Registration/SSH - Revision history

M Janczyk at 16:12, 28 May 2026

2026-05-28T16:12:33Z

← Older revision		Revision as of 18:12, 28 May 2026
Line 12:		Line 12:
	\| bwUniCluster 3.0		\| bwUniCluster 3.0
	\| style="background-color:#90EE90;" \| bwIDM Portal		\| style="background-color:#90EE90;" \| bwIDM Portal
	\| Centralized key management, 180-day validity		\| Centralized key management, 180-day validity (720-day for FIDO2 SK keys)
	\|-		\|-
	\| bwForCluster BinAC 2		\| bwForCluster BinAC 2
Line 28:		Line 28:
	\| bwForCluster NEMO 2		\| bwForCluster NEMO 2
	\| style="background-color:#90EE90;" \| bwIDM Portal		\| style="background-color:#90EE90;" \| bwIDM Portal
	\| Centralized key management, 180-day validity		\| Centralized key management, 180-day validity (720-day for FIDO2 SK keys)
	\|}		\|}

Line 103:		Line 103:
	Centralized SSH key management provides:		Centralized SSH key management provides:

	* Security enforcement: Keys must use strong algorithms ~~and~~ have 180-day validity		* Security enforcement: Keys must use strong algorithms; regular keys have 180-day validity, FIDO2 SK keys have 720-day validity
	* Centralized control: Review and revoke all keys from one location		* Centralized control: Review and revoke all keys from one location
	* Two key types: Interactive keys (manual logins) and Command keys (automated workflows)		* Two key types: Interactive keys (manual logins) and Command keys (automated workflows)
Line 121:		Line 121:
	=== FIDO2 Hardware Keys ===		=== FIDO2 Hardware Keys ===

	'''ED25519-SK''' keys use hardware security keys (like Yubikey) for authentication:		'''ED25519-SK''' and '''ECDSA-SK''' keys use hardware security keys (like Yubikey or Feitian ePass FIDO A4B) for authentication:

			* Valid for '''720 days''' - no frequent re-registration needed
	* Always valid - no 2-factor unlock required
			* No pre-login required - no need to first unlock with password and TOTP
	* Hardware-protected - private key never leaves the device		* Hardware-protected - private key never leaves the device
	* Physical presence required - must touch key to authenticate		* Physical presence required - must touch key to authenticate

	'''Note:''' ECDSA-SK keys are not supported. Use ED25519-SK only.

	{\| class="wikitable" style="text-align:center;"		{\| class="wikitable" style="text-align:center;"
Line 133:		Line 132:
	\|-		\|-
	! Cluster		! Cluster
	! ED25519-SK ~~Support~~		! SK Support (ED25519-SK / ECDSA-SK)
	\|-		\|-
	\| bwUniCluster 3.0		\| bwUniCluster 3.0
Line 151:		Line 150:
	<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">		<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
	<p style="padding-left: 5px; margin: 0px;">'''Important:'''</p>		<p style="padding-left: 5px; margin: 0px;">'''Important:'''</p>
	* ~~Keys~~ are valid for '''180 days''' and automatically revoked after expiration.		* Regular SSH keys are valid for '''180 days''' and automatically revoked after expiration. FIDO2 hardware keys (SK) are valid for '''720 days'''.
	* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>).		* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>).
	</div>		</div>
Line 211:		Line 210:
	\|}		\|}

	'''FIDO2 Hardware Keys''' (ED25519-SK):		'''FIDO2 Hardware Keys''' (ED25519-SK, ECDSA-SK):
	* ~~Always~~ ~~valid~~ - no 2-~~factor unlock~~ needed		* Valid for '''720 days''' - no re-authentication needed
			* No pre-login required - no password/TOTP unlock needed
	* Authentication via physical key touch only		* Authentication via physical key touch only
	* Only on bwUniCluster 3.0 and NEMO 2 (not Helix)		* Only on bwUniCluster 3.0 and NEMO 2 (not Helix)
Line 256:		Line 256:
	* IP restriction: Limit to specific IP address(es) or subnet		* IP restriction: Limit to specific IP address(es) or subnet
	* Admin approval: Keys require review before activation		* Admin approval: Keys require review before activation
	* Short validity: Maximum 30 days
	</div>		</div>

H Schumacher: Added 'generate ssh key' step, included 'bind key' as last step, removed spacing in info box, downsized two images

2026-04-23T09:18:17Z

Added 'generate ssh key' step, included 'bind key' as last step, removed spacing in info box, downsized two images

← Older revision		Revision as of 11:18, 23 April 2026
Line 149:		Line 149:
	== Step 1: Add Your SSH Key to the Portal ==		== Step 1: Add Your SSH Key to the Portal ==

		⚫	<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
	First, upload your public key to the management portal:
			<p style="padding-left: 5px; margin: 0px;">'''Important:'''</p>

		⚫	* Keys are valid for '''180 days''' and automatically revoked after expiration.
⚫	<div style="border: 3px solid #ffc107~~; padding: 15px~~; background-color: #fff3cd; margin: 10px 0;">
		⚫	* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>).
	'''Important:'''
⚫	* Keys are valid for '''180 days''' and automatically revoked after expiration
⚫	* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>)
	</div>		</div>

	'''1. ~~Navigate~~ to SSH key ~~management:~~'''		'''1. Generate an SSH key''' (if you don't have one):
			* Run in your local terminal: <pre> ssh-keygen -t ed25519 -C "your_email@example.com"
			</pre>
			* Press Enter to accept the default location, then set a strong passphrase.
			* You now have a private key (~/.ssh/id_ed25519) and a public key (~/.ssh/id_ed25519.pub).

			'''2. Navigate to SSH key management:'''
	* [https://login.bwidm.de/user/ssh-keys.xhtml bwUniCluster 3.0 / NEMO 2] (bwIDM)		* [https://login.bwidm.de/user/ssh-keys.xhtml bwUniCluster 3.0 / NEMO 2] (bwIDM)
	* [https://bwservices.uni-heidelberg.de/user/ssh-keys.xhtml bwForCluster Helix] (bwServices)		* [https://bwservices.uni-heidelberg.de/user/ssh-keys.xhtml bwForCluster Helix] (bwServices)
Line 163:		Line 167:
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My SSH Pubkeys page]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My SSH Pubkeys page]]

	'''2. Click "Add SSH Key" / "SSH Key Hochladen"'''		'''3. Click "Add SSH Key" / "SSH Key Hochladen"'''

	[[File:Bwunicluster 2.0 access ssh keys empty.png\|center\|400px\|thumb\|Add SSH Key button]]		[[File:Bwunicluster 2.0 access ssh keys empty.png\|center\|400px\|thumb\|Add SSH Key button]]

	'''3. Enter key details:'''		'''4. Enter key details:'''
	* '''Name:''' Descriptive identifier (e.g., "laptop-work", "desktop-home")		* '''Name:''' Descriptive identifier (e.g., "laptop-work", "desktop-home")
	* '''SSH Key:''' Paste complete contents of your <code>.pub</code> file		* '''SSH Key:''' Paste complete contents of your <code>.pub</code> file
	* Click '''Add''' / '''Hinzufügen'''		* Click '''Add''' / '''Hinzufügen'''

	[[File:Ssh-key.png\|center\|~~600px~~\|thumb\|Add SSH key dialog]]		[[File:Ssh-key.png\|center\|400px\|thumb\|Add SSH key dialog]]

		⚫	'''5. Your key appears in the list:'''

		⚫	[[File:Ssh-success.png\|center\|600px\|thumb\|SSH key successfully added]]
⚫	'''4. ~~Success!'''~~ Your key appears in the list

		⚫	'''6. Bind your key to a cluster''' as either an [[#Step_2A:_Register_Interactive_Key\|Interactive Key]] or [[#Step_2B:_Register_Command_Key\|Command Key]].
⚫	[[File:Ssh-success.png\|center\|~~800px~~\|thumb\|SSH key successfully added]]
⚫	'''~~Next:'''~~ Bind your key to a cluster as either an [[#Step_2A:_Register_Interactive_Key\|Interactive Key]] or [[#Step_2B:_Register_Command_Key\|Command Key]].

	== Step 2A: Register Interactive Key ==		== Step 2A: Register Interactive Key ==

M Janczyk: /* SSH Key Authentication for HPC Clusters */

2026-01-12T13:27:07Z

SSH Key Authentication for HPC Clusters

← Older revision		Revision as of 15:27, 12 January 2026
Line 33:		Line 33:
	'''Choose your cluster below:'''		'''Choose your cluster below:'''
	* [[#SSH_Keys_on_BinAC_2_and_JUSTUS_2\|BinAC 2 and JUSTUS 2]] - Self-managed keys		* [[#SSH_Keys_on_BinAC_2_and_JUSTUS_2\|BinAC 2 and JUSTUS 2]] - Self-managed keys
	* [[#SSH_Keys_via_bwIDM.2FbwServices\|bwUniCluster 3.0, Helix, and ~~NEMO 2~~]] - Centralized management		* [[#SSH_Keys_via_bwIDM.2FbwServices\|bwUniCluster 3.0, Helix, and NEMO2]] - Centralized management

	= SSH Keys on BinAC 2 and JUSTUS 2 =		= SSH Keys on BinAC 2 and JUSTUS 2 =

M Janczyk at 15:47, 3 December 2025

2025-12-03T15:47:24Z

← Older revision		Revision as of 17:47, 3 December 2025
Line 103:		Line 103:
	Centralized SSH key management provides:		Centralized SSH key management provides:

	* ~~'''~~Security enforcement:~~'''~~ Keys must use strong algorithms and have 180-day validity		* Security enforcement: Keys must use strong algorithms and have 180-day validity
	* ~~'''~~Centralized control:~~'''~~ Review and revoke all keys from one location		* Centralized control: Review and revoke all keys from one location
	* ~~'''~~Two key types:~~'''~~ Interactive keys (manual logins) and Command keys (automated workflows)		* Two key types: Interactive keys (manual logins) and Command keys (automated workflows)

	'''Note:''' Self-managed <code>~/.ssh/authorized_keys</code> files are ignored on these clusters.		'''Note:''' Self-managed <code>~/.ssh/authorized_keys</code> files are ignored on these clusters.
Line 113:		Line 113:
	=== Standard SSH Keys ===		=== Standard SSH Keys ===

	* ~~'''~~ED25519:~~'''~~ 256 bits (recommended)		* ED25519: 256 bits (recommended)
	* ~~'''~~RSA:~~'''~~ 2048 bits or more		* RSA: 2048 bits or more
	* ~~'''~~ECDSA:~~'''~~ 521 bits		* ECDSA: 521 bits

	'''Important:''' Always protect your private keys with a strong passphrase.		'''Important:''' Always protect your private keys with a strong passphrase.
Line 123:		Line 123:
	'''ED25519-SK''' keys use hardware security keys (like Yubikey) for authentication:		'''ED25519-SK''' keys use hardware security keys (like Yubikey) for authentication:

	* ~~'''~~Always valid~~'''~~ - no 2-factor unlock required		* Always valid - no 2-factor unlock required
	* ~~'''~~Hardware-protected~~'''~~ - private key never leaves the device		* Hardware-protected - private key never leaves the device
	* ~~'''~~Physical presence required~~'''~~ - must touch key to authenticate		* Physical presence required - must touch key to authenticate

	'''Note:''' ECDSA-SK keys are not supported. Use ED25519-SK only.		'''Note:''' ECDSA-SK keys are not supported. Use ED25519-SK only.
Line 145:		Line 145:
	\|}		\|}

	'''Get started:''' See [[Registration/SSH/~~Yubikey~~-Quick-Start\|SSH with ~~Yubikey~~ - Quick Start Guide]]		'''Get started:''' See [[Registration/SSH/SSH-FIDO2-Quick-Start\|SSH with FIDO2 - Quick Start Guide]]

	== Step 1: Add Your SSH Key to the Portal ==		== Step 1: Add Your SSH Key to the Portal ==
Line 207:		Line 207:

	'''FIDO2 Hardware Keys''' (ED25519-SK):		'''FIDO2 Hardware Keys''' (ED25519-SK):
	* ~~'''~~Always valid~~'''~~ - no 2-factor unlock needed		* Always valid - no 2-factor unlock needed
	* Authentication via physical key touch only		* Authentication via physical key touch only
	* ~~'''~~Only on bwUniCluster 3.0 and NEMO 2~~'''~~ (not Helix)		* Only on bwUniCluster 3.0 and NEMO 2 (not Helix)
	* See [[Registration/SSH/~~Yubikey~~-Quick-Start\|~~Yubikey~~ Quick Start Guide]]		* See [[Registration/SSH/SSH-FIDO2-Quick-Start\|SSH with FIDO2 - Quick Start Guide]]

	=== Registration Steps ===		=== Registration Steps ===
Line 248:		Line 248:

	'''Mandatory restrictions:'''		'''Mandatory restrictions:'''
	* ~~'''~~Single command:~~'''~~ Specify exact command with full path		* Single command: Specify exact command with full path
	* ~~'''~~IP restriction:~~'''~~ Limit to specific IP address(es) or subnet		* IP restriction: Limit to specific IP address(es) or subnet
	* ~~'''~~Admin approval:~~'''~~ Keys require review before activation		* Admin approval: Keys require review before activation
	* ~~'''~~Short validity:~~'''~~ Maximum 30 days		* Short validity: Maximum 30 days
	</div>		</div>

M Janczyk at 19:11, 1 December 2025

2025-12-01T19:11:23Z

← Older revision		Revision as of 21:11, 1 December 2025
Line 288:		Line 288:

	'''5. Wait for approval'''		'''5. Wait for approval'''

			[[File:Ssh-service.png\|center\|800px\|thumb\|Key pending approval]]

	== Revoking SSH Keys ==		== Revoking SSH Keys ==

			Revoke keys that are no longer needed or potentially compromised.

	<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">		<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">

M Janczyk: /* Revoking SSH Keys */

2025-12-01T19:08:55Z

Revoking SSH Keys

← Older revision		Revision as of 21:08, 1 December 2025
Line 294:		Line 294:
	'''Note:''' Revoked keys are immediately disabled and cannot be reused.		'''Note:''' Revoked keys are immediately disabled and cannot be reused.
	</div>		</div>

	'''1. Navigate to SSH key management:''' disabled and cannot be reused.

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''

M Janczyk at 19:07, 1 December 2025

2025-12-01T19:07:07Z

← Older revision		Revision as of 21:07, 1 December 2025
Line 151:		Line 151:
	First, upload your public key to the management portal:		First, upload your public key to the management portal:

			<div style="border: 3px solid #ffc107; padding: 15px; background-color: #fff3cd; margin: 10px 0;">
	'''Important:'''		'''Important:'''
	* Keys are valid for '''180 days''' and automatically revoked after expiration		* Keys are valid for '''180 days''' and automatically revoked after expiration
	* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>)		* Upload only your '''public key''' file (ending in <code>.pub</code>, e.g., <code>~/.ssh/id_ed25519.pub</code>)
			</div>

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''
Line 242:		Line 244:
	=== Security Requirements ===		=== Security Requirements ===

			<div style="border: 3px solid #dc3545; padding: 15px; background-color: #f8d7da; margin: 10px 0;">
	Command keys are '''always valid''' (no 2FA required), making them security-sensitive.		Command keys are '''always valid''' (no 2FA required), making them security-sensitive.

Line 249:		Line 252:
	* '''Admin approval:''' Keys require review before activation		* '''Admin approval:''' Keys require review before activation
	* '''Short validity:''' Maximum 30 days		* '''Short validity:''' Maximum 30 days
			</div>

	'''Common use case:''' [[Registration/SSH/rrsync\|rrsync for data transfers]]		'''Common use case:''' [[Registration/SSH/rrsync\|rrsync for data transfers]]
Line 284:		Line 288:

	'''5. Wait for approval'''		'''5. Wait for approval'''

	[[File:Ssh-service.png\|center\|800px\|thumb\|Key pending approval]]

	== Revoking SSH Keys ==		== Revoking SSH Keys ==

			<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">
	Revoke keys that are no longer needed or potentially compromised.
			'''Note:''' Revoked keys are immediately disabled and cannot be reused.
			</div>

	'''~~Note:'''~~ ~~Revoked~~ ~~keys~~ ~~are~~ ~~immediately~~ disabled and cannot be reused.		'''1. Navigate to SSH key management:''' disabled and cannot be reused.

	'''1. Navigate to SSH key management:'''		'''1. Navigate to SSH key management:'''

M Janczyk at 18:43, 1 December 2025

2025-12-01T18:43:17Z

Show changes

M Janczyk at 18:12, 1 December 2025

2025-12-01T18:12:44Z

@@ Line 1: / Line 1: @@
 |}
 '''SSH Keys''' allow you to log into a system without entering a password. Instead of proving your identity with something you know (a password), you prove it with something you have (a cryptographic key).
@@ Line 32: / Line 44: @@
 * '''ECDSA:''' 521 bits
 * '''ED25519:''' 256 bits (default, recommended)
-* '''ECDSA-SK / ED25519-SK:''' FIDO2 hardware keys (Yubikey, etc.)
+* '''ED25519-SK:''' FIDO2 hardware keys (Yubikey, etc.)
 '''Important:''' Always protect your private keys with a strong passphrase.
@@ Line 42: / Line 56: @@
 [[Image:Attention.svg|center|25px]]
 |style="padding:5px; background:#cef2e0; text-align:left"|
-'''FIDO2 SSH Keys (ECDSA-SK and ED25519-SK)''' offer the best security:
+'''FIDO2 SSH Keys (ED25519-SK)''' offer the best security:
 * '''Always valid''' - no 2-factor unlock required
@@ Line 51: / Line 65: @@
 |}
-'''FIDO2 SSH Keys currently work ONLY on:'''
+! FIDO2 Keys (ED25519-SK)
-'''bwUniCluster 3.0''' and '''bwForCluster NEMO 2'''
+| bwUniCluster 3.0
 |}
@@ Line 113: / Line 138: @@
 * Must re-authenticate after validity expires
-'''FIDO2 SSH Keys (ECDSA-SK/ED25519-SK)''' work differently:
+'''FIDO2 SSH Keys (ED25519-SK)''' work differently:
 * '''Always valid''' - no 2-factor unlock needed
 * Authentication via physical key touch only

M Janczyk at 16:01, 1 December 2025

2025-12-01T16:01:21Z

Show changes