Overview Getting Started SSH Keys Software Hardware Jobs Apptainer For Faculty

SSH Keys for Cluster Access

IMPORTANT: SSH keys are the ONLY method to access Beehive. Password authentication is disabled. Set up your SSH key to get access.

You log in to the cluster's login node, cluster.ttic.edu (ssh YOUR_USERNAME@cluster.ttic.edu). Do not use beehive.ttic.edu - that is the Slurm controller and does not accept user logins. Your account must also have been enabled for the cluster by the administrators; a key alone is not enough.

Why Use SSH Keys with Passphrases?

Your SSH private key is like a password that never expires. If someone steals an unprotected private key, they have permanent access to any system that trusts that key.

A passphrase-protected key is useless to an attacker without the passphrase.

"But typing a passphrase every time is annoying!"

That's where SSH agent comes in - you type your passphrase once per session, and it remembers it for you.

Generate Your SSH Key

Run this command on your local computer (not on the cluster):

ssh-keygen -t ed25519 -C "your_email@example.com" -f /path/to/private_key

When prompted: - Enter a strong passphrase (use 4+ words) - Confirm your passphrase

Windows users: Use Windows Terminal, not Command Prompt.

Add your key to the cluster

Contact admin@ttic.edu to add or update SSH keys.

Send the contents of your public key file (/path/to/private_key.pub - the file ending in .pub, a single line starting with ssh-ed25519). Never send the private key itself.

Add a key yourself (if you already have access)

If you can already SSH into the cluster, you can add a new key without contacting an admin.

ssh-copy-id logs in with your existing key, not the new one, so that key must be available to ssh first: load it into ssh-agent (ssh-add /path/to/existing_private_key - see Using SSH Agent below). If it reports that all keys were skipped because they already exist, re-run it with -f.

From your local machine:

ssh-copy-id -i /path/to/public_key YOUR_USERNAME@cluster.ttic.edu

Verify it works before relying on it:

ssh -o IdentitiesOnly=yes -i /path/to/private_key YOUR_USERNAME@cluster.ttic.edu

You only need your key on the login node. Compute nodes do not accept user SSH logins - you reach them through Slurm jobs (srun, sbatch), never with ssh <node>.

Using SSH Agent

SSH agent keeps your unlocked private key in memory after you enter the passphrase once, so you don't have to type it again for the rest of your session.

Start SSH Agent

Linux/macOS:

eval "$(ssh-agent -s)"
ssh-add /path/to/private_key

Windows:

Right-click Windows Terminal and select "Run as Administrator", then run:

Get-Service -Name ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Then open a normal (non-admin) terminal and add your key:

ssh-add /path/to/private_key

Make SSH Agent Persistent

macOS:

ssh-add --apple-use-keychain /path/to/private_key

Then add this to ~/.ssh/config so ssh loads the passphrase from the keychain automatically after a reboot:

Host cluster.ttic.edu
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile /path/to/private_key

Linux - Add to ~/.bashrc or ~/.zshrc:

if [ -z "$SSH_AUTH_SOCK" ]; then
    eval "$(ssh-agent -s)"
    ssh-add /path/to/private_key
fi

Windows - Already configured above with Set-Service -StartupType Automatic

Troubleshooting

Permission Denied

Check your connection:

ssh -v -i /path/to/private_key YOUR_USERNAME@cluster.ttic.edu

Fix local key permissions (Linux/macOS):

chmod 700 ~/.ssh
chmod 600 /path/to/private_key
chmod 644 /path/to/public_key

Check server-side setup:

ssh YOUR_USERNAME@cluster.ttic.edu  # Login with existing key
cat ~/.ssh/authorized_keys          # Should show your key
ls -la ~/.ssh                       # Should show drwx------
ls -la ~/.ssh/authorized_keys       # Should show -rw-------

If permissions are wrong on the server:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

If your key is set up correctly but you still get Permission denied (publickey), your account may not be enabled on the login node yet - only accounts the administrators have added to the cluster user list can log in. For a new or recently changed account, contact the administrators before debugging further.

Connection closed while typing your passphrase

The login node gives you only 15 seconds to finish authenticating. If you type a long passphrase slowly you may see Connection closed by ... port 22 (or Timeout before authentication). Load your key into ssh-agent first (ssh-add /path/to/private_key) so you enter the passphrase before connecting, not during.

SSH Agent Not Working

Check if running:

ssh-add -l

If you see "Could not open a connection to your authentication agent":

Linux/macOS:

eval "$(ssh-agent -s)"
ssh-add /path/to/private_key

Windows:

Right-click Windows Terminal and select "Run as Administrator", then run:

Get-Service -Name ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Then open a normal (non-admin) terminal and add your key:

ssh-add /path/to/private_key

Need More Help?

Run SSH in verbose mode:

ssh -vvv -i /path/to/private_key YOUR_USERNAME@cluster.ttic.edu

Save the output and contact admin@ttic.edu for assistance.

Security Best Practices

Always use a strong passphrase
Never share your private key (only the .pub file)
Use ssh-agent for convenience without compromising security
Use different keys for different systems
Rotate keys annually
Keep your private key on your personal machine only