Assuming users received the invitation from CSCS and got enrolled in MFA.

Step-by-step guide

Step - 1: Users either need to log in to the SSHService web application to generate keys and download (or) Users may download the keys using the sshservice-cli

Step - 2: (Optional but recommended) set the passphrase using the following command

ssh-keygen -f ~/.ssh/cscs-key -p


Option - A: Load the keys into the SSH agent

Step - 3: Add the key to the SSH agent:

ssh-add -t 1d ~/.ssh/cscs-key

Step - 4: Connect to the login node using CSCS keys and the -A option which allows the forwarding of keys to the subsequent systems

ssh -A username@ela.cscs.ch

Step - 5: Connect to Piz Daint or Eiger from the frontend system Ela 

ssh daint


ssh eiger


Option - B: Using the ssh command as below 

Step - 3:  

ssh -o IdentityFile=$HOME/.ssh/cscs-key -o IdentitiesOnly=yes -o ProxyJump=ela.cscs.ch daint.cscs.ch

Note: Using this option user may not be able to jump from daint to dom or vice-versa but tweaking the command by adding an argument -A to make the keys available on all the destination hosts


Option - C: Using the ssh config file 

Copy the keys to ~/.ssh and make sure the right permissions are set on the key 

chmod 600 ~/.ssh/cscs-key