SSH keys (and how not to lock yourself out)

An SSH key lets you log into lab machines without typing your password every time. You make a pair of files once on your own computer, paste one of them at pwd.nuilab.org (opens in new tab) , and you’re done.

It is optional — password login keeps working either way. But nearly everyone who has trouble here hits one of two problems: they can’t tell the two files apart, or they deleted the key that was working in order to “start clean”. This page is about both.

⚠️ Never delete a key to troubleshoot. If something isn’t working, add a new key with a different label — you can have several, and they don’t conflict. Deleting is what turns “my login is being difficult” into “I can’t get in at all”. Delete a key when you actually mean to revoke it (a lost or wiped laptop), never as a debugging step.

Public key vs private key — the one thing to get right

ssh-keygen creates two files, one pair. They belong together and they are not interchangeable:

The names differ by four characters, so the reliable test is to look at what you copied:

• A public key is one single line. It starts with ssh-ed25519 AAAA… and usually ends with a short comment like you@your-laptop.
• A private key is many lines, and the first one is -----BEGIN OPENSSH PRIVATE KEY-----.

If what you copied contains the word BEGIN, stop. That’s the private key — the wrong file. Go back and take the one whose name ends in .pub.

Make a key pair (if you don’t have one yet)

Windows

1. Open PowerShell: click Start, type PowerShell, press Enter.
2. Run:

   ssh-keygen -t ed25519
   

   Press Enter at each prompt to accept the defaults. (A passphrase is optional; leaving it empty is fine.)
3. The two files land in C:\Users\<you>\.ssh\ — id_ed25519 and id_ed25519.pub.

Turn on file extensions first if you plan to look at them in File Explorer. By default Windows hides them, so id_ed25519 and id_ed25519.pub show up as the same name with the same icon — which is exactly how people end up opening the private key by mistake.

• Windows 11: in File Explorer, click View → Show → tick File name extensions.
• Windows 10: in File Explorer, open the View tab → tick File name extensions.

Then print the public key in PowerShell and copy the whole line:

type $env:USERPROFILE\.ssh\id_ed25519.pub

Select the entire line — from ssh-ed25519 through the comment at the end — and copy it. It will probably wrap onto several display lines in the window; that’s just the window being narrow, it’s still one line.

macOS and Linux

Open Terminal and run:

ssh-keygen -t ed25519

Press Enter at each prompt for the defaults. That creates ~/.ssh/id_ed25519 (private — keep it) and ~/.ssh/id_ed25519.pub (public — the one you share).

Then print the public key:

cat ~/.ssh/id_ed25519.pub

On a Mac you can copy it straight to the clipboard instead:

pbcopy < ~/.ssh/id_ed25519.pub

Add it at pwd.nuilab.org

Go to pwd.nuilab.org (opens in new tab) (the same site also answers as reset.nuilab.org), sign in, and find the SSH keys section. It has Add and Delete.

Click Add and fill in two fields:

• Label — a name for this computer, so you can tell your keys apart later. 1–32 characters, and only letters, digits, dot, underscore and hyphen — no spaces. For example laptop, windows-laptop, office.desktop.
• Public key — paste the whole single line, starting at ssh-ed25519 and including the trailing comment. Don’t trim anything off either end.

Save, and it works on every lab machine you’ve been granted — no password prompt. If your account has git access, the same key is copied to git.nuilab.org (opens in new tab) within about ten minutes; see Git — code hosting .

What the error messages mean

The portal checks your input before it saves anything. All three of these are refusals — nothing was changed, and none of them is a reason to delete an existing key.

“It asks for my password, and my password doesn’t work”

This one is misleading, and it usually does not mean your key is broken.

SSH deliberately refuses to reveal whether an account exists on a machine. So if your account isn’t resolving on that particular machine, you don’t get a helpful message — you get a password prompt anyway, your correct password is refused, and you end up at:

Permission denied (publickey,password).

That line names publickey first, which sends people off to delete and re-add keys. It is only a list of the methods that were offered, not a diagnosis.

Rule of thumb: if you got a password prompt at all, your key is probably fine and the problem is on the server side. Report it in Mattermost (opens in new tab) instead of changing your keys — say which machine you tried and paste the last line of the error. Deleting keys at that point only removes the thing that would have worked once the account issue is sorted out.

If you’re locked out

Message Francisco on Mattermost (opens in new tab) . There’s no ticket system — chat is the way. Include:

• which machine you were trying to reach,
• the exact error line you got,
• and the label of the key you’re using (never the key itself, and never the private key).

If you can still sign in to pwd.nuilab.org (opens in new tab) , you can add a fresh key yourself under a new label — that’s usually faster than waiting. If you can’t sign in there either, start with Reset your password .

Related

• Reset your password (and find your username) — recovering your account when the password is the problem.
• Git — code hosting (Forgejo) — the other place a key can go, and cloning over SSH.
• How the lab systems connect — what your one lab account covers.