In your private linux workstation execute the command ssh-keygen with next options:

  [mymachine]$ ssh-keygen -t ed25519
  Generating public/private ed25519 key pair.

Accept the default location to store the key (~/.ssh/id_ed25519) by pressing Enter (strongly recommended) or enter an alternative location.

  Enter file in which to save the key (/home/myuser/.ssh/id_ed25519):
  Created directory '/home/myuser/.ssh'.

Enter a passphrase consisting of 10 to 30 characters. The same rules as for creating safe passwords apply. It is strongly advised to refrain from specifying no passphrase.

  Enter passphrase (empty for no passphrase):******************************
  Enter same passphrase again:******************************
  Your identification has been saved in /home/myuser/.ssh/id_ed25519.
  Your public key has been saved in /home/myuser/.ssh/id_ed25519.pub.
  The key fingerprint is:  
  SHA256:1fHELFajEIi4FpLB1zL50SmM6BUGn7wmViXK6j8FPXk  myuser@mymachine
  The key's randomart image is:
  +--[ED25519 256]--+
  |     o=o         |
  |      . * .=     |
  |    = = X S.o    |
  |   . . + * *o    |
  |   .F = O =      |
  |   o + O . o     |
  |++ ...o O .      |
  |   oo .X .       |
  | .oE..+o         |
  +----[SHA256]-----+

You should make absolutely sure that the private key (~/.ssh/id_ed25519) is not accessible by anyone other than yourself (always set its permissions to 0600). The private key must never fall into the hands of another person.

To change the password of an existing key pair, use the command:

  [mymachine]$ ssh-keygen -p

Once the public/private key pair is generated, you have to send the public key file ~/.ssh/id_ed25519.pub to res_support@iac.es (please, make sure you send us only the public key, while the private key must be kept safe on your computer).

Using the ssh-agent in Linux

When doing lots of secure shell operations it is cumbersome to type the SSH passphrase for each such operation. Therefore, the SSH package provides another tool, ssh-agent, which retains the private keys for the duration of an X or terminal session. All other windows or programs are started as clients to the ssh-agent. By starting the agent, a set of environment variables is set, which will be used by ssh, scp, or sftp to locate the agent for automatic login. See the ssh-agent man page for details.

After the ssh-agent is started, you need to add your keys by using ssh-add. It will prompt for the passphrase. After the password has been provided once, you can use the secure shell commands within the running session without having to authenticate again.

Using the ssh-agent in a Terminal Session

In a terminal session you need to manually start the ssh-agent and then call ssh-add afterward. There are two ways to start the agent. The first example given below starts a new Bash shell on top of your existing shell. The second example starts the agent in the existing shell and modifies the environment as needed.

  [mymachine]$ ssh-agent -s /bin/bash
  [mymachine]$ eval $(ssh-agent)

After the agent has been started, run ssh-add to provide the agent with your keys.

Using ssh-agent in an X Session

To invoke ssh-add to add your keys to the agent at the beginning of an X session, do the following:

• Log in as the desired user and check whether the file ~/.xinitrc exists.
• If it does not exist, use an existing template or copy it from /etc/skel:

   if [ -f ~/.xinitrc.template ]; then mv ~/.xinitrc.template ~/.xinitrc; \
   else cp /etc/skel/.xinitrc.template ~/.xinitrc; fi

• If you have copied the template, search for the following lines and uncomment them. If ~/.xinitrc already existed, add the following lines (without comment signs).

    # if test -S "$SSH_AUTH_SOCK" -a -x "$SSH_ASKPASS"; then  
    # ssh-add < /dev/null
    # fi

• When starting a new X session, you will be prompted for your SSH passphrase.

Using keychain in MacOS

• If you want to load the keys automatically and store the passphrases in the Keychain you need to modify your ~/.ssh/config file:

    Host *
     AddKeysToAgent yes
     UseKeychain yes
     IdentityFile ~/.ssh/id_ed25519

• Add the private key to the SSH agent after updating ssh config file:

   [mymachine]$ ssh-add -K ~/.ssh/id_ed25519

In windows systems IAC recommend the use of putty. It is a free SSH client that you can be downloaded from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html, but any other client compatible with SSH version 2 could be used. In the next lines we will describe how to install, configure and use a ssh client under Windows systems.

Once the client has been installed, try next steps if you are using putty (other clients have similar instructions):

1. Download putty and follow instructions on the web to install it (we recommend you install the full package that includes putty and also other useful tools like puttygen, pageant, pscp, pftp, etc.)
2. Launch PuTTygen in order to generate the ssh key
3. Select Ed25519 as Type of key and click on Generate
4. Move your mouse randomly since it is needed to generate strong keys
5. Click on Save public key to store the public key into a file. Send this file containing the public key to res_support@iac.es
6. Enter a passphrase consisting of 10 to 30 characters. The same rules as for creating safe passwords apply. It is strongly advised to refrain from specifying no passphrase
7. After introducing the key passphrase click on Save private key
8. Keep the private key file in a safe location and do not share with anyone

Connecting to LaPalma using your private key

The private/public key pair must be generated only once (as it was described above), and then you will need to specify the very same private key file every time you use putty to connect LaPalma (lapalma1.iac.es). To do so, go to putty menu, choose SSH and then click on Auth, there you will find the place where you can specify the file where your private key is stored. You can avoid specifying the private key every time you want to connect LaPalma if you use a ssh-agent, as described below.

Using the ssh-agent in Windows

As in the case of Linux, the package Putty provides a tool to avoid typing the SSH passphrase for each connection. The name of the tool is Pageant. You can use it following next steps;

1. If Pageant is not currently running (an icon is displayed in the taskbar), launch it
2. Double-click on the icon in the taskbar an the list of keys will be shown
3. Push Add Key and select the private key previously generated
4. Enter the passphrase
5. The list is now updated and you can click on Close
6. Now it is possible to connect to lapalma1.iac.es with Putty. Launch the application and specify the remote machine and click on Open (*)
7. Finally, a new window will appear asking for your username, specify it and you will connect LaPalma (no password is required)

(*) If it is your first connection to the machine, your will get a Warning telling you that the hostkey from the server is unknown, and will ask you if you are agree to cache the new host key, press Yes. IMPORTANT: If you see this warning another time and you haven't modified or reinstalled the ssh client, please, don't log in and contact with LaPalma support.