Differences

This shows you the differences between two versions of the page.

--- other:ssh [2023/03/24 17:42] – [Connecting to servers commonly used by LSCE users] Updated IPSL servers info jypeter
+++ other:ssh [2026/08/07 16:36] (current) – [Connecting to servers commonly used by LSCE users] Updated jypeter
@@ Line 14: / Line 14: @@
   * We assume below that you have a ''my_login'' account on the remote ''remote_server'' computer, and that you know your password
-    * This page will also show some examples using the [[https://intranet.lsce.ipsl.fr/informatique/fr/inter.php|LSCE]], [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] and [[https://intranet.lsce.ipsl.fr/informatique/en/tgcc.php|TGCC]] servers
+    * This page will also show some examples using the [[https://intranet.lsce.ipsl.fr/informatique/en/inter.php|LSCE]], [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] and [[https://intranet.lsce.ipsl.fr/informatique/en/tgcc.php|TGCC]] servers
   * Instead of a password, you can also [[other:ssh#using_ssh_keys|use a set of private and public keys and a passphrase]]
-    * This is the only kind of authentication that will work if you need to use the [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] (aka //**ciclad** and **climserv**//)!
+    * This is the only kind of authentication that will work if you need to use the [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] (aka ''**spirit[x]**'')!
   * Many programs are said to //work over ssh// when they implicitly use the //ssh protocol// to securely transfer data from one server to another: ''scp'' (copy remote directories and files), ''rsync'' (synchronize remote directories and files), ...
@@ Line 28: / Line 28: @@
 <WRAP center round tip 60%>
-  * The following will work in a **Linux** terminal, but can also work in a //terminal// on a **Mac** or on a **Windows 10** computer
+  * The following will work in a **Linux** terminal, but can also work in a //terminal// on a **Mac** or on a **MS Windows** computer
-  * On **Windows 10**, ''ssh'' is directly available in a ''Windows Powershell'', a [[other:win10apps#windows_terminal|Windows Terminal]] or the old ''cmd'', but the most user-friendly way to use ''ssh'' is to use [[other:putty_conf|PuTTY]]
+  * On **Windows 10/11**, ''ssh'' is directly available in a ''Windows Powershell'', a [[other:win10apps#windows_terminal|Windows Terminal]] or the old ''cmd'', but the most user-friendly way to use ''ssh'' is to use [[other:putty_conf|PuTTY]]
   * On a **Mac**, ''ssh'' is directly available in the built-in Apple [[other:ssh#a_recommended_terminal_for_mac|Terminal application]]
@@ Line 37: / Line 37: @@
   * **''ssh [options] [my_login@]remote_server''**
-    * If your login is the same on the local and remote computer, you can omit the optional ''my_login@'' part:\\ e.g. simply use ''ssh ssh1.lsce.ipsl.fr'' instead of ''ssh my_login@ssh1.lsce.ipsl.fr''
+    * If your login is the same on the local and remote computer, you can omit the optional ''my_login@'' part:
-    * The **first time** you connect to a **new server**, ''ssh'' will ask if you are sure of what you are doing, and then store some unique information about the remote server in the ''known_hosts'' file ([[#configuration_files|details]]).\\ <code>PS C:\Users\my_login> ssh ciclad.ipsl.jussieu.fr
+      * e.g. simply use ''ssh ssh1.lsce.ipsl.fr'' instead of ''ssh my_login@ssh1.lsce.ipsl.fr''
-The authenticity of host 'ciclad.ipsl.jussieu.fr (134.157.176.129)' can't be established.
+    * The **first time** you connect to a **new server**, ''ssh'' will ask if you are sure of what you are doing, and then store some unique information about the remote server in the ''known_hosts'' file ([[#configuration_files|details]]).\\ \\ ''ssh'' will automatically check this security information each time you connect to the same server, and warn you if something seems wrong.
-RSA key fingerprint is SHA256:n6wFvMaJuyInd0LNhp78dfMd04Dr751lEekcU7X2UfU.
-Are you sure you want to continue connecting (yes/no)? yes
-Warning: Permanently added 'ciclad.ipsl.jussieu.fr,134.157.176.129' (RSA) to the list of known hosts.
-my_login@ciclad.ipsl.jussieu.fr: Permission denied (publickey,hostbased).</code>\\ ''ssh'' will automatically check this security information each time you connect to the same server, and warn you if something seems wrong.
 ==== Most common options ====
   * ''-X'' or ''-Y'' options if you will need to **use graphical programs on the remote server**
-    * All the Details in the [[other:ssh#using_an_x_server_to_display_graphics|Using an X server to display graphics]] section
+    * Details in the [[other:ssh#using_an_x_server_to_display_graphics|Using an X server to display graphics]] section
   * ''-A'': **enable //agent forwarding//**. This is useful when you use [[other:ssh#using_ssh_keys|ssh keys and an ssh agent]]
-  * ''-t command'': this option allows you to **execute a specific command on the remote server** (without displaying the output of the initial ''ssh''). We use this mostly to //chain ssh connections//, when we want to automatically go through a specific //gateway// server to access another server\\ e.g. ''ssh -A -X my_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix''
+  * ''-t command'': this option allows you to **execute a specific command on the remote server** (without displaying the output of the initial ''ssh''). We use this mostly to //chain ssh connections//, when we want to automatically go through a specific //gateway// server to access another server
+    * e.g. ''ssh -A -X my_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix''
-  * ''-v'': **verbose mode**. Use this option only when you can't connect, or things don't seem to work correctly. Analyzing the verbose output when you start ''ssh'' should allow you, or the [[other:newppl:starting#getting_help_from_the_lsce_system_administrators|system administrators]], to find out what is wrong
+  * ''-v'': **verbose mode**. Use this option only when you can't connect to the remote server, or things do not seem to work correctly
+    * Analyzing ''ssh'' verbose output hould allow you, or the [[other:newppl:starting#getting_help_from_the_lsce_system_administrators|system administrators]], to find out what is wrong
+    * See also the [[#solving_common_problems|Solving common problems]] section
 ==== Connecting to servers commonly used by LSCE users ====
@@ Line 64: / Line 63: @@
   * If your computer is **on the LSCE ethernet/wired network**:
     * Go to the server with the smallest [[other:newppl:starting#determining_the_load_of_a_linux_server|load]]:\\ ''ssh -A -X my_LSCE_login@obelix''\\ or ''ssh -A -X my_LSCE_login@obelix.lsce.ipsl.fr''
-    * Go to a specific ''obelixNN'' (possibly because you have some running processes on this server that you want to monitor with [[other:newppl:starting#determining_the_load_of_a_linux_server|top]], or terminate with ''kill'')\\ e.g. ''ssh -A -X my_LSCE_login@obelix4''
+    * Go to a specific ''obelixNN'' (possibly because you have some running processes on this server that you want to monitor with ''[[other:newppl:starting#determining_the_load_of_a_linux_server|top]]'', or terminate with ''[[other:newppl:starting#using_the_kill_command_to_terminate_processes|kill]]'')\\ e.g. ''ssh -A -X my_LSCE_login@obelix4''
   * If your computer is **outside LSCE**, or **on the LSCE WiFi network**, you have to:
     * Ask your advisor to send a mail to [[other:newppl:starting#getting_help_from_the_lsce_system_administrators|help-lsce]], and request an access to the ''ssh1'' server
-    * Connect through the ''ssh1'' gateway server, i.e you first use ''ssh'' to connect to the ''ssh1'' gateway, and then use ''ssh'' to go to an ''obelix'' server\\ These two ''ssh'' commands can be [[other:ssh#most_common_options|conveniently chained with the '-t' option]]!\\ ''ssh -A -X my_LSCE_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix''
+    * Connect through the ''ssh1'' gateway server, i.e you first use ''ssh'' to connect to the ''ssh1'' gateway, and then use ''ssh'' to go to an ''obelix'' server\\ These two ''ssh'' commands can be [[other:ssh#most_common_options|conveniently chained with the '-t' option]] !\\ ''ssh -A -X my_LSCE_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix''
 === IPSL servers ===
 If you want to connect to the [[https://documentations.ipsl.fr/spirit/spirit_clusters/head_nodes.html|IPSL servers]] (only possible with [[other:ssh#using_ssh_keys|ssh keys]]!):
+  * [[https://mesocentre.ipsl.fr/account-opening/|Requesting an account at IPSL]]
   * Connecting to ''spirit1'':
     * ''ssh -A -X my_meso_login@spirit1.ipsl.fr''
     * Depending on what you need to do, you can also use ''spirit2'', ''spiritx1'' or ''spiritx2''
   * [[https://documentations.ipsl.fr/spirit/spirit_clusters/head_nodes.html|More details]]
-  * Note: the ''ciclad'' server may still be accessible when you read this page, but its usage has been deprecated in favor of the ''spirit'' servers
 === TGCC (super)computers ===
-If you want to use the [[https://www-hpc.cea.fr/tgcc-public/en/html/tgcc-public.html|TGCC computers]] (e.g. ''irene''):
+If you want to use the [[https://www-dcc.extra.cea.fr/|TGCC computers]] (e.g. ''irene''):
-  * Note: you have to go //trough// the ''ssh1'' LSCE gateway to access the TGCC, even if you are on the LSCE wired network!
+  * [[https://www-dcc.extra.cea.fr/Tgcc/|Account creation forms]]
-  * ''ssh -A -X my_LSCE_login@ssh1.lsce.ipsl.fr -t ssh -A -X my_TGCC_login@some_tgcc_login_node''
+  * [[https://www-hpc.cea.fr/tgcc-public/en/html/tgcc-public.html|TGCC documentation]]
+  * Note: you have to go //through// the ''ssh1'' LSCE gateway to access the TGCC, even if you are on the LSCE wired network!
+    * ''ssh -A -X my_LSCE_login@ssh1.lsce.ipsl.fr -t ssh -A -X my_TGCC_login@some_tgcc_login_node''
     * Once you are on a TGCC login node (e.g. ''irene''), you can get lots of information by typing ''<node>.info'' (e.g. ''irene.info'')
   * [[https://intranet.lsce.ipsl.fr/informatique/en/tgcc.php|more TGCC connection details]]
@@ Line 152: / Line 154: @@
 You will find (some of) the following text files:
-  * ''known_hosts'': the text file were ''ssh'' stores one line of security information about each server you have connected to from this computer\\ e.g. ''ciclad.ipsl.jussieu.fr,134.157.176.253 ssh-rsa AAAAB3NzaC1y[a long identifier...]''
+  * ''known_hosts'': the text file were ''ssh'' stores one line of security information about each server you have connected to from this account
+    * e.g. ''spiritx1.ipsl.fr,129.104.53.5 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYT[a loooooong identifier...]''
+    * When you use ssh to connect to a new computer, ssh will add the new security information to ''known_hosts''
+      * <code>$ ssh spiritx2.ipsl.fr
+The authenticity of host 'spiritx2.ipsl.fr (129.104.53.15)' can't be established.
+ECDSA key fingerprint is SHA256:f9mID6QTQKleSW50Kt55rNdiN3Qbjk7hezFFC/nQCYo.
+ECDSA key fingerprint is MD5:84:5b:61:c3:0b:5f:0d:67:0a:e6:c3:8c:05:9d:39:2f.
+Are you sure you want to continue connecting (yes/no)? yes
+Warning: Permanently added 'spiritx2.ipsl.fr,129.104.53.15' (ECDSA) to the list of known hosts.</code>
   * ''config'': an optional configuration text file, e.g.\\ <code># Empty lines and lines starting with '#' are "comments"
@@ Line 158: / Line 168: @@
 ServerAliveInterval=120
-ServerAliveCountMax=90</code>
+ServerAliveCountMax=90
+ForwardX11 yes</code>
   * [[#using_ssh_keys|ssh keys]] related information:
-    * ''authorized_keys'': the //public key(s)// of the account(s) authorized to connect to //this// account.
+    * ''authorized_keys'': a file listing the //public key(s)// of all the remote account(s) authorized to connect to //this// account.
     * the **//private// (and probably the //public//) //ssh key(s)//** used on this account
       * e.g. ''id_ed25519'' and ''id_ed25519.pub'' files
@@ Line 183: / Line 194: @@
   * [[other:x_conf#troubleshooting|X server related errors]]
-  * Other types of errors: remember that you can run ''ssh'' in **verbose** mode to help you determine what is wrong (''-v'' option)
+  * Other types of errors: use ''ssh -v'' and the **verbose** mode to help you determine what is wrong
+    * Have you specified an existing account on the remote server? (''ssh remote_account@remote_server'')
+    * If you use ssh keys, **is your private key readable only for you**?
+      * <code>$ ls -l ~/.ssh/id_ed25519
+-rw-r--r-- [...] .ssh/id_ed25519
+$ ssh remote_account@remote_server
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+Permissions 0644 for '.ssh/id_ed25519' are too open.
+It is required that your private key files are NOT accessible by others.
+This private key will be ignored.
+Load key ".ssh/id_ed25519": bad permissions
+$ chmod 600 ~/.ssh/id_ed25519
+$ ls -l ~/.ssh/id_ed25519
+-rw------- [...] .ssh/id_ed25519</code>
+    * Is there an error (or a wrong, possibly old, parameter) in your local ''.ssh/config'' file?
+      * check lines looking like ''debug1: Reading configuration data /some_path/your_login/.ssh/config''
+    * ...
 ===== Copying files between servers/computers =====
@@ Line 291: / Line 321: @@
 ==== What are ssh keys and why use them? ====
-//ssh keys// are a combination of two specific (and unique) **text files**, **the //private// key** file and **the //public// key** file, linked by a special kind of password called **the passphrase**, that can be used instead of a standard password to connect securely from one server to another server
+//ssh keys// are a combination of two specific (and unique) text files (with encryption information encoded in plain text)
-ssh keys have to be configured properly (a few easy steps), and are **very convenient** because:
+  * **the //private// key** file
+  * **the //public// key** file
+  * //key// files are linked by a special kind of password called **the passphrase**, that can be used instead of a standard password to connect securely from one computer/server to another server
-  * Contrary to passwords, **they usually don't expire!**\\ You don't have to change ssh keys (except in some extra secure computing centers like TGCC) and you can keep them for years
+ssh keys have to be configured properly (a few easy steps), and are **very convenient**, because:
-  * **They don't depend on the accounts and the passwords of the servers where you use them**
+  * Contrary to passwords, **//ssh keys// usually don't expire!**\\ You don't have to change ssh keys (except in some extra secure computing centers like TGCC), and you can keep them for years
-    * You can (and should!) use the same set of ssh keys on several servers: you can then use the **same** passphrase to access all these servers, rather than having to memorize different passwords\\ e.g. if you have your //private// key on ''account_A'' of ''server_A'' and install the matching //public// key on ''account_B'' of ''server_B'', etc... you can then use ''ssh'' on ''account_A@server_A'' to access ''account_B@server_B'', ''account_C@server_C'', ... with the **same** passphrase !
-    * **You can give your public key** to somebody and then access their account using your own passphrase (no need to know the password of the other person)
+  * **//ssh keys// don't depend on the accounts and the passwords of the servers where you use them**
+    * You can (and should!) use the same set of ssh keys on several servers: you can then use the **same** passphrase to access all these servers, rather than having to memorize different passwords
+      * e.g. if you have your //private// key on ''account_A'' of ''server_A'' and install the matching //public// key on ''account_B'' of ''server_B'', etc... you can then use ''ssh'' on ''account_A@server_A'' to access ''account_B@server_B'', ''account_C@server_C'', ... with the **same passphrase** !
+    * **You can share your public key** with somebody, and then access their account using your own passphrase (no need to know the password of the other person)
   * The [[https://mesocentre.ipsl.fr/|IPSL Mésocentre ESPRI]] servers can **only** be accessed with a public key and passphrase (the password is not used)
-  * By default, ''ssh'' will ask you to type your passphrase each time you connect to a server, but **you can [[other:ssh#using_an_ssh_agent|use an ssh agent]] to securely store your passphrase for you**\\ Once you have typed your passphrase in the //ssh agent//, you can connect to all the servers that have your public key without having to type your passphrase!
+  * By default, ''ssh'' will ask you to type your passphrase each time you connect to a server, but **you can [[other:ssh#using_an_ssh_agent|use an ssh agent]] to securely store your passphrase for you**
-    * ''scp'' (and [[other:win10apps#winscp|WinSCP]] on Windows) and the tools using ''ssh'' on your local computer will not ask your passphrase, if they find the passphrase in a running //ssh agent// on the local computer
+    * Once you have typed your passphrase in the //ssh agent//, you can connect to all the servers that have your public key without having to type your passphrase!
-      * if you use the ''-A'' option ([[other:ssh#most_common_options|agent forwarding]]), the remote server will also //know// (securely) your passphrase, and you will not have to type the passphrase when using ''ssh'', ''scp'' and tools running //over ssh// on the remote server(s)
+    * the local //ssh agent// is usually terminated when you log out of your local computer (or reboot the computer)
-    * the local //ssh agent// is terminated when you log out of your local computer (or reboot the computer)
+  * ''scp'' (and [[other:win10apps#winscp|WinSCP]] on Windows) and the tools using ''ssh'' on your local computer will not ask your passphrase, if they find the passphrase in a running //ssh agent// on the local computer
+    * if you use the ''-A'' option ([[other:ssh#most_common_options|agent forwarding]]), the remote server will also securely (and temorarily) //store// your passphrase, and you will not have to type the passphrase when using ''ssh'', ''scp'' and tools running //over ssh// on the remote server(s)
 ==== Generating ssh keys ====
+If you already have a pair of ssh keys, you probably do not want to generate a new pair, unless you have been asked to (e.g. because an old encryption type like //DSA// has been deprecated), or you have lost one of the keys, or forgotten your passphrase, or you had an empty passphrase and you know it is a very bad thing.
+When you generate a new pair of keys, you will have to replace the old keys that you were using on all your desktops/laptops, and all the remote servers
 === Some common sense advice ===
@@ Line 326: / Line 368: @@
 === Generating keys in a terminal (Linux and Mac) ===
-If you already have a pair of ssh keys, you probably don't want to generate a new pair, unless you have been asked to (e.g. because an old encryption type like //DSA// has been deprecated), or you have lost one of the keys, or forgotten your passphrase. If you generate a new pair of keys, you will have to replace the old keys that you were using on all your desktops/laptops, and all the remote servers
+There are several ways to generate pairs of ssh keys with ''ssh-keygen''. The following one is the one recommended for opening an account on [[https://mesocentre.ipsl.fr/account-opening/|IPSL Mésocentre ESPRI]]. If you open an account on ''spirit[x]'', and you already have a //ed25519// public key, just **send your existing public key**!
-There are several ways to generate pairs of ssh keys with ''ssh-keygen''. The following one is the one recommended for opening an account on [[https://mesocentre.ipsl.fr/account-opening/|IPSL Mésocentre ESPRI]]. If you open an account on ''spirit'', but already have a public key, just **send your existing public key**!
   * Type ''ssh-keygen  -t ed25519''
@@ Line 337: / Line 377: @@
     * The **//private// key**: ''id_ed25519''
       * Note: on a Linux computer, the private key has to be readable only by you, otherwise ''ssh'' will not work
-      * <code> > cd ~/.ssh
+      * <code>$ cd ~/.ssh
- > ls -l id_ed25519
+$ ls -l id_ed25519*
 -rw------- 1 my_login my_group some_date id_ed25519
- > cat id_ed25519
+-rw-r--r-- 1 my_login my_group some_date id_ed25519.pub
+$ cat id_ed25519
 -----BEGIN OPENSSH PRIVATE KEY-----
 b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABC7W9+Eu7
@@ Line 349: / Line 392: @@
       * This is the //key// that **you can share**, or that you have to send when opening an account on [[https://mesocentre.ipsl.fr/account-opening/|IPSL Mésocentre ESPRI]].
         * Note that the ''my_login@my_machine'' string at the end of the line is just some information about who generated the keys, and where, and can be removed or replaced by something more informative
-      * <code> > cat id_ed25519.pub
+      * <code>$ cat id_ed25519.pub
 ssh-ed25519 AAAAC3NzaC1lZDI1NT [ lots of cryptic characters ] Frx8rRFKthpmqRdkXl my_login@my_machine</code>
 === Generating or importing keys with PuTTY (Windows) ===
@@ Line 356: / Line 400: @@
 Read [[other:putty_conf#converting_existing_ssh_keys_with_puttygen|Converting existing ssh keys with PuTTYgen]], or [[other:putty_conf#creating_ssh_keys_with_puttygen|Creating ssh keys with PuTTYgen]]
+=== Multiple keys, or keys with non standard file names ===
+Some computing centers will require you to renew your keys regularly (e.g. every year). In that case it is a good idea to:
+  * **keep the standard keys** (e.g ''id_ed25519'' and ''id_ed25519.pub'') to use on computers where keys don't //expire//
+  * and **generate a set of //temporary// keys** that you can easily update without overwriting the standard keys
+On Linux/Mac, use the following to easily generate keys with file names using the computing center name (e.g. ''ccrt'') and the current date
+  * ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_ccrt_`date +%Y_%m_%d`
+  * <code>$ date
+Tue Aug  4 15:33:13 CEST 2026
+$ date +%Y_%m_%d
+_08_04
+$ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_ccrt_`date +%Y_%m_%d`
+Generating public/private ed25519 key pair.
+Enter passphrase (empty for no passphrase):
+Enter same passphrase again:
+[...]
+$ ls -ltr ~/.ssh/id_ed25519*
+[...]
+-rw------- 1 [...] 444 Aug  4 15:24 .ssh/id_ed25519_ccrt_2026_08_04
+-rw-r--r-- 1 [...]  94 Aug  4 15:24 .ssh/id_ed25519_ccrt_2026_08_04.pub</code>
 ==== Installing ssh keys ====
+<note tip>**Special cases**:
+  * ''spirit[x]'' servers: if you need to use the [[other:ssh#ipsl_servers|IPSL spirit[x] servers]], you have to send your //public// key when you request your account, and the IT people will take care of installing your //public// key in the correct place when they create your account
+    * You also have to ask IPSL IT if you need to update the public key
+  * **High Performance Computing Centers**: read the documentation and ask the IT people to determine if (and how) you can use ssh keys...
+</note>
+The **required //ssh key// files have to be present in the ''.ssh'' [[other:ssh#configuration_files|directory where ssh stores its configuration files]]**, on the //source// **and** //target// computers.
+We assume below that we are using ''ed25519'' keys, so the //key// files we need will are named: ''id_ed25519'' (and ''id_ed25519**.ppk**'' on a Windows computer, if you use [[other:putty_conf#using_ssh_keys_with_putty_pageant|PuTTY/Pageant]]), and ''id_ed25519**.pub**''.
+  * on the **//source// computer**\\ (the //source computer// is your local desktop/laptop, or a remote Linux server if you will use ''ssh''/''scp'' from this remote server to access another remote server)\\ \\
+    * you need **the //private// key**: e.g. ''id_ed25519''
+      * remember that **the private key has to be readable only by the file owner (you!)** on a linux (or Mac) computer\\ <code>$ chmod 600 ~/.ssh/id_ed25519
+$ ls -l ~/.ssh/id_ed25519
+-rw------- [...] /some_path/your_login/.ssh/id_ed25519</code>
+  * and the **//target// computer**\\ (a remote Linux server)\\ \\
+    * you need **the //public// key**: e.g. ''id_ed25519.pub''
+    * you need a copy of the //public// key in the ''authorized_keys'' file
+      * **if the ''authorized_keys'' file does not exist yet**, just copy the //public// key file\\ <code>$ cd ~/.ssh
+$ ls -l authorized_keys
+ls: cannot access authorized_keys: No such file or directory
+$ cp -p id_ed25519.pub authorized_keys</code>
+      * **if there is already an ''authorized_keys'' file** (possibly with older public keys), just create a backup of the existing file, and **add the new public key at the end of the file**\\ <code>$ cd ~/.ssh
+$ cat authorized_keys
+ssh-dss AAAAB3NzaC1kc3MAAACBAM9w0bY604COfD5[...]
+[...]
+OUZ8jrQrhDbq2P7GNTTaEEdy+JvtDvZSZLG4+DwhWSk[...] some_login
+$ mv authorized_keys authorized_keys.save
+$ cat authorized_keys.save id_ed25519.pub > authorized_keys
+$ cat authorized_keys
+ssh-dss AAAAB3NzaC1kc3MAAACBAM9w0bY604COfD5[...]
+[...]
+OUZ8jrQrhDbq2P7GNTTaEEdy+JvtDvZSZLG4+DwhWSk[...] some_login
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICD35I[...] another_login
+</code>
 ==== Using the keys ====
@@ Line 376: / Line 492: @@
 ==== Windows ssh agent ====
-On Windows, you should use [[other:putty_conf|Pageant]] as an ssh agent
+  * On Windows, we recommend using [[other:putty_conf#using_the_private_key_in_pageant|Pageant/PuTTY]] as an //ssh agent//, because:
+    * [[other:putty_conf#launching_putty_pageant|Pageant/PuTTY]] also offers a very easy and convenient way to define profiles to connect to your favorite servers
+    * Some programs that use ''ssh'' to transfer files will automatically use the keys stored in ''Pageant'': [[other:win10apps#winscp|WinSCP]], [[other:emacs_doc|emacs]], ...
+  * It is also possible (but less convenient) to use the Windows built-in ''ssh-agent'' and ''ssh'' commands!
+    * Note that the //agent service// is not activated by default and you will get the following error when you try to use ''ssh-add''
+      * <code>C: > ssh-add
+Error connecting to agent: No such file or directory</code>
+    * It is necessary to first **activate the agent Windows //service//** (in an **//elevated// PowerShell**, i.e with //Administrator// privileges) as explained in the [[https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement#user-key-generation|User key generation]] section
+      * <code>C: > Get-Service ssh-agent
+Status   Name               DisplayName
+------   ----               -----------
+Stopped  ssh-agent          OpenSSH Authentication Agent
+C: > Get-Service ssh-agent | Set-Service -StartupType Automatic
+C: > Start-Service ssh-agent
+C: > Get-Service ssh-agent
+Status   Name               DisplayName
+------   ----               -----------
+Running  ssh-agent          OpenSSH Authentication Agent
+C: > ssh-add
+Enter passphrase for C:\Users\your_login/.ssh/id_dsa: XXXX_Type_Your_Passphrase_Here_XXXX
+Identity added: C:\Users\your_login/.ssh/id_dsa
+Identity added: C:\Users\your_login/.ssh/id_ed25519
+C: > ssh-add -l
+SHA256:/vC3Ma6s9Wj[Some_Summary_Info_About_The_Key]c1Q4 (DSA)
+SHA256:8BGKU+zBnJXH[Some_Summary_Info_About_The_Key]2Al8 jypeter@obelix5 (ED25519)</code>
 ==== Mac ssh agent ====