Setup your SSH Keys

Generating SSH Keys

If you do not have ssh keys generated, you will need to do that.

We recommend creating an ssh identity (using the ed25519 backend). The following bash code shows how to do this, ensuring the file has the correct permissions.

REMOTE_USERNAME="$USER"  # set to an identifier
PRIVATE_KEY_FPATH="$HOME/.ssh/id_${REMOTE_USERNAME}_ed25519"

if [ -f $PRIVATE_KEY_FPATH ]; then
    echo "Found PRIVATE_KEY_FPATH = $PRIVATE_KEY_FPATH"
else
    echo "Create PRIVATE_KEY_FPATH = $PRIVATE_KEY_FPATH"

    ssh-keygen -t ed25519 -b 256 -f $PRIVATE_KEY_FPATH -N "" -C ""
    echo $PRIVATE_KEY_FPATH

    # Ensure permissions correct and the new key is registered with the ssh-agent
    chmod 700 ~/.ssh
    chmod 400 ~/.ssh/id_*
    chmod 644 ~/.ssh/id_*.pub
    eval "$(ssh-agent -s)"
    ssh-add $PRIVATE_KEY_FPATH
fi

Remember to ensure the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/known_hosts
chmod 400 ~/.ssh/id_*
chmod 644 ~/.ssh/id_*.pub

Register SSH Keys with a Gitlab

For official instructions see: https://docs.gitlab.com/ee/user/ssh.html

For the kitware gitlab, navigate to your user preferences, by clicking your user icon in the top right and then clicking preferences.

Then on the left menu click SSH keys.

Print out the contents of your public key via:

PUBLIC_KEY="$HOME/.ssh/id_${REMOTE_USERNAME}_ed25519.pub"
cat $PUBLIC_KEY

Then copy/paste that info the prompt for your “Key” on the website. Adding this will allow you to clone and interact with repos without being prompted for credentials each time.

Register SSH Keys with a DVC server

This is for Kitware employees with access to the VPN only.

This tutorial is also slightly older, and needs an update.

By creating pair of public/private SSH keys, you will be able to access git repos and remote DVC caches without being prompted for server login credentials.

We will assume you have these following environment variables. Please populate with your information.

# This is usually Kitware active-directory username
REMOTE_USERNAME=<your-username-on-the-remote>

# This is the remote machine that is hosting the data cache
REMOTE_URI=the-remote-dvc-server.kitware.com

# Optional: make a one-word name for the server
REMOTE_NICKNAME=an alias for the server

For example, my username on horologic.kitware.com is jon.crall, and I like to refer to the server as horologic.

REMOTE_USERNAME=jon.crall
REMOTE_URI=horologic.kitware.com
REMOTE_NICKNAME=$(echo $REMOTE_URI | cut -d. -f1)

Once you have this information, create an ssh identity ( using the ed25519 backend). The following bash code shows how to do this, ensuring the file has the correct permissions, and also sending the public key to the remote server you want to authenticate with:

PRIVATE_KEY_FPATH="$HOME/.ssh/id_${REMOTE_USERNAME}_ed25519"

if [ -f $PRIVATE_KEY_FPATH ]; then
    echo "Found PRIVATE_KEY_FPATH = $PRIVATE_KEY_FPATH"
else
    echo "Create PRIVATE_KEY_FPATH = $PRIVATE_KEY_FPATH"

    ssh-keygen -t ed25519 -b 256 -f $PRIVATE_KEY_FPATH -N ""
    echo $PRIVATE_KEY_FPATH

    # Ensure permissions correct and the new key is registered with the ssh-agent
    chmod 700 ~/.ssh
    chmod 400 ~/.ssh/id_*
    chmod 644 ~/.ssh/id_*.pub
    eval "$(ssh-agent -s)"
    ssh-add $PRIVATE_KEY_FPATH

    # -----------------------------------------
    # Step 2: Register SSH Keys with dvc remote
    # -----------------------------------------
    # Run ssh-copy-id to let the remote know about your ssh keys
    # You will have to enter your active-directory password here
    ssh-copy-id -i $PRIVATE_KEY_FPATH $REMOTE_USERNAME@$REMOTE_URI
fi

Depending on your configuation you may need to explicitly register this key with this remote on your local machine. Append the appropriate lines to your $HOME/.ssh/config file:

Host $REMOTE_NICKNAME $REMOTE_URI
    HostName $REMOTE_URI
    Port 22
    User ${REMOTE_USERNAME}
    identityfile "$HOME/.ssh/id_${REMOTE_USERNAME}_ed25519"

If you defined the above environment variables you should be able to run this code to ensure it exists programatically:

codeblock(){
    __doc__="
    Helper function for unindenting text
    "
    echo "$1" | python -c "import sys; from textwrap import dedent; print(dedent(sys.stdin.read()).strip('\n'))"
}

# If the host is not already registered in your config then add it
HOST_IN_CONFIG="$(cat $HOME/.ssh/config | grep '^ *HostName *'$REMOTE_URI)"
if [[ "$HOST_IN_CONFIG" == "" ]]; then
    echo "Adding host do your config"
    codeblock "
        # Programatically added bock
        Host $REMOTE_NICKNAME $REMOTE_URI
            HostName $REMOTE_URI
            Port 22
            User ${REMOTE_USERNAME}
            identityfile "$HOME/.ssh/id_${REMOTE_USERNAME}_ed25519"
    " >> $HOME/.ssh/config
    chmod 600 ~/.ssh/config
else
    echo "Host was already in your config"
fi

For the working example variables it may look like this:

Host horologic horologic.kitware.com
    HostName horologic.kitware.com
    Port 22
    User jon.crall
    identityfile ~/.ssh/id_jon.crall_ed25519

Remember to ensure the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/known_hosts
chmod 400 ~/.ssh/id_*
chmod 644 ~/.ssh/id_*.pub

Troubleshooting SSH Keys

If you receive a permission error when you do a git pull and you are sure your public ssh key is correctly registered with gitlab, you can do the following to force git to use a particular ssh key.

export GIT_SSH_COMMAND="ssh -i <path-to-key>"

# OR

git config --local core.sshCommand 'ssh -i <path-to-key>'

Information from SO41385199.