Authentication Page (Advanced Site Settings dialog)

In SSH-2, it is in principle possible to establish a connection without using SSH’s mechanisms to identify or prove who you are to the server. Some servers may simply require no authentication whatsoever.

By default, WinSCP assumes the server requires authentication (we’ve never heard of one that doesn’t), and thus must start this process with a username. If you find you are getting username prompts that you cannot answer, you could try enabling Bypass authentication entirely. However, most SSH servers will reject this.

This is not the option you want if you have a username and just want WinSCP to remember it; It’s also probably not what if you’re trying to set up passwordless login to a mainstream SSH server; depending on the server, you probably wanted public-key authentication or perhaps GSSAPI authentication. (These are still forms of authentication, even if you don’t have to interact with them.)

This option only affects SSH-2 connections. SSH-1 connections always require an authentication step.1

The SSH-2 equivalent of TIS authentication is called ‘keyboard-interactive’. It is a flexible authentication method using an arbitrary sequence of requests and responses; so it is not only useful for challenge/response mechanisms such as S/Key, but it can also be used for (for example) asking the user for a new password when the old one has expired.1

WinSCP leaves this option enabled by default, but supplies a switch to turn it off in case you should have trouble with it. If your server uses keyboard-interactive authentication to ask for your password only, and you wish to allow WinSCP to reply with password entered on Login dialog, tick Respond with password to the first prompt.

TIS and CryptoCard authentication are (despite their names) generic forms of simple challenge/response authentication available in SSH-1 only. You might use them if you were using S/Key one-time passwords, for example, or if you had a physical security token that generated responses to authentication challenges. They can even be used to prompt for simple passwords.

With this switch enabled, WinSCP will attempt these forms of authentication if the server is willing to try them. You will be presented with a challenge string (which may be different every time) and must supply the correct response in order to log in. If your server supports this, you should talk to your system administrator about precisely what form these challenges and responses take.1

You must select SSH-1 as a Preferred SSH protocol version to enable this option.

Use the Private key file box to specify local path to your private key file if you are going to use public key authentication. The file must be in PuTTY format. If the private key is passphrase-protected, you will be prompted for passphrase once the authentication begins. If you have your private keys loaded into Pageant, leave the box blank, unless you want to ensure that only that particular key is used for authentication.

The passphase cannot be entered in advance on Login dialog and thus it cannot be saved to site. If you need to login to server automatically without prompt, generate key without passphrase. Use this method carefully and only under special circumstances.

If you select a key file in a different format (OpenSSH or ssh.com), WinSCP will offer you to convert the key to PuTTY format. This feature is available only in the latest beta release.

GSSAPI credential delegation is a mechanism for passing on your Kerberos (or other) identity to the session on the SSH server. If you enable this option, then not only will WinSCP be able to log in automatically to a server that accepts your Kerberos credentials, but also you will be able to connect out from that server to other Kerberos-supporting services and use the same credentials just as automatically.

This option is the Kerberos analogue of SSH agent forwarding.

Note that, like SSH agent forwarding, there is a security implication in the use of this option: the administrator of the server you connect to, or anyone else who has cracked the administrator account on that server, could fake your identity when connecting to further Kerberos-supporting services. However, Kerberos sites are typically run by a central authority, so the administrator of one server is likely to already have access to the other services too; so this would typically be less of a risk than SSH agent forwarding.1

Read more about Login dialog and Advanced Site Settings dialog.