The Secure SHell protocol is a cryptographic network protocol meant to allow secure connections on an otherwise unsecured network.
While this page will focus on how to use the
ssh command, bundled in the
package, to obtain login prompts on CS machines and for file transferts, note that it can be used for many
networking task including port forwarding, tunneling, network filesystems, etc.
The syntax to login to a remote machine is as follow:
$ ssh USERNAME@HOSTNAME.DOMAIN
Here you will want to use your CS username (see the
Accounts section for more information) or your
"first.last" name for McGill campus login (not recommanded).
All available public resources (and their hostnames) are listed under the
Resources section. The
domain will always be
cs.mcgill.ca for all CS machines.
For example, I could type
$ ssh email@example.com
to login to one of the workstation in TR 3110 or
$ ssh firstname.lastname@example.org
to login to our public general purpose server.
Note that if you want to invoke graphical application over SSH, you will need to specify the
option to allow forwarding of X graphical data (will only work on Linux), as follow:
$ ssh -Y email@example.com
By using SSH Certificates you will not need to add the ssh keys for every new host that you connect to. New connections usually have:
The authenticity of host 'HOSTNAME.cs.mcgill.ca (X.X.X.X)' can't be established. ECDSA key fingerprint is SHA256:RADNOMSTRINOFCHARACTERS. Are you sure you want to continue connecting (yes/no/[fingerprint])?When you type in "yes" the system sees that as a trusted host and adds it to your host keys under ~/.ssh/known_hosts file.
To use our CS ssh Certificate, download the following file from within the McGill network (VPN, or ssh tunneling):
https://ssh-cert.cs.mcgill.ca/key.pubthen add it to your known hosts file: ~/.ssh/known_hosts
On MacOS or Linux you can simply do:
curl https://ssh-cert.cs.mcgill.ca/key.pub >> ~/.ssh/known_hosts
Now when you ssh to any CS host you should no longer be prompted for the authenticity of the host (if you are please open a ticket with firstname.lastname@example.orgYou can check with a debug (-v) that you are using certificates and you will see a line like:
debug1: Host 'HOSTNAME.cs.mcgill.ca' is known and matches the ECDSA-CERT host certificate
Password authentication for remote login can become tedious on top of being a security liability. SSH keys, based on public key cryptography, will allow you to remotely login without a password.
The idea is that you will create 2 files: a public and a private one. You will copy the public key file on every machine you want access to without using a password (in CS, your home directory is the same everywhere, so you do not need to copy the file at all).
When you try logging in without password to a machine that knows your public key; it will authenticate you by asking your machine a question that can only be answered by knowing what the private key is. Thus, it will be your responsability to ensure the private key remains private.
Obviously, most of this will happen in the background. To generate an SSH key, simply run the following command:
$ ssh-keygen -b 4096
By default it will write your public key to
$HOME/.ssh/id_rsa.pub and your private key to
$HOME/.ssh/id_rsa. If you decided to encrypt your private key for more security, by choosing a
passphrase, you can make your SSH agent remember the passphrase for the current session by running the command:
If you ran the key generation command on a CS machine, you are good to go. Otherwise, copy your public key to
$HOME/.ssh/id_rsa.pub on every machine you want to be able to connect to without a password. You
may want to use the special command
$ ssh-copy-id USERNAME@FQDN
to handle the distribution of your public key.
openssh includes many utility for file transfert. The simplest to use, if you are used to the
cp command, is probably
scp, which uses almost the same syntax:
$ scp [-r] SOURCE_USERNAME@SOURCE_FQDN:SOURCE_PATH DESTINATION_USERNAME@DESTINATION_FQDN:DESTINATION_PATH
FQDN stands for "Fully Qualified Domain Name" which basically mean
-r option can be used to specify we wish to copy directories.
Here are some examples of file transfer, note that if the source or destination host is not specified, it is assumed to be the local host.
$ scp test_file email@example.com:~/
will send the test file in the current working directory on my local host to my home directory on
$ scp firstname.lastname@example.org:/tmp/a email@example.com:/tmp/b
would send the file
/tmp/a on host
/tmp/b on host
Other file transfert utility includes
rsync, but they are beyond the scope of
sh_rsa_verify: cannot handle type rsa-sha2-512 key_from_blob: key type does not match cannot decode server_host_key_blob
Fix: Use the following fix until you can upgrade your OS/ssh version
ssh -o HostKeyAlgorithms=ssh-rsa cs_username @HOSTNAME.cs.mcgill.caor add to your config file:
Host *.cs.mcgill.ca HostKeyAlgorithms ssh-rsa,firstname.lastname@example.org
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: POSSIBLE DNS SPOOFING DETECTED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ The RSA host key for HOSTNAME.cs.mcgill.ca has changed, and the key for the corresponding IP address X.X.X.X
If you used our systems in the past, the host keys of some hosts might have changed over the years.
Fix:To avoid this simply use SSH Certificates.
To remove the old host key you can run:
ssh-keygen -R HOSTNAME.cs.mcgill.ca
If you still need help please send a request to email@example.com
openssh package is now available natively on Windows since version 1803. It
can thus be invoked directly from the
cmd program. If that is unsatisfactory to you, you can take a
look into a GUI application like
MobaXterm (recommanded) or
PuTTY (legacy option).
When using a CS machine remotely, we ask you to be conscious of other users and make sure not to run a task that
will deplete the machine resources. In the case of memory, it is very application dependant, but if you suspect
your task will hog the CPU, you can lower its priority with the
nice command as follow:
$ nice -n 10 COMMAND
The argument to the
-n option can be anything between
0 (normal priority) and
20 (lowest priority).