Follow the steps below to set up public key authentication.

Before You Begin: We highly recommend that you create a ~/.ssh/config file on your local system as described in Setting Up SSH Passthrough before you proceed with these steps.

Step 1: Create an SSH Public/Private Key Pair

To use public key authentication with the Secure Front Ends (SFEs), you need to have an SSH public/private key pair. If you do not, you can create a SSH public/private key pair by typing the following command and following the prompts:

your_local_system% ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/username/.ssh/id_rsa): ENTER
Enter passphrase (empty for no passphrase):enter a passphrase
Enter same passphrase again: type your passphrase again
Your identification has been saved in /Users/username/.ssh/id_rsa.
Your public key has been saved in /Users/username/.ssh/id_rsa.pub.

Your passphrase for the private key must meet NASA password requirements.

If you are using a non-Unix system, please consult your SSH documentation.

Step 2: Initialize the SSH Public Key on the SFEs

Copy the public key file to your ~/.ssh2 directory on each SFE you want to use, as follows (where sfeX represents sfe[6‑8]):

your_local_system% ssh username@sfeX.nas.nasa.gov ssh-key-init --add < ~/.ssh/id_rsa.pub

Windows users: The above command with the redirection (i.e., < ~/.ssh/id_rsa.pub) will hang on Windows systems. You can try the following alternative method:

1. On your local Windows system, copy the contents of the ~/.ssh/id_rsa.pub file onto the clipboard (e.g., using the notepad program on Windows).
2. From your Windows system, ssh into an SFE: your_local_system% ssh sfe
3. From the SFE, run the command: sfe% ssh-key-init --add
4. Paste the contents of the clipboard, then type Ctl-D to complete.

Note: Public keys with embedded forced commands or other constraints will be ignored.

To view your existing public keys on sfeX:

ssh username@sfeX.nas.nasa.gov ssh-key-init --get

To completely replace all existing public keys on sfeX:

ssh username@sfeX.nas.nasa.gov ssh-key-init --set < ~/.ssh/id_rsa.pub

To delete one or more public keys on sfeX that contain the string denoted by STRING:

ssh username@sfeX.nas.nasa.gov ssh-key-init --remove=STRING

For example, the following would remove the public key(s) containing AAAAB3NzaC1yc2EAAAADAQABAAABAQCw2qCC:

ssh-key-init --remove=AAAAB3NzaC1yc2EAAAADAQABAAABAQCw2qCC

Notes:

• If you don't specify the full key string, you must ensure that any shorter string you use does not match other keys you do not want to remove.
• The username@ is not required when your local username matches your NAS username, or if you have already configured your username in the configuration file (~/.ssh/config). You can download a NAS template for the configuration file here: Setting Up SSH Passthrough

You can also invoke the ssh-key-init command when you are already logged into an SFE. In this case, omit the ssh username@sfeX.nas.nasa.gov portion and begin the command line with ssh-key-init. Note that when you include the --add and --set options directly on an SFE, you must paste the keys into the terminal window and then terminate by typing Control-d. Keep in mind that public keys are not currently synchronized between SFEs, so each ssh-key-init invocation is only relevant to the particular sfeX it is run on.

To test your public/private key pair:

your_local_system% ssh -i ~/.ssh/id_rsa username@sfeX.nas.nasa.gov 

You will be prompted for both your SecurID passcode and your private key passphrase.