Skip to main content

How To Use SSH Keys on Windows Clients (with PuTTY)

How To Use SSH Keys on Windows Clients (with PuTTY)

Using encrypted keys for authentication offers two main benefits. Firstly, it is convenient as you no longer need to enter a password (unless you encrypt your keys with password protection) if you use public/private keys. Secondly, once public/private key pair authentication has been set up on the server, you can disable password authentication completely meaning that without an authorized key you can't gain access - so no more password cracking attempts.

It's a relatively simple process to create a public/private key pair and install them for use on your ssh server.

Step 1: Download and Install PuTTY, PuTTYgen and Pageant

To get started, we'll need to download and install both PuTTY (putty.exe), PuTTYgen (puttygen.exe) and Pageant (pageant.exe). You can find links to each of these at the project's website. However, the easiest way to get both of the necessary programs is by downloading and installing the full .msi package, as pictured below:

 

Step 2: Generate the OpenSSH-compatible Keys with PuTTYgen

  1. Start the PuTTYgen utility, by double-clicking on its .exe file or pressing the Windows key and searching for PuTTYgen
  2. For Type of key to generate, select SSH-2 RSA
  3. In the Number of bits in a generated key field, specify either 2048 or 4096 (increasing the bits makes it harder to crack the key by brute-force methods)
  4. Click the Generate button
  5. Move your mouse pointer around in the blank area of the Key section, below the progress bar (to generate some randomness) until the progress bar is full
  6. A private/ public key pair has now been generated
  7. In the Key comment field, enter any comment you'd like, to help you identify this key pair, later (e.g. your e-mail address; home; office; etc.) -- the key comment is particularly useful in the event you end up creating more than one key pair
  8. Optional: Type a passphrase in the Key passphrase field & re-type the same passphrase in the Confirm passphrase field (if you would like to use your keys for automated processes, however, you should notcreate a passphrase)
  9. Click the Save public key button & choose whatever filename you'd like (some users create a folder in their computer named my_keys)
  10. Click the Save private key button & choose whatever filename you'd like (you can save it in the same location as the public key, but it should be a location that only you can access and that you will NOT lose! If you lose your keys and have disabled username/password logins, you will no longer be able log in!)
  11. Right-click in the text field labeled Public key for pasting into OpenSSH authorized_keys file and choose Select All
  12. Right-click again in the same text field and choose Copy

NOTE: PuTTY and OpenSSH use different formats for public SSH keys. If the SSH Key you copied starts with "---- BEGIN SSH2 PUBLIC KEY ...", it is in the wrong format. Be sure to follow the instructions carefully. Your key should start with "ssh-rsa AAAA ...."

Step 3: Save The Public Key On The Server

Now, you need log into your server via SSH as you normally would using PuTTY and paste the copied public key in the file ~/.ssh/authorized_keys on your server.

If your SSH folder does not yet exist, create it manually:

mkdir ~/.ssh

chmod 0700 ~/.ssh

touch ~/.ssh/authorized_keys

chmod 0644 ~/.ssh/authorized_keys

Paste the SSH public key into your ~/.ssh/authorized_keys file using the command-line text editor of your choice and save it.

Step 4: Create a PuTTY Profile to Save Your Server's Settings

In PuTTY, you can create (and save) profiles for connections to your various SSH servers, so you don't have to remember, and continually re-type, redundant information.

  1. Start PuTTY by double-clicking its executable file or pressing the Windows key and searching for PuTTY
  2. PuTTY's initial window is the Session Category (navigate PuTTY's various categories, along the left-hand side of the window)
  3. In the Host Name field, enter the IP address of your server
  4. Enter the port number in the Port field
  5. Select SSH under Protocol;
  6. Along the left-hand side of the window, select the Data sub-category, under Connection;
  7. Specify the username that you plan on using, when logging in to the SSH server, and whose profile you're saving, in the Auto-login username field;
  8. Expand the SSH sub-category, under Connection;
  9. Highlight the Auth sub-category and click the Browse button, on the right-hand side of the PuTTY window;
  10. Browse your file system and select your previously-created private key;
  11. Return to the Session Category and enter a name for this profile in theSaved Sessions field, e.g. user@12.34.56.78 or user@hostname;
  12. Click the Save button for the Load, Save or Delete a stored session

Now you can log in to user@12.34.56.78 and you will not be prompted for a password. However, if you had set a passphrase on your public key, you will be asked to enter the passphrase at that time (and every time you log in, in the future).

Step 5 (Optional): Disable the Password for Root Login via SSH

Once you have copied your SSH keys unto your server and ensured that you can log in with the SSH keys alone, you can restrict the root login to only be permitted via SSH keys.

In order to do this, open up the /etc/ssh/sshd_config file:

Within that file, find the line that includes PermitRootLogin and modify it to ensure that users can only connect with their SSH key:

PermitRootLogin without-password

Alternatively, if you have configured sudo on your server and are configuring SSH keys for a sudo user, you can disable direct root access altogether:

PermitRootLogin no

 

Related articles