Skip to main content Skip to secondary navigation

FarmShare SSH Host Keys

Main content start

FarmShare uses several common SSH keys, so you only have to verify keys a few times (instead of once for each server you connect to).  You can also use GSSAPI Key Exchange to safely skip key verification.

When you connect to a system using SSH, but before any passwords are sent, your SSH client does a check to see if it is talking to the correct server.  This is known as host key verification.  The normal method of doing this verification is to display a message containing the hashed host key (known as a fingerprint), asking you if that key is correct.  Once you confirm that the key is correct, your client should not ask you again, unless the key changes or the list of trusted keys is deleted.

Normally, each machine has its own SSH host key.  To make things easier for you, while still maintaining a level of security, we have generated one host key for each type of FarmShare node: There is one SSH host key for login nodes, one for compute nodes, and one for GPU nodes.

You can find the SSH host keys below, as well as key fingerprints in two formats (your SSH client will use one of the two).

GSSAPI Key Exchange

It is possible to bypass the SSH host key verification step, while still ensuring that you are connecting to the machine you expect!  To do this, you will need to be logged into Kerberos, while also using a properly-configured client.  Then a different Kerberos protocol and key is used to verify the identity of the host.

On Linux, Mac OS X 10.9 & below, and any Mac OS X using non-system SSH, place the following configuration block in your ~/.ssh/config file:

Host rice*.stanford.edu oat*.stanford.edu wheat*.stanford.edu
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
GSSAPIKeyExchange yes

This requires a little bit of care (and probably a Host * line at the end) to ensure that you don't mess with the rest of your SSH configuration.

On Windows, you will need to download a third-party build of PuTTY, one that has GSSAPI key exchange support included.

Host Keys and Fingerprints

Here are the SSH public keys and key fingerprints for FarmShare v2:

For the rice login nodes:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILKHpqh9AM+h5dAR10kubaxMTwgsS9weCMUcZDHdT4Cr rice.stanford.edu
256  MD5:   f6:a4:69:2d:08:07:37:d4:1d:62:ce:33:f6:67:f1:c1 rice.stanford.edu (ED25519)
256  SHA256:rdOi2irXvc0RXGp0D1/fEo+A4vSLUC7k1ArtQTOD+V4     rice.stanford.edu (ED25519)

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDU0r1QTae9D+5K34iKuF6gA7NzoSEkfxOj2gz8L/KU+30COU9+nNV00DpnuZHKFlQvWzF+8CSGMdCyeWO3gpKC4QcN+J2IfuRhQvh1mD09dHsc+I/LlDYbUukYse+5sM8jEyQKWqGFbnfhvsMzPz/m3TyKvZpmu3k1ODxy/uTHUiDvgLPynUugVVMcHR8s5JWSr17uvAsdXjPA+C1Vkvoky9xSmOA0y/yND4QTxknpd8gG0YFcAJUE6gequBaP/Mc/TUQbcAtaMgZ7JsA2hoC0aAmW+wlPaq4QK8vvM5Pa/pDDAs3i/jVxCS9STdK+THNckTO/0foyC0MTa0ufIRYGkwTnyKfqQF+0tYdzJ0YmlhyEViXrQJYbwhVJ2nn4XG7UmteVP0bI+RBcv7JhIjGkLZ+oXd4O6OaKSLNyz3+yCmUENAlZbO51bQOI06w0tektyPppOwNxCsPDv3E//lrW2PPgpx+ZMXQDn3PUNmMIqBPIXOT0ej/D1Xp+bOOcXWk= rice.stanford.edu
​3072 MD5:   e4:bf:89:7d:54:c4:ec:de:83:86:d8:76:ff:d5:a3:7d rice.stanford.edu (RSA)
3072 SHA256:vsNgw9dGLWNWQVpWKtl8WxJpKH7yWQEB1vUq76LF4R8     rice.stanford.edu (RSA)

For the wheat compute nodes:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwl7Vy/xrQNF1gkf2D4YbOiSNdHVZZdO1B0ZOg93ZMo wheat.stanford.edu
256 MD5:   96:8f:95:6c:08:c0:7f:66:50:a2:3b:74:19:77:03:80 wheat.stanford.edu (ED25519)
​256 SHA256:hb+URFBJtnI66u8tJ884R6NYNoUWOUnZ9SY5p27/UR8     wheat.stanford.edu (ED25519)

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6obzawQGg2a0el5/UmXF5Rax+iTX9MtblC3JqPDrqPZcDsnjtmxEJZpVVKmA0yUJTK3uB+An2m37uXxzcptm2DkzEL4GtA4KbZCqS/LXMszgihvssqDvHf/cDBL/7ewYo60K7vTRwCrXjJoOvsLkn3Qo5bTjUwO+lxtZsbndV3c+t6cBTPFChZQCt3oZXX+AOUdLxHyLvKEuknncd0w8EelnUcQIGsrVq9vPOVDsvc+7dWXc85XlI2RWdy/RQ9thP4QOD3/nWHSmt+XsFAMyPT9+tk7t6j309X1JZ7LDrR4PcPKdAV8Di18nhIZoCPvr8ZPLn1Ry69nnRiMIvCZ1UI+fgHd1c+qChqfaRc1tjrUwDuvd1fjZuPGBAtfYROTUTOU828FUddyqvZYwiNkxvbLo8uZGiKv/s6of1uMlY8EzrVXdNu3NEHiY2kxjRfkWQyNF+e4o+gVUYTaAdn6eqT41mY4EOJOhzhFwqhdPs6E/dxHuQxuRIvjQ1CZGOacE= wheat.stanford.edu
​3072 MD5:   05:f4:a8:dd:ec:84:d6:ee:f6:1d:fa:2e:5a:39:ad:48 wheat.stanford.edu (RSA)
3072 SHA256:Wc6M+ytUns/6aQQ7oGwhmUvTirh2F2+bC5XwCW82S1U     wheat.stanford.edu (RSA)

For the oat GPU nodes:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDkFtixLWlJK5vIKe7N8mbIp63NXUIVej007UrsJyqSz oat.stanford.edu
256  MD5:   a1:f3:73:39:5c:28:b6:41:5f:92:ef:9c:60:aa:b2:83 oat.stanford.edu (ED25519)
​256  SHA256:tzEH/cWHU0P9/gmGJ7ceQVGhbOToaghLvxruubIrPyk     oat.stanford.edu (ED25519)

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCUsUFS3UvNEGtJE3TWoOx0tx2NpIqQYiBfagtm0nPBqUOtl2ZDKADhrVBIajn3VRSjvAS2hpItdwDs1/NBtqHqkEYqOSt1WDPU1Ld5ktbisWQ+iIOLOwdLVacse+4pNXospYAEO0dok9ZFDBZPzF2zNaBqSefxQvoLC/iyO5xjoZ/LcYDkz036KoRm1Y6NFcLwhTxXdSNyyOhvuMqpZrDMlPXMujRlkEqhkDS+73CGGDKrDfW4SBJja5Tg+zizSD/TxsKXqUle6n0EVsFot9wz1zHw8mcXlhflyH/4Cz66fhbRMf6Tv9yzvoKQyij2XMWxRJ4OFz+wfQ38/0rHr6vyTj7KvPERHTQmLQ4mMF0Bo/uMxctr74gCIob3ya138P2W8NbqmtbGH5gAYL0DVIiEMo5PPV3uhO12VDHSfVoRfqxwJ2sYWBgGkNAHykUgJ4oag17fToFcagr0dfh8xeqG02mxJS0pSxiqTqmOSQurTEua59qVZV+wvg1i00244Xk= oat.stanford.edu
​3072 MD5:   07:37:fa:10:bf:9a:0e:81:fd:29:7b:91:03:ae:a5:57 oat.stanford.edu (RSA)
3072 SHA256:PZx/lsQHualxmRBRu+2wL12RKOO/u5nsqf9Ohntq7ak     oat.stanford.edu (RSA)

If you have any problems with host-key verification, such as getting a different fingerprint, please let us know!