...

This page aims to provide you with a step-by-step guide on how to use public key authentication to connect to the HLRNfor external login to the NHR systems at the Berlin ("Lise") and Göttingen ("Emmy") sites. It also provides information for internal login to connect between NHR nodes in Berlin/Göttingen.

Summary

1. Create an SSH key pair with a passphrase that is not used anywhere else.
2. Upload the your public key on our Service Portal.
3. Specify your new private key when connecting to our frontends login nodes (either via ssh -i <yourkey><your_private_key_file> or in your ssh configlocal SSH configuration).

Step-by-step guide

An SSH key pair consists of a public key and a private key. The public key is used to encrypt messages. Such messages can only be decrypted by using the corresponding private key. The For this reason the private key must be stored safely on the local machine - protected by a passphrase, and not accessible for other users.

...

Generating your key pair differs depending on the SSH implementation available on your local machine. The default for with Linux and MacOS is OpenSSH. This is also available (without extra installation) in more recent versions of Windows.

...

If you are not asked for a passphrase, please use ssh-keygen =pf $HOME/.ssh/id_rsa_hlrn to create a passphrase. Once you are certain that you have set a passphrase to protect the key, you can safely continue with uploading the public key as described below.

We recommend to use choose a good distinct comment (ssh-keygen -C "<comment>" -f <...> ) to conveniently identify your key later on.

...

...

Before you can log in to one of the HLRN Berlin/Göttingen login nodes, make sure you first have to upload uploaded your SSH public key (not the private one) at the HLRN Service Portal. There Here you can also perform other administrative tasks like displaying or removing (public) keysview or remove public keys uploaded earlier (if any).

At the HLRN the Service Portal, choose the item "Manage keys" / "Verwalten Ihrer Keys". For the key management you will have to log in using your HLRN account with your user name and your portal password.

...

1.  Press the button "Request upload of a new key" / "Upload eines neuen Schlüssels anfordern". After pressing the upload request button, you will need to confirm that you will adhere to the HLRN our key usage policy. The most important points here are: to always use a passphrase to protect the key and to never give access to your private key to others. Please read carefully and make sure you understand the implications of this agreement.
2. In the next step, an e-mail is sent to your registered mail address containing a one-time URL. Use this URL (click it or copy it into the address field of your browser) to go to the page containing the actual upload button.

You can upload up to seven SSH public keys to at the HLRN service portal.

...

External Login using SSH Keys

For external connections to the NHR login nodes in Berlin/Göttingen the private key of the SSH key pair is needed. Recall the name and the location (see above) of the file containing the private key. 

OpenSSH

With the -i option to the ssh command you can specify the full path of your private SSH key file when you log in to one of the HLRN Berlin/Göttingen login nodes. You will be asked for the passphrase of your private key.

...

Alternatively, use the SSH configuration file $HOME/.ssh/config on your local machine to permanently store options for specific SSH connections so that they can be omitted on the command line.

For example, by adding add the following lines to your local $HOME/.ssh/config :

Host blogin
    Hostname blogin.hlrn.de
    IdentityFile ~/.ssh/id_rsa_hlrn
    User your_username

Now the ssh command will automatically choose the proper credentials in the future, i. e., -l your_username and -i <private_key> can be omitted from the command line so that ssh blogin  is sufficient.

...

In PuTTY, you have to add/select your private key to Connection → SSH → Auth to be able to log in.

Internal Login

SSH for internal connections between a Berlin and a Göttingen login node works right out of the box - that is, without specifying any keys. This also applies to SSH connections between nodes of the same site. This is enabled through host-based authentication which is active by default.

...