Skip to content

Setup SSH

Overview

JSC provides SSH access to supercomputers (JURECA, JUWELS, JUSUF). This document describes how to set up SSH access to the JSC systems. The setup on all the machines is the same.

The following provides a condensed version of the full SSH login documentation, which you may consult for further details. It also contains a section on troubleshooting.

OpenSSH Key Generation

SSH, or Secure Shell, is a way to access another computer from afar securely. Imagine you are using your home computer but want to do something on a different computer in a different location, like training an AI model. SSH makes this possible while keeping the connection safe and private.

To generate an SSH key, open a terminal on Linux or WSL on Windows and type:

ssh-keygen -a 100 -t ed25519 -f ~/.ssh/id_ed25519

The options specify the type of the key (-t), the number of key derivation function rounds (-a), and the location to place the key (-f), which is selected to be the default. Optionally, one can give a comment to the key with -C to help distinguish multiple keys.

Uploading and Managing SSH Keys on Juelich HPC Systems

To manage your SSH keys and access Juelich HPC systems effectively, proceed as follow:

  1. Create a user account on JuDoor:

    • Go to JuDoor and sign up.
    • Follow the instructions in this video to complete the registration process.

  2. Join a project or create one:

    • After creating your account, you need to join a project to get compute time or create one. For more information, refer to this guide.

  3. Sign the usage agreements:

    • After joining a project, sign the usage agreements as shown in this video.

  4. Manage your SSH keys:

    • Under the section "Systems" click on "Manage SSH-keys".
    • To manage SSH keys, we use the format: 
      from="[Your IP address or hostname]" ssh-ed25519 [Your SSH key]

  5. Add IP range and key to JuDoor: JSC restricts from where you can log in, so you need to:

    • Determine your IP range: Use whatismyip or the SSH-keys management interface to find your IP range. I will use as an example the IP 93.199.55.163 (YOUR IP IS DIFFERENT).

    • Replace the second half with "0.0/16":

      • It was 93.199.55.163 -> It becomes 93.199.0.0/16
      • Add this new IP to the from= clause so it looks like this now from="93.199.0.0/16"

    • Add a second magic number, with a comma: ,10.0.0.0/8 🧙‍♀️.

    • If you are from FZJ, also add ,134.94.0.0/16.

      • The final from= clause looks something like this from="93.199.0.0/16,10.0.0.0/8,134.94.0.0/16"

    • Copy your ssh key that is in ~/.ssh/id_ed25519.pub

      • The ssh key looks something like this: ssh-ed25519 AAAAC3NzaC1lZDE1NTA4AAAAIHaoOJF3gqXd7CV6wncoob0DL2OJNfvjgnHLKEniHV6F user@demonstration.fz-juelich.de (YOUR KEY IS DIFFERENT)

    • Paste your SSH key after the from clause(with a space in-between) to get:

      • from="93.199.0.0/16,10.0.0.0/8,134.94.0.0/16” ssh-ed25519 AAAAC3NzaC1lZDE1NTA4AAAAIHaoOJF3gqXd7CV6wncoob0DL2OJNfvjgnHLKEniHV6F user@demonstration.fz-juelich.de

    • Click on "Start upload of SSH-Keys" to save your key.

  6. Documentation and Support:

Log in to a Machine

After completing the steps outlined in the previous section, you are ready to log in to the Juelich HPC systems. Below are examples for accessing two of the systems, JUWELS Booster and JURECA, using SSH.

  • Logging into JUWELS Booster

To log in to the JUWELS Booster system, open your terminal and use the following SSH command. Ensure you replace <yourid> with your actual JuDoor user name.

ssh -i ~/.ssh/id_ed25519 <yourid>@juwels-booster.fz-juelich.de
  • Logging into JURECA

For accessing JURECA, you have two options depending on your network setup. Use the appropriate command by replacing <yourid> with your JuDoor user name.

Standard Access:

ssh -i ~/.ssh/id_ed25519 <yourid>@jureca.fz-juelich.de

IPv4 Access: If you need to explicitly use IPv4, use the following command:

ssh -i ~/.ssh/id_ed25519 <yourid>@jureca-ipv4.fz-juelich.de

OpenSSH Persistent Configuration

To simplify your SSH connections, follow these steps to configure persistent SSH settings for systems like JUWELS Booster:

  • Create the SSH configuration file ~/.ssh/config if it doesn't exist: 

    touch ~/.ssh/config

  • Add configuration for JUWELS Booster: edit ~/.ssh/config to include: 

    Host juwels_booster
    User [USERNAME]
    HostName juwels-booster.fz-juelich.de
    ServerAliveInterval 60
    IdentityFile ~/.ssh/id_ed25519
    MACs hmac-sha2-512-etm@openssh.com
    Replace [USERNAME] with your JuDoor user name.

  • Connect using your configuration: 

    ssh juwels_booster

Dealing with MFA

Since November 2025, JSC systems require Multi-Factor Authentication (MFA) for SSH logins. You can set ControlMaster to persist your session and avoid repeated MFA prompts: 

Host juwels_booster
    User [USERNAME]
    [OTHER SETTINGS ...]
    ControlPath ~/.ssh/control-%h-%p-%r
    ControlMaster auto
    ControlPersist 4h
Session persistence only works for one login-node at a time so if you are using scp or rsync or other tools to get data from remote machine make sure you use the correct login node

Troubleshooting

Please visit the full SSH login documentation's section on troubleshooting, which also contains support contact information.