Guide

SSH authentication and keys

An SSH server checks two keys. One identifies the server. One identifies you.

DiagramTwo different keys. Do not swap them.

Your key pairPrivate .ppk stays on the PCPublic line goes to the server account

Server host keyShown on first SSH loginCompare the fingerprint, then the client remembers it

Generating a new key pair does not answer a host-key warning. The warning is about the server, not about your login key.

The situation

You want SFTP or SCP without typing a password, or the server refuses passwords. A host-key warning is not fixed by generating a new key pair.

Prerequisites

Permission You may install a public key, or an administrator will.
PuTTYgen The Authentication page can start it with Tools → Generate New Key Pair with PuTTYgen.
A passphrase It cannot be saved in the site. Skip it only for an approved unattended job.

Create a key and use it

Generate on your PC Save the private key in PuTTY format. Selecting an OpenSSH or ssh.com file offers a conversion.
Install the public key Display Public Key shows a line for OpenSSH authorized_keys. The page can also install it on an OpenSSH server after you authenticate. Use that only on a host you are allowed to change.
Private key file Point the session at the .ppk. Leave Password empty.
Host key On the first connection, compare the server fingerprint. It will not match your new key, and it should not.
Optional agent Pageant or OpenSSH ssh-agent can hold the key for the Windows session. Attempt authentication using agent is on by default. If both a file and an agent are set, that specific key is tried first.

Keyboard-interactive stays on by default. Some servers ask for a password or a second factor that way. There is an option to answer the first prompt with the Login dialog password. Turn the method off only when it is clearly in the way.

GSSAPI, usually Kerberos, works when the PC and the server already share it. Attempt GSSAPI authentication is the user-auth form. A separate checkbox on the Key exchange page covers GSSAPI during key exchange. Leave credential delegation off unless the server should reuse your Kerberos identity.

What each file is for

site.ppk Private key. Secret. Never mail it.
Public line Goes to the account’s authorized_keys, or to the administrator.
Host fingerprint Identifies the server. You compare it. You do not generate it in PuTTYgen.

Leave “Certificate to use with the private key” empty unless you were told to use an SSH certificate authority.

Expected result

The directory opens. With a passphrase and no agent, you are prompted when authentication starts. A saved site remembers the path to the .ppk, not the passphrase.

Common mistakes

Uploading the .ppk or pasting it into a form.
Installing the public key for a different username.
Generating a key because the host-key warning appeared.
Letting Pageant offer the wrong key. Set Private key file, or unload the others.

Security

A private key without a passphrase is a password in a file. Pageant holds the decrypted key in memory for the Windows session and does not write that copy to disk when the session ends. Lock the workstation. Allow agent forwarding only when the remote server should be able to use your agent. Public-key login does not replace the host-key check.

Troubleshooting

If a password prompt remains, the public key is not installed for that account, the file is the wrong key, or the agent offered a key the server rejected. Confirm which fingerprint the administrator installed. It is yours, and it will not equal the host key. See the error finder.

Winsaip is an independent educational resource and is not affiliated with or endorsed by the developers of WinSCP.