Monday, November 12, 2018

Using SCP under Putty-CAC with PIV

Our Linux host is now PIV login only, so I have to use PuTTY-CAC to access it. The default procedure that I was handed was to also install WinSCP and use that with Pageant selected as a session handler once PuTTY-CAC was set up, but I didn't have an option to install WinSCP. Starting a PuTTY-CAC session with PIV causes Pageant to be started in the background. Theoretically I should be able to use that Pagent session to run pscp.exe but it didn't work the way that I expected.

Here's how to run and install PuTTY-CAC as required by our security policy: https://piv.idmanagement.gov/engineering/ssh/


Here's one of many identical readouts of the pscp man page. Pscp can normally just be run from a CMD window. Way down at the bottom of thie man page it has suggestions for linking up pscp with Pageant. Pscp didn't automatically authenticate using Pageant as advertised, and the -agent argument seemed to have no effect. The one which worked was using a saved PuTTY session name in place of the host. The example was confusing because it showed a download from a remote host, which I hadn't realized was a thing, but just substituting the session name for the upload host name worked just fine. ftp://ftp.fu-berlin.de/pc/network/putty/putty-0.56/htmldoc/Chapter5.html
Also here: http://www.straightrunning.com/puttymanual/Chapter5.html



Here's what my command line looked like with all the paths to things hard coded:
"C:\Program Files\PuTTY\pscp.exe" -r directory host-piv:/home/user