Putty with Pageant Bridge

Connect over SSH using Putty via KeeperPAM

Keeper's SSH Agent integrates seamlessly with Putty for authentication, ensuring private keys are securely stored in the Keeper Vault instead of being saved locally on the device. This approach enhances security by protecting sensitive keys from local exposure.

In this guide, we'll configure Putty authentication for use with managed keys secured by Keeper. Using distinct keys for authentication and signing helps maintain a clear separation of roles, further strengthening your security posture.

Prerequisites

• Ensure that SSH Agent is active on the Keeper Desktop

• Ensure Pageant Bridge is installed

Pageant Bridge Install

The "Pageant bridge" functions as a translation layer or proxy service, utilizing utilities like wsl-ssh-pageant or winssh-pageant to facilitate communication between PuTTY's Pageant agent and diverse environments, including native Windows OpenSSH, WSL, or Cygwin.

Standard OpenSSH clients and modern Linux/WSL tools cannot natively communicate with PuTTY's Pageant, which relies on a Windows messaging system (WM_COPYDATA).

Install Pagaent via Powershell

winget install -e --id NathanBeals.WinSSH-Pageant

NOTE: Be mindful of the privileges you install Pageant with. If you utilized an elevated powershell (Admin), you will have to run Putty with admin privileges. If you install Pagaent as local user, Putty too must be run as local user.

Configure Putty

Configure Putty to utilize Pageant Bridge to pass Keeper Tunnel credentials to Putty. In Putty select Connection -> SSH -> Auth and make sure Attempt authentication using Pageant is selected. Also make sure Allow agent forwarding is selected.

Configure Keeper Desktop

Now login to your Keeper Desktop Application, select the endpoint you are attempting to connect to and start your tunnel.

Next make sure your SSH Agent is started and sharing the credentials of the endpoint your are connecting to (Select the circled “?” next to the SSH command):

Now you should see the Agent settings and credentials:

In putty set the local host and port. Make sure to use USERNAME@127.0.0.1 (In this example linuxuser):

NOTES: You can also enter the username in the Putty settings by Connection -> Data and under Auto-login username: USERNAME without setting it in the hostname field. 1st Time Launch you will receive a pop-up from Keeper asking to authorize access to your key. You can authorize and select DOn’t ask again to suppress this on subsequent logins.

Launch the Putty connection and the SSH agent will deliver the SSH key for authentication.