SSH Keys for bastion.wm.edu

Beginning September 9, 2026, bastion.wm.edu will no longer allow password + Duo authentication. To use bastion after that date, you will need to authenticate with an SSH key.

This page explains how to create an SSH key on Windows, macOS, or Linux and how to use it when connecting through bastion.

Creating an ssh key
Adding your key to bastion.wm.edu
Using ssh-agent and ssh-add
Using the key and trouble shooting
Security reminders and help

Before you start

An SSH key comes in two parts:

Private key - This stays on your computer. Never send it to anyone and never upload it to a website.
Public key - This is safe to share. You will add your public key to your W&M GitLab account at code.wm.edu. The public key will end with the suffix .pub

You can think of the public key as a lock and the private key as the key that opens it. The server gets the lock; you keep the key.

Use a passphrase!

When you create your SSH key, you will be asked for a passphrase.

You should always set a passphrase on your SSH private key.

A passphrase protects your private key if someone gets a copy of the key file from your computer. Without a passphrase, someone who obtains your private key may be able to use it to access systems that trust that key.

Your SSH passphrase is different from your W&M password. Choose a strong passphrase that you can remember, but do not reuse an important password from another account.

You normally will not have to type the passphrase every time you connect. The ssh-agent program can securely keep your unlocked key available for you during your login session. See more information on ssh-agent and ssh-add below.

Create an SSH key

For new keys, we recommend an ed25519 key, if this is not available on your system, rsa is another popular choice.

You should create your key on the computer you normally use to connect to campus systems.

Windows

Recent versions of Windows include OpenSSH.

Open PowerShell or Windows Terminal and run:

ssh-keygen -t ed25519

You will see something similar to:

Generating public/private ed25519 key pair.
Enter file in which to save the key (C:\Users\yourname\.ssh\id_ed25519):

Press Enter to accept the default location.

You will then be asked for a passphrase:

Enter passphrase (empty for no passphrase):

Enter a strong passphrase. Do not leave this blank.

You will be asked to enter the passphrase a second time.

When the command finishes, you should have two files:

C:\Users\<username>\.ssh\id_ed25519
C:\Users\<username>\.ssh\id_ed25519.pub

The file ending in .pub is your public key.

Never share or upload id_ed25519.

MacOS & Linux

Open Terminal and run:

ssh-keygen -t ed25519

When asked where to save the key, press Enter to accept the default:

/Users/yourname/.ssh/id_ed25519

When asked for a passphrase, enter a strong passphrase. Do not leave it blank.

You will then have two files:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

The .pub file is your public key.

Never share or upload id_ed25519.

Add your public key to W&M GitLab

The public key is the file ending in .pub.

You need to copy the contents of that file and add it to your account on code.wm.edu.

Windows

In PowerShell, run:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

cat C:\Users\<username>\.ssh\id_ed25519.pub

to display the public key.

Copy the entire line that is displayed. It will look similar to:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... yourname@computer

Copy the entire line, from ssh-ed25519 through the end.

macOS or Linux

Run:

cat ~/.ssh/id_ed25519.pub

Copy the entire line that is displayed.

It will look similar to:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... yourname@computer

Copy the entire line, from ssh-ed25519 through the end.

Add the key to code.wm.edu

https://code.wm.edu/

Click on the icon on the top right of the screen (your picture or a default icon) and select "Preferences" in the drop down menu.
Then select "Access" in the left side panel. Under "Access" select "SSH keys"
In the SSH keys window, click the "Add new key" button on the top right of the table "Your SSH keys".
Paste your public key into the "Key" window
Give it a title in the "Title" field
Optionally, give it an "Expiration Date"
Click the "Add key" button below the "Expiration Date" field.

Then add your public SSH key to your account.

Only copy the contents of the .pub file. Never copy your private key.

ssh-agent and ssh-add

When you add a passphrase to your private key you will have to type it every time you use it. However, typing the passphrase every time you connect would be inconvenient. This is where ssh-agent and ssh-add come in.

ssh-agent

ssh-agent is a program that keeps your decrypted SSH key available in memory after you unlock it with your passphrase.

Instead of asking you for your passphrase every time SSH needs your key, SSH can ask the agent to use the key for you.

The private key itself remains protected by its passphrase on disk.

ssh-add

ssh-add tells the SSH agent which private key you want it to use.

For example:

ssh-add ~/.ssh/id_ed25519

You will be asked for your key's passphrase. After you enter it, the agent can use that key for your SSH connections.

Why use both?

The usual workflow is:
Start ssh-agent.
Use ssh-add to load your private key.
Enter your passphrase once.
Use SSH normally.

This gives you the security benefit of a passphrase without requiring you to type that passphrase for every SSH connection.

Using ssh-agent

The exact setup is slightly different depending on your operating system.

Windows

Windows includes an OpenSSH Authentication Agent service.

Open a PowerShell as Administrator (right-click PowerShell in the start menu and select "Run as Administrator").
At the PowerShell prompt type "Get-Service ssh-agent" and hit enter.
If it lists the service as stopped, set it to start manually by typing: "Set-Service -Name ssh-agent -StartupType Automatic", then hit enter.
To start the type "Start-Service ssh-agent" and hit return.

Now that the ssh-agent service is started, you can close the Adminstrator PowerShell window. Then, you can add your private key to the agent by typing:

ssh-add $env:USERPROFILE\.ssh\id_ed25519

or just

ssh-add

if you only have one key.

Enter your passphrase when prompted.

You can check which keys are loaded with:

ssh-add -l

macOS

macOS normally provides an SSH agent for you.

You can add your key with:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

This allows macOS to use the keychain to help manage your SSH passphrase.

If that command is not available on your system, try:

ssh-add ~/.ssh/id_ed25519

You can see which keys are currently loaded with:

ssh-add -l

Linux

On many Linux systems, an SSH agent is already running as part of your desktop session.

Try:

ssh-add ~/.ssh/id_ed25519

Enter your passphrase when prompted.

To see which keys are loaded:

ssh-add -l

If you receive an error indicating that no agent is available, start one with:

eval "$(ssh-agent -s)"

Then add your key:

ssh-add ~/.ssh/id_ed25519

Using your key

Once your public key has been added to code.wm.edu and your private key has been loaded into ssh-agent, test your connection.

Your exact SSH command depends on the server you are trying to reach and the instructions provided for that system.

For example, when using bastion as a jump host, you may use an SSH command with -J:

ssh -J your-wm-username@bastion.wm.edu your-wm-username@target-server

Your HPC/RC documentation will provide the appropriate command for the system you are trying to access.

The important point is that your SSH client uses your private key to authenticate, while bastion and the destination server use the public key that you have registered.

Troubleshooting

"Permission denied (publickey)"

This usually means that the server did not accept the SSH key you offered.

Check the following:

Did you add the correct public key to your W&M GitLab account?
Did you copy the entire contents of id_ed25519.pub?
Did you accidentally upload your private key instead?
Is your SSH agent running?
Did you run ssh-add to load your key?
Are you using the correct W&M username?
Are you connecting to the correct server?

You can see which keys your SSH agent currently has loaded with:

ssh-add -l

"Could not open a connection to your authentication agent"

This means that your SSH client cannot find a running ssh-agent.

On Linux, try:

eval "$(ssh-agent -s)"

Then:

ssh-add ~/.ssh/id_ed25519

On Windows, make sure the OpenSSH Authentication Agent service is running (see above).

I forgot my key passphrase

Your SSH key passphrase cannot be recovered.

If you no longer know the passphrase, create a new SSH key and add the new public key to your W&M GitLab account.

Do not send your private key to support or anyone else in an attempt to recover the passphrase.

Security reminders

Please keep these rules in mind:

Your private key is secret.
Never email it, upload it to GitLab, put it in a shared folder, or send it to another person.

Use a passphrase.
A private key without a passphrase provides much less protection if the key file is stolen.

Your public key is not secret.
It is safe to add the .pub file to services that need to authenticate you.

Do not copy your private key to bastion.
The private key should remain on your own computer. You use it from your computer to authenticate to remote systems.

You may have more than one SSH key.
For example, you might use one key for W&M systems and another for a different organization or service.

Need help?

For questions or problems with bastion.wm.edu itself, contact W&M IT at:

[[w|support]]

HPC/RC does not administer or control the bastion host but are happy to answer questions about it if we can. For specific questions about using bastion to connect to HPC/RC clusters or system, please email [[w|hpc-help]].