From 21cf920f6d6f9aa6e7fc8db9a925778503a5433c Mon Sep 17 00:00:00 2001 From: AliveDevil Date: Thu, 8 Oct 2026 15:53:40 +0200 Subject: [PATCH] Update SFTP protocol with Pageant requirements --- protocols/sftp/index.md | 8 ++-- tutorials/index.md | 4 ++ tutorials/sftp_publickeyauth_pageant.md | 49 +++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 5 deletions(-) create mode 100644 tutorials/sftp_publickeyauth_pageant.md diff --git a/protocols/sftp/index.md b/protocols/sftp/index.md index a70650e1..daa6d345 100644 --- a/protocols/sftp/index.md +++ b/protocols/sftp/index.md @@ -9,6 +9,7 @@ providers ../../tutorials/sftp_publickeyauth_1password ../../tutorials/sftp_publickeyauth_bitwarden ../../tutorials/sftp_publickeyauth_yubikey +../../tutorials/sftp_publickeyauth_pageant ::: :::{image} ../_images/ftp.png @@ -45,6 +46,7 @@ The following configuration options from `~/.ssh/config` are supported for SFTP - *ProxyJump* to connect via SSH tunnel through bastion server. - *PreferredAuthentications* to limit authentication methods tried to login. - *IdentitiesOnly*. Only try explicitly set private keys to authenticate but not all identities found in SSH agent. Resolves _Too many authentication failures_ errors with servers limiting the number of attempted authentication requests. +- *Include* to compose the configuration from multiple files, e.g. to keep settings written by other applications in a separate file. - A [bookmark](../../cyberduck/bookmarks.md) will update its public key authentication setting from the *IdentityFile* configuration in `~/.ssh/config`. Also when opening a new [connection](../../cyberduck/connection.md#toolbar-button) using *File → Open Connection…, IdentityFile* and *User* parameters in the OpenSSH user config file are auto completed. Example `~/.ssh/config` configuration: @@ -146,14 +148,10 @@ Host myhostname IdentityAgent ~/.bitwarden-ssh-agent.sock ``` - ::: :::{group-tab} Windows -The following agents are supported: - * [Pageant](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html). Refer to [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty). - * OpenSSH for Windows using the pipe (`\\.\pipe\openssh-ssh-agent`) by default. Use `IdentityAgent` to set a custom socket path for any other compatible agent if needed. - * [1Password SSH agent](https://developer.1password.com/docs/ssh/agent/compatibility/#cyberduck) +SSH agents that provide a named pipe are supported, such as the OpenSSH agent, the [1Password SSH agent](https://developer.1password.com/docs/ssh/agent/compatibility/#cyberduck) and [Pageant](../../tutorials/sftp_publickeyauth_pageant.md). The OpenSSH agent pipe (`\\.\pipe\openssh-ssh-agent`) is used by default. Use `IdentityAgent` to set a different pipe if needed. ::: :::: diff --git a/tutorials/index.md b/tutorials/index.md index d2a7deaa..aabc48fb 100644 --- a/tutorials/index.md +++ b/tutorials/index.md @@ -18,6 +18,7 @@ sftp_publickeyauth sftp_publickeyauth_1password sftp_publickeyauth_bitwarden sftp_publickeyauth_yubikey +sftp_publickeyauth_pageant cli_github_action ::: @@ -65,5 +66,8 @@ Authenticate with SSH private key saved in Bitwarden. ### [Use YubiKey](sftp_publickeyauth_yubikey.md) Authenticate with SSH private key saved on YubiKey. +### [Configure Pageant](sftp_publickeyauth_pageant.md) +Authenticate with SSH private key loaded in Pageant. + ## [Use Cyberduck CLI GitHub Action](cli_github_action.md) Use Cyberduck CLI Docker Container in GitHub Actions \ No newline at end of file diff --git a/tutorials/sftp_publickeyauth_pageant.md b/tutorials/sftp_publickeyauth_pageant.md new file mode 100644 index 00000000..75468ecf --- /dev/null +++ b/tutorials/sftp_publickeyauth_pageant.md @@ -0,0 +1,49 @@ +Configure Public Key Authentication for SFTP using Pageant +==== + +> Public-key authentication using _Pageant_ SSH Agent allows you to connect to a remote server without a password. Instead of passwords, you use a pair of keys (private and public) for authentication. The private key is kept secret, while the public key is shared with the server. + +:::{important} +* Cyberduck [9.6](https://cyberduck.io/changelog/) or later required +* PuTTY/Pageant [0.77](https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html) or later required + +The previous built-in Pageant integration has been removed in Cyberduck 9.6. Refer to [#18479](https://github.com/iterate-ch/cyberduck/issues/18479). +::: + +Refer to [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty) for general usage of Pageant. Pageant supports writing the `IdentityAgent`-option into an OpenSSH configuration file on startup. + +1. Install [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html), which includes _Pageant_ and _PuTTYgen_. + +2. Start Pageant with the `--openssh-config` option, e.g. in the shortcut used to launch Pageant at login. Private key files to load can be appended to the command line. + + ``` + pageant.exe --openssh-config %USERPROFILE%\.ssh\pageant.conf + ``` + +3. Add an `Include` directive at the top of `%USERPROFILE%\.ssh\config` before any `Host` entry to apply it to all hosts. + + ``` + Include ~/.ssh/pageant.conf + ``` + +4. Open your private key in _PuTTYgen_ and copy the public key shown in _Public key for pasting into OpenSSH authorized_keys file_. Add it to the `authorized_keys` in your `~/.ssh` directory on the server running OpenSSH. + +5. Add a new [Bookmark](../cyberduck/bookmarks.md) in Cyberduck. Enter the alias from your OpenSSH configuration or the hostname in _Server_. You do **not** need to set a value for _Password_. + + :::{tip} + The server may respond with _[Too many authentication failures](../protocols/sftp/index.md#too-many-authentication-failures)_ when trying to authenticate with all keys loaded in _Pageant_. In the [Bookmark](../cyberduck/bookmarks.md) panel, select the public key corresponding to your private key loaded in _Pageant_ for *SSH Private Key*. The public key must be available as a file, e.g. saved from _PuTTYgen_ to `%USERPROFILE%\.ssh\mykey.pub`. + + Alternatively, add the public key to the OpenSSH configuration file `~/.ssh/config` with the `IdentityFile` directive + + ``` + # Public Key File used to filter identities from SSH agent + IdentityFile ~/.ssh/mykey.pub + ``` + ::: + +6. Connect to the server. The private key loaded in _Pageant_ is used to authenticate. + +## References + +* [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) +* [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty)