Skip to content

Using SSH Keys

How to use your SSH key pair to log into another remote machine.

To use your SSH key to log in to another remote machine, you must copy the public key file to the remote machine. For use at the SCDF, you can use the user portal application https://useraccount.sdcc.bnl.gov/ssh-key to upload your public key file (the one with the .pub extension) to the facility. Your public key will be stored in LDAP and will be available on all of the gateway machines. When you log into one of the gateway machines after uploading your key, you will be prompted to enter the passphrase for your private key (the passphrase and private key remain on your local machine and never be transmitted over the network). After successfully entering your passphrase, you will be logged into the gateway. To avoid typing your passphrase each time you log in, see the section on Ssh Agent.

If your browser dialog does not display your .ssh directory or files because they are hidden, see Generate Ssh Key Pairs.

SSH Keys on Multiple Machines

You may have up to 5 SSH keys on your SCDF account at the same time. If you own multiple machines (e.g., a desktop and a laptop), generate a separate key pair on each machine and add each public key to your account on the portal. There is no need to copy a private key between machines, and doing so is discouraged: a private key should never leave the machine it was generated on.

Give each key a comment that names the machine it lives on (ssh-keygen -t ed25519 -C "work-laptop"). The portal lists every key on your account with its type, SHA256 fingerprint and comment, and each key has its own Delete button, so the comment is how you tell them apart when a machine is retired or a key needs to be removed.

Only Ed25519 keys can be added. Keys of other types that were added before this rule are still listed (marked Deprecated), still work, and can still be deleted, but cannot be re-added once removed.

If your public key ends with a [username]@[host] _string that does _ not directly follow an equals character ('='), the [username]@[host] string serves as a host restriction and must be removed from the public key before the key can be used from another machine. A [username]@[host] string that immediately follows _'=' _at the end of the public key is merely a comment and can be ignored or removed.

Note: If you want to move keys between a Windows machine running PuTTY and a Linux machine, then you will have to convert the format of the key since PuTTY uses a different format from OpenSSH. To do so, see Generate SSH Key Pairs on the Generate SSH Key Pairs. If you use https://en.wikipedia.org/wiki/Cygwin, the key files should be fully compatible, since OpenSSH is the version of SSH implemented in Cygwin.

Using Multiple SSH Keys

If you need to use multiple, different SSH keys in order to access remote locations in addition to SCDF, a few options are available:

  • Add the -i flag to your SSH client command and specify the path to your desired private key (e.g., ssh -i ~/.ssh/id_rsa_2).
  • Load all necessary keys into your Ssh Agent.
  • Configure your SSH client to load the required key when connecting to each host, via the IdentityFile configuration directive in your .ssh/config file, along with the host name, your user name, and an alias, if desired, e.g.:
    Host your_alias yourhost.sdcc.bnl.gov HostName yourhost.sdcc.bnl.gov IdentityFile ~/.ssh/your-private_key User your_user_name