SSH Keys

What is an SSH Key?

SSH keys are cryptographic keys that can be used to replace your username and password as an authentication method. The SSH key is actually a pair of keys: a public key and a private key.

Your public key may be shared freely, in this case with the Mill. Your private key should not be shared with anyone. Having the private key that matches the public key on the Mill proves your identity and allows you to log in.

It is a security best practice to use a unique key for access to the Mill. We recommend using the Ed25519 algorithm. We also recommend using a password-protected key, with the caveat that we cannot assist you with recovering the key should you lose this password.

Why Use an SSH Key?

Using an SSH key is more secure than a password, and it simplifies the process of authenticating. Once it is set up, it will perform authentication automatically and can save significant time if you find yourself typing your password many times per day.

Additionally, using an SSH key will allow you to connect to the Mill from off-campus without the use of the campus VPN.

Windows

Generating an SSH Key

Newer Windows versions are increasing support for native SSH tools, but for compatibility reasons we recommend Windows environments use the key generation feature of MobaXterm. From the menu, select tools - MobaKeygen SSH Key generator.

Screenshot of the MobaXterm application with the Tools menu expanded. The dropdown menu displays system, office, and network utilities, including options such as MobaXterm packages manager, X11 window, Command Prompt (admin), Windows PowerShell (admin), MobaTextEditor, MobaDiff, and Network services. The option “MobaKeyGen (SSH key generator)” is highlighted under the Network section, indicating it is selected. The left navigation pane shows User sessions and PuTTY sessions folders. The image demonstrates how to access the SSH key generator tool from the MobaXterm Tools menu.

Select the EdDSA encryption (1) at the bottom and click generate (2). Move the mouse in the blank area to generate randomness for the key until the green bar fills.

Screenshot of the MobaXterm SSH Key Generator window showing instructions for creating an SSH key pair. The EdDSA key type is selected and highlighted with a red circle labeled “1.” In the Actions section, the Generate button is highlighted with a red circle labeled “2.” Other available key types include RSA, DSA, ECDSA, and SSH-1 (RSA). The key display area at the top indicates “No key.” The image illustrates the steps to select the EdDSA algorithm and click Generate to create a new SSH key pair.

You may change the "Key comment" field to indicate what the key is intended to be used for. Often this comment matches the name of the key file you use when you save it. Next, you may add a password in the "Key passphrase" fields to protect your key. Then save the public and private keys by giving each key a meaningful name, potentially something like usernameMill_public and usernameMill_private.


Screenshot of the MobaXterm SSH Key Generator after an SSH key pair has been created. The public key is displayed in the upper text box under the heading “Public key for pasting into OpenSSH server (~/.ssh/authorized_keys file).” Below it, fields show the key fingerprint and a key comment. Empty fields are available for entering and confirming a key passphrase. The EdDSA key type is selected with the curve Ed25519 (255 bits). Action buttons on the right include Generate, Load, Save public key, and Save private key. The image illustrates the completed key generation screen and the options to save the newly created SSH keys.

Adding Your Private Key to MobaXTerm

To add your private key to MobaXTerm, go to settings then configuration.

Screenshot of the MobaXterm application with the Settings menu expanded. The dropdown menu displays options including Configuration (highlighted), Keyboard shortcuts, Import configuration, Export configuration, Reset configuration, Manage shared sessions, and Edit session presets. The main MobaXterm window is visible in the background, showing toolbar icons such as Session, Servers, Tools, Games, and Sessions, along with the left navigation pane containing User sessions and PuTTY sessions. The image demonstrates how to access the Configuration settings in MobaXterm.

Start by going into the SSH tab (1). Check the checkbox in (2) to enable the use of the internal SSH agent. Then hit the plus button (3) and select the private key that you saved in the generation step.

Screenshot of the MobaXterm Configuration window with the SSH tab selected. Three red numbered circles highlight the steps for adding an SSH key to the MobaXterm agent. Step 1 circles the SSH tab at the top of the window. Step 2 circles the checkbox labeled “Use internal SSH agent ‘MobAgent’,” which is enabled. Step 3 circles the plus (+) button next to the list of keys loaded at MobAgent startup. The window also displays additional SSH browser and SSH settings options, as well as an OK button at the bottom. The image demonstrates how to navigate to SSH settings and add a private key to MobAgent for automatic SSH authentication.

Linux

Generating an SSH Key

The campus Linux build has an SSH agent installed by default that can generate keys. To begin, type the command

ssh-keygen -t ed25519 

and follow the instructions. You will be prompted to choose a filename for your private key. Your public key will have the same name as the private key with .pub appended to the end. You will then be prompted for a password for your key. You may enter a password or hit enter to submit a blank (no) password. Your key will then be saved in the location of your terminal.

Adding Your Private Key to Local SSH-Agent

The expected location for your SSH keys is the ~/.ssh folder, so consider storing your keys from the previous step there. To add the newly generated private key to your SSH agent, use ssh-add giving the path to the key:

ssh-add ~/.ssh/Mill_key

If your key has a passphrase, you will be prompted to enter that passphrase when you add the key. Once it is entered, the agent will remember the key for the rest of the session.

If you would like to automate this process so that your keys are loaded on login, you can add the above command to the end of your ~/.bashrc file.

Adding Your Public Key to the Mill

In your public key file you saved is the full text of your key. It starts with the name of the algorithm used to generate the key and ends with a comment string you can use to label what the key is for. It looks something like:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMIKa7DdczXryggTNb0qjbOtUbFsvTlm2QPeyKM2OdT mill_example

Now that your computer has registered your private key, you must upload the corresponding public key to the Mill. You need to modify the file: ~/.ssh/authorized_keys by adding your SSH key on a NEW LINE. Simply paste your public key on a new line (there should already be a key on the first line, used for internal Mill services) and save the changes.

OOD

You can use the file browser that is integrated with OnDemand to add your public key to the Mill using a web browser. This is ideal if you are off-campus because OOD allows off-campus logins without an SSH key.

Select the file browser from the OOD landing page and open your home directory:

Screenshot of the Open OnDemand web portal with the Files menu expanded. The navigation bar at the top includes Apps, Files, Jobs, Clusters, and Interactive Apps. The Files menu is open and displays the option “Home Directory.” Part of the dashboard page is visible in the background, including a maintenance notice and the information technology logo for the University of Missouri. The image demonstrates how to access the user's home directory through the Files menu.

Then enter your .ssh folder and use the context menu to edit the file.

Open OnDemand file manager displaying the contents of the .ssh directory within a user's home folder. The file authorized_keys is selected and highlighted in blue. A context menu is open for the selected file, showing options to View, Edit, Rename, Download, and Delete. Other visible files in the directory include authorized_keys.bak, id_rsa, id_rsa.pub, and known_hosts. The image demonstrates accessing the menu for the authorized_keys file in order to edit or manage SSH authorized keys.

Paste your key on a NEW LINE then save the file.

Alternatives

You can also edit this file to add your key over terminal or using an SCP client to edit the file. These methods are not preferred as they will require you to be on-campus to authenticate with your password.

Print Article