PuTTY CAC
PuTTY CAC is a fork of PuTTY, a popular Secure Shell (SSH) terminal. PuTTY CAC adds the ability to use the Windows Certificate API (CAPI), Public Key Cryptography Standards (PKCS) libraries, or Fast Identity Online (FIDO) keys to perform SSH public key authentication using a private key associated with a certificate that is stored on a hardware token.
PuTTY CAC can be used with many types of cryptographic tokens such as Yubikeys and popular smart card models. The 'CAC' in 'PuTTY CAC' refers to Common Access Card, a smart card token used for US Government facilities which was one of the initial drivers for the development of PuTTY CAC.
PuTTY CAC is maintained independently from the US Government by the open source community.
You can download the latest release of PuTTY CAC here: https://github.com/NoMoreFood/putty-cac/releases
PuTTY CAC source code and binaries are free to use for any purpose. The license can be found here: https://github.com/NoMoreFood/putty-cac/blob/master/code/LICENCE
Prerequisites
- Microsoft Windows 10 or Later
- For CAPI support, an appropriate Windows smart card mini-driver must be installed. This is typically provided by the smart card manufacturer although many common hardware tokens are supported by OpenSC.
- For PKCS support, a PKCS #11 library (typically a DLL file) is needed to interface with the hardware token. This is typically provided by the smart card manufacturer although many common hardware tokens are supported by OpenSC.
- For FIDO support, a FIDO key supported by Windows 10.
Usage
You can find a basic set of instructions on the usage of United States Government's ID Management website under the 'SSH Using PuTTY-CAC' section:
https://playbooks.idmanagement.gov/piv/engineer/ssh/
Command Line Usage
PuTTY CAC supports the same command line options as PuTTY with some additional, specialized options for PuTTY CAC specifically.
In place of a PuTTY key file path for any PuTTY utility, you can specific certificate thumbprint or application identifier. For example:
- Connect to user@host using the certificate with thumbprint '716B8B58D8F2C3A7F98F3F645161B1BF9818B689' the user certificate store:
putty.exe user@host -i CAPI:716B8B58D8F2C3A7F98F3F645161B1BF9818B689
- Connect to user@host using the certificate with thumbprint 'B8B58D8F2C3A7F98F3F645161B1BF9818B689716' using PKCS library 'PKCS.dll':
putty.exe user@host -i PKCS:B8B58D8F2C3A7F98F3F645161B1BF9818B689716=C:\PKCS.dll