Update SFTP protocol with Pageant requirements

protocols/sftp/index.md

@@ -9,6 +9,7 @@ providers
 ../../tutorials/sftp_publickeyauth_1password
 ../../tutorials/sftp_publickeyauth_bitwarden
 ../../tutorials/sftp_publickeyauth_yubikey
+../../tutorials/sftp_publickeyauth_pageant
 :::
 
 :::{image} ../_images/ftp.png
@@ -45,6 +46,7 @@ The following configuration options from `~/.ssh/config` are supported for SFTP
 - *ProxyJump* to connect via SSH tunnel through bastion server.
 - *PreferredAuthentications* to limit authentication methods tried to login.
 - *IdentitiesOnly*. Only try explicitly set private keys to authenticate but not all identities found in SSH agent. Resolves _Too many authentication failures_ errors with servers limiting the number of attempted authentication requests.
+- *Include* to compose the configuration from multiple files, e.g. to keep settings written by other applications in a separate file.
 - A [bookmark](../../cyberduck/bookmarks.md) will update its public key authentication setting from the *IdentityFile* configuration in `~/.ssh/config`. Also when opening a new [connection](../../cyberduck/connection.md#toolbar-button) using *File → Open Connection…, IdentityFile* and *User* parameters in the OpenSSH user config file are auto completed.
 
 Example `~/.ssh/config` configuration:
@@ -146,14 +148,10 @@ Host myhostname
 	IdentityAgent ~/.bitwarden-ssh-agent.sock
 ```
 
-
 :::
 :::{group-tab} Windows
 
-The following agents are supported:
- * [Pageant](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html). Refer to [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty).
- * OpenSSH for Windows using the pipe (`\\.\pipe\openssh-ssh-agent`) by default. Use `IdentityAgent` to set a custom socket path for any other compatible agent if needed. 
- * [1Password SSH agent](https://developer.1password.com/docs/ssh/agent/compatibility/#cyberduck)
+SSH agents that provide a named pipe are supported, such as the OpenSSH agent, the [1Password SSH agent](https://developer.1password.com/docs/ssh/agent/compatibility/#cyberduck) and [Pageant](../../tutorials/sftp_publickeyauth_pageant.md). The OpenSSH agent pipe (`\\.\pipe\openssh-ssh-agent`) is used by default. Use `IdentityAgent` to set a different pipe if needed.
 
 :::
 ::::

tutorials/index.md

@@ -18,6 +18,7 @@ sftp_publickeyauth
 sftp_publickeyauth_1password
 sftp_publickeyauth_bitwarden
 sftp_publickeyauth_yubikey
+sftp_publickeyauth_pageant
 cli_github_action
 :::
 
@@ -65,5 +66,8 @@ Authenticate with SSH private key saved in Bitwarden.
 ### [Use YubiKey](sftp_publickeyauth_yubikey.md)
 Authenticate with SSH private key saved on YubiKey.
 
+### [Configure Pageant](sftp_publickeyauth_pageant.md)
+Authenticate with SSH private key loaded in Pageant.
+
 ## [Use Cyberduck CLI GitHub Action](cli_github_action.md)
 Use Cyberduck CLI Docker Container in GitHub Actions

tutorials/sftp_publickeyauth_pageant.md

@@ -0,0 +1,49 @@
+Configure Public Key Authentication for SFTP using Pageant
+====
+
+> Public-key authentication using _Pageant_ SSH Agent allows you to connect to a remote server without a password. Instead of passwords, you use a pair of keys (private and public) for authentication. The private key is kept secret, while the public key is shared with the server.
+
+:::{important}
+* Cyberduck [9.6](https://cyberduck.io/changelog/) or later required
+* PuTTY/Pageant [0.77](https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html) or later required
+
+The previous built-in Pageant integration has been removed in Cyberduck 9.6. Refer to [#18479](https://github.com/iterate-ch/cyberduck/issues/18479).
+:::
+
+Refer to [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty) for general usage of Pageant. Pageant supports writing the `IdentityAgent`-option into an OpenSSH configuration file on startup.
+
+1. Install [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html), which includes _Pageant_ and _PuTTYgen_.
+
+2. Start Pageant with the `--openssh-config` option, e.g. in the shortcut used to launch Pageant at login. Private key files to load can be appended to the command line.
+
+   ```
+   pageant.exe --openssh-config %USERPROFILE%\.ssh\pageant.conf
+   ```
+
+3. Add an `Include` directive at the top of `%USERPROFILE%\.ssh\config` before any `Host` entry to apply it to all hosts.
+
+   ```
+   Include ~/.ssh/pageant.conf
+   ```
+
+4. Open your private key in _PuTTYgen_ and copy the public key shown in _Public key for pasting into OpenSSH authorized_keys file_. Add it to the `authorized_keys` in your `~/.ssh` directory on the server running OpenSSH.
+
+5. Add a new [Bookmark](../cyberduck/bookmarks.md) in Cyberduck. Enter the alias from your OpenSSH configuration or the hostname in _Server_. You do **not** need to set a value for _Password_.
+
+   :::{tip}
+   The server may respond with _[Too many authentication failures](../protocols/sftp/index.md#too-many-authentication-failures)_ when trying to authenticate with all keys loaded in _Pageant_. In the [Bookmark](../cyberduck/bookmarks.md) panel, select the public key corresponding to your private key loaded in _Pageant_ for *SSH Private Key*. The public key must be available as a file, e.g. saved from _PuTTYgen_ to `%USERPROFILE%\.ssh\mykey.pub`.
+
+   Alternatively, add the public key to the OpenSSH configuration file `~/.ssh/config` with the `IdentityFile` directive
+
+   ```
+   # Public Key File used to filter identities from SSH agent
+   IdentityFile ~/.ssh/mykey.pub
+   ```
+   :::
+
+6. Connect to the server. The private key loaded in _Pageant_ is used to authenticate.
+
+## References
+
+* [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)
+* [How To Use Pageant to Streamline SSH Key Authentication with PuTTY](https://www.digitalocean.com/community/tutorials/how-to-use-pageant-to-streamline-ssh-key-authentication-with-putty)