Win32-OpenSSH
Win32-OpenSSH copied to clipboard
PowerShell
Load ssh-agent keys from MS-CAPI
One of the major advantages of running ssh-agent on windows would be to authenticate using key material already securely stored in MS-CAPI. Please take advantage of this.
Similar functionality was created in a forked version of PuTTY called PuTTY-CAC: https://github.com/risacher/putty-cac
PuTTY-CAC was created to allow users to authenticate ssh sessions using the key material of a certificate on a smartcard. This allows them to use an agent where their private key is never even exposed to the local machine. However, it works using any certificate private key available to the user in MS-CAPI.
Any recent movement on this? Would be nice to be able to use public keys stored on CAC card or yubikey devices. Agent would have to prompt for PIN. Like the putty cac pageant does.
Likewise interested in this - Windows forces use of a software key in a file - even WSL2 cannot access the smartcard, so I'm going to have to reboot into Linux to get things done.
Yes. This is in plan. Will likely come towards year end.
Has this plan been updated?
Sorry for the pile-on, but there are a large number of US government customers who would benefit greatly from native MS-CAPI / ssh-agent integration on Windows for smartcard (CAC/PIV) authentication. Would love to see this happen.
@NoMoreFood - You have deep insight into Win32-OpenSSH and putty CAC, will you be able to take this up? Once again appreciate all your contributions to Win32-OpenSSH.
@chuckmilam have you tried https://github.com/cuviper/ssh-pageant ?
Essentially the flow would look like OpenSSH <> ssh-pagent (acting as ssh-agent) <> pagent (from PuTTY-CAC).
@kategray I have not. Thank you for the suggestion. I may give it a try, but I'm not confident I'll be able secure approval to use it in the long run. The issue in my environment would be introducing Cygwin, which would require a whole new round of approvals and questions about maintenance and concern for potential for new vulnerabilities.
If we could just get Microsoft to support smartcards in their OpenSSH implementation, life would be great. It's easy to get approval for Microsoft-included OS features.
For the record, I've been in contact with @NoMoreFood, and he's been quite helpful and responsive on issues with PuTTY-CAC--but this isn't PuTTY-CAC. So, I'm confused.
@chuckmilam if you look at the releases page, he contributes to Win32-OpenSSH as well as working on PuTTY-CAC.
As a workaround until this is implemented, it's possible to use CAPI keys through a PKCS#11-CAPI bridge such as p11-capi or pvpkcs11.
I managed to connect to an SSH server using this command:
ssh -I ./p11capi_w64.dll server.example.com
To add the public key to the server's authorized_keys, I used putty-cac's "Copy to Clipboard" button:
