Smallstep certificate#

This is one of the two ways to obtain an SSH certificate described in Connecting with an SSH agent.

Note

On Windows, this method only works when connecting to the cluster from Windows PowerShell or the Command Prompt. PuTTy or MobaXterm users need to obtain a Firewall-based certificate using Pageant instead.

  1. Only once: install the step CLI. See the Smallstep installation documentation for more information.

    Install step-ca.exe and step.exe using Winget. Using Windows PowerShell or Command Prompt:

    winget install Smallstep.step-ca

    Install step-ca and step using homebrew. In the terminal:

    brew install step

    Install the step-cli and step-ca packages. Instructions for specific Linux distributions can be found on the Smallstep installation documentation page.

  2. Only once: set up (bootstrap) the environment. This creates the ~/.step directory.

    step ca bootstrap --context VSC --team VSC --team-url=https://hpc.vub.be/_static/VSC-CA.json

  3. Start up your SSH agent.

    Use the built-in Windows OpenSSH agent.

    Use the default SSH Agent with OpenSSH.

    Use the default SSH Agent with OpenSSH.

  4. Obtain a certificate. It has a lifetime of 16 hours.

    step ssh login --context VSC

Note

You can automatically obtain a certificate when connecting with SSH as a specific user (in this example vsc98765) by adding the following to your SSH config file:

# Use Smallstep to handle the SSH connection and automatically renew/login when the certificate expires
Match User vsc98765
    ProxyCommand step ssh proxycommand %r %h %p --context VSC

Note

Smallstep can also issue a certificate without using an agent:

step ssh certificate <email> ~/.ssh/smallstep --context VSC --no-agent

This creates a private key and certificate in your ~/.ssh folder. You will need to pass -i ~/.ssh/smallstep to ssh, or configure it in your SSH config file, to use it. This key is also valid for 16 hours.