Skip to content

SSH Keys

SSH Keys allow logging in without entering a password on each connection. Instead of a password, the server verifies a cryptographic key.

Validity of SSH Keys

Interactive SSH Keys are only valid for one hour after the last 2-factor login. They must be "unlocked" by entering the OTP and service password on first use.

No self-managed authorized_keys

It is not possible to self-manage SSH Keys via ~/.ssh/authorized_keys. Existing files with this name are ignored. SSH Keys must be managed via FeLS.

Minimum requirements

  • RSA: 2048 bits or more
  • ECDSA: 521 bits
  • ED25519: 256 bits (default)

ECDSA-SK and ED25519-SK keys (for U2F hardware tokens) are not supported.

Set a strong passphrase on your private key.

Adding a new SSH Key

  1. Log into FeLS.
  2. Click on My SSH Pubkeys / Meine SSH Pubkeys in the main menu.

  3. Click Add SSH Key / SSH Key hochladen.

  4. Enter a name and paste your SSH public key (not the private key) into the SSH Key: field. Click Add / Hinzufügen.

    Re-using SSH keys

    An SSH public key that has already been used before cannot be added again.

  5. The new key appears in the list.

Newly added keys are valid for three months. After that they are revoked and blocked from reuse.

Registering an Interactive Key

Interactive Keys can be used for normal interactive logins. They are valid for one hour after the last 2-factor login. On the first login attempt the SSH key will not be accepted; you must log in with OTP and service password to unlock it. After that, the key works for one hour without re-entering the OTP and password.

  1. Log into FeLS.
  2. Locate the requested service in the main menu and click Set SSH Key / SSH Key setzen.

  3. In the lower block, locate the SSH Key you want to use and click Add / Hinzufügen.

  4. Choose Interactive under Type of usage, optionally enter a comment, and click Add / Hinzufügen.

  5. The key is now registered.

Registering a Command Key

Command Keys are intended for automated workflows where interactive authentication is not feasible. They are always valid (no unlock step required), which makes them high-value targets. The following restrictions apply:

  • Must be restricted to a single command.
  • Must be restricted to a single IP address or a small subnet.
  • Must be reviewed and approved by an HPC administrator before use.
  • Valid for one month only.

The registration process is the same as for an Interactive Key, but select Command under Type of usage and fill in the Command and From (network address) fields. Include a comment to speed up the approval process.

The key will be marked as Pending until approved. You will receive an e-mail once it is active.

Revoking / Deleting an SSH Key

  1. Log into FeLS.
  2. Click on My SSH Pubkeys / Meine SSH Pubkeys.
  3. Click Revoke / Zurückziehen next to the key.

Revoked SSH keys

Revoked keys are blocked and cannot be reused.