Connect to a server via ssh¶

• Overview
• Create an ssh keypair
  • On Linux/Mac/Windows10
  • On older Windows
• Add the public ssh key to the authorized_keys file
  • Option 1: Use ssh-copy-id from your laptop/computer
  • Option 2: Use a terminal-based text editor from the server
• Login to a server via ssh
• Common issues
  • I set up my ssh key pair but I still can't log in
  • "Remote host identification has changed" error message
• Requesting support

Overview¶

ssh keys offer stronger security than password authentication and are highly resistant to brute-force attacks. Each key pair consists of a public key with extension .pub and a private key. Public ssh keys may be transferred to the machine you would like to connect to, while private keys are kept on the machine where they were generated.

Create an ssh keypair¶

On Linux/Mac/Windows¶

ssh-keygen -t ed25519

The above command will prompt you to set a password to unlock the key. If you accept the default options offered by the ssh-keygen command it subsequently generates two files named id_ed25519.pub and id_ed25519 and saves them under /home/<user>/.ssh/.

These files can be confirmed / displayed using

ls ~/.ssh

which should show something similar to id_ed25519 id_ed25519.pub known_hosts, depending on whether default options were chosen during generation.

To display the content of the id_ed25519.pub file, which is the public half of your key, you can issue:

cat ~/.ssh/id_ed25519.pub

which displays something like

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaVb7jqPwhxFvY8ZcZ4OQ8F0o9yNfP2t9JH6Jt0O2n7 user@host

On older Windows¶

Windows 10 and 11 have OpenSSH available via Powershell. See this ssh tutorial for more details. If you don't have the ssh command available in Powershell, see Microsoft's openssh overview.

Add the public ssh key to the authorized_keys file¶

The public ssh key can be added to the authorized_keys file on the server you would like to connect to, i.e. ScienceCluster login node or an instance on ScienceCloud.

Once you have located or received the public ssh key, you have two options when doing so: either using the ssh-copy-id command from your laptop/computer or a terminal-based text editor from the server.

Option 1: Use ssh-copy-id from your laptop/computer¶

You can use ssh-copy-id from Mac, Linux or WSL on Windows.

To add the public ssh key to ScienceCluster:

ssh-copy-id -i ~/path_to_local_key/your_public_key_name.pub shortname@cluster.s3it.uzh.ch

To add the public ssh key to the server on ScienceCloud:

ssh-copy-id -i ~/path_to_local_key/your_public_key_name.pub user@ipaddress

This will add the public ssh key to ScienceCluster or to the server on ScienceCloud, stored as a new line in the file ~/.ssh/authorized_keys.

Option 2: Use a terminal-based text editor from the server¶

Using a terminal-based text editor to edit the authorized_keys file is also an option if you prefer a more manual approach.

First, it is suggested to make a backup of the existing authorized_keys file (if there is one), in case you make any errors during this process.

cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys_copy

To add a new public ssh key open the authorized_keys file with the nano text editor

nano ~/.ssh/authorized_keys

This command will open the nano text editor and allow you to edit the new authorized_keys file.

To add a new public ssh key, simply move the cursor to a new line and paste the desired public ssh key. For reference, you can print the value of your public key if you run cat ~/path_to_local_key/your_public_key_name.pub from the laptop/computer where you generated the key pair. The entire printed value will be what you copy/paste into the ~/.ssh/authorized_keys file on the server.

When you are finished, exit the nano editor with CTRL+x. To confirm type y then ENTER.

Before you close the connection, open a second connection to the instance to verify that you have not corrupted the authorized_keys file. If you have any trouble establishing a new connection to the same instance, consider restoring the file from the backup copy: mv ~/.ssh/authorized_keys_copy ~/.ssh/authorized_keys.

Login to a server via ssh¶

Once you have added the public ssh key to the authorized_keys file, you can verify that the ssh login to ScienceCluster or to the ScienceCloud server works with the new key pair by adding -i ~/.ssh/your_private_key to the ssh command.

The login should now complete without asking for a password. Note that the command might ask for the passphrase you specified for the key.

Common issues¶

I set up my ssh key pair but I still can't log in¶

A common issue with the key authentication is incorrect permissions on the home directory, .ssh directory, or the .ssh/authorized_keys file on the server. The home directory should be writable only by the owner while the other two should be accessible only by the owner. You can set the correct permissions by connecting via ssh to the server and running the following commands:

chmod 750 $HOME
chmod 700 $HOME/.ssh
chmod 600 $HOME/.ssh/authorized_keys

If you aren't prompted for your password, try adding this options -o PubkeyAuthentication=no -o PreferredAuthentications=password to the ssh command.

"Remote host identification has changed" error message¶

It is a perfectly normal behaviour: when you connect to an host that gets the host keys regenerated and your ssh client, i.e. your laptop/computer, expects them to be the same as before.

To fix the problem take a close look at the warning message, in particular to the line Offending ED25519 key in _ <PATH_TO_YOUR_HOME_DIR>/_.ssh/known_hosts:.

The .ssh/known_hosts file is located in your home directory on the ssh client where the ssh key pair was created, and stores the host keys for hosts you have ever connected to.

You can either delete the offending line from the ~/.ssh/known_hosts file or run the ssh-keygen command with option -R.

This command will remove the host key corresponding to the ScienceCluster or ScienceCloud instance IP address from your known_hosts file.

Once you reconnect you will be prompted to accept a new host key and upon doing that no warning message should display.

Requesting support¶

Please add -vvv to your ssh command, which prints a verbose output.

For example, if connecting to ScienceCluster:

ssh -vvv shortname@cluster.s3it.uzh.ch

and contact Science IT with the output as text or a screenshot.