BoilerKey and SSH Key Login to Clusters FAQ

August 13, 2020  8:00am – August 31, 2020  5:00pm
Brown, Gilbreth, Halstead, Hammer, Rice, Scholar, Snyder, Workbench

As explained in the news article on Requiring BoilerKey or SSH key authentication on Community Clusters, all clusters will now be requiring BoilerKey or SSH key authentication in order to log in to them, effective mid-August 2020. Here are some common questions about this change:

How do I use BoilerKey to access the community clusters?

  • SSH: SSH to the cluster as usual. When asked for a password, type in the usual BoilerKey sequence (PIN,push or PIN,code) you would use in any other services using BoilerKey.
  • Remote Desktop (ThinLinc):
    • When using a web browser (Chrome, Firefox, Safari) to access desktop, use either PIN,push or PIN,code.
    • When using the installed ThinLinc client:, you MUST use PIN,push. This will prompt you TWICE though, and both requests must be approved on your BoilerKey device or via Duo.
    • PIN,code will NOT work in the installed/native ThinLinc client.
    • SSH Key authentication also works for installed/native ThinLinc access (see below).

If I am using SSH key authentication now, should I change anything?

No. Your current SSH key pairs will continue to work.

How can I create and use SSH keys?

To use SSH keys, you will need to generate a "keypair" on the computer from which you wish to log in. This keypair consists of two files: a private key and a public key. You must keep the private key file secure on your local computer (hence the name "private" key). Do not lose the private key, but also DO NOT upload or send the private key to research or other systems.

Log in to the cluster and copy the public key to the end of the file "~/.ssh/authorized_keys". The next time you try to log in to that cluster, SSH will check to be sure you have the private key file matching the public key you have now placed on the cluster. This will authenticate you, and no additional BoilerKey or password is required.

Specific steps to create SSH keypairs differ based on your operating system. Please refer to the Accounts - Logging In - SSH Keys section in the user guide of each cluster for detailed instructions.

Can I use an SSH key for Remote Desktop (ThinLinc) access?

Yes, the installed ThinLinc client does support the use an SSH keypair. For detailed instructions on creating and installing SSH keypairs, refer to the Accounts - Logging In - SSH Keys section in the user guide of each cluster. Using a web browser to access Remote Desktop does NOT support SSH keypairs and will require BoilerKey.

To set up SSH key authentication in the installed ThinLinc client:

  • Open the Options panel, Security tab, and select Public key as your authentication method.
  • Click OK to return to the ThinLinc Client login window. You should now see a Key field in place of the Password field.
  • In the Key field, click the ... option to locate and select the private key file on your local computer.

For more details on Remote Desktop use through ThinLinc, refer to the Accounts - Logging In - ThinLinc section in the user guide for each cluster.

Should I use BoilerKey for other Research Computing services such as Jupyter Hub, RStudio Server, or Gateway?

Here are the options for all major Research Computing services:

  • SSH: BoilerKey or SSH keypair
  • Remote Desktop (ThinLinc) via Web Browser: BoilerKey
  • Remote Desktop (ThinLinc) via installed Client: BoilerKey (push only) or SSH keypair
  • Gateway: BoilerKey
  • JupyterHub: Password
  • RStudio Server: BoilerKey

If you have any questions about these changes, please contact us at rcac-help@purdue.edu.

Originally posted: August 11, 2020  11:33am