Euler Access And Safe SSH Key Setup

Euler is ETH Zurich's shared service for research calculations. Secure Shell (SSH) is the protected text connection from your computer to Euler. An SSH key pair lets Euler recognize your computer without falling back to the ETH password after the key is set up correctly.

Goal: understand and recover the Euler SSH setup without replacing a working key or unrelated SSH configuration.

Prerequisites: a personal ETH account and a working network connection.

Use The Numbered Passport Procedure#

Follow the numbered recipe in Establish Safe Euler SSH Access. It is the single source for commands on Windows, macOS, and Linux. Run it from the local Passport when assigned so Check my work can record the result.

Do not combine that recipe with an older key filename or SSH block from notes, another student, or a previous tutorial. Stop at the first failed step.

The procedure has twelve gates:

1. check the network or VPN;
2. prove password login while ignoring the user SSH config;
3. inspect existing SSH files without changing them;
4. keep an existing euler identity that already works, or test the standard pair if it exists;
5. compare the fingerprints of an existing pair that does not work;
6. create id_ed25519_euler only when neither half exists;
7. install only id_ed25519_euler.pub;
8. prove direct public-key-only access;
9. create or update the isolated euler alias;
10. inspect the resolved target, port, identity, proxy, authentication, and forwarding fields;
11. prove the alias with all password fallbacks disabled;
12. configure euler-tunnel only after the alias prints config-ok.

What The Success Markers Mean#

A prompt for the SSH key passphrase is normal during key-ok and config-ok. A prompt for the ETH account password means a key-only gate did not pass.

Files And Boundaries#

The resolved values checked before the final test are:

hostname euler.ethz.ch
port 22
user <your-short-ETH-username>
identityfile <one or more private-key paths; never a .pub path>
identitiesonly <yes for the standard setup; yes or no for a retained working setup>
preferredauthentications publickey
passwordauthentication no
kbdinteractiveauthentication no
forwardagent no

The username is the short ETH username, not an email address. The identityfile value must not end in .pub. Password and keyboard-interactive fallback stay disabled for the final alias, agent forwarding stays off, the port is 22, and no proxycommand or proxyjump line is resolved. The direct euler alias is deliberately isolated from any old tunnel setting.

Why The Procedure Does Not Generate A Timestamped Key#

One stable filename makes the alias, tunnel, VS Code, and diagnostics agree on the same key. A timestamped replacement can leave several plausible keys and hide which public key Euler authorized. The no-overwrite guard protects an existing standard pair. If either file already exists, inspect it instead of creating another key.

Existing Pair Does Not Authenticate#

Do not regenerate it first. Use the fingerprint step in the mission:

• matching fingerprints mean the pair is coherent; keep it and install its existing .pub file through the already-proven password login;
• different fingerprints, an unreadable private key, or a missing half mean stop and request help;
• a successful direct key-ok means skip generation and installation.

This distinction prevents a missing authorized_keys entry from being misdiagnosed as a broken private key.

Existing SSH Config Is Invalid#

The alias step validates the current config before writing. If OpenSSH names a bad line:

1. stop the alias step;
2. read the exact file and line number;
3. keep the timestamped backup;
4. ensure every Host, HostName, User, IdentityFile, and other option is on its own line;
5. validate again before connecting.

Do not append another host block to a malformed line, replace the whole .ssh directory, or weaken authentication settings.

Safe Diagnostic Information#

You may share:

• local operating system and shell;
• which numbered gate failed;
• the exact error with usernames and paths removed when needed;
• the resolved ssh -G fields above;
• whether password-login-ok, key-pair-matches, key-ok, or config-ok appeared.

Never share a private key, ETH password, key passphrase, recovery code, complete verbose log containing private paths, or research data.

Continue To A Compute Node#

Direct SSH reaches an Euler login node. It is suitable for file management, editing, and Slurm job control, not computation. For VS Code or another interactive session on a compute allocation, continue with Euler Tunnel And VS Code only after config-ok.

Troubleshooting#

Use Euler Troubleshooting By Symptom for timeouts, permission warnings, malformed config lines, tunnel password prompts, and VS Code Remote SSH behavior. Use the ETH HPC support route for account or service issues that the numbered procedure cannot resolve.

Primary Sources#

• ETH HPC SSH
• ETH HPC host keys
• ETH HPC user account

Verified: 2026-09-04. Review by: 2026-12-04. Owner: IDEAL Lab IT.