Automation of SFTP script when key has passphrase

My objective is to call some SFTP scripts from SSIS packages, but so far I am experimenting with just running a script from a DOS command window. My example does a simple put from my Windows XP Pro workstation (with WinSCP installed) to another Windows XP workstation with OpenSSH installed.

I am using RSA private/public key encryption.

When I set up the keys, I entered a passphrase, because I understand that this is good practice.

However, when I run the script, the SFTP program prompts for the passphrase to complete the authorisation. I see no way to include the passphrase in a flag in the open command. This makes the process non-automated because it requires user interaction.

Additionally, sometimes I find that I must execute the script *twice* in order for the little text file to be copied from my PC to the remote PC. This seems wrong.

I should be grateful for assistance.

I found the following page in the FAQ collection, entitled, "How can I connect without entering private key passphrase each time?"
https://beta.winscp.net/eng/docs/faq_passphrase

If I understand this FAQ entry correctly, it would appear that what I was trying to do will not work with WinSCP; so the answer is to work without a passphrase or to use a different SSH FTP client.

Is this correct?

Correct.

Edit 2021: There's now -passphrase switch:
https://beta.winscp.net/eng/docs/scriptcommand_open#passphrase

Okay thanks for that confirmation.
:D

I am also curious about the automatic sending of files. I had a similar experience where I scheduled a task using winscp but the process was definitely not automatic because I had to enter my password everytime the task ran. Is there a way to send the password? Would using a batch command allow me to send the password? I am not too worried about security in my instance. I read what was posted by the others and I am led to believe it cannot be done with WinSCP. I am trying the public/private key approach but cannot seem to get it to work yet.

Please let me know your thoughts and ideas.

Thank you in advance for your help.

In the article:
How can I connect without entering private key passphrase each time?
I saw the following:

The best solution is to use authentication agent, so that you enter the passphrase only once.
If you need to avoid entering the passphrase to automate a task (such as with scripting) and using authentication agent is not suitable for you, you can store the key unprotected (without an passphrase). Note that this imposes security risk, if someone gains access to the key.

How do I store the key unprotected?

Thanks for your help.

@martin, thank you for clarifying the situation for me. I have got this working quite well now.

Isager asked: "How do I store the key unprotected?"

When you create a private key, you can add extra security into the mix by defining a passphrase (this is not the password of a user). This passphrase must be supplied by the user when you make a connexion to the SSH server (unless you use the authentication agent thing - which I have no experience of).

This means that if you want to build an unattended solution using WinSCP you cannot also have a passphrase built into your private key; if you do, you will have to physically enter it interactively. So I simply accepted the reduced level of security and left the passphrase out of process of generating the key pair.

I hope this helps.