Pageant Fails to Generate OpenSSH Config

Pageant fails to generate OpenSSH config because it relies on the legacy PuTTY registry format, whereas modern Windows SSH clients require the authorized_keys file in the .ssh directory. To resolve this, you must manually export your keys from Pageant or PuTTYgen into the correct OpenSSH PEM or private key format and place them in the proper user profile location.

Understanding the Architecture Mismatch

The core issue stems from a fundamental difference in how authentication agents handle key storage. Pageant is part of the PuTTY suite, which stores all configuration data, including loaded keys, within the Windows Registry under HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys and related subkeys. It acts as an agent that holds decrypted private keys in memory for use by PuTTY and other PuTTY-based tools. In contrast, the OpenSSH client bundled with modern versions of Windows (starting from Windows 10 version 1809) does not read from the PuTTY registry. Instead, it expects private keys to be stored as files in the %USERPROFILE%\.ssh directory. Specifically, it looks for files named after the host (e.g., id_rsa, id_ed25519) or specified via the -i flag. Because Pageant operates entirely within the registry and memory space, it has no native mechanism to write these file-based configurations directly into the OpenSSH folder structure. This architectural disconnect means that even if Pageant successfully authenticates you when using PuTTY, the native Windows OpenSSH client remains unaware of your credentials.

The Role of ssh-agent.exe

Windows includes its own implementation of the standard SSH agent called ssh-agent.exe. This service is designed specifically to work with the OpenSSH client ecosystem. If you are trying to make Pageant "generate" config for OpenSSH, you are likely attempting to bridge two incompatible systems. The correct approach is not to force Pageant to create files, but to either migrate your workflow to use ssh-agent.exe or to manually convert your keys so they can be used by both systems independently.

Manual Key Conversion Process

Since automatic generation is not supported, you must perform a manual conversion. This involves exporting your existing key from the PuTTY ecosystem and converting it to a format that OpenSSH understands. You will need the puttygen.exe utility, which is included in the PuTTY installation package. First, launch puttygen.exe. If you have previously saved a PuTTY private key file (with a .ppk extension), click on Load and select that file. If your key is only stored in the Windows Registry and was loaded directly into Pageant without saving to disk, you may need to load it from the registry by clicking Load and selecting the specific key entry if available, though typically keys must be saved as .ppk files first to be portable. Once the key is loaded in PuTTYgen, verify that the public key displayed matches what you expect. Navigate to the Conversions menu at the top of the window. Select Export OpenSSH key. Note that older versions of PuTTYgen might label this as Save private key after ensuring the format is set to OpenSSH. Save this file to your %USERPROFILE%\.ssh directory. Name it appropriately, such as id_ed25519 or id_rsa, depending on the key type. Ensure the file permissions are restricted to your user account, as OpenSSH will refuse to use keys that are readable by others. Troubleshooting SSH Connection Issues with PuTTY on Windows PC provides additional context on verifying key integrity and connection parameters, which is useful once you have moved away from Pageant.

Configuring OpenSSH to Use the Converted Key

After placing the converted private key file in the .ssh folder, you need to ensure the OpenSSH client knows where to find it. While OpenSSH often auto-detects standard names like id_rsa or id_ed25519, explicit configuration is more reliable. You can configure this globally by editing the ~/.ssh/config file. Create this file if it does not exist. Add a block for your specific server:

Host myserver
    HostName example.com
    User username
    IdentityFile ~/.ssh/id_ed25519

Alternatively, you can specify the key directly in the command line using the -i flag:

ssh -i ~/.ssh/id_ed25519 [email protected]

If you prefer to keep using Pageant for other applications but want OpenSSH to work, you cannot link them directly. However, you can use pageant.exe alongside ssh-agent.exe if you migrate your keys to the Windows credential manager or use the plink.exe tool with the --agent flag, though this still does not integrate with the native ssh.exe client's file-based expectations.

Migrating to Native Windows SSH Agent

For a cleaner long-term solution, consider abandoning Pageant for Windows-native workflows. You can add your private keys to the built-in ssh-agent service. First, ensure the service is running by executing:

Get-Service ssh-agent | Start-Service

Then, add your converted private key to the agent:

ssh-add ~/.ssh/id_ed25519

This allows you to use the native ssh command without specifying the key file every time, mimicking the convenience of Pageant while staying within the OpenSSH ecosystem. This method is generally more stable on modern Windows updates and integrates better with Git for Windows and other developer tools that rely on standard SSH protocols. SSH Hostname Not Bound to IP on Windows Device: Still Works? explores network-level connectivity issues that may arise during these migration steps, ensuring your DNS resolution is not conflated with authentication failures.

Verifying the Setup

To confirm that your new setup works, attempt to connect to your remote server using the verbose mode of the SSH client. Run:

ssh -v [email protected]

Look for lines indicating that the identity file is being offered for authentication. If you see messages about Offering public key followed by Server accepts key, your configuration is successful. If you encounter permission denied errors, double-check the file permissions of the private key and ensure the corresponding public key is correctly installed on the remote server's ~/.ssh/authorized_keys file.

Frequently Asked Questions

Can I make Pageant automatically update the .ssh folder?

No, Pageant does not have a feature to write files to the disk or monitor the Windows filesystem for changes. It is strictly a memory-based agent that reads from the registry. Any synchronization between Pageant and OpenSSH must be done manually through key export and import processes.

Why does ssh.exe reject my .ppk key file?

The native OpenSSH client does not support the proprietary PuTTY .ppk format. It requires keys in PEM or OpenSSH-specific formats. You must use puttygen.exe to convert the .ppk file to an OpenSSH-compatible private key before ssh.exe can utilize it.

Is it safe to run both Pageant and ssh-agent simultaneously?

Yes, it is safe to run both agents at the same time. They operate on different sockets and do not interfere with each other. However, you must explicitly tell each SSH client (PuTTY vs. OpenSSH) which agent to use, as they do not share keys across different agent implementations.

How do I fix permission denied errors after moving keys?

OpenSSH enforces strict file permissions. On Windows, ensure that the private key file in .ssh is only accessible by your user account. Right-click the file, go to Properties > Security, and remove access for Groups and Users except for your specific account. Additionally, ensure the .ssh folder itself has appropriate permissions.

What should I do if my public key doesn't match the private one?

Verify that you exported the correct private key from PuTTYgen. The public key displayed in PuTTYgen should match the content of your authorized_keys file on the server. If they differ, re-export the private key and regenerate the public key pair to ensure consistency between your local machine and the remote server.