Switching TortoiseGit from TortoiseGitPlink to Git's ssh.exe: what key and host-key configuration must move with it

Answer

When you switch TortoiseGit’s SSH client from TortoiseGitPlink to Git’s ssh.exe, the per‑remote PuTTY key settings are ignored and host‑key verification moves from the PuTTY registry to OpenSSH’s known_hosts file. You must therefore copy or convert the private key to OpenSSH format (or reference it via ~/.ssh/config) and pre‑populate the service account’s known_hosts.

Confirmed facts

• TortoiseGit ignores any per‑remote PuTTY key entry once the SSH client is set to ssh.exe.
• Authentication then relies on OpenSSH mechanisms: default id_* keys, ssh-agent, or a Host entry in %USERPROFILE%\\.ssh\\config.
• Host keys are stored in %USERPROFILE%\\.ssh\\known_hosts, not in HKEY_CURRENT_USER\\Software\\SimonTatham\\PuTTY\\SshHostKeys.
• TortoiseGit logs the exact binary it runs; enabling Settings → General → Debug → Show command line or checking TortoiseGitProcess.log shows whether TortoiseGitPlink.exe or ssh.exe was invoked.

Likely explanation / assumptions

If the service account cannot see the interactive user’s Pageant session, you must make the key available to OpenSSH. OpenSSH cannot read PuTTY‑format .ppk files directly, so either convert them with PuTTYgen or use an ssh‑pageant bridge. The known_hosts file must be readable by the account; if the account’s HOME points to a non‑writable directory, ssh.exe will fail to load keys or host keys.

Steps to migrate

1. Open TortoiseGit → Settings → Network and set SSH client to ssh.exe (usually C:\\Program Files\\Git\\usr\\bin\\ssh.exe).
2. For the build/service account, ensure %USERPROFILE%\\.ssh exists and is writable.
3. Convert the PuTTY .ppk key to OpenSSH format: puttygen key.ppk -O private-openssh -o %USERPROFILE%\\.ssh\\id_rsa (or place the key elsewhere and reference it in %USERPROFILE%\\.ssh\\config with IdentityFile).
4. Set correct permissions: the .ssh folder should be accessible only by the account; on Windows, right‑click → Properties → Security and remove inheritance, granting read/write to the account only.
5. Pre‑cache the server’s host key: run ssh-keyscan -t rsa git.example.com >> %USERPROFILE%\\.ssh\\known_hosts (verify the fingerprint out‑of‑band).
6. Test the connection: ssh -T [contact removed] should succeed without prompting for a password or host‑key verification.
7. Optionally enable TortoiseGit debug logging, perform a fetch, and check the log for the line containing Running: ssh.exe to confirm the binary used.

Missing detail needed

Please confirm whether the service account’s HOME (or %USERPROFILE%) points to a writable directory where .ssh can be created, and whether any GIT_SSH, GIT_SSH_COMMAND or core.sshCommand variables are set for that account, as they would override the TortoiseGit setting.