---
title: "SSH Keys"
canonical: "https://kb.uconn.edu/space/SH/27104772140/SSH%20Keys"
format: markdown
---
> Macro (toc)

### What are SSH Keys?

SSH keys provide a secure way to authenticate yourself to an SSH server using** public-key cryptography** and **challenge-response authentication**. Unlike passwords, SSH keys help prevent **brute-force attacks** and do not expose valid credentials if the server is compromised. They are the preferred method for accessing the cluster because they enhance security and streamline actions that require authentication, including logging in and transferring files. 

> 📝 SSH keys always come in a pair
> 📝 
> 📝 - a “private key” that exists on your local computer
> 📝 - a “public key” that can be transferred on to the cluster or any other system that uses keys
> 📝 
> 📝 To learn more visit: [https://wiki.archlinux.org/title/SSH_keys](https://wiki.archlinux.org/title/SSH_keys)

### Set up SSH Keys through Command Line

Applicable for MobaXterm, Linux, MacOS, and Windows Subsystem for Linux (WSL)

1. To generate a key, on your local command line enter the following
2. ssh-keygen will then prompt you to protect your private key with a passphrase. You may create one or leave it blank.

```
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mobaxterm/.ssh/id_rsa):
Created directory '/home/mobaxterm/.ssh'.
Enter passphrase (empty for no passphrase):
.
.
.
```

3. Add the public key to the cluster (adjust path to **id_rsa.pub **if needed and enter your **netid**)
  

> ❌ If the `ssh-copy-id` command fails, the key must be manually copied onto the cluster:
> ❌ 
> ❌ 1. On a local terminal, open the **id_rsa.pub** file with a text editor (nano, vim, cat) and copy the content
> ❌ 2. On the cluster, navigate to the .ssh folder in your home directory (`cd ~/.ssh`)
> ❌ 3. If it doesn’t already exist, create a new file called *authorized_keys* in this directory
> ❌ 4. Paste the contents of **id_rsa.pub** into the file *~/.ssh/authorized_keys*

✅ You should now be able to access the cluster without password or Duo prompts!

### GUI Guide for MobaXterm

**Generating SSH keys**

1. Under tools, select MobaKeyGen (SSH key generator)
  
2. Edit the “number of bits in a generated key:” to **4096**
3. Click generate.
4. Optionally set a passphrase then save both the public and private keys.
5. Copy the public key (**id_rsa.pub) **on to the cluster in the file `~/.ssh/authorized_keys` manually or use:

**Using Private Key for Passwordless Access on MobaXterm**

Edit a saved User Session by right clicking and selecting “edit session” or create a new session.


![image-20240910-154020.png](media://f283cdee-a060-4209-8077-f252d2d70fc4)

In “Session Settings” > Advanced SSH settings”, select “Use private key”. Then locate the private key on your local machine. For MobaXterm, it will be under your `AppData\Roaming\MobaXterm\home\.ssh` labeled “Private Key File”.


![image-20240910-154651.png](media://3e3d43d1-a1ae-4bd0-a82e-85cd9fa1c3c7)


Click “OK” to save and you should be able to log on the cluster with that session without password or DUO prompt!

### Adding SSH Key to Filezilla

**Option 1:**

Under site manager, set the path to your keyfile for the specific connection.

![image-20250812-182717.png](media://f717fc62-84f8-4627-bcf1-6d3178d56e23)

**Option 2:**

“Edit” > “Settings” > “SFTP” > “Add key file…” and locate your **id_rsa.pub **public key.

For more details on file transfer and Filezilla: [File Transfer - Storrs HPC - UConn Knowledge Base](https://kb.uconn.edu/space/SH/26033783688/File+Transfer)

![image-20240829-193114.png](media://14b0eddd-b2d2-40b2-9925-25276b15c12b)


### Set up SSH Keys for Putty/WinSCP

#### Obtaining and Starting PuTTYgen

PuTTYgen is included in the [WinSCP installation package](https://winscp.net/eng/docs/ui_installer_selectcomponents). You can also download it separately from the [WinSCP download page](https://winscp.net/eng/downloads.php#putty_additional).

PuTTYgen originates from PuTTY and is also part of the PuTTY installation package. It does not matter if you use PuTTYgen from WinSCP or the PuTTY installation package, they are identical.

To start PuTTYgen, go to *Tools > PuTTYgen* on [Login dialog](https://winscp.net/eng/docs/ui_login).

When you run PuTTYgen you will see a window where you have two main choices: *Generate*, to generate a new public/private key pair, or *Load* to load in an existing private key.

![image-20250102-220210.png](media://80475501-622a-49a8-9bd7-6979b2234ae7)

After loading or generating a key the following output will be displayed.

![image-20250102-220117.png](media://d6574a07-cf39-45c2-8b1e-38192033db41)

Optionally set a passphrase then save both the public and private keys.   
Add the public key to the cluster (adjust path to **id_rsa.pub **if needed and enter your **netid**)

```
# Adjust the path to id_rsa.pub and insert your netid!
cat ~/.ssh/id_rsa.pub | ssh -tt \
  -o PubkeyAuthentication=no \
  -o PreferredAuthentications=keyboard-interactive \
  -o IdentityAgent=none \
  YOURNETID@hpc2.storrs.hpc.uconn.edu \
  'umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; chmod 600 ~/.ssh/authorized_keys; cat >> ~/.ssh/authorized_keys'
```


> ❌ If the `ssh-copy-id` command fails. We have to manually copy the key onto the cluster:
> ❌ 
> ❌ 1. Open the key in puTTYgen
> ❌ 2. Copy the key output in the top box
> ❌ 3. Paste the contents into the `~/.ssh/authorized_keys` file

### SSH Keys in WinSCP

WinSCP requires the private key to be in the format PuTTY (**.ppk** file). Fortunately, WinSCP includes a program called PuTTYgen and allows you to generate a key pair where the private key is in the **.ppk** format.

![image-20240910-174033.png](media://85809bf1-71b7-4354-99ad-896969a6156a)

Next, generate a key pair and save the private key.

![image-20240910-175521.png](media://aafa7fe1-f5d0-407d-a43c-911ee95ba235)

Edit or create a new session. Under Advanced>SSH>Authentication, check “Allow agent forwarding” and locate the private key file that you previously generated.

![image](media://b48d2137-a3e8-4bf1-9535-27e691acbd8d)

You should now be able to connect without the DUO prompt!

### Common Errors

> ℹ️ **If you encounter the following error, fear not!**
> ℹ️ 
> ℹ️ ```
> ℹ️ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> ℹ️ @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
> ℹ️ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> ℹ️ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
> ℹ️ Someone could be eavesdropping on you right now (man-in-the-middle attack)!
> ℹ️ It is also possible that a host key has just been changed.
> ℹ️ The fingerprint for the RSA key sent by the remote host is
> ℹ️ Please contact your system administrator.
> ℹ️ Add correct host key in /home/hostname /.ssh/known_hosts to get rid of this message.
> ℹ️ Offending RSA key in 
> ℹ️ RSA host key for pong has changed and you have requested strict checking.
> ℹ️ Host key verification failed.
> ℹ️ ```
> ℹ️ 
> ℹ️ Simply remove hpc2 from your known hosts with the following command:
> ℹ️ 
> ℹ️ ```
> ℹ️ ssh-keygen -R hpc2.storrs.hpc.uconn.edu
> ℹ️ ```
> ℹ️ 
> ℹ️ You should now be able to log in again 😀

> ℹ️ **If you encounter the following error, fear not!**
> ℹ️ 
> ℹ️ ```
> ℹ️ Received disconnect from x.x.x.x Too many authentication failures 
> ℹ️ 
> ℹ️ Disconnected from x.x.x.x port 22 
> ℹ️ ```
> ℹ️ 
> ℹ️ Usually the authorized_keys under a user’s .ssh HPC directory would need to be removed to reset the connection.
> ℹ️ 
> ℹ️ If you get this error, feel free to let us know and we can help remove your local .ssh directory or authorized_keys file from HPC.
> ℹ️ 
> ℹ️ Once removed, your local SSH keys would need to be re-generated/copied over to HPC using the following command:
> ℹ️ 
> ℹ️ ```
> ℹ️ ssh-copy-id -i ~/.ssh/id_rsa.pub -o PubkeyAuthentication=no netidhere@hpc2.storrs.hpc.uconn.edu
> ℹ️ ```