Automation of SFTP script when key has passphrase

My objective is to call some SFTP scripts from SSIS packages, but so far I am experimenting with just running a script from a DOS command window. My example does a simple put from my Windows XP Pro workstation (with WinSCP installed) to another Windows XP workstation with OpenSSH installed.

I am using RSA private/public key encryption.

When I set up the keys, I entered a passphrase, because I understand that this is good practice.

However, when I run the script, the SFTP program prompts for the passphrase to complete the authorisation. I see no way to include the passphrase in a flag in the open command. This makes the process non-automated because it requires user interaction.

Additionally, sometimes I find that I must execute the script *twice* in order for the little text file to be copied from my PC to the remote PC. This seems wrong.

I should be grateful for assistance.

I found the following page in the FAQ collection, entitled, "How can I connect without entering private key passphrase each time?"
https://beta.winscp.net/eng/docs/faq_passphrase

If I understand this FAQ entry correctly, it would appear that what I was trying to do will not work with WinSCP; so the answer is to work without a passphrase or to use a different SSH FTP client.

Is this correct?

Correct.

Edit 2021: There's now -passphrase switch:
https://beta.winscp.net/eng/docs/scriptcommand_open#passphrase

Okay thanks for that confirmation.
:D

I am also curious about the automatic sending of files. I had a similar experience where I scheduled a task using winscp but the process was definitely not automatic because I had to enter my password everytime the task ran. Is there a way to send the password? Would using a batch command allow me to send the password? I am not too worried about security in my instance. I read what was posted by the others and I am led to believe it cannot be done with WinSCP. I am trying the public/private key approach but cannot seem to get it to work yet.

Please let me know your thoughts and ideas.

Thank you in advance for your help.

In the article:
How can I connect without entering private key passphrase each time?
I saw the following:

The best solution is to use authentication agent, so that you enter the passphrase only once.
If you need to avoid entering the passphrase to automate a task (such as with scripting) and using authentication agent is not suitable for you, you can store the key unprotected (without an passphrase). Note that this imposes security risk, if someone gains access to the key.

How do I store the key unprotected?

Thanks for your help.

@martin, thank you for clarifying the situation for me. I have got this working quite well now.

Isager asked: "How do I store the key unprotected?"

When you create a private key, you can add extra security into the mix by defining a passphrase (this is not the password of a user). This passphrase must be supplied by the user when you make a connexion to the SSH server (unless you use the authentication agent thing - which I have no experience of).

This means that if you want to build an unattended solution using WinSCP you cannot also have a passphrase built into your private key; if you do, you will have to physically enter it interactively. So I simply accepted the reduced level of security and left the passphrase out of process of generating the key pair.

I hope this helps.

Thank you so much for responding so quickly.
I think I did what you suggested in your reply. I left the passphrase out when generating the key.

I think my additional difficulty may be in where to put the public key on the server. My sftp server is windows. I do not have a .ssh directory nor can I create one.

What exactly do I have to do to put the public key out on the sftp server? I thought I just copied and pasted the key into the authenticate_keys file but I am unclear on the process.

Do I have to be running Pageant for this to work?

Please give me as many details as you can. I really appreciate your help.

Thanks.

My dev & test platform is also a Windows environment. I was unable to get a version of SSH for Windows to instal on Windows Server 2003, which was my preferred method, and I have since found out that there are issues with Windows Server 2003, so I ended up using two Windows XP boxes for my development. One acts as the SSH server and one is the client running SFTP/WinSCP.

You have to instal OpenSSH or some other implementation of SSH for Windows on the machine that is to act as the SSH server.

I also could not create a folder called .ssh but I was able to create a folder called SSH within the home folder of the user I used, i.e. C:\Documents and Settings\UserOne\SSH. Inside the SSH folder I put the public key file, called authorized_keys if I remember correctly. This file contains one of more public keys. You should keep your private key file(s) on your client machines.

You have to do a bunch of setup steps with SSH to include users that can be accessed by your client piece. You end up creating a groups file and a password file. The users that you add must correspond to users on the machine or users on the domain. Setting up SSH is a subject in itself and I did the bare minimum, just to get a test scenario running, since in production the SSH part is not my responsibility.

I do not run pageant in my solution so I cannot comment on its use.