If you have a habit of connecting to the same remote machines often, set up a Saved Session, which remembers the settings for that connection so that you can reuse them. This is similar to the OpenSSH and Tectia feature of configuration files, but with a GUI. [7.1.2] Simply configure PuTTY the way you like it, then save that configuration under a name, such as “My Favorite Settings” or “office.”

When you create and name a Saved Session, it becomes available not only to PuTTY, but also to the other programs in PuTTY’s suite, such as PSCP and Plink. Just provide the saved session’s name in place of a hostname. For example, if you created a Saved Session called “office” to stand for employer.example.com, you could run:

    C:\> plink office

and it will connect to employer.example.com.

Saved Sessions are stored in the Windows registry under the key \HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions.

Like other SSH implementations, PuTTY records the host keys of SSH servers it encounters. They are stored in the Windows registry under the key \HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys.

We always recommend you use the SSH-2 protocol, since it is more secure and robust than the original SSH-1. Nevertheless, PuTTY does support both protocols, and you can choose your preferred protocol on the PuTTY Configuration dialog, under Connection/SSH. The choices are:

With Plink, you can force the protocol version with the -1 (SSH-1 only) and -2 (SSH-2) options:

    C:\> plink -2 smith@server.example.com

SSH uses TCP/IP as its transport mechanism, and PuTTY gives you control over some TCP-related settings.

    C:\> plink -P 12345 smith@server.example.com

SSH clients allocate a pseudo-terminal on the server machine: a software abstraction representing a computer terminal. [7.4.6.5] PuTTY does this by default, but you can prevent this in the PuTTY Configuration dialog, under Connection/SSH.

Because PuTTY is designed as a terminal client, which is interactive, you generally can leave this setting alone. But if you’re using PuTTY noninteractively, say, only to set up port forwarding—you don’t strictly need a pseudo-terminal. If you’re using Plink, you can disable pseudo-terminal allocation with the -T option or leave it enabled with -t.

PuTTY supports SOCKS, an application-layer network proxying system supported by various SSH implementations. [7.4.7] You can enable it in the PuTTY Configuration dialog, under Connection/Proxy.

On the Connection/SSH section of the PuTTY Configuration dialog, you can choose the encryption algorithms (ciphers) acceptable to the client. [7.4.9] Any algorithms appearing below the line “--warn below here--” will cause PuTTY to display a warning before they are used.

For most people, the defaults are fine. But if, say, a security hole were found in one of the algorithms (say, Blowfish), you could move it below the line, and PuTTY will warn before using it.

PuTTY supports the following authentication types: password, public-key, challenge-response (a.k.a. keyboard-interactive), and TIS. [7.4.13] Password authentication works by default. Public-key authentication requires you to set up a key, as we’ve seen. [2.4] Challenge-response authentication is enabled in the PuTTY Configuration dialog, under Connection/SSH/Auth. [5.4.5]

TIS authentication is uncommon: it authenticates users via the Gauntlet firewall toolkit from Trusted Information Systems. It works only for the SSH-1 protocol so we recommend against using it. That being said, it is enabled in the PuTTY Configuration dialog, under Connection/SSH/Auth.

The data flowing between the SSH client and server may optionally be compressed to save bandwidth. [7.4.14] To enable compression, open the PuTTY Configuration dialog and look under Connection/SSH. If you’re using Plink, add the -C option to enable compression:

    C:\> plink -C smith@server.example.com

If you’re having a connection problem with PuTTY, you can capture the session data in a file. Open the PuTTY Configuration dialog and look under Session/Logging. Here you select the file to receive the data, and four different settings:

If you’re using Plink, you can display diagnostic information with the -v option:

    C:\> plink -v smith@server.example.com
    Server version: SSH-1.99-OpenSSH_3.8.1p1
    We claim version: SSH-2.0-PuTTY-Release-0.56
    Using SSH protocol version 2
    Doing Diffie-Hellman group exchange
    Doing Diffie-Hellman key exchange
    Host key fingerprint is:
    ssh-dss 1024 80:de:c6:fa:f7:82:4f:c7:c4:8c:1f:6f:d4:40:4b:0e
    Initialised AES-256 client->server encryption
    Initialised AES-256 server->client encryption
    ...

SSH can be used within batch jobs to secure their communications. [11.1] With PuTTY, batch jobs are most easily done with Plink and its -batch option:

    C:\> plink -batch smith@server.example.com my-job

The -batch option suppresses all user prompts. But wait: just because you’ve disabled prompts doesn’t automatically authenticate you. You’ll also need to set up passwordless authentication. Otherwise, you’ll simply fail to authenticate, prompts or no.