How to log in with SSH

Log in to a UiO machine using SSH

From Windows, Linux or Mac, log in to a computer at UiO as follows:

$ ssh username@machine.uio.no

Here, username is your UiO username, and machine.uio.no is the machine you will log in to. This works on shared machines such as login.uio.no and on unit-wise shared machines or servers that have opened for SSH.

It will not work if you try to log in to a Linux machine located on the normal office network at UiO. To reach office computers, you must log in via a machine that has been opened for it, for example like this:

$ ssh -J username@login.uio.no  username@officemachine.uio.no

• SSH then first logs in to the first machine (login.uio.no), and then sets up a tunnel to the second machine (officemachine.uio.no).

This host utilizes two factor authentication via Microsoft Azure.
  If you are using the Microsoft Authenticator mobile application, you
  should have received a notification which you need to accept in
  order to proceed. If you are using One Time Password (OTP) codes,
  enter the OTP code now.;

• You will first be required to perform two-factor authentication via Azure. If you use Microsoft Authenticator, you receive a push notification and are asked to do a number matching. If you use another two-factor solution (OTP), please enter a six-digit code.
• You will then be asked for a password for logging in to login.uio.no and then again a password for logging in to the computer you want to use.

This process can be simplified by configuring .ssh/config, see separate documentation:

How to set up SSH

In case of errors or problems with login, you can add an option to get more details:

$ ssh -vv username@login.uio.no

You will then get a lot of debug information that helps you find where things go wrong.

Copying files to and from machines at UiO with SCP

The scp command to copy files works similarly to SSH via a login machine.

$ scp -J username@login.uio.no  locale_file username@officemachine.uio.no:/catalog/filename

The first time you log in to a new machine

The first time you log in to a machine, you will get a notification like this:

user@client:~ $ ssh uiouser@login.uio.no
The authenticity of host 'login.uio.no (129.240.12.61)' can't be established.
ED25519 key fingerprint is SHA256:UKmAMkH6PqvIykd499f6yhxK1vSfMO7wMay3HyFQUuo
Are you sure you want to continue connecting (yes/no)?

Here the value SHA256:UKmAMkH6PqvIykd499f6yhxK1vSfMO7wMay3HyFQUuo is a fingerprint of the key of this machine. If you log in at login.uio.no, it should match this value. All machines will have their unique key.

If this value is not correct, then it may be a sign of an attack or that someone is trying to eavesdrop on the connection. If you are going to log in to other machines at UiO, you can first log in at login.uio.no and then log in to the machine you are going to.

If you want to check the fingerprint on a machine, it can be done as follows with ssh:

user@client:~$ssh -o fingerprinthash=sha256 -o visualhostkey=yes login.uio.no
Host key fingerprint is SHA256:UKmAMkH6PqvIykd499f6yhxK1vSfMO7wMay3HyFQUuo
+--[ED25519 256]--+
|oo .    .o.o     |
|+ . .  .. +      |
|.o   ... o       |
| .    ... .      |
|  o     SE . .   |
| o o .  o o . .  |
|  = . .o +.B .   |
|+  +  o.+.*o* o  |
|=+o    ..***o+   |
+----[SHA256]-----+
user@login.uio.no's password:

Fingerprint is also in DNS (but not signed with DNSSEC):

user@client:~$ dig +short SSHFP login.uio.no
smaug.uio.no.
4 2 50A9803241FA3EABC8CA4778F7D7FACA1C4AD6F49F30EEF031ACB71F 215052EA
user@client:~$

If both of these are correct, it can be assumed that the key is correct.