Tips for SSH

SSH (Secure Shell) is a tool for accessing remote clusters and servers. This help page covers some general configuration and LIGO-specific tips

Keys

SSH keys come in pairs: a private key (which you keep secret) and a public key (which you share with servers).

• Private key — Stored on your machine (typically ~/.ssh/id_ed25519). This proves your identity and should never be shared. Anyone with your private key can impersonate you.
• Public key — Shared with servers you want to access. The server stores this in ~/.ssh/authorized_keys. When you connect, the server uses this to verify you're the legitimate owner of the private key.

Where Keys Live

By default, SSH keys are stored in the ~/.ssh/ directory:

~/.ssh/
├── id_ed25519           # Your private key (keep secret!)
├── id_ed25519.pub       # Your public key (safe to share)
├── config               # SSH configuration file
└── authorized_keys      # Keys allowed to log in on remote servers (file automatically created/edited)

Never commit your private keys to version control or share them. The .pub file is safe to share — you'll add this to servers you want to access.

Generating a New SSH Key

If you don't have an SSH key yet, you can create one with a command like this:

ssh-keygen -t ed25519 -C "your_email@example.com"

When prompted, press Enter to save it in the default location (~/.ssh/id_ed25519). You will then be asked to add a passphrase for extra security. Technically, you can hit Enter to have an empty passphrase, but this is not recommended and there are better ways to avoid entering your password multiple times.

Configuration

SSH configuration is stored in ~/.ssh/config. This file allows you to define shortcuts for frequently used hosts, avoiding the need to remember long hostnames and usernames.

A basic config looks like:

Host myserver
    HostName server.example.com
    User myusername
    IdentityFile ~/.ssh/id_ed25519

Then you can simply type ssh myserver instead of ssh myusername@server.example.com -i ~/.ssh/id_ed25519. An additional benefit is that vscode will also recognise this configuration so you can ssh from there.

Common SSH Config Options

• HostName — The actual hostname or IP address to connect to
• User — Default username for this host (if not specified, uses your current username)
• IdentityFile — Path to your private SSH key (can specify multiple for fallback)
• Port — Non-standard SSH port (default is 22)

Note: if you use a standard location for your identity file, e.g. ~/.ssh/id_ed25519, then you can omit the IdentityFile argument as by default SSH tries a series of defaults. However, this may be useful if you have multiple keys with custom names.

Using Wildcards

You can use wildcards to apply settings to multiple hosts:

Host *
    IdentityFile ~/.ssh/id_ed25519

Configuring for accessing the LIGO Data Grid

There is help available on the LIGO computing docs for understanding how to access the different clusters. To add to that, here is an SSH config setup to simplify the process of accessing the CIT cluster (you will need to replace <albert.einstein> with your username).

Host caltechsshproxy
  Hostname sshproxy.ligo.caltech.edu
  User <albert.einstein>
  ControlMaster auto
  ControlPersist 10m
  ControlPath ~/.ssh/sockets/%r@%h:%p
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

Host *.ligo.caltech.edu caltech
  User <albert.einstein>
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ProxyJump caltechsshproxy

Host ldas-*.ligo.caltech.edu citlogin*.ligo.caltech.edu
  ForwardAgent yes

Host caltech
  Hostname citlogin2.ligo.caltech.edu

The first element sets up a proxy (or jump host): an intermediate server that relays your connection to a final destination that isn't directly accessible. This is common in cluster environments where login nodes are isolated from the internet for security reasons. Your SSH connection goes: your machine → proxy server → destination cluster. This is required for CIT due to the use of 2FA.

The second element sets default settings for all connections to CIT. Then, the third and fourth elements set up handy tools to simplify picking the node to log in to. Specifically, there is a preferred login node (in this case, citlogin2) which can be accessed with

ssh caltech

ssh citlogin1.ligo.caltech.edu

Host *
    UseKeychain yes
    AddKeysToAgent yes

# Start the SSH Agent (run in PowerShell as Administrator)
Start-Service ssh-agent

# Optional: Set it to start automatically on boot
Set-Service -Name ssh-agent -StartupType Automatic

ssh-add C:\Users\<your-username>\.ssh\id_ed25519

Host *
    AddKeysToAgent yes

ssh-add -l

Host *
    ControlMaster auto
    ControlPath ~/.ssh/control-%C
    ControlPersist 10m

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 10