This page aims to provide you with a step-by-step guide on how to use public key authentication for external login to the NHR systems at the Berlin ("Lise") and Göttingen ("Emmy") sites. It also provides information for internal login to connect between NHR nodes in Berlin/Göttingen.
- Create an SSH key pair with a passphrase that is not used anywhere else.
- Upload your public key on our Service Portal.
- Specify your private key when connecting to our login nodes (either via
ssh -i <your_private_key_file>or in your local SSH configuration).
An SSH key pair consists of a public key and a private key. The public key is used to encrypt messages. Such messages can only be decrypted using the corresponding private key. For this reason the private key must be stored safely on the local machine - protected by a passphrase, and not accessible for other users.
SSH Key Generation
Generating your key pair differs depending on the SSH implementation available on your local machine. The default with Linux and MacOS is OpenSSH. This is also available (without extra installation) in more recent versions of Windows.
On your local system, run
ssh-keygen in the terminal of your choice to create an SSH key pair (type RSA) with a size of 4096 bits. During the key generation process you will be asked for a passphrase to protect the key:
In this example, the private key is saved in the file
/home/user/.ssh/id_rsa_nhr, the corresponding public key in the file
/home/user/.ssh/id_rsa_nhr.pub. If you run this command,
user will be replaced by your local username.
Verify that you indeed have a passphrase on your private key with
If you are not asked for a passphrase, please use
ssh-keygen =pf $HOME/.ssh/id_rsa_nhr to create a passphrase. Once you are certain that you have set a passphrase to protect the key, you can safely continue with uploading the public key as described below.
We recommend to choose a distinct comment (
ssh-keygen -C "<comment>" -f <...> ) to conveniently identify your key later on.
Current login node ssh host keys
When connecting for the first time, ssh will show you a key fingerprint of our login nodes, and ask for confirmation.
The current ssh host keys for
the fingerprints are:
Under Windows, SSH key pairs can be generated with the tool PuTTYgen which is part of the PuTTY installation package and also available separately.
- Select: Type of key to generate: SSH-2 RSA
- Fill in: Number of bits in a generated key: 4096
- Press: Generate
- Fill in: your key passphrase
- Fill in: confirm your passphrase
- copy the shown public key to a new textfile for upload to NHR
(don't use "Save public key" for upload to NHR, wrong formatting here)
- Press: Save private key
- Please remember the path name where you saved your SSH key files!
PuTTY changed its default key file format in version 0.75 from PPK2 to PPK3. This is not an issue as long as you use a PuTTY version, or software using PuTTY in its core, greater 0.75
SSH Public Key Upload
Before you can log in to one of the Berlin/Göttingen login nodes, make sure you have uploaded your SSH public key (not the private one) at the Service Portal. Here you can also view or remove public keys uploaded earlier (if any).
At the Service Portal, choose the item "Manage keys" / "Verwalten Ihrer Keys". For the key management you will have to log with your user name and your portal password.
For security reasons, the upload is done in two steps:
- Press the button "Request upload of a new key" / "Upload eines neuen Schlüssels anfordern". After pressing the upload request button, you will need to confirm that you will adhere to our key usage policy. The most important points here are: to always use a passphrase to protect the key and to never give access to your private key to others. Please read carefully and make sure you understand the implications of this agreement.
- In the next step, an e-mail is sent to your registered mail address containing a one-time URL. Use this URL (click it or copy it into the address field of your browser) to go to the page containing the actual upload button.
You can upload up to seven SSH public keys at the service portal.
The SSH public keys are stored centrally in the Berlin/Göttingen LDAP service. Please do not add SSH keys discussed above to your
$HOME/.ssh/authorized_keys file in Berlin/Göttingen. This is only used for internal authentication within the Berlin/Göttingen sites. It will not grant access from outside.
.ssh is a hidden directory. If it is not shown by default, you might need to enter
~/.ssh in the location box.
At least with Safari you can press
command-shift-G and manually enter
Also, you can press
CTRL-H to toggle between showing and not showing hidden files.
Or, another workaround: copy your public key file to a path not containing any hidden files/directories.
External Login using SSH Keys
For external connections to the NHR login nodes in Berlin/Göttingen the private key of the SSH key pair is needed. Recall the name and the location (see above) of the file containing the private key.
-i option to the
ssh command you can specify the full path of your private SSH key file when you log in to one of the Berlin/Göttingen login nodes. You will be asked for the passphrase of your private key.
Example for a login to blogin (Berlin):
Alternatively, use the SSH configuration file
$HOME/.ssh/config on your local machine to permanently store options for specific SSH connections so that they can be omitted on the command line.
For example, add the following lines to your local
ssh command will automatically choose the proper credentials in the future, i. e.,
-l your_username and
-i <private_key> can be omitted from the command line so that
ssh blogin is sufficient.
In PuTTY, you have to add/select your private key to
Connection → SSH → Auth to be able to log in. In PuTTY version 0.78 this option has changed to
Connection → SSH → Auth
SSH for internal connections between a Berlin and a Göttingen login node works right out of the box - that is, without specifying any keys. This also applies to SSH connections between nodes of the same site. This is enabled through host-based authentication which is active by default.
For internal connections, please always use the host name alone, omitting the domain suffix ".hlrn.de". You can use the generic names blogin, glogin or specific names like blogin5, glogin2, etc.. This way NHR internal links are used which are faster than external routes. The latter are used when specifying fully qualified host names (blogin.hlrn.de or glogin.hlrn.de) which is not recommended here.