Skip to main content

Creating SSH Keys with a Yubikey

Access to whistler.math.tamu.edu uses hardware-backed SSH keys generated with a Yubikey. This guide walks through generating an ed25519-sk key pair and uploading the public key to TAMU Gateway so it can be used for authentication.

The process has two parts:

  1. Generate the SSH key pair with your Yubikey
  2. Upload the public key to Gateway

Generating the SSH Key Pair​

  1. Plug in your Yubikey.

  2. Open a terminal.

    • Windows users: open cmd.exe as an administrator.

  3. (Windows only) Create a .ssh folder in your home directory:

    mkdir .ssh

  4. Generate the key pair:

    ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519
    note

    Windows may not accept the tilde (~), so use the full path to your .ssh directory instead, for example C:\Users\YourUserName\.ssh\id_ed25519.

    id_ed25519 is just an example base file name. You can make it more descriptive if you prefer, e.g. ~/.ssh/id_ed25519_whistler.

  5. Touch your Yubikey when prompted. The command should prompt you to press the button on the Yubikey (typically a small metal pin on the sides or a circle on top).

    warning

    If you are not prompted to press the button, you will need to upgrade your SSH installation, making sure to include FIDO2 support. If you already have SSH with FIDO2 installed, double-check your PATH — you may be using an alternative SSH installation on your system.

  6. Set a passphrase (optional). After pressing the button on your Yubikey you will be prompted to enter a passphrase:

    • Pressing Enter sets an empty passphrase, meaning you can use the key pair without entering a passphrase.
    • Entering a passphrase requires you to type it each time you connect to a system using this key.

    In either case you will be prompted to confirm your choice.

  7. Confirm the generated files. This generates two files in ~/.ssh/:

    • ~/.ssh/id_ed25519 — your private key.
    • ~/.ssh/id_ed25519.pub — your public key.
    danger

    Never share your private key (~/.ssh/id_ed25519) with anyone, and do not copy or move it to another machine.

  8. Upload the public key (~/.ssh/id_ed25519.pub) to Gateway using the steps in the next section.

Adding Your Public Key in Gateway​

TAMU Gateway lets you manage the SSH keys used with managed Linux research systems.

  1. Log in with your NetID at https://gateway.tamu.edu/settings/linux/.

  2. The Linux Settings window lets you manage your SSH keys for use with managed Linux research systems. If you have any questions, reach out to helpdesk@tamu.edu.

  3. To add a new SSH key, click the Add Key button.

  4. On the SSH Authentication Keys page, paste your public SSH key into the text box and click Add Key.

    info

    Only certain key types are supported by this interface, e.g. ED25519-SK. Ensure you are uploading a supported key type. Each system you connect to may also have its own key-type requirements, so consider those when choosing which keys to upload.

  5. A successful submission returns you to the Linux Settings page.

  6. If a key was uploaded incorrectly and you wish to remove it, use the Remove Key option next to that key.

note

Once a new key has been added, it may take some time before the key is usable for authentication on a managed Linux server.

Next Steps​

After your key has propagated, connect to the cluster using the standard SSH instructions in the Connecting to HPC Systems guide, using whistler.math.tamu.edu as the hostname.