Using SCP under Putty-CAC with PIV

Our Linux host is now PIV login only, so I have to use PuTTY-CAC to access it. The default procedure that I was handed was to also install WinSCP and use that with Pageant selected as a session handler once PuTTY-CAC was set up, but I didn't have an option to install WinSCP. Starting a PuTTY-CAC session with PIV causes Pageant to be started in the background. Theoretically I should be able to use that Pagent session to run pscp.exe but it didn't work the way that I expected.

Here's how to run and install PuTTY-CAC as required by our security policy: https://piv.idmanagement.gov/engineering/ssh/

Here's one of many identical readouts of the pscp man page. Pscp can normally just be run from a CMD window. Way down at the bottom of thie man page it has suggestions for linking up pscp with Pageant. Pscp didn't automatically authenticate using Pageant as advertised, and the -agent argument seemed to have no effect. The one which worked was using a saved PuTTY session name in place of the host. The example was confusing because it showed a download from a remote host, which I hadn't realized was a thing, but just substituting the session name for the upload host name worked just fine. ftp://ftp.fu-berlin.de/pc/network/putty/putty-0.56/htmldoc/Chapter5.html

Also here: http://www.straightrunning.com/puttymanual/Chapter5.html

Here's what my command line looked like with all the paths to things hard coded:

"C:\Program Files\PuTTY\pscp.exe" -r directory host-piv:/home/user

PuTTY -batch Authentication Denied

New system. PuTTY pscp is not working right. Normal pscp -v -batch in the code is failing with an unhelpful "Authentication Denied" message. Directly logging into the remote system with PuTTY is working fine.

What I learned to fix it:

1. Get the most current version of PuTTY. Googling the problem revealed that many online thought that there was a "bug" in version 0.60 that caused this, and upgrading to 0.62 (apparently the most recent version) fixes it. Here's a few links of many in which this assertion is made:

http://www.derkeiler.com/Newsgroups/comp.security.ssh/2009-02/msg00070.html

https://groups.google.com/forum/#!topic/comp.security.ssh/GbAEXzBD8hE

http://earthwithsun.com/questions/312197/putty-0-61-why-do-i-see-access-denied-message-after-i-enter-my-login-id

2. After performing the upgrade it still gets me Authentication Denied, but also better error messages. Now it also says "GSSAPI authentication request refused". Whatever the hell that is. From the following links, I learned that I mostly just need to disable GSSAPI authentication, and the best way to do this was through the PuTTY configuration:

http://superuser.com/questions/465709/getting-access-denied-error-in-putty-with-a-normal-user

http://superuser.com/questions/312197/putty-0-61-why-do-i-see-access-denied-message-after-i-enter-my-login-id

Here is the same explanation applied to a slightly different situation (not trying to use pscp):

http://nolabnoparty.com/en/access-denied-ssh-error-with-putty-in-windows-7/

3. I was able to make a PuTTY configuration that had GSSAPI turned off and pscp started working, but my configuration was poorly named. I had made two configurations, one named @ and the other being named . The one with GSSAPI turned off was @, and if I did pscp -v -batch -load @ it worked. After looking at how I had PuTTY configured on my other systems I realized that for pscp with the private key authentication to work automatically without having to feed it the parameter for which configuration to load, I needed the configuration to be set up with the user name as the default username in the Connection->Data parameters. So I deleted the @ configuration, and corrected the configuration to have the username as the default username, the private key selected under Connection->SSH->Auth and GSSAPI turned off under Connection->SSH->Auth->GSSAPI.

4. Now the new system is set up like my other systems. Except that arguably they are all wrong now; what I should have is a custom named configuration that the code calls using pscp -load rather than having the default pscp configuration for automatically using the username and keys.

5. I should upgrade PuTTY to version 0.63 now for security reasons:

http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html