Registration/SSH - Revision history

M Janczyk: /* SSH Key Authentication for HPC Clusters */

2026-01-12T13:27:07Z

SSH Key Authentication for HPC Clusters

← Older revision		Revision as of 15:27, 12 January 2026
Line 33:		Line 33:
	'''Choose your cluster below:'''		'''Choose your cluster below:'''
	* [[#SSH_Keys_on_BinAC_2_and_JUSTUS_2\|BinAC 2 and JUSTUS 2]] - Self-managed keys		* [[#SSH_Keys_on_BinAC_2_and_JUSTUS_2\|BinAC 2 and JUSTUS 2]] - Self-managed keys
	* [[#SSH_Keys_via_bwIDM.2FbwServices\|bwUniCluster 3.0, Helix, and ~~NEMO 2~~]] - Centralized management		* [[#SSH_Keys_via_bwIDM.2FbwServices\|bwUniCluster 3.0, Helix, and NEMO2]] - Centralized management

	= SSH Keys on BinAC 2 and JUSTUS 2 =		= SSH Keys on BinAC 2 and JUSTUS 2 =

M Janczyk at 15:47, 3 December 2025

2025-12-03T15:47:24Z

← Older revision		Revision as of 17:47, 3 December 2025
Line 103:		Line 103:
	Centralized SSH key management provides:		Centralized SSH key management provides:

	* ~~'''~~Security enforcement:~~'''~~ Keys must use strong algorithms and have 180-day validity		* Security enforcement: Keys must use strong algorithms and have 180-day validity
	* ~~'''~~Centralized control:~~'''~~ Review and revoke all keys from one location		* Centralized control: Review and revoke all keys from one location
	* ~~'''~~Two key types:~~'''~~ Interactive keys (manual logins) and Command keys (automated workflows)		* Two key types: Interactive keys (manual logins) and Command keys (automated workflows)

	'''Note:''' Self-managed <code>~/.ssh/authorized_keys</code> files are ignored on these clusters.		'''Note:''' Self-managed <code>~/.ssh/authorized_keys</code> files are ignored on these clusters.
Line 113:		Line 113:
	=== Standard SSH Keys ===		=== Standard SSH Keys ===

	* ~~'''~~ED25519:~~'''~~ 256 bits (recommended)		* ED25519: 256 bits (recommended)
	* ~~'''~~RSA:~~'''~~ 2048 bits or more		* RSA: 2048 bits or more
	* ~~'''~~ECDSA:~~'''~~ 521 bits		* ECDSA: 521 bits

	'''Important:''' Always protect your private keys with a strong passphrase.		'''Important:''' Always protect your private keys with a strong passphrase.
Line 123:		Line 123:
	'''ED25519-SK''' keys use hardware security keys (like Yubikey) for authentication:		'''ED25519-SK''' keys use hardware security keys (like Yubikey) for authentication:

	* ~~'''~~Always valid~~'''~~ - no 2-factor unlock required		* Always valid - no 2-factor unlock required
	* ~~'''~~Hardware-protected~~'''~~ - private key never leaves the device		* Hardware-protected - private key never leaves the device
	* ~~'''~~Physical presence required~~'''~~ - must touch key to authenticate		* Physical presence required - must touch key to authenticate

	'''Note:''' ECDSA-SK keys are not supported. Use ED25519-SK only.		'''Note:''' ECDSA-SK keys are not supported. Use ED25519-SK only.
Line 145:		Line 145:
	\|}		\|}

	'''Get started:''' See [[Registration/SSH/~~Yubikey~~-Quick-Start\|SSH with ~~Yubikey~~ - Quick Start Guide]]		'''Get started:''' See [[Registration/SSH/SSH-FIDO2-Quick-Start\|SSH with FIDO2 - Quick Start Guide]]

	== Step 1: Add Your SSH Key to the Portal ==		== Step 1: Add Your SSH Key to the Portal ==
Line 207:		Line 207:

	'''FIDO2 Hardware Keys''' (ED25519-SK):		'''FIDO2 Hardware Keys''' (ED25519-SK):
	* ~~'''~~Always valid~~'''~~ - no 2-factor unlock needed		* Always valid - no 2-factor unlock needed
	* Authentication via physical key touch only		* Authentication via physical key touch only
	* ~~'''~~Only on bwUniCluster 3.0 and NEMO 2~~'''~~ (not Helix)		* Only on bwUniCluster 3.0 and NEMO 2 (not Helix)
	* See [[Registration/SSH/~~Yubikey~~-Quick-Start\|~~Yubikey~~ Quick Start Guide]]		* See [[Registration/SSH/SSH-FIDO2-Quick-Start\|SSH with FIDO2 - Quick Start Guide]]

	=== Registration Steps ===		=== Registration Steps ===
Line 248:		Line 248:

	'''Mandatory restrictions:'''		'''Mandatory restrictions:'''
	* ~~'''~~Single command:~~'''~~ Specify exact command with full path		* Single command: Specify exact command with full path
	* ~~'''~~IP restriction:~~'''~~ Limit to specific IP address(es) or subnet		* IP restriction: Limit to specific IP address(es) or subnet
	* ~~'''~~Admin approval:~~'''~~ Keys require review before activation		* Admin approval: Keys require review before activation
	* ~~'''~~Short validity:~~'''~~ Maximum 30 days		* Short validity: Maximum 30 days
	</div>		</div>

M Janczyk at 19:11, 1 December 2025

2025-12-01T19:11:23Z

← Older revision		Revision as of 21:11, 1 December 2025
Line 288:		Line 288:

	'''5. Wait for approval'''		'''5. Wait for approval'''

			[[File:Ssh-service.png\|center\|800px\|thumb\|Key pending approval]]

	== Revoking SSH Keys ==		== Revoking SSH Keys ==

			Revoke keys that are no longer needed or potentially compromised.

	<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">		<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">

M Janczyk: /* Revoking SSH Keys */

2025-12-01T19:08:55Z

Revoking SSH Keys

← Older revision		Revision as of 21:08, 1 December 2025
Line 294:		Line 294:
	'''Note:''' Revoked keys are immediately disabled and cannot be reused.		'''Note:''' Revoked keys are immediately disabled and cannot be reused.
	</div>		</div>

	'''1. Navigate to SSH key management:''' disabled and cannot be reused.

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''

M Janczyk at 19:07, 1 December 2025

2025-12-01T19:07:07Z

← Older revision		Revision as of 21:07, 1 December 2025
Line 151:		Line 151:
	First, upload your public key to the management portal:		First, upload your public key to the management portal:

			<div style="border: 3px solid #ffc107; padding: 15px; background-color: #fff3cd; margin: 10px 0;">
	'''Important:'''		'''Important:'''
	* Keys are valid for '''180 days''' and automatically revoked after expiration		* Keys are valid for '''180 days''' and automatically revoked after expiration
	* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>)		* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>)
			</div>

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''
Line 242:		Line 244:
	=== Security Requirements ===		=== Security Requirements ===

			<div style="border: 3px solid #dc3545; padding: 15px; background-color: #f8d7da; margin: 10px 0;">
	Command keys are '''always valid''' (no 2FA required), making them security-sensitive.		Command keys are '''always valid''' (no 2FA required), making them security-sensitive.

Line 249:		Line 252:
	* '''Admin approval:''' Keys require review before activation		* '''Admin approval:''' Keys require review before activation
	* '''Short validity:''' Maximum 30 days		* '''Short validity:''' Maximum 30 days
			</div>

	'''Common use case:''' [[Registration/SSH/rrsync\|rrsync for data transfers]]		'''Common use case:''' [[Registration/SSH/rrsync\|rrsync for data transfers]]
Line 284:		Line 288:

	'''5. Wait for approval'''		'''5. Wait for approval'''

	[[File:Ssh-service.png\|center\|800px\|thumb\|Key pending approval]]

	== Revoking SSH Keys ==		== Revoking SSH Keys ==

			<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">
	Revoke keys that are no longer needed or potentially compromised.
			'''Note:''' Revoked keys are immediately disabled and cannot be reused.
			</div>

	'''~~Note:'''~~ ~~Revoked~~ ~~keys~~ ~~are~~ ~~immediately~~ disabled and cannot be reused.		'''1. Navigate to SSH key management:''' disabled and cannot be reused.

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''

M Janczyk at 18:43, 1 December 2025

2025-12-01T18:43:17Z

Show changes

M Janczyk at 18:12, 1 December 2025

2025-12-01T18:12:44Z

@@ Line 1: / Line 1: @@
 |}
 '''SSH Keys''' allow you to log into a system without entering a password. Instead of proving your identity with something you know (a password), you prove it with something you have (a cryptographic key).
@@ Line 32: / Line 44: @@
 * '''ECDSA:''' 521 bits
 * '''ED25519:''' 256 bits (default, recommended)
-* '''ECDSA-SK / ED25519-SK:''' FIDO2 hardware keys (Yubikey, etc.)
+* '''ED25519-SK:''' FIDO2 hardware keys (Yubikey, etc.)
 '''Important:''' Always protect your private keys with a strong passphrase.
@@ Line 42: / Line 56: @@
 [[Image:Attention.svg|center|25px]]
 |style="padding:5px; background:#cef2e0; text-align:left"|
-'''FIDO2 SSH Keys (ECDSA-SK and ED25519-SK)''' offer the best security:
+'''FIDO2 SSH Keys (ED25519-SK)''' offer the best security:
 * '''Always valid''' - no 2-factor unlock required
@@ Line 51: / Line 65: @@
 |}
-'''FIDO2 SSH Keys currently work ONLY on:'''
+! FIDO2 Keys (ED25519-SK)
-'''bwUniCluster 3.0''' and '''bwForCluster NEMO 2'''
+| bwUniCluster 3.0
 |}
@@ Line 113: / Line 138: @@
 * Must re-authenticate after validity expires
-'''FIDO2 SSH Keys (ECDSA-SK/ED25519-SK)''' work differently:
+'''FIDO2 SSH Keys (ED25519-SK)''' work differently:
 * '''Always valid''' - no 2-factor unlock needed
 * Authentication via physical key touch only

M Janczyk at 16:01, 1 December 2025

2025-12-01T16:01:21Z

Show changes

S Braun: /* Minimum requirements for SSH Keys */

2025-11-07T13:21:13Z

Minimum requirements for SSH Keys

← Older revision		Revision as of 15:21, 7 November 2025
Line 50:		Line 50:
	'''Please set a strong passphrase for your private keys.'''		'''Please set a strong passphrase for your private keys.'''

	ECDSA-SK and ED25519-SK keys (for use with U2F/FIDO Hardware Tokens like Yubikeys) can currently only be used on NEMO2.		ECDSA-SK and ED25519-SK keys (for use with U2F/FIDO Hardware Tokens like Yubikeys) can currently only be used on NEMO2 and bwUniCluster 3.0.

	= Adding a new SSH Key =		= Adding a new SSH Key =

M Janczyk at 08:28, 12 August 2025

2025-08-12T08:28:20Z

← Older revision		Revision as of 10:28, 12 August 2025
Line 3:		Line 3:
	[[Image:Attention.svg\|center\|25px]]		[[Image:Attention.svg\|center\|25px]]
	\|style="padding:5px; background:#cef2e0; text-align:left"\|		\|style="padding:5px; background:#cef2e0; text-align:left"\|
	This process is only necessary for the bwUniCluster and the bwForCluster Helix.		This process is only necessary for the bwUniCluster and the bwForCluster Helix and NEMO2.
	On the other clusters, SSH keys can still be copied to the <code>authorized_keys</code> file.		On the other clusters, SSH keys can still be copied to the <code>authorized_keys</code> file.
	\|}		\|}