SSH Access

What is SSH?

If you have been granted access to a Lafayette hosted server, you’ll need to use SSH (Secure SHell) to connect.

SSH keys provide an increased security option for authenticating to shared and service-related systems. The following instructions detail how to create SSH key pairs for use with UNIX-like and Windows systems.

SSH keys on Linux, macOS, and Windows

The ssh-keygen utility is used to generate SSH keys.

UNIX-like systems primarily include Linux and macOS.  These provide ssh-keygen natively as part of OpenSSH.

Windows also provides ssh-keygen as part of OpenSSH, but only from Windows 10 onward.

Older versions of Windows, i.e., Windows 7 and early releases of Windows 10 did not preinstall OpenSSH.  An installation of software that includes OpenSSH such as PuTTy or MobaXterm is required.

The ssh-keygen command generates cryptographic keys in OpenSSH format.  This format refers to the compact single-line string structure that is ideal for use with UNIX-like systems, i.e., authorized_keys.  This is the required format for College systems and OpenSSH formatted keys using the Ed25519 algorithm is the current standard for SSH authentication.

The OpenSSH format comprises three fields:

  • Field 1 is the algorithm used, i.e., ssh-ed25519.
  • Field 2 is the key “blob”, a Base64 encoded string encompassing the key parameters (the algorithm type, length, name and public key bytes).  This field is always exactly 68 characters in length.
  • Field 3 is a comment field providing an optional descriptor.  This field serves to identify which account and system the key belongs to, defaulting to the user@hostname format.

An example OpenSSH formatted key appears below where the three fields can be clearly seen:

ssh-ed25519 AAAAB3NzaC1yc…[truncated]…3NzaC1yc user@hostname

NOTE:  Keys provided using the PEM or SECSH (RFC 4716) public key file formats cannot be accepted.

Create an SSH key

Checking for Existing SSH Keys

Before creating a new key, time may be saved by checking to see if you already have one.  A single SSH key can be used to access multiple servers, though security policy may state otherwise.

To check for the presence of keys on your computer, list the contents of the .ssh directory as below:

ls -al ~/.ssh

Files prefixed “id_” indicate the presence of one or more keys.

If the .ssh directory does not exist, or is empty, The steps for generating an SSH key will need to followed.

A usable SSH key will be indicated by the presence of two files named id_ed25519 and id_ed25519.pub.

Differences with Linux/macOS systems

Generating an SSH key from a system running Linux or macOS is largely the same.

The main difference between the two is that with macOS, the home directory is /Users.  With all distributions of Linux, the home directory is /home.

The steps for generating keys are otherwise identical and the only difference is the directory path required to locate the files.

Differences with Windows systems

Generating an SSH key from a system running Windows involves a little nuance.  The version of Windows is a factor, as is the multiple software programs that provide SSH functionality.

Where Windows does not provide the necessary functions, the steps to create and manage SSH keys are generally integrated within a specific program.  Examples of Windows software include PuTTY and MobaXTerm.  These and other similar programs are designed for accessing remote systems.

To generate an SSH key, follow the instructions…

Alternatively, Windows users can set up Git Bash (https://gitforwindows.org/) or Windows Subsystem for Linux (https://docs.microsoft.com/en-us/windows/wsl/about)

…follow the instructions for Mac / Linux users.

The files comprising SSH keys

When the ssh-keygen utility is used to generate SSH keys, it produces two files in the appropriate format. These files are named with a prefix id_ followed by the algorithm used, with the public key written to the file with the .pub extension. The private key file has no extension. These files, by default, are saved to a directory named .ssh in the user’s home directory.

NOTE:  Linux and macOS directories with names starting with a period, referred to as dot files, are hidden. This is by design, to reduce clutter in your home directory.

$HOME/.ssh/

The two key files, together are referred to as a key pair.  Each key pair comprises a private (secret) key, and a public key.  The public key can be distributed as freely as necessary.

Once a key has been generated, navigate to the .ssh directory and either copy the .pub file or its contents (it can be opened using any text editor). This information can then shared as widely as needed using a preferred method of communication to those administering the system(s) to be accessed.

Applying a Passphrase to your SSH key

This process of generating an SSH will request a passphrase.

The passphrase may be empty to indicate no passphrase (host keys must have an empty passphrase), or it may be a string of arbitrary length.

Enter a passphrase for using your key. The passphrase you enter is used to encrypt your private key. A good passphrase should be alphanumeric having 10-30 character length. A null passphrase can be used, however, this will result in a low level of security.

Key Generation step-by-step

The steps for creating SSH keys using the ssh-keygen tool are as follows:

Launch your preferred terminal program and start the ssh-keygen tool using the command below:

ssh-keygen -t ed25519 -C netID@computer
Generating public/private ed25519 key pair.

The tool will respond by requesting a filename, i.e., a full path to the directory where ssh-keygen will write the key files.  Enter the path and a filename for the file that will hold the key:

Enter file in which to save the key (/home/user/.ssh/id_ed25519):

Enter the preferred file name, or hit enter and the default id_ filename will be used.

NOTE:  If a key already exists using the default file names, ssh-keygen will request overwrite confirmation.  It would be advisable to select No to this action. Then confirm whether the existing key is in use.

/home/user/.ssh/id_ed25519 already exists.
Overwrite (y/n)?

Enter a passphrase for using your key.

Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Re-enter the passphrase to confirm it.

The process for generating a key with ssh-keygen is complete and the location of the key files is confirmed:

Your identification has been saved in [filename]
Your public key has been saved in [filename].pub
/home/[username]/.ssh/[filename].pub.
The key fingerprint is:
SHA256:UqU2WDrh5ueCBPw9dfokFYn2ZnSsqtOgqBIRf04QnpU [user]@[computer]

Check the Passphrase Key: The private key was saved in .ssh/id_ed25519 file which is the read-only file. No one else must see the content of that file, as it is used to decrypt all correspondence encrypted with the public key. The public key is save in .ssh/id_ed25519.pub file.

Provide the contents of the id_ed25519.pub file to the appropriate party for access to the server.

Key Generation on Windows

If you’re using Windows, then you will generate your key using PuTTY by copying and pasting the key from the Key Generator using the instructions available at:

By default PuTTY generates keys in PEM or SECSH Public Key File Format. This is not the desired format so please copy and paste your key as described in the directions above so that you can send it in OpenSSH format.

SSH Keys for Firebird HPC Access

An SSH key is required for access to Firebird using terminal software.  The SSH key replaces the need for a password to log in, providing a more secure means for authentication.

Once an SSH key has been generated using the guidance for your platform, i.e., Linux, macOS, or Windows.  Provide the systems administrator with your public key.

NOTE:  The private key must always be kept secret.  Sharing a private key is no different from sharing your password.  If the secret is compromised, you must generate a new SSH key.

Tagged in: