nomorefood / putty-cac Goto Github PK
View Code? Open in Web Editor NEWWindows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys
Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys
After i finally figured out how to run these dsp's, trying to make gives an error that says, that /ZI and /Gy are incopatible. How to fix it?
Hi,
Simple request: Make the Window resizable, or add an horizontal scroll.
When you're using a large name then you can't show the full text.
Thank you!
I am told that although PIV/CAC auth works for "putty.exe" it does not for "pscp.exe" or "psftp.exe".
(The smart card manager reports that the card uses PKCS#1 SHA-256 with RSA encryption)
Is that in fact the case? If not, any ideas on why this user is having problems with it would be appreciated.
Thank you.
Ken
See the discussion on: smartcard-openssh-and-putty-ssh
Note the same Yubikey 4 works via opensc-pkcs11.dll, but does not work via CAPI. The Yubikey 4 is a PIV like card and uses the Microsoft builtin smart card drivers.
OpenSSH servers no longer accept SHA1 signatures. Putty-CAC appears to still be trying use SHA1 in cart-capi.c
It looks like cert-capi.c is defaulting to using CALG_SHA1
in line 86, or the code at line 111:
tInfo.pszAlgId = NCRYPT_SHA1_ALGORITHM;
As I don't have a good way to debug Putty-CAC here is some of the putty-log, openssh debug and a snipit which show up twice. I think from lines70 and 71.
CryptSignHash(hHash, pProviderInfo->dwKeySpec, NULL, 0, NULL, &iSig) != FALSE &&
CryptSignHash(hHash, pProviderInfo->dwKeySpec, NULL, 0, pSig = snewn(iSig, BYTE), &iSig) != FALSE)
But then in the breakpoint hits and the siglen = 0 which is not good.
Hello,
I am trying to determine if there is any way to automate the retrieval of the CAPI string (ssh-rsa AAAAB3NzXX.......) from a smartcard/PKI infrastructure (AD or CA perhaps) or if it has the be retrieved from the card manually by the user each time. Thanks
I am on Windows 10 machine with a 4K monitor and I have just discovered putty-cac. However, it looks blurry. Putty 0.70 doesn't have this issue and when I launch both side by side, the difference is amazing. After trying to use for a few hours, I started to get a headache. I tried playing with compatibility settings, but to no avail. Any recommendations as to what could be the cause if they are off the same codebase? (Screenshot shows putty on left and putty-cac on right)
I used PuTTY-CAC using a a smart card and the OpenSC PKCS library. Then I decided to skip OpenSC because on Windows it's not really needed and not using it means one less (unsigned) package to install. So I uninstalled OpenSC and tried to use the MS CAPI instead.
Now, no matter how many times I try to remove any certificate using "Clear Cert" in the PuTTY configuration (which says "") or using "Remove" in Pageant, which does not list any certificate, I still get an error dialog saying message "PuTTY could not load the selected PKCS library. Either the file is corrupted or not appropriate for this version of PuTTY. [...]".
Obviously, the library file is "corrupted", since it is uninstalled. The bug is that there does not seem to be any way to get rid of the error message using either the PuTTY or Pageant user interface.
The only way I have found to get out of this situation is to delete the CAPICertID registry key, which has a value starting with "PKCS" and ending with the path to the (now non-existent) "C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll".
Is there a way to support certificate authorities on SSH servers, rather than trust-on-first-use? I'm not seeing an option in the app.
It would be nice to be able to add one or more CAs to PuTTY and have it automatically recognize servers signed with a trusted CA key. It would be particularly useful in CAC and other high security environments.
Is it compatibile with Windows XP with SP3 ?
Just wondering if you can make Pageant list valid certificates first. Perhaps sort by descending order of the end validity date of each certificate? This will be useful for smart card that has a lot of certificates. Alternatively, there could be an option to filter out expired certificates from the list. Thanks!
Hi,
I suggest to add a button with the name "Export Public Key" (or add the right button option with this option) for exporting the Public Key of the selected cert.
Other similar projects, when you do a double-click over a cert will copy the Public Key (the text used for paste into the ".authorized" file) to the clipboard. However, as this projects opens the Certificate Display windows when you double-click, then another option will be useful for copy the public key.
You agree?
There seems to be a problem under windows 10 with ActivClient in cert enumeration function. It brings up a partial window but hangs w/o showing the list of available certificates, both for putty and pageant.
We were able to work around this by hard coding the certificate path in the command line for pageant. unfortunately I don't have access to this machine anymore. A user took off with it since he was ok with the workaround.. Just thought I should report this..
Hi,
I have a question about using OpenPGP token (Yubikey FIPS) and pageant-cac via the opensc-pkcs11 library (os: win10):
In the OpenSC Forum, I received information that pageant-cac does not support 4096bit keys?
If so, why this restriction?
Will 4096bit key support be added in the future?
If a 4096bit key is stored on the token, the pageant displays a message that there is no available key on the card. For 2048bit OpenPGP keys I haven't tried it yet.
I know that 4096bit OpenPGP keys can be put into a putty via the gpg-agent (GnuPGP), but because of exclusive access to the token it is useless to me. (I need to use one Token at the same time in PKCS11 mode [VPN connection] and OpenPGP mode [ssh connection]).
The pkcs11 support has been removed from v0.65.
is it possible to support pkcs11 in future version?
Line 1486 in 5eb85eb
This line can't be correct. SaveCertListOn
is set to 1 or 0 based on the string in argv[i]
is "-savelist"
or not, but this code branch is only entered if argv[i]
is either "-savecertlist"
or "-savcecertlistoff"
. The second argument to strcmp
should be "-savecertlist"
.
pageant and putty crash when add dll library
I open pagent, click "Add PKCS Cert", select opensc-pkcs11.dll, and click OK in windown form "PuTTY: Select Certificate for Authentication"
Same situation in putty if I add dll library
I have windows 10 pro with all last updates.
AppCrash_pageant.exe_38d025ccead485afa7be298d5c4356469c38aa8_bc63c0b2_246b0da0.zip
Hi,
When you like to load a CAPI cerfiticicate using the command-line and the Pageant it's already running, then you can't load a new certificate.
Example:
If you start with "C:\Program Files\PuTTY\pageant.exe" CAPI:2a361e0c4c53e9f357207b48d9e4762e3a840521 then the Pageant starts and loads this certificate.
However, if you first execute "C:\Program Files\PuTTY\pageant.exe" and after you run
"C:\Program Files\PuTTY\pageant.exe" CAPI:2a361e0c4c53e9f357207b48d9e4762e3a840521 then you see a Window Error with the message "The already running Pageant refused to add the key".
Please, can you improve this behaviour?
The idea is to have the option to load any certificate at any time.
Thank you!
If both "Remember Certs" and "Force PIN Caching" are disabled, when attempting to enable "Remember Certs", "Force PIN Caching" is also automatically enabled.
If "Remember Certs" is enabled, enabling/disabling "Force PIN Caching" works as expected.
If "Force PIN Caching" is enabled and "Remember Certs" is disabled, its impossible to enable "Remember Certs" without first disabling "Force PIN Caching" (which then as point 1, will enable both)
Example: e41c556#commitcomment-23300358
While it may be moot in cases like
Line 607 in 35f7ab9
Line 37 in 35f7ab9
Solution: Constants for IDs defined in a header; both source modules and resource files should include those headers and use those contants for the IDs.
Hi,
I'm developing PKCS#11 token and testing it.
In the test, I found some problems in nistp521 operation.
Line 69 in ffd5c71
The nistp521r1 ecpoint (x, y) has the length of 521 bits or 65byte+1bit for each x and y.
In some case, a effective size of x is 65 bytes and of y is 66 bytes, then pkcs_lookup_token_cert() will fail.
Furthermore, puttygen always puts 66bytes x2 long into PEM EC Public Key regardless of x,y length.
If both x and y are 65byte long and public key in certificate is formed 66byte long, this routine doesn't work properly.
I've attached files in zip:
nistp521_65and66_pub.pem - EC public key generated by OpenSSL. x=65bytes, y=66bytes
nistp521_65byte.ppk - putty key generated by puttygen, x and y are both 65bytes but 0 paddings exist.
nistp521_65byte_privkey.pem - private key of nistp521_65byte.ppk, generated by generated by puttygen
nistp521_65byte_pubkey.pem - public key of nistp521_65byte.ppk, generated by generated by puttygen
nistp521_65byte_cert.pem - certificate of nistp521_65byte.ppk, generated by OpenSSL
nistp521_keys.zip
Thanks,
masayuki
Hello,
I would like to know more about how is the ssh-rsa string is generated from the certificate.
The main question is: what algorithm is used for certificate convertion and how does it work with openssh? The most confusing part, is that it seems to be not certificate authentication per se... but it still works somehow...
Also, the CAPI:e495b3a063cd6a779ea810007d066ecd27da17f9
part seems unimportant (I've deleted it, and the auth still worked), is it just there so that you could more easily distinguish the keys in the authorized_keys file?
We have users with lots of different certificates (multiple YubiKeys, VPN certs, etc.). It's nearly impossible for users to determine which certificate to add to pageant/putty, and "Autoload Certs" loads all of the available certs which leads to errors like:
The smart card cannot perform the requested operation or the operation requires a different smart card.
We need a way to load just the certificate for the current user from the connected smart card.
On Windows 7 when Pageant 0.69 using a CAPI cert asks for PIN entry it is not possible to just enter the PIN + press the enter key. After entering the PIN need to either move focus to the "OK" button (tab * 2) and then hit enter/space or click "OK" with the mouse. It has been like this on all releases in this repo.
It did work on Kageant 0.6x. The PIN entry dialog looks exactly the same on both.
It is a small thing but quite annoying.
Hi,
This function described in the title is present in some other forks. And I feel it very useful. It's a check for knowing wich certificate is used, and a method for grant the use.
The original patch is published here:
http://people.mpi-klsb.mpg.de/~pcernko/pageant.html
And in this forum is commented the port to another fork that uses some PuTTY-CAC patches:
http://www.9bis.net/kitty/?action=forum&id=0809
I hope you can implement (importing the patches) it soon!
Regards.
We are running the 64-bit version of Windows 7 Enterprise w/SP1 installed, and when we update to 0.70u1, we are then unable to launch the PuTTY software, getting an error dialog box "Failed to initialize COM subsystem".
I should note, this is using the 32-bit version of putty-cac, and we have ActivClient 7.1.x installed.
We were using 0.70 with no issues, as well as the previous versions, 0.68 and 0.68u1, all 32-bit.
Thanks.
Hello,
Did anyone try Yubikey 4 as a smartcard holding the certificates? Because for me currently neither Putty CAC or Pageant CAC show Yubikey-stored certificates in certificate selection dialog. Only the software certificates are shown.
Yubikey 4 certs are displayed in certmgr.msc
and also work correctly in Chrome/Edge (HTTPS client authentication) and in curl built with WinSSL. Putty is the only "missing link" for me.
I tried some changes from #2 (like changing chuid etc.) but no dice.
Hi,
is there any hope that you might support converting the public keys into ssh-certificates to use ssh's integrated certificate system for authenticating users? I didn't find anything in the existing issues.
I.e.
ssh-rsa ...
key and have it signed by the ssh-ca...[email protected] ...
somewhere in putty-cac. As it doesn't have to be kept secret that shouldn't be too much of an issue.It would make my life quite a bit easier. :)
Thanks
Stefan
Hello,
I think it's the same on 0.72 and 0.71 (and maybe earlier versions; didn't test):
For improved security, I want Pageant to force users entering the PIN of the PKCS cert every time: is this possible? I though unchecking the "Force PIN Caching" option would make sense, but I see no different behaviour than when it's ticked.
This is not an issue on PuTTY CAC directly without Pageant: the PIN is by default requested every time there. I think this should also be by default on Pageant (or at least an option).
My end goal is to use PKCS certs on MobaXterm or WinSCP thanks to Pageant, but I still want users to enter their PIN every time they SSH or SCP somewhere!
The only workaround at the moment is to exit from Pageant, re-start it and browse the PKCS dll again to add the certificate from the smartcard; then the PIN will be requested again at next SSH session... but that's quite an effort; users will probably never want to go through that!
Another inconvenience that I noticed is that the pop up window for the PKCS cert's PIN is often hidden behind other windows. For example, I can't enter the PIN when I launch a saved WinSCP session for the first time because the PIN prompt is behind and I can't move the WinSCP window. Maybe this deserves to open another issue...
Thank you,
Chris.
Sometimes when a computer running Pageant-CAC is hibernated, Pageant loses the PIN caching. It will ask for PIN every time after recovery from hibernation.
When Pageant is started, it will remember the PIN after first typing. But after hibernation it asks for PIN every time when connecting, until Pageant is restarted and cache works again until next hibernation.
Edit: this is with a CAPI cert from a PIV YubiKey.
Hi,
This is more a question than an issue - I hope that is ok...
We want to pre-provision users on the server-side so that they will be able to use Putty-CAC.
On the server-side we are using the "rsa-sha" string that is copied into the clipboard by putty-CAC when "Copy to Clipboard" is pressed to authenticate, so can someone here describe how that string is calculated from the original certificate material?
If we could know that, then we could process each certificate to generate the "rsa-sha" string and populate each user's profile with that string.
Thanks,
Jim
Hi @NoMoreFood ,
In my daily use I open a lot of times: PuTTY, Pageant and KeePass (with the KeeAgent plugin). So, I need to load the Pageant every time I start the PuTTY. Why? Because I don't like that other Pageants act as server (yes, I use them in a client mode). The problem is that: the first Pageant needs to be the server. So, if I like to use the Pageant-CAC I have two options:
So, my suggestion it's add a command-line "-run" to the pageant for running another binary when the Pageant it's loaded. In my case, this will be the PuTTY executable. So, starting a direct access to Pageant I can really open a new PuTTY session. This will grant that the Pageant it's loaded when I open the PuTTY for the first time.
Futhermore, the use of this parameter should imply that the window "Pageant is already running" will not be shown. As the Pageant will be called multiples times (or you can add too the command parameter "-nocheckrunning" if you prefer it).
You agree with this enhancement?
Thank you!
According to the Pageant docs, you can pass filenames to keys to have them preloaded.
How can you preload CAPI certs? Possible?
Hi,
Some times I use (or I test) the PKCS#11 API. However, It's a pain to search each time for the DLL library.
Why not include a list of used libraries? This will provide a more user friendly interface.
You agree? ๐
Using 0.69 64-bit version of pageant. Also use ruToken device with installed cert/key. The cert is working because it works correctly with puttysc (checked).
"Add pkcs cert" -> choose 64-bit pkcs dll for this device -> "Cert is not available"
This might be a stupid question - but putty-cac does not support RFC6187 ("x509v3*") does it, and instead uses only pubkey method even if certificate is loaded from CAPI?
Since the only open implementation seems to be PKIX-SSH I guess implementing RFC6187 is too much of a nightmare?
After lots of trying I finally found a way to use my Yubikey paired with Putty-CAC.
Though there are 2 programs in between. One of them being OpenSC, which in turn seems to need Yubico-PIV-Manager (which loads the certificate into Windows certmanager where it can be read by OpenSC as pkcs-11).
Is there a way to simply start Pageant.exe and import the Yubikey without having to initialize the Yubico-PIV-Manager as well as OpenSC beforehand?
Thanks in advance once more!
Hi,
I downloaded the "Pageant.EXE". And I like to use it in a PORTABLE mode. However, I see that if I check, for example, the option "Autoload Certs" it's saved in the registry.
So I request for a method for using a command-line parameter for disabling the use of the registry. Or an option for disabling the "Autoload Certs". My objetive is starting the Pageant mananger using SCRIPTS, and I don't like to use at all the registry.
Please, can you help me with this?
Thank you!
Hi,
As I need to run different versions of Pageant, it will be desirable if the CAC version will have a different icon. For example, one whith a green variation over the stock.
You agree?
Hi,
This issue isn't a bug, and is not a problem of PuTTY-CAC too. However, I have this problem:
Anyone knows a solution to run both in parallel?
Thank you!
Using pageant with a smartcard is not a problem in the first place (i'm using a Yubikey 4 Nano), but if you unplug said smartcard and plug it back in, pageant seems to be unable to load the certificate.
After Just replugging it and startig a PuTTY-CAC session with PKCS Auth, i get an error saying "Server refused public-key signature despite accepting key!".
So I removed the "obsolete" PKCS Key by clicking on it and then hitting "remove" in pageant, then I added it again. But still, trying to authenticate with a server failed. To make pageant work again I need to restart the whole application. This problem seems to be only present on Windows 8 / Windows 10! Is there a way to just automatically remove the PKCS Key once the smartcard is unplugged? I think unplugging said device is not a rarity when you're at your workplace, thus restarting pageant each time does produce a lot of hassle.
Also: The PIN prompt only happens when connecting to a server using putty. Should it not instead prompt you for the PIN just as you add your PKCS cert? Because of that I need to firstly start a PuTTY remote login (on any host) and THEN I can start my WinSCP (which is able to use pageant but does not prompt for a pin if it's needed).
Thanks in advance.
Hi,
We are trying to setup an SSH Agent Forwarding situation where we "start" by using Putty-CAC (with Pageant-CAC running and loaded with the key) to get to what I call a "jump machine" (this is connection/authentication is implemented via a COTS product).
Then, onnce we are logged into the jump machine, we have an SSH private key in the .ssh dir and the corresponding public key in the .ssh of the target (==target1), and the user can SSH to the the 'target1' machine without entering a password. In the same way, we have agent forwarding configured, so the user can then SSH to the 2nd target (==target2) machine, again with no password.
However, we are having problem with that 2nd hop (to target2) and the user gets prompted for the password :(....
NOTE that if we use just Pageant and Putty, and Putty directly to the jump machine, then the SSH to target1, and then the next SSH to target2, works fine, with no password being entered.
To be clear, I don't know if this is a problem with Putty-CAC... I don't actually know WHAT the problem is, but I am posting this here, to try to maybe get some information.
In a test, I have recorded the same login chain, using both approaches (Putty+Pageant+forwarding) vs. (Putty-CAC+Pageant-CAC+COTS) and using "SSH -vvvv" and comparing the output side-by-side, which I am attaching.
The difference seems to be that the one that works has this:
debug2: key: imported-openssh-key (0x7f109753bc00)
debug2: key: /home/centos/.ssh/identity ((nil))
debug2: key: /home/centos/.ssh/id_rsa ((nil))
debug2: key: /home/centos/.ssh/id_dsa ((nil))
debug2: key: /home/centos/.ssh/id_ecdsa ((nil))
debug3: Wrote 68 bytes for a total of 1317
whereas the one that does not work has just this:
debug2: key: /home/centos/.ssh/identity ((nil))
debug2: key: /home/centos/.ssh/id_rsa ((nil))
debug2: key: /home/centos/.ssh/id_dsa ((nil))
debug2: key: /home/centos/.ssh/id_ecdsa ((nil))
debug3: Wrote 68 bytes for a total of 1317
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
i.e., the one that does not work is missing this line:
debug2: key: imported-openssh-key (0x7f109753bc00)
the "imported-openssh-key" is the private key, so it appears that on the scenario that is not working, for some reason, the SSH is not getting the private key passed to it or something.
Does this make any sense?
Thanks,
Jim
log.txt
Hi,
In the "Pageant Key List" at time four different rows are shown:
CERT-TYPE / KEY LENGTH / FINGERPRINT / COMMENT-NAME
For example,
ssh-rsa 1024 01:02:03:...... my-cert
ssh-rsa 2048 11:12:13:...... CAPI
ssh-rsa 2048 21:22:23:...... CAPI
And as you can see for CAPI certs the name is missing. So, please can you add also the name in this case?
Here can be an example of the suggested format (including the different variants):
ssh-rsa 1024 01:02:03:...... KEY(my-cert)
ssh-rsa 2048 11:12:13:...... CAPI(my-card)
ssh-rsa 2048 21:22:23:...... CAPI(my-card2)
ssh-rsa 2048 31:32:33:...... PKCS(dll-name:my-token)
I feel this can be easy to implement as the name (Comment) it's stored as a simple STRING and it can contain any info.
You agree?
I use Pageant with a Yubikey Neo on Windows 10 version 1703. On version 0.69, when starting Pageant and specifying a certificate name as command prompt argument, I get this error (both on the PIN caching version and on the master branch):
Selecting the certificate manually in Pageant doesn't work either.
Also, selecting the certificate in PuTTY works, but on connection the same error is displayed. Clicking "Copy to clipboard" in the Authentication parameters causes PuTTY to crash.
Greetings.
I've been trying to download https://github.com/NoMoreFood/putty-cac/blob/master/binaries/x64/pageant.exe which I believe is version 0.70.2 .
My Symantec Endpoint Protection is marking it "Infected" with "WS.Reputation.1"
I found version 0.70.1 and it appears that Symantec is happy with this version.
Can you please look into this?
(Side note -- I know this is a github thing and not a you thing, but the "tags" are sorted in a weird way, so 0.70 is above 0.70.u2 and 0.70.u1 even though 0.70.u1/2 are newer.)
I have tried to run version 0.73 Update 1 (64-bit) on two Windows 10 (1909) machines, with the same result: PuTTY does not start. The busy cursor flashes for a brief moment, and then nothing. PuTTY.exe crashes, Pageant.exe works. I haven't tried the other programs.
I compiled the latest version from GitHub on Mingw-w64, and all went smoothly: the program ran without issue, except for one thing: the "Certificate" entry in the settings was missing. It was as if I had compiled the standard PuTTY. Is there some build configuration setting I missed, or is it not possible to compile the "cac" version with Mingw? Anyway, the startup problem could not be reproduced with the Mingw compiled version.
The following error is reported in the event log:
Faulting application name: putty.exe, version: 0.73.0.1, time stamp: 0x5e52e5e3
Faulting module name: putty.exe, version: 0.73.0.1, time stamp: 0x5e52e5e3
Exception code: 0xc0000005
Fault offset: 0x000000000002afb6
Faulting process id: 0x6b44
Faulting application start time: 0x01d5ed78d7a941e6
Faulting application path: C:\Program Files\PuTTY\putty.exe
Faulting module path: C:\Program Files\PuTTY\putty.exe
Report Id: 5a40248f-1bc0-4e6a-9ada-d80932a39c17
Faulting package full name:
Faulting package-relative application ID:
Putty 0.71 has been released and adresses multiple critical vulnerabilities:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
Security fixes found by an EU-funded bug bounty programme:
a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification
potential recycling of random numbers used in cryptography
on Windows, hijacking by a malicious help file in the same directory as the executable
on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding
multiple denial-of-service attacks that can be triggered by writing to the terminal
Merge putty 0.70 upstream fixes into putty-cac
Would you mind, if I create a package for https://chocolatey.org/ ?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.