Registration/SSH

This process is only necessary for the bwUniCluster and the bwForCluster Helix. On the other clusters, SSH keys can still be copied to the authorized_keys file.

Registering SSH Keys with your Cluster

Interactive SSH Keys are not valid all the time, but only for one hour after the last 2-factor login. They have to be "unlocked" by entering the OTP and service password.

SSH Keys are a mechanism for logging into a computer system without having to enter a password. Instead of authenticating yourself with something you know (a password), you prove your identity by showing the server something you have (a cryptographic key).

The usual process is the following:

• The user generates a pair of SSH Keys, a private key and a public key, on their local system. The private key never leaves the local system.

• The user then logs into the remote system using the remote system password and adds the public key to a file called ~/.ssh/authorized_keys .

• All following logins will no longer require the entry of the remote system password because the local system can prove to the remote system that it has a private key matching the public key on file.

While SSH Keys have many advantages, the concept also has a number of issues which make it hard to handle them securely:

• The private key on the local system is supposed to be protected by a strong passphrase. There is no possibility for the server to check if this is the case. Many users do not use a strong passphrase or do not use any passphrase at all. If such a private key is stolen, an attacker can immediately use it to access the remote system.

• There is no concept of validity. Users are not forced to regularly generate new SSH Key pairs and replace the old ones. Often the same key pair is used for many years and the users have no overview of how many systems they have stored their SSH Keys on.

• SSH Keys can be restricted so they can only be used to execute specific commands on the server, or to log in from specified IP addresses. Most users do not do this.

To fix these issues it is no longer possible to self-manage your SSH Keys by adding them to the ~/.ssh/authorized_keys file on bwUniCluster/bwForCluster. SSH Keys have to be managed through bwIDM/bwServces instead. Existing authorized_keys files are ignored.

Minimum requirements for SSH Keys

Algorithms and Key sizes:

• 2048 bits or more for RSA
• 521 bits for ECDSA
• 256 Bits (Default) for ED25519

ECDSA-SK and ED25519-SK keys (for use with U2F Hardware Tokens) cannot be used yet.

Please set a strong passphrase for your private keys.

Adding a new SSH Key

Newly added keys are valid for three months. After that, they are revoked and placed on a "revocation list" so that they cannot be reused. Copy only the contents of your public ssh key file to bwIDM/bwServices. The file ends with .pub ( e.g. ~/.ssh/<filename>.pub).

SSH keys are generally managed via the My SSH Pubkeys menu entry on the registration pages for the clusters. Here you can add and revoke SSH keys. To add a ssh key, please follow these steps:

1. Select the cluster for which you want to create a second factor:
→ bwUniCluster 2.0
→ bwForCluster Helix

My SSH Pubkeys.

3. Click the Add SSH Key or SSH Key Hochladen button.

Add new SSH key.

4. A new window will appear. Enter a name for the key and paste your SSH public key (file ~/.ssh/<filename>.pub) into the box labelled "SSH Key:". Click on the button labelled Add or Hinzufügen.

Add new SSH key.

5. If everything worked fine your new key will show up in the user interface:

New SSH key added.

Once you have added SSH keys to the system, you can bind them to one or more services to use either for interactive logins (Interactive key) or for automatic logins (Command key).

Registering an Interactive Key

Interactive SSH Keys are not valid all the time, but only for one hour after the last 2-factor login. They have to be "unlocked" by entering the OTP and service password.

Interactive Keys can be used to log into a system for interactive use. Perform the following steps to register an interactive key:

1. Add a new interactive SSH key if you have not already done so.

2. Select Registered services/Registrierte Dienste from the top menu and click Set SSH Key/SSH Key setzen for the cluster for which you want to use the SSH key.

Select Cluster for which you want to use the SSH key.

3. The upper block displays the SSH keys currently registered for the service. The bottom block displays all the public SSH keys associated with your account. Find the SSH key you want to use and click Add/Hinzufügen.

Add SSH key to service.

4. A new window appears. Select Interactive as the usage type, enter an optional comment and click Add/Hinzufügen.

Add interactive SSH key to service.

5. Your SSH key is now registered for interactive use with this service.

SSH key is now registered for interactive use.

Registering a Command Key

SSH command keys are always valid and do not need to be unlocked with a 2-factor login. This makes these keys extremely valuable to a potential attacker and poses a security risk. Therefore, additional restrictions apply to these keys: They must be limited to a single command to be executed. They must be limited to a single IP address (e.g., the workflow server) or a small number of IP addresses (e.g., the institution's subnet). They must be reviewed and approved by a cluster administrator before they can be used. Validity is reduced to one month.

Command Keys can be used for automatic workflows. If you want to use rsync, please read the rrsync wiki.

Perform the following steps to register a "Command key" (in this example we use rrsync):

1. Add a new "command SSH key" if you have not already done so.

2. Select Registered services/Registrierte Dienste from the top menu and click Set SSH Key/SSH Key setzen for the cluster for which you want to use the SSH key.

Select Cluster for which you want to use the SSH key.

3. The upper block displays the SSH keys currently registered for the service. The bottom block displays all the public SSH keys associated with your account. Find the SSH key you want to use and click Add/Hinzufügen.

Add SSH key to service.

4. A new window appears. Select Command as the usage type. Type the full command with the full path, including all parameters, in the Command text box. Specify a network address, list, or range in the From text field (see man 8 sshd for more info). Please also provide a comment to speed up the approval process. Click Add/Hinzufügen.

Example
If you want to register a command key to be able to transfer data automatically, please use the following string as in the Command text field (please verify the path on the cluster first): /usr[/local]/bin/rrsync -ro /home/aa/aa_bb/aa_abc1/

Add command SSH key to service.

5. After the key has been added, it will be marked as Pending: You will receive an e-mail as soon as the key has been approved and can be used.

SSH key is now registered for interactive use.

Revoke/Delete SSH Key

Revoked keys are locked and can no longer be used.

SSH keys are generally managed via the My SSH Pubkeys menu entry on the registration pages for the clusters. Here you can add and revoke SSH keys. To revoke/delete a ssh key, please follow these steps:

1. Select the cluster for which you want to create a second factor:
→ bwUniCluster 2.0
→ bwForCluster Helix

My SSH Pubkeys.

2. Click REVOKE/ZURÜCKZIEHEN next to the SSH key you want to revoke.

Revoke SSH key.