SSH client on Windows
SSH keys are required to connect to Puhti and Mahti over SSH
Since April 14th 2025, connecting to Puhti and Mahti over SSH only works
using SSH keys added in MyCSC. Password authentication and public keys
stored in users' personal ~/.ssh/authorized_keys file on the
supercomputer no longer works.
Read the detailed instructions on setting up and using SSH keys.
There are various programs that can be used for creating a remote SSH connection on a Windows system. This page provides instructions for three popular alternatives: MobaXterm, PuTTY and PowerShell.
Generating SSH keys
Using SSH keys
See the page on setting up SSH keys for general information about using SSH keys for authentication. Please note that it is mandatory to add your public key to MyCSC – copying it directly to a CSC supercomputer does not work!
Supported key types are Ed25519 and RSA 4096 through 16384. We strongly recommend Ed25519.
MobaXterm is an SSH client with an embedded X server, which means that it can be used to display graphics.
You can generate SSH keys using the utility tool MobaKeyGen (see tutorial), or in a local terminal by running:
If you have not set up SSH keys before, feel free to accept the default
name and location by pressing ENTER (recommended). However, if using the
default file name would overwrite an existing key, you will receive a
warning that looks like this:
Generally, you do not want to overwrite existing keys, so enter n, run
ssh-keygen again and enter a different file name when prompted. See also
the section on
SSH key files with non-default name or location.
Next, you will be asked for a passphrase. Please choose a secure passphrase. It should be at least 8 characters long and contain numbers, letters and special characters. Never leave the passphrase empty when generating an SSH key pair!
If you want your generated keys to persist through MobaXterm restarts,
set a persistent home directory for MobaXterm in the program settings
(Settings --> Configuration --> General). Note, this is only required if
you have generated your keys via the terminal, not MobaKeyGen.
The PuTTY SSH client is an alternative to using OpenSSH.
To generate SSH keys for connecting with PuTTY, use the PuTTYgen key generator. Normally, PuTTYgen does not need to be installed separately, as it comes bundled with the PuTTY installation package.
Launch PuTTYgen and follow this tutorial to set up SSH keys. Although the tutorial is formally written for MobaKeyGen, the instructions can easily be adapted for PuTTYgen as the user interface is virtually identical.
You may also consult the PuTTYgen documentation or the relevant SSH Academy tutorial.
You can use the Windows PowerShell command-line shell to connect to a CSC supercomputer using the Win32 OpenSSH client. To install OpenSSH on a Windows device, follow these installation instructions.
After installing OpenSSH, you can generate SSH keys using PowerShell by running:
If you have not set up SSH keys before, feel free to accept the default
name and location by pressing ENTER (recommended). However, if using the
default file name would overwrite an existing key, you will receive a
warning that looks like this:
Generally, you do not want to overwrite existing keys, so enter n, run
ssh-keygen again and enter a different file name when prompted. See also
the section on
SSH key files with non-default name or location.
Next, you will be asked for a passphrase. Please choose a secure passphrase. It should be at least 8 characters long and contain numbers, letters and special characters. Never leave the passphrase empty when generating an SSH key pair!
After you have generated an SSH key pair, you need to add the public key to the MyCSC portal. Read the instructions here.
You may also wish to configure authentication agent to make using SSH keys more convenient.
Basic usage
After setting up SSH keys and adding your public key to MyCSC, you can connect to a CSC supercomputer.
To connect using MobaXterm, open the terminal and run:
# Replace <username> with the name of your CSC user account and
# <host> with "puhti" or "mahti"
ssh <username>@<host>.csc.fi
Alternatively, you may connect using the GUI following this tutorial.
When you launch PuTTY, you are asked to configure your SSH session. Do so according to the table below:
| Option | Value |
|---|---|
| Host Name | puhti.csc.fi or mahti.csc.fi |
| Port | 22 |
| Connection type | SSH |
When creating a remote connection using PuTTY, select the private key file
under Connection --> SSH --> Auth --> Credentials. If you want the private
key to be used each time you connect, save your session to store your choice.
Finally, click Open and enter your CSC username and SSH key passphrase.
If you are connecting for the first time, PuTTY will ask if you trust the host.
Click Accept.
Open PowerShell and run:
# Replace <username> with the name of your CSC user account and
# <host> with "puhti" or "mahti"
ssh <username>@<host>.csc.fi
Corrupted MAC on input
When connecting using the OpenSSH client software on Windows, you might encounter an error stating "Corrupted MAC on input". This is a known issue, and can be avoided by explicitly choosing a different MAC algorithm. For details, please see our FAQ page on the topic.
SSH key file with non-default name or location
If you are connecting via the MobaXterm terminal or PowerShell, and have stored
your SSH key file with a non-default name or in a non-default location
(somewhere else than ~/.ssh/id_<algorithm>), you must tell the ssh command
where to look for the key. Use option -i as follows:
# Replace <username> with the name of your CSC user account,
# <host> with "puhti" or "mahti" and <path-to-private-key>
# with the path to your SSH private key
ssh <username>@<host>.csc.fi -i <path-to-private-key>
Graphical connection
Note
For performance reasons, we generally recommend using the HPC web interfaces to run applications which require displaying graphics.
To enable displaying graphics over SSH, use the -X (X11 forwarding) or -Y
(trusted X11 forwarding) option when creating the connection:
When connecting using the MobaXterm GUI, ensure the X11-Forwarding option
under Session --> SSH --> Advanced SSH settings is toggled.
If you want to create a connection with graphical support,
you can use, for example, the
Xming X server. To enable displaying
graphics remotely, select Enable X11 forwarding in the PuTTY program settings
(Connection --> SSH --> X11).
If you want to create a connection with graphical support, you can use, for example, the Xming X server. To enable displaying graphics remotely, run:
Then, use the -X (X11 forwarding) or -Y (trusted X11 forwarding) option when
creating the connection:
Authentication agent
To avoid having to type your passphrase every time you connect, enable the
MobAgent authentication agent in the program settings (Settings -->
Configuration --> SSH --> SSH agents).
- Toggle the option
Use internal SSH agent "MobAgent". - Click the
+button and select the private key you want to load at MobAgent startup. - Click
OKand restart MobaXterm. You'll be prompted to enter your key passphrase. - You may now connect to CSC supercomputers without having to type your passphrase again.
To avoid having to type your passphrase every time you connect, you can use the Pageant authentication agent to store your private keys in memory.
- Start Pageant. It will put an icon into the System tray.
- Right-click the Pageant icon and select
View Keysfrom the menu to show the private keys Pageant is holding. When you start Pageant, it has no keys, so the list box will be empty. - Press the
Add Keybutton to add a key to Pageant. - Find your private key file in the
Select Private Key Filedialog, and pressOpen. Pageant will ask you to enter the key passhphrase. - Now start PuTTY and open an SSH session to any CSC supercomputer. PuTTY will notice that Pageant is running, retrieve the key automatically from Pageant, and use it to authenticate. You may now open as many PuTTY sessions as you like without having to type your passphrase again.
To avoid having to type your passphrase every time you connect, you can configure the Windows SSH agent to store your keys in memory for the duration of your local login session.
SSH agent forwarding
Note
You should only forward your SSH agent to remote servers that you trust and only when you really need it. Forwarding your SSH agent by default to any server you connect to is considered insecure.
Agent forwarding is a useful mechanism where the SSH client is configured to
allow an SSH server to use your local ssh-agent on the server as if it was
local there. This means in practice that you can, for example, connect directly
from Puhti to Mahti using the SSH keys you have set up on your local machine,
i.e. you do not need to create a new set of SSH keys on CSC supercomputers.
Agent forwarding is also very handy if you need to copy data between Puhti and Mahti, or, for example, push to a private Git repository from CSC supercomputers.
When using a local terminal, enable agent forwarding by including the -A
flag to your ssh command:
In the MobaXterm GUI, agent forwarding is enabled by toggling the Allow
agent forwarding option found under Session --> SSH --> Advanced SSH
settings --> Expert SSH settings.
To enable agent forwarding in PuTTY, first make sure Pageant is running.
Then, toggle the Allow agent forwarding option found under Connection
--> SSH --> Auth before creating a new session.
Once connected, you may verify that SSH agent forwarding worked by running:
If you see the fingerprint(s) of your SSH key(s) listed, agent forwarding is working.