Using ssh

Using ssh to Access Math Department Resources

The University of Wisconsin-Madison Department of Mathematics maintains a login server for SSH connections from outside the department. It is named login.math.wisc.edu(referred to as login.x below for previty).

Connecting

To connect from a university network or from outside the university with a VPN:

• Server name: login.math.wisc.edu
• Port: 22
• Authentication method: password or SSH key
• To connect this way, you must have an IP address that corresponds to a wisc.edu host address. You can use the campus wireless| UWNet, | Eduroam, or | WiscVPN.
• Example SSH command to connect:

  ssh login.math.wisc.edu

To connect from outside the university:

• Server name: login.math.wisc.edu
• Port: 8022
• Authentication method: SSH key only
• Example SSH command to connect:

  ssh -p 8022 login.math.wisc.edu

Connecting to other servers

To access Math Department resources via SSH, you must first use an SSH client to connect to login.math.wisc.edu. You can then SSH to the system of your choice within the department.

For example, suppose you wished to run a sage program on one of the research servers. For simplicity sake, the research servers have aliases (nicknames) magma0, magma1, ..., magma19, with the more powerful machines having the lowest numbers.

To start your sage program, you might use an SSH client on your laptop to connect to login.math then run SSH again on login.x to connect to magma0. Please do not run research programs on login.x! While this machine may have all the tools necessary to test programs, it is not powerful enough to handle more than the most trivial of tasks. If you run a program that uses a lot of resources on login.x, you may prevent users (including yourself) from accessing these machines or significantly reduce it's responsiveness.

Generating an SSH Key

The IT staff recommends that you generate an SSH key to use when moving from one machine to another within the department network. Using an SSH key is both easier and more secure than retyping your password when you are moving from one Math Department machine to another. To use an SSH key, do the following.

1. Log onto any Linux workstation or research server in the department. You can use SSH as explained above to connect to login.x for this purpose.
2. If you are logged in to a desktop GUI, open a terminal window.
3. At the prompt, type "ssh-keygen". Accept the default values. You need not enter a passphrase, but it is more secure if you do. You can just press enter at the prompt to not use a passphrase.
4. Add the key you just generated to your authorized_keys file. Type, "cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys"
5. To test, type, "ssh magma0". You should be connected to magma0 without having to retype your password unless you chose to use a passphrase. Then you would be prompted for that password instead of your user account password.

Note: The login server login.math requires the use of SSH keys to connect from outside university networks. You can use this same SSH key for that purpose. Instructions for doing so are different for each ssh client and are therefore beyond the scope of this document. Consult your client's documentation (or do an internet search) or ask a member of the IT staff for assistance.

SSH FAQ

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

Problem

When connecting to a server you see this message

   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
   @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
   IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
   Someone could be eavesdropping on you right now (man-in-the-middle attack)!
   It is also possible that a host key has just been changed.
   The fingerprint for the ECDSA key sent by the remote host is
   SHA256:1U70vTc+CTgtUhqWKJ5tIs03SDJOsLtBRp3OQxgCoWQ.

Solution

If you had connected to the server recently without problem please contact IT ASAP and we'll take a look. If it has been a long time(6+ months) since you last connected it is possible that the server's "SSH fingerprint" has changed. In this case you can either contact IT(preferred) or run this command:

   ssh-keygen -R NAME_OF_SERVER_YOU_WERE_CONNECTING_TO

Then try connecting again. It will ask you about the "authenticity of host". Just enter "yes". You should now be connected.

If the problem happens again soon after it was fixed once please contact IT ASAP as this can indicate a possible security issue.

Connecting: Advanced Topics

These topics assume you are using an OpenSSH client(Linux, Mac OS, or [1])

Your SSH settings folder is the .ssh folder in your home directory.

Using login.x as a Jump Host

One can configure the OpenSSH client to automatically use login.x as a "jump host" to connect to other servers. Once you have SSH keys configured you can connect to any research server with a single command. For example, to connect to magma2 using login.x as a jump host:

$ ssh -J login magma2
you@edmonton:~$ 

First add the SSH public key from your account on the servers to your workstation/laptop:

1. SSH to login.x
2. Show your SSH public key:

   cat ~/.ssh/id_rsa.pub

3. Copy this text to the clipboard
4. Edit or create a file named authorized_keys in the .ssh folder on your workstation/laptop and paste in the text from above on its own line.
5. Save the file.

Next, edit the config file in your .ssh folder on your workstation/laptop and add the following, replacing YOUR_USER_NAME with your account name on the servers:

Host login
    HostName login.math.wisc.edu
    User YOUR_USER_NAME
    Port 8022
    ForwardAgent yes

Host magma2
    HostName magma.math.wisc.edu
    User YOUR_USER_NAME

You can add more "Host" entries for other servers that you use.

Then test as shown above.