ✅ Password authentication control (`-DisablePasswordAuthentication`)
-- ✅ Service auto-start (`-EnableService`, `-StartService`)
+- ✅ Service auto-start and start (automatic, no switches needed)
+- ✅ Windows Firewall rules (automatic per-profile: Domain, Private, Public)
+- ✅ Port configuration (`-SSHPort`, default 22)
 - ✅ Config backup before modification (automatic timestamped backups)
 - ✅ Config validation (`sshd -t`) before restart with automatic rollback
 - ✅ CA selection via regex (`-CAInclusionExpression`, `-CAExclusionExpression`)