The Authentication Page (Advanced Site Settings dialog)

In SSH, it is in principle possible to establish a connection without using SSH’s mechanisms to identify or prove who you are to the server. Some servers may simply require no authentication whatsoever.

By default, WinSCP assumes the server requires authentication (we’ve never heard of one that doesn’t), and thus must start this process with a username. If you find you are getting username prompts that you cannot answer, you could try enabling Bypass authentication entirely. However, most SSH servers will reject this.

This is not the option you want if you have a username and just want WinSCP to remember it; It’s also probably not what if you’re trying to set up passwordless login to a mainstream SSH server; depending on the server, you probably wanted public-key authentication or perhaps GSSAPI authentication. (These are still forms of authentication, even if you don’t have to interact with them.)1

‘Keyboard-interactive’ is a flexible authentication method using an arbitrary sequence of requests and responses; so it is not only useful for challenge/response mechanisms such as S/Key, but it can also be used for (for example) asking the user for a new password when the old one has expired.1

WinSCP leaves this option enabled by default, but supplies a switch to turn it off in case you should have trouble with it. If your server uses keyboard-interactive authentication to ask for your password only, and you wish to allow WinSCP to reply with password entered on Login dialog, tick Respond with password to the first prompt.

Use the Private key file box to specify local path to your private key file if you are going to use public key authentication. The file must be in PuTTY format. If the private key is passphrase-protected, you will be prompted for passphrase once the authentication begins.

You can use Pageant so that you do not need to explicitly configure a key here.

If a private key file is specified here with Pageant running, WinSCP will first try asking Pageant to authenticate with that key, and ignore any other keys Pageant may have. If that fails, WinSCP will ask for a passphrase as normal. You can also specify a public key file in this case (in RFC 4716 or OpenSSH format), as that’s sufficient to identify the key to Pageant, but of course if Pageant isn’t present WinSCP can’t fall back to using this file itself.

The passphrase cannot be entered in advance in session settings and thus it cannot be saved to site. If you need to login to server automatically without prompt, generate a key without passphrase. Use this method carefully and only under special circumstances.

If you select a key file in a different format (OpenSSH or ssh.com), WinSCP will offer you to convert the key to PuTTY format. If certificate file with the same name2 is found, it will be automatically added to the converted key file.

Private Key Tools

Use the button Display Public Key to display public key in a format suitable for pasting into OpenSSH authorized_keys file.

The command Tools > Generate New Key Pair with PuTTYgen starts PuTTYgen, in which you can generate a new private key pair. After you save your new key pair in PuTTYgen, WinSCP will detect it and automatically insert a path to the new key file into Private key file box.

Use the command Tools > Install Public Key into Server to install a public key into OpenSSH server. You will be prompted to select key pair to install. You will need to authenticate to the server to install the key. You can authenticate using a password or using another key (select it in Private key file box). After installing succeeds, the new private key will be inserted into the Private key file box.

In some environments, user authentication keys can be signed in turn by a certifying authority (CA for short), and user accounts on an SSH server can be configured to automatically trust any key that’s certified by the right signature. This is optional. If you don’t know you need it, you can leave this blank.

This can be a convenient setup if you have a very large number of servers. When you change your key pair, you might otherwise have to edit the authorized_keys file (in case of OpenSSH) on every server individually, to make them all accept the new key. But if instead you configure all those servers once to accept keys signed as yours by a CA, then when you change your public key, all you have to do is to get the new key certified by the same CA as before, and then all your servers will automatically accept it without needing individual reconfiguration.

One way to use a certificate is to incorporate it into your private key file. You can do that using PuTTYgen. But another approach is to tell WinSCP itself where to find the public certificate file, and then it will automatically present that certificate when authenticating with the corresponding private key.

To do this, enter the pathname of the certificate file into the Certificate to use with the private key file selector.

When this setting is configured, WinSCP will honour it no matter whether the private key is found in a file, or loaded into Pageant.1

GSSAPI credential delegation is a mechanism for passing on your Kerberos (or other) identity to the session on the SSH server. If you enable this option, then not only will WinSCP be able to log in automatically to a server that accepts your Kerberos credentials, but also you will be able to connect out from that server to other Kerberos-supporting services and use the same credentials just as automatically.

This option is the Kerberos analogue of SSH agent forwarding.

Note that, like SSH agent forwarding, there is a security implication in the use of this option: the administrator of the server you connect to, or anyone else who has cracked the administrator account on that server, could fake your identity when connecting to further Kerberos-supporting services. However, Kerberos sites are typically run by a central authority, so the administrator of one server is likely to already have access to the other services too; so this would typically be less of a risk than SSH agent forwarding.1

Read more about Login dialog and Advanced Site Settings dialog.