Forum » Feature Requests »

Post a reply

Options
Add an Attachment

If you do not want to add an Attachment to your Post, please leave the Fields blank.

(maximum 10 MB; please compress large files; only common media, archive, text and programming file formats are allowed)

Options

Topic review

jimbo8098

I'm not trying to import the file, more accurately I am expecting it to work similarly to the sftp command Windows now deploys alongside OpenSSH. When I use sftp, I get logged right in: 

PS C:\Users\JimSpeir> sftp <redacted>

sftp>


However, if I were to remove the config I listed before, I get a "too many authentication failures" error because sftp tries to log in with all of my SSH keys instead of just the specific one as before.

As for WinSCP, if I remove the public key from the list, it gets the same "too many authentication failures" error. Here's the logs so you can see what it's doing, which is just rotating through SSH keys on my ssh-agent: 

. 2026-07-03 18:45:48.051 Looking up host "<redacted>" for SSH connection

. 2026-07-03 18:45:48.132 Connecting to <redacted> port 22

. 2026-07-03 18:45:48.196 Connected to <redacted> (from 192.168.69.7:61537)

. 2026-07-03 18:45:48.263 We claim version: SSH-2.0-WinSCP_release_6.6.2

. 2026-07-03 18:45:48.264 Connected to <redacted> (from 192.168.69.7:61537)

. 2026-07-03 18:45:48.332 Remote version: SSH-2.0-AWS_SFTP_1.2

. 2026-07-03 18:45:48.333 Using SSH protocol version 2

. 2026-07-03 18:45:48.334 Have a known host key of type rsa2

. 2026-07-03 18:45:48.404 Doing ECDH key exchange with curve nistp256, using hash SHA-256

. 2026-07-03 18:45:48.514 Host key fingerprint is:

. 2026-07-03 18:45:48.514 ssh-rsa 2048 SHA256:7xHP0y0BdMjwpB4IWCQsm9WkEseCUkfT3GHVFx8Pzec

. 2026-07-03 18:45:48.524 Host key matches cached key

. 2026-07-03 18:45:48.525 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] outbound encryption

. 2026-07-03 18:45:48.525 Initialised HMAC-SHA-256 outbound MAC algorithm

. 2026-07-03 18:45:48.525 Initialised AES-256 SDCTR (AES-NI accelerated) [aes256-ctr] inbound encryption

. 2026-07-03 18:45:48.525 Initialised HMAC-SHA-256 inbound MAC algorithm

. 2026-07-03 18:45:48.584 Agent is running. Requesting keys.

. 2026-07-03 18:45:48.606 Agent has 21 SSH-2 keys

! 2026-07-03 18:45:48.606 Using username "<redacted>>".

. 2026-07-03 18:45:48.720 Server offered these authentication methods: publickey

. 2026-07-03 18:45:48.721 Trying Agent key #0

. 2026-07-03 18:45:48.881 Server refused our key

. 2026-07-03 18:45:48.881 Server offered these authentication methods: publickey

. 2026-07-03 18:45:48.881 Trying Agent key #1

. 2026-07-03 18:45:48.960 Server refused our key

. 2026-07-03 18:45:48.960 Server offered these authentication methods: publickey

. 2026-07-03 18:45:48.960 Trying Agent key #2

. 2026-07-03 18:45:49.052 Server refused our key

. 2026-07-03 18:45:49.052 Server offered these authentication methods: publickey

. 2026-07-03 18:45:49.052 Trying Agent key #3

. 2026-07-03 18:45:49.140 Server refused our key

. 2026-07-03 18:45:49.140 Server offered these authentication methods: publickey

. 2026-07-03 18:45:49.140 Trying Agent key #4

. 2026-07-03 18:45:49.257 Server refused our key

. 2026-07-03 18:45:49.257 Server offered these authentication methods: publickey

. 2026-07-03 18:45:49.257 Trying Agent key #5

. 2026-07-03 18:45:49.341 Remote side sent disconnect message type 2 (protocol error): "Too many authentication failures"

* 2026-07-03 18:45:49.424 (EFatal) Remote side sent disconnect message

* 2026-07-03 18:45:49.424 type 2 (protocol error):

* 2026-07-03 18:45:49.424 "Too many authentication failures"

* 2026-07-03 18:45:49.424 Authentication log (see session log for details):

* 2026-07-03 18:45:49.424 Using username "<redacted>>".

* 2026-07-03 18:45:49.424 

* 2026-07-03 18:45:49.424 Authentication failed.


But if I define the public key in the private key field, the exact private key is used to log into the SFTP server as if -i was used. The ssh-agent handles the rest thanks to your recent changes.

I am basically asking you to support the Match directive since if WinSCP supported that, the public key is defined in one place. My personal reason is pure convenience, 1Password can be setup to automatically set these directives using the "Bookmarks" feature since this feature just writes .ssh config in the .ssh/1Password/config directory.
martin

@jimbo8098: I'm not sure I understand. Did you (try to) import that config file to WinSCP? Or are you just showing it as an example of working setup for OpenSSH? WinSCP does not support Match directive. Please post a session log file.
jimbo8098

With OpenSSH agent support in the new RC, I had issues getting WinSCP to use a specific key. I was able to provide the 1Password-provided key in the private key field as a public key but 1Password had already had this configured within the .ssh/config: 
# 1Password Item: <item name>
 
Match Host <host> User <user>
  IdentitiesOnly yes
  IdentityFile ~/.ssh/1Password/<pubkey>

Without defining the public key in the private key box in SSH > Authentication, at least 17 keys were attempted. If, on the other hand, I were to use Windows-shipped SFTP command it obeyed .ssh/config perfectly.
martin

Re: 5.20.2 beta works great but...

@Guest: That's quite difficult to interpret/parse. Btw, why aren't you using ProxyJump?
Guest

5.20.2 beta works great but...

It would be better to import ProxyCommand as tunneling configurations as well.

For example: 
Host Aliyun-Windows
  HostName 47.94.59.xxx
  User Administrator
  PasswordAuthentication no
 
Host GXKJ-a100
  HostName 12.2.20.xxx
  User kdyhn_gxkj
  ProxyCommand ssh -W %h:%p Aliyun-Windows
martin

@EVAndrey and @urichalex: Bug 2053 is included in WinSCP 5.20 beta.
urichalex

Me too please.
EVAndrey

Hi @martin! Send me a link to version 6, please.
EVAndrey

Re: download link

Hi! Send me the link too please.
martin

Re: Tested 5.20 beta

@Gunnar: Thanks for your tests.

Regarding the import from ~: I have fixed this:
Issue 2053 – Support importing key files that are specified using home ~ prefix from OpenSSH config file

Can you send me an email, so I can send you back a development version of WinSCP for testing? Please include a link back to this topic in your email. Also note in this topic that you have sent the email. Thanks.

You will find my address (if you log in) in my forum profile.

Regarding the conversion to ppk: That already works. It's probably %HOMEPATH% that breaks it. And as it's not allowed in OpenSSH config file anyway, no point "fixing" it. With the original ~ and the above fix, it should work now too.
Gunnar

Tested 5.20 beta

Hello,

while setting up my new developer notebook I've just stumbled upon your new support for .ssh/config, which would be great for me, since I have lots of keys and connections configured there.

So I tested it via the current 5.20 beta, here are the results :-)

  • I could import the connections.
  • The connections configurations contain ~\.ssh\keyfilename, WinSCP could not read a keyfile, I changed it to %HOMEPATH%\.ssh\keyfilename in one connection, keyfile could be read.
  • WinSCP expects ppk keyfiles

So regarding my requirements it would be great if

  • keyfile references link to windows user path\.ssh\keyfilename (I wonder if this would have been the case if I installed just for the current user and not for all users?).
  • Importing could kind of "batch-create" ppk files for all keyfiles.

Best regards,
Gunnar
martin

Re: download link

@manivela: I'm sending you an email with a development version of WinSCP to the address you have used to register on this forum.
manivela

download link

@martin: Is it possible to download this version yet? I'd like to try this as well.
martin

@gleynes: The OpenSSH import is implemented in upcoming WinSCP 6.0. I'm sending you an email with a development version of WinSCP to the address you have used to register on this forum.
gleynes@gmail.com

I think that importing the ssh config file would be a very fundamental and important feature for any serious user, developers, and testers.

This comment is very good, but I don't know about the "wildcard" part. I would simply want to see an entry for each server that is in my ssh config file. I would not want to be be able to edit my ssh config from the WinSCP application to avoid unanticipated corruption.

ppr wrote:

Parsing of wildcards would be also helpful. For me it would be ideal if it would work like this:

  • global configuration – location of ssh config file, ~/.ssh/config by default
  • option to use it as defaults when some value is not explicitly configured in WinSCP
  • matching of entered hostname to config entries, with wildcard support
  • support for things that WinSCP can easily work with, i.e. HostName, Port, User, IdentityFile, ServerAliveInterval + ServerAliveCountMax, ProxyJump

I have the login information and key location for each of my servers in my ssh config, and convenient names set up for each. So, I pretty much live by this file, because it's a standard way to specify SSH connections.

Under the menu Remote I would want to see a list of connections that are imported from ~/.ssh/config (or the path specified by a system variable?).

Caveat: I just downloaded WinSCP and I don't think I've used it in the past. So, I may be off on where the menu belongs. I was surprised when this feature didn't exist and I came here to see what people have been saying. I've used FileZilla in the past, but I'm giving WinSCP a shot for various reasons. Thanks!

EDIT: It seems to have been implemented, although I didn't find documentation by searching and I can't find a way to import this file in the menus.
vmiheer

Would be great to have ssh config file support.
ppr

Well, who in their right mind configures a dozen of identical servers by hand when they can just write web-worker-* and then use just a hostname ;)

But what I wrote is more like a layer of defaults, while the OP wanted to treat .ssh/config as a source of easily accessible configurations, more like current import functionality.
martin

@ppr: That's what I feared. In the end, people will ask for a full support :)
ppr

Parsing of wildcards would be also helpful. For me it would be ideal if it would work like this:

  • global configuration – location of ssh config file, ~/.ssh/config by default
  • option to use it as defaults when some value is not explicitly configured in WinSCP
  • matching of entered hostname to config entries, with wildcard support
  • support for things that WinSCP can easily work with, i.e. HostName, Port, User, IdentityFile, ServerAliveInterval + ServerAliveCountMax, ProxyJump
shawnz

Thanks for the consideration!
shawnz

I think it would be fine to just ignore any sections that use wildcards. Or maybe options in wildcard sections could affect all imported hosts which match, and ignored otherwise.
martin

As above: How exactly do you imagine WinSCP should work with the OpenSSH config?

The config file is not a site manager (while some use like this). It's a pattern matching configuration file.
shawnz

I think it would be helpful if it were supported as an import source in the "Import sites" dialog box. Of course not all OpenSSH options could be supported, but at least the HostName, Port and User settings could be processed and imported.

However this would still involve a syncing process so maybe it doesn't meet the other poster's needs. But it would be fine for me.
martin

How exactly do you imagine WinSCP should work with the OpenSSH config?
jpjodoin

That would be very useful for me also. My openssh config file describe all the servers I need to access on a regular basic (including jumpbox), so it would be awesome if I didn't have to worry about keeping this information in sync with my WinSCP configuration when I need to fetch/upload a file on a machine.
abareptia

Re: support .ssh/config

I will be good have something like this setup. As we also use git and like to use config file to manage host.
martin

Re: support .ssh/config

Thanks for your suggestion.
We will see, if more people ask for this.
bunam

Support .ssh/config

Hello,

As i suppose we use more Git for Windows or other tooling Ubuntu from the market, it could be cool to have a folder "ssh config" that will be automatically populated by the content of the file. Direct editing should be nice but later?

Also if I have a host named srv-ansible the URL like sftp://srv-ansible/ should go to the right server, with the good user name, using the good id file, like OpenSSH would do ;)

.ssh/config 
...
Host ansible srv-ansible
 User ebt
 HostName  172.16.238.120
...

Thank you for having taken the time to read.

Documentation

Support

Associations

Follow Us