See
chapter 9
for more information about Pageant in general.
4.21.4 ‘Attempt TIS or CryptoCard authentication’
TIS and CryptoCard authentication are (despite their names) generic forms of simple challenge/response authentication available in SSH protocol version 1 only. You might use them if you were using S/Key one-time passwords, for example, or if you had a physical security token that generated responses to authentication challenges. They can even be used to prompt for simple passwords.
With this switch enabled, PuTTY will attempt these forms of authentication if the server is willing to try them. You will be presented with a challenge string (which may be different every time) and must supply the correct response in order to log in. If your server supports this, you should talk to your system administrator about precisely what form these challenges and responses take.
4.21.5 ‘Attempt keyboard-interactive authentication’
The SSH-2 equivalent of TIS authentication is called ‘keyboard-interactive’. It is a flexible authentication method using an arbitrary sequence of requests and responses; so it is not only useful for challenge/response mechanisms such as S/Key, but it can also be used for (for example) asking the user for a new password when the old one has expired.
PuTTY leaves this option enabled by default, but supplies a switch to turn it off in case you should have trouble with it.
4.21.6 ‘Allow agent forwarding’
This option allows the SSH server to open forwarded connections back to your local copy of Pageant. If you are not running Pageant, this option will do nothing.
See
chapter 9
for general information on Pageant, and
section 9.4
for information on agent forwarding. Note that there is a security
risk involved with enabling this option; see
section 9.5
for details.
4.21.7 ‘Allow attempted changes of username in SSH-2’
In the SSH-1 protocol, it is impossible to change username after failing to authenticate. So if you mis-type your username at the PuTTY ‘login as:’ prompt, you will not be able to change it except by restarting PuTTY.
The SSH-2 protocol does allow changes of username, in principle, but does not make it mandatory for SSH-2 servers to accept them. In particular, OpenSSH does not accept a change of username; once you have sent one username, it will reject attempts to try to authenticate as another user. (Depending on the version of OpenSSH, it may quietly return failure for all login attempts, or it may send an error message.)
For this reason, PuTTY will by default not prompt you for your username more than once, in case the server complains. If you know your server can cope with it, you can enable the ‘Allow attempted changes of username’ option to modify PuTTY's behaviour.
4.21.8 ‘Private key file for authentication’
This box is where you enter the name of your private key file if you are using public key authentication. See
chapter 8
for
information about public key authentication in SSH.
This key must be in PuTTY's native format (*.PPK). If you have a private key in another format that you want to use with PuTTY, see
section 8.2.12
.
You can use the authentication agent Pageant so that you do not need to explicitly configure a key here; see
chapter 9
. If a file is
specified here with Pageant running, PuTTY will first try asking Pageant to authenticate with that key, and ignore any other keys Pageant may have. If that fails, PuTTY will ask for a passphrase as normal.
4.22 The GSSAPI panel
The ‘GSSAPI’ subpanel of the ‘Auth’ panel controls the use of GSSAPI authentication. This is a mechanism which delegates the authentication exchange to a library elsewhere on the client machine, which in principle can authenticate in many different ways but in practice is usually used with the Kerberos single sign-on protocol.