Authentication Tab (Login Dialog)

In SSH-2, it is possible to establish a connection without using SSH’s mechanisms to identify or authenticate oneself to the server. Some servers may prefer to handle authentication in the data channel, for instance, or may simply require no authentication whatsoever.

By default, WinSCP assumes the server requires authentication (most do), and thus must provide a username. If you find you are getting unwanted username prompts, you could try checking Bypass authentication entirely.

This option only affects SSH-2 connections. SSH-1 connections always require an authentication step.1

If this option is enabled, then WinSCP will look for Pageant and attempt to authenticate with any suitable public keys Pageant currently holds.

This behaviour is almost always desirable, and is therefore enabled by default. In rare cases you might need to turn it off in order to force authentication by some non-public-key method such as passwords.1

Learn how to use the Pageant (PuTTY’s SSH authentication agent) application for public key authentication.

TIS and CryptoCard authentication are (despite their names) generic forms of simple challenge/response authentication available in SSH-1 only. You might use them if you were using S/Key one-time passwords, for example, or if you had a physical security token that generated responses to authentication challenges.

With this switch enabled, WinSCP will attempt these forms of authentication if the server is willing to try them. You will be presented with a challenge string (which will be different every time) and must supply the correct response in order to log in. If your server supports this, you should talk to your system administrator about precisely what form these challenges and responses take.1

The SSH-2 equivalent of TIS authentication is called ‘keyboard-interactive’. It is a flexible authentication method using an arbitrary sequence of requests and responses; so it is not only useful for challenge/response mechanisms such as S/Key, but it can also be used for (for example) asking the user for a new password when the old one has expired.1

WinSCP leaves this option enabled by default, but supplies a switch to turn it off in case you should have trouble with it. If your server uses keyboard-interactive authentication to ask for your password only, and you wish to allow WinSCP to reply with password entered on Session tab, tick Respond with password to the first prompt.

The switch tells WinSCP to attempt GSSAPI or SSPI authentication.

The GSSAPI is a generic API for doing client-server authentication. The motivation behind it is that every security system has its own API, and the effort involved with adding different security systems to applications is extremely difficult with the variance between security APIs. However, with a common API, application vendors could use the generic API and it could work with any number of security platforms (Kerberos, Entrust, …).

The SSPI is Microsoft specific (non-standard) implementation of GSSAPI.

To use MIT Kerberos authentication, you need to have MIT Kerberos for Windows installed.

If your Kerberos realm is not in the AD, MIT Kerberos authentication will not be used. For this you will need to specify a Service Principal Name as described below. Then, either store the password for <user>@<Kerberos Realm> under the advanced tab of the User accounts control panel or use runas /netonly /user:<user>@<realm> <path to WinSCP> to start WinSCP. If the latter method is used, the credentials that get established at startup after providing the kerberos password are only available to children of the initial process - ie. started using the Session → New Session… or Session → Saved Sessions navigation.

This option allows the SSH server to open forwarded connections back to your local copy of Pageant. If you are not running Pageant, this option will do nothing. Learn more about agent forwarding. 1

The situation where it option is useful is where you do not have Kerberos for Windows on a local machine and are using cross realm where the realm of the server is not in AD. The local machine can be part of a domain, or a stand alone machine. It is proving handy for use from home for example.

The Service Principal Name should be entered in the form:

host/<hostname>@<Kerberos Realm Name>

When one of more of the realms are not AD, then the Microsoft ksetup command will need to be used to define the realms to the local machine. It can be found on the Windows XP PRO CD under support tools which get installed into C:\Program Files\Support Tools\. There is also a version for Windows 2000.

ksetup /AddKdc <realm> <KdcName>

(Repeat for other KDCs)

ksetup /SetRealmFlags <realm> TCPSupported Delegate

If the realm has the DNS SRV records setup the KdcName is optional at least on XP.

MIT 1.3 KDCs supports TCP. The Delegate flag is needed for servers in the MIT realm as it does not return the OK_TO_DELEGATE flag. The Delegate flag is also needed to have an AFS token issued when the server is using the Andrew File System.