Setting up ssh Key Access to the Cluster

A major weakness of using passwords for security is that passwords have to be stored permanently on the remote system. You may have noticed that there is a recent movement towards “passkeys” for many digital services, for the same reason. Using keys has the following advantages:

• There is no need to remember a long and complicated password
• Keys come in pairs - a private key, which never leaves your own system, and a public key, which is stored on the remote system. The public key is useless without the private key, so it can be shared safely.
• Once keys have been set up, logging into the system is easier, faster and safer.

Henceforth, access to Lengau will be by means of keys only. Password access is temporary and will be withdrawn after the first login.

This is the process for logging into Lengau for the first time once services have been restored:

1. Login to the CHPC User Portal using your username and password.
2. Complete MFA verification using the 6-digit code sent to your email (valid for 2 hours).
3. Configure and download your unique VPN profile, then connect to the CHPC VPN.
4. Create your SSH keys (if none exist) and copy the contents of public key to a text file.
5. Load the contents of the public key file onto the cluster through the ssh-keys management page on the user portal.
6. SSH to Lengau using your CHPC username. If you have not loaded the keys at the previous step, you will be prompted to do so now at the login prompt.

1. The process of generating a private / public key pair is very similar across the various platforms
2. It is very easy to generate the key pair from a command line. Using the menu interface in a GUI-based application is slightly more complicated.
3. Once you have an appropriate key pair, you can use the same private key on different workstations, different operating systems and different ssh clients - it is simply a matter of providing the client with the appropriate key.
4. Command-line ssh clients generally store the keys in the $HOME/.ssh directory or its equivalent.
5. ssh clients with GUIs, such as MobaXterm or BitVise, need to be configured appropriately (free versions are fine).
6. Windows users can choose from a wide range of ssh clients. CHPC staff members prefer MobaXterm and prefer not to support PuTTY or WinSCP. If you need software that can offer more powerful menu-based file transfers as well as a command line terminal, consider BitVise.
7. In Unix-like operating systems like Linux or Cygwin, the permissions of the key files and authorized_keys are important. The user must have read and write access to these files and there must be no other permissions. The permission of a file such as authorized_keys can be set correctly with chmod 0600 authorized_keys.

Use the steps below to create the key and keep the public key file ready for normal registration on the cluster.

1. Windows - setting up keys with MobaXterm
2. Windows - setting up keys with BitVise
3. Windows - setting up keys with a Windows shell
4. Setting up keys in Linux or WSL
5. Setting up keys in MacOS

The MobaXterm command line method illustrated in this video is nearly identical to the method used for Linux and MacOS.

• Best: a modern key such as ed25519
• Also acceptable: ECDSA keys
• RSA is allowed only if it is 3072 bits or stronger
• Do not use DSA keys

Good example (use this):

ssh-keygen -t ed25519 -C "your_username@lengau"

Also okay:

ssh-keygen -t ecdsa -b 384 -C "your_username@lengau"

or

ssh-keygen -t rsa -b 3072 -C "your_username@lengau"

Do *not* use:

• ssh-keygen -t dsa -C “your_username@lengau”
• ssh-keygen -t rsa -b 1024 -C “your_username@lengau”

If you already have a key, you can display it with:

• Windows:

  type $env:USERPROFILE\\.ssh\\id_ed25519.pub

• macOS orLinux:

  cat ~/.ssh/id_ed25519.pub

Contact CHPC Help Desk at helpdesk@chpc.ac.za