Replacing Password Authentication in PuTTY with SSH Key Pairs

The Problem: Password Fatigue and Security Risks

Relying on passwords for SSH access creates two primary issues: susceptibility to brute-force attacks and the operational friction of typing complex credentials for every session. Switching to public-key authentication replaces the password with a cryptographic key pair, ensuring that only a client possessing the private key can initiate a session.

Prerequisites

• PuTTY and PuTTYgen installed on a Windows machine.
• A target Linux server with SSH access and a user account with sudo privileges.
• Network connectivity to the server on port 22.

Step 1: Generating the Key Pair with PuTTYgen

PuTTY uses a proprietary .ppk format for private keys, which differs from the OpenSSH format used by Linux. You must use PuTTYgen to create a compatible pair.

1. Launch PuTTYgen.
2. Under Parameters, select Ed25519. This is currently recommended over RSA for better security and smaller key sizes. Note: Ensure your server's SSH version supports Ed25519; otherwise, use RSA 2048 or 4096.
3. Click Generate and move your mouse over the blank area to create entropy.
4. Enter a Key passphrase. This encrypts the private key on your disk, preventing an attacker from using the key if they steal the file.
5. Click Save private key to store the .ppk file in a secure local directory.
6. Copy the text from the box labeled Public key for pasting into OpenSSH authorized_keys file. This single-line string is what the server needs.

Step 2: Installing the Public Key on the Server

The server must recognize your public key before it will allow a key-based login. You must place the copied string into a specific file in the user's home directory.

Run these commands on the Linux server as the target user:

# Create the .ssh directory if it doesn't exist
mkdir -p ~/.ssh

# Set directory permissions to 700 (read/write/execute for owner only)
chmod 700 ~/.ssh

# Append the public key string to the authorized_keys file
# Replace "ssh-ed25519 AAA..." with the string copied from PuTTYgen
echo "ssh-ed25519 AAA... user@workstation" >> ~/.ssh/authorized_keys

# Set file permissions to 600 (read/write for owner only)
chmod 600 ~/.ssh/authorized_keys

Risk: If the .ssh directory or authorized_keys file has permissions that are too open (e.g., 777), the SSH daemon will reject the key for security reasons, and you will be forced back to password authentication.

Step 3: Configuring the PuTTY Client

Now, tell the PuTTY client to present the private key during the handshake.

1. Open PuTTY.
2. Go to Connection > Data and enter your username in the Auto-login username field. This skips the "login as:" prompt.
3. Navigate to Connection > SSH > Auth. (In newer versions, this is Connection > SSH > Auth > Credentials).
4. In the Private key file for authentication field, browse to and select your .ppk file.
5. Return to the Session category, enter your Host Name, and save the session to avoid repeating these steps.

Optional: Using Pageant for Single Sign-On

If you manage multiple servers, entering your passphrase for every single session is tedious. Pageant (the PuTTY authentication agent) holds decrypted keys in memory.

• Launch Pageant. It will appear as an icon in the system tray.
• Right-click the icon and select Add Key.
• Select your .ppk file and enter the passphrase once.
• PuTTY will now automatically attempt to use any keys loaded in Pageant before prompting for a password.

Verification and Diagnostics

To verify the configuration, launch the saved session. You should be prompted for the key passphrase (if not using Pageant) rather than the user account password.

If the connection still asks for a password, check the server logs to identify the failure point:

# Run as root or via sudo on the server
tail -f /var/log/auth.log | grep sshd

Look for Authentication refused: bad ownership or modes for directory /home/user/.ssh, which indicates a permission error on the server side.

Rollback Procedure

If you lose access to your private key or the configuration fails, you can revert to password authentication by removing the public key from the server:

1. Log in using a password (if still enabled) or via a cloud console/IPMI.
2. Open ~/.ssh/authorized_keys in a text editor and remove the line corresponding to the PuTTY key.
3. Ensure PasswordAuthentication yes is set in /etc/ssh/sshd_config and restart the service: sudo systemctl restart ssh.