Account Setup¶

Why SSH keys?¶

SSH keys provide stronger protection against impersonation attacks than passwords and remove the need to type credentials on every login. To ensure the security of our infrastructure, all accounts are required to register at least one SSH public key before accessing any cluster. Until a key is registered, your account will only have access to the setup server (account-setup.sw.ehu.es).

If you are not familiar with how SSH public key authentication works, this guide from SSH.com provides a good overview. In short, you generate a key pair (a private key that stays on your computer and a public key that you upload to our server), and the server uses them to verify your identity without transmitting a password.

Step 1: Generate an SSH key pair on your local machine¶

Open a terminal on your computer (cmd or PowerShell on Windows) and run:

ssh-keygen -t ed25519

This will create two files in your ~/.ssh/ directory:

• id_ed25519: your private key (keep this safe, never share it).
• id_ed25519.pub: your public key (this is what you will upload to our server).

When prompted, you can optionally set a passphrase to add an extra layer of protection to your private key. If you do, consider using ssh-agent so you don't have to type it on every connection (see Troubleshooting below).

Press Enter to accept the default file location unless you have a reason to change it.

Step 2: Upload your public key to the authentication server¶

1. Connect to account-setup.sw.ehu.es via SSH using your password. This is the only machine that still accepts password access.

   ssh your_username@account-setup.sw.ehu.es
   

2. A setup script will run automatically. When prompted, paste the contents of your public key file (~/.ssh/id_ed25519.pub).

3. Optionally, set a secret passphrase on the authentication server. This is independent of the passphrase on your private key and provides an additional layer of security for managing your keys on our systems.

Once this process is complete, your account will have access to the rest of our clusters. You can reconnect to account-setup.sw.ehu.es at any time to manage your keys, add new ones (e.g. from a different device), select your preferred shell, or change your server passphrase.

Here is a video showing the full process from a Linux terminal:

Step 3: Configure your SSH client¶

Linux / macOS¶

No extra configuration is needed. Simply connect with:

ssh your_username@cluster_address

If your key is in the default location (~/.ssh/id_ed25519), SSH will use it automatically.

Windows: MobaXterm¶

After creating your keys, configure your MobaXterm session to use the private key:

1. Open your session settings.
2. Enable the "Use private key" option.
3. Browse to and select your private key file (the one without the .pub extension).

Migrating from authorized_keys¶

If you previously added keys directly to ~/.ssh/authorized_keys on the cluster, those keys will continue to work. However, we recommend also adding them to the authentication server so you can manage all your keys from a single place and avoid needing to contact the HPC team if you lose access.

Troubleshooting¶

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

See also¶