SSH gateways in Maths

May 20^th update: uploading or changing your ssh public key

If you need to replace your ssh public key by uploading a new one from a remote system or alternatively, if you want to log into a system in Maths to create a new keypair but are unable to do this because you have forgotten your ssh passphrase, lost your ssh private key or the private key is on a computer in another country, etc there is a solution if you have a working Unified Access/Zscaler Connector connection:

To upload a new public key (or both your public and private keys) from your remote system, you can use the scp utility to upload these to the lovelace computer server (lovelace.ma.ic.ac.uk); assuming your new public key is in your ~/.ssh folder with the name id_rsa.pub, launch a terminal on your computer and type the following command:

scp ~/.ssh/id_rsa.pub your_username@lovelace.ma.ic.ac.uk:.ssh/id_rsa.pub_new

substituting your own username for 'your_username'; this will temporarily store your new public key with a different filename. Now log into lovelace using the command:

ssh your_username@lovelace.ma.ic.ac.uk

and check your ssh authorized_keys file to see what keys are in it:

cd ~/.ssh; cat authorized_keys

If only one key is listed in the authorized_keys file then it is probably your old id_rsa.pub key so it's safe to replace it with the new key you have just uploaded:

cp id_rsa.pub_new authorized_keys

but if it has more then one key, then you are probably using multiple keys from other systems and only you will know if this is the case. You'll probably want to leave these in place so do the following; first look at your existing (old) id_rsa.pub key to see what it looks like:

cat id_rsa.pub

Now open your authorized_keys file with your favourite text editor and locate & delete the line whose contents match your old id_rsa.pub key. Save the file and then add your new public key to it:

cat id_rsa.pub_new >> authorized_keys

You can now log out of lovelace, disconnect from the Unified Access service and connect to any of the three Maths ssh gateways using your ssh client as before and from there, log into whatever system in the College you intend to use.

April 22^nd update: Maths ssh gateway facility available again

At long last, the Maths ssh gateways have now been fully reinstated and are directly accessible both externally from outside College as well as internally on the College network and via Unified Access/Zscaler Connector. Owing to the new requirements mandated by the College in December, 2025 for external/public-facing systems, the gateways now use a more secure configuration and you will need to create a ssh private/public keypair with embedded passphrase and also set up and use Google Authenticator 2 factor authentication to access these gateways as described here. Please note: 'old-style' login attempts using typed-in passwords, attempts to connect without a ssh private/public keypair, using keypairs containing mis-matched keys and keypairs that lack a passphrase will now be rejected immediately as will an inability to authenticate your identity using Google Authenticator via a smartphone or similar device. The non-standard access port number for connections from outside the College remains as previously but will not be stated here (for obvious reasons...); just ask if you are not sure what this is.

The new ssh gateways retain the same aachen, cathedral & hessian hostnames as the original machines and can be accessed by all Maths users while access accounts can also be set up on request for users from other departments or external users needing to access Maths research IT facilities. Set up in a similar fashion to Maths Linux systems and running the latest stable version of Ubuntu 24.04, they also provide direct access via scp & sftp to both College and Maths fileservers mounted on the gateways while the ssh configuration supports all of the extra network-related features including port forwarding, port translation and tunnelling, which can be useful for using remote web browser-based applications. And of course, X Windows forwarding is also enabled.

You can stay logged into a ssh gateway for as long as you like and there are no time or usage limits. However, some makes/models of modem-routers supplied by broadband service providers are known to terminate and disconnect ssh connections after 2 or 3 minutes of inactivity; this happens with any ssh connection - not just to the Maths ssh gateways. There is a workaround for this to by enabling TCP keepalives in your ssh client which essentially sends dummy packets over your ssh connection every few minutes even if you are not doing anything on your computer.

The gateways and their addresses are:

aachen		aachen.ma.ic.ac.uk
cathedral		cathedral.ma.ic.ac.uk
hessian		hessian.ma.ic.ac.uk

As always we will be happy to answer any questions you may have or assist with any problems you might encounter when using the new service - please contact Maths Research Computing

---

Andy Thomas

Research Computing Manager,
Department of Mathematics

last updated: 20.5.2026