Put your SSH experience on Windows on steroids

In this blog post, I want to show you how to make working with Linux VMs and Git easier by configuring SSH on your Windows machine in a secure but convenient way. Let me first explain why you might want to apply these tips and tricks.

Git has become the de facto standard for version control over the past few years. You're probably using it for your software development projects, and perhaps even for your blog if you write in Markdown and use a static site generator.

You might also be using Node.js, Python, or other languages that you find easier to work with on Linux. Maybe you're running a VirtualBox VM or deploying your applications to the cloud. The last thing you want is to enter a password every time you connect through PuTTY or transfer a file with WinSCP.

I also usually use Vagrant for my VMs, and the setup below makes that experience more convenient.

We'll put the settings in place so you only need to enter your SSH key's passphrase once. The following settings apply to the tools described here when they use an SSH key to authenticate.

Prerequisites:

• Git (Git Extensions)
• PuTTY
• PuTTYgen (comes with Git Extensions)

Generate a SSH key

To generate an SSH key, use ssh-keygen.exe, found in the bin folder of your Git installation. For this setup, use the key names shown in this post so OpenSSH can find them by their default names.

Open Git Bash and run the following command to generate your open-ssh key. Use a strong passphrase when prompted to help protect the key if you accidentally lose it.

$ ssh-keygen -t rsa -b 4096 -C "your@email.domain"
Generating public/private rsa key pair.
Enter file in which to save the key (/c/Users/Marco/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in ~/.ssh/id_rsa.
Your public key has been saved in ~/.ssh/id_rsa.pub.
The key fingerprint is:
30:a5:c1:7a:bb:00:bf:7c:24:b7:4d:f1:d6:3d:e5:7e your@email.domain

With the keys in place, we can set up SSH connections through Bash (id_rsa) or PuTTY (id_rsa.ppk). The remaining problem is that we have to enter the passphrase each time in bash and manually load the PuTTY key into pageant.exe.

Pageant

Pageant, installed as part of the PuTTY package, holds your keys and makes them available to mRemote, WinSCP, and PuTTY. Open pageant.exe, load your id_rsa.ppk key, and enter its passphrase. From then on, PuTTY, WinSCP, and programs that act as frontends for them (such as mRemote) will consult Pageant for a key to use when connecting.

You might want to load this key automatically at startup. You can do that using one of the following methods:

1. If you've allowed Pageant to handle the ppk file extension, add the key files to the Windows "Startup" folder.
2. 

SSH Agent forwarding

This configuration is optional, but it lets you connect to one machine over SSH and then connect from there to another machine using the same key. That way, you don't have to store your private SSH key on those servers.

Your private key should always stay as close as possible to you!

PuTTY

• Open PuTTY.
• Go to "Connection" -> "SSH" -> "Auth".
• 
• 
• Go back to "Session".
• Select the "Default Settings" entry.
• Click "Save".

WinSCP

• In a new WinSCP connection tab, enable the Advanced options checkbox.
• Go to "SSH" -> "Authentication".
• 
• 
• 

Now we can use SSH through PuTTY without repeatedly entering the key's passphrase. In Bash, however, we still need to enter it each time we open a new shell.

Bash profile

We can solve this by starting an ssh-agent to cache the key.

Configure this by adding the following .profile file to your %USERPROFILE%, at the same level as your .shh folder.

declare -x SSH_ENV="$HOME/.ssh/environment"
 
# start the ssh-agent
function start_agent {
    echo "Initializing new SSH agent..."
    # spawn ssh-agent
    ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}"
    echo succeeded
    chmod 600 "${SSH_ENV}"
    . "${SSH_ENV}" > /dev/null
    ssh-add
}
# test for identities
function test_identities {
    # test whether standard identities have been added to the agent already
    ssh-add -l | grep "The agent has no identities" > /dev/null
    if [ $? -eq 0 ]; then
        ssh-add
        # $SSH_AUTH_SOCK broken so we start a new proper agent
        if [ $? -eq 2 ];then
            start_agent
        fi
    fi
}
# check for running ssh-agent with proper $SSH_AGENT_PID
if [ -n "$SSH_AGENT_PID" ]; then
    ps -f -u "${USERNAME}" | grep "$SSH_AGENT_PID" | grep ssh-agent > /dev/null
    if [ $? -eq 0 ]; then
        test_identities
    fi
else
    if [ -f "$SSH_ENV" ]; then
    . "$SSH_ENV" > /dev/null
    fi
    ps -f -u "${USERNAME}" | grep "$SSH_AGENT_PID" | grep ssh-agent > /dev/null
    if [ $? -eq 0 ]; then
        test_identities
    else
        start_agent
    fi
fi

Your key will be cached after you enter its passphrase in Bash once. When you close Bash and open it again, the agent will make your key available automatically.

Your folder structure will look something like this:

c:\Users\Marco\.profile
c:\Users\Marco\.ssh
c:\Users\Marco\.ssh\id_rsa
c:\Users\Marco\.ssh\id_rsa.ppk
c:\Users\Marco\.ssh\id_rsa.pub

Bonus

Add the contents of your id_rsa.pub key to the following file on a Linux server: ~/.ssh/authorized_keys

You can then log in to the server without entering a password. localhost -ssh -l marco -P 22

When you connect, the server will show a message like this:

Using username "marco".
Authenticating with public key "your@email.domain" from agent
Last login: Sat Sep 12 14:48:21 2015 from 192.168.1.33
CoreOS stable (766.3.0)
marco@dockertest ~ $

I hope you enjoy your SSH experience on steroids!

1. No more entering passwords when pushing or pulling with Git.
2. No more storing private SSH keys on a server or VM.
3. No more logging in to a VM with a password.
4. No more passwords when using WinSCP.
5. Don't forget to lock your computer, since your key is cached now!