CLEAR SSH Access Guide

Host Address

The primary host address used to connect to CLEAR is:

ssh.clear.rice.edu

From a Windows terminal, Command Prompt, or PowerShell session with OpenSSH installed, connect using:

ssh <NetID>@ssh.clear.rice.edu

Replace <NetID> with your Rice NetID. Complete the password and Duo authentication prompts as required.

Important Notes

• X11 forwarding is not available through the ssh-staff or ssh-student gateway servers. For X11 forwarding, connect directly to the destination Rice server when network access permits.
• When entering your password in a terminal, no characters will appear on the screen. This is normal. Type your password carefully and press Enter.
• When required, complete the Duo authentication prompt to finish signing in.
• For off-campus access, you may need to connect to the Rice VPN or use the appropriate Rice SSH gateway before connecting to an internal Rice server.

Connect from the macOS Terminal

1. Open the Terminal application:
   Finder > Applications > Utilities > Terminal
2. Connect using:

   ssh <NetID>@ssh.clear.rice.edu

3. Replace <NetID> with your Rice NetID.
4. Enter your NetID password when prompted and complete Duo authentication as required.

Connect Using X11 Forwarding

To request X11 forwarding, use one of the following commands:

ssh -X <NetID>@ssh.clear.rice.edu

For trusted X11 forwarding:

ssh -Y <NetID>@ssh.clear.rice.edu

An X11 server must be installed and running on your Mac before graphical applications can be displayed locally.

For more information and support, contact the TS&S Service Desk.

Installation

Windows 10 and Windows 11 include an optional OpenSSH Client that can be used to connect to CLEAR.

1. Open Settings and locate Optional Features.
2. Check whether OpenSSH Client is installed.
3. If it is not installed, add the OpenSSH Client optional feature.

Note: The scp command is installed as part of the OpenSSH Client.

Using SSH

Open Command Prompt, PowerShell, or Windows Terminal and enter:

ssh <NetID>@ssh.clear.rice.edu

Replace <NetID> with your Rice NetID.

Note: When you type your password, nothing will appear on the screen. This is normal. Type your password carefully, press Enter, and complete Duo authentication as required.

Using SCP

SCP can securely copy files between your local computer and CLEAR. The general syntax is:

scp <source> <destination>

Copy a File to CLEAR

For example, to copy a local file named test.txt to your CLEAR home directory:

scp ./test.txt <NetID>@ssh.clear.rice.edu:~/

To copy the file and give it a different name:

scp ./test.txt <NetID>@ssh.clear.rice.edu:~/<new_name>

To copy the file into an existing directory in your CLEAR home directory:

scp ./test.txt <NetID>@ssh.clear.rice.edu:~/<dir>/<new_name>

Retrieve a File from CLEAR

To copy a file from CLEAR to your current local directory:

scp <NetID>@ssh.clear.rice.edu:~/<dir>/<file> .

Authentication requirements may vary depending on your configured access method.

This section is for Windows users who prefer to connect to CLEAR using PuTTY.

Configure a PuTTY Session

After installing and starting PuTTY, you will see a configuration window similar to the following:

1. Select Session in the left-hand menu.
2. In Host Name (or IP address), enter <NetID>@ssh.clear.rice.edu.
3. In Saved Sessions, enter a descriptive name such as ssh clear.
4. Click Save to save the configuration for future use.

Connect to CLEAR

1. Select Session.
2. Select your saved CLEAR session.
3. Click Load.
4. Click Open.
5. Enter your Rice NetID and NetID password when prompted.
6. Complete Duo authentication as required.

After authentication is complete, you will be presented with a terminal session on the CLEAR system.

You may occasionally receive the following warning when connecting to a system with SSH:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

What Does This Mean?

SSH stores the host keys of systems you have previously connected to in a known_hosts file. If the host key presented by a server changes, SSH displays a warning because the change could indicate a security problem.

A host key can also legitimately change after a server is rebuilt, replaced, upgraded, or has its SSH host keys regenerated.

Important: Do not ignore a host-key warning if you are unsure why the key changed. Verify the change with the appropriate system administrator or OIT support before removing the stored key.

Remove an Outdated Host Key

After confirming that the host-key change is legitimate, OpenSSH users can remove the old key with:

ssh-keygen -R ssh.clear.rice.edu

Then reconnect:

ssh <NetID>@ssh.clear.rice.edu

Review the new host-key prompt before accepting the new key.

Manual known_hosts Locations

If manual editing is necessary, the OpenSSH known_hosts file is typically located at:

macOS and Linux

~/.ssh/known_hosts

Windows OpenSSH

C:\Users\<local_account>\.ssh\known_hosts

Remove only the entry associated with the affected host after confirming that the host-key change is legitimate.

SSH public/private key authentication can be used as part of your CLEAR login workflow.

Advantages

• Convenient for repeated SSH connections
• Provides strong authentication when properly configured and managed

Considerations

• You must securely manage your private key.
• Your public key must be installed on the remote system.
• Correct permissions must be configured for the .ssh directory and authorized_keys file.
• A compromised private key may allow unauthorized access to systems where the corresponding public key is authorized.

Important: Never share your private key. Only your public key should be copied to remote systems.

When generating a new SSH key, use the Ed25519 algorithm when supported.

Generate an SSH Key with OpenSSH

On systems with OpenSSH installed, you can generate an Ed25519 key pair with:

ssh-keygen -t ed25519

Follow the prompts to select the key location and configure a passphrase.

Additional Platform Resources

Windows with PuTTY

Using SSH Keys with PuTTY

Windows with OpenSSH

Getting started with OpenSSH

macOS

How to use ssh-keygen to generate an SSH key on Mac

Linux

How to set up SSH keys on a Linux or Unix system

VS Code

VS Code SSH Tips

Install Your Public Key on CLEAR

Your public key should be added to the ~/.ssh/authorized_keys file in your CLEAR home directory.

On the CLEAR system:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

Add the contents of your public key to:

~/.ssh/authorized_keys

Then set the appropriate permissions:

chmod 600 ~/.ssh/authorized_keys

Important: Never copy your private key to CLEAR or share it with another person.

This section is for Windows users who need to run graphical applications on CLEAR using PuTTY with X11 forwarding.

You must have an X11 server installed and running on your Windows computer before starting an X11-forwarded SSH session.

Install PuTTY using the instructions here: Get and install PuTTY.

Step 1: Configure the SSH Session

1. Select Session.
2. In Host Name (or IP address), enter <NetID>@ssh.clear.rice.edu.
3. Enter a descriptive name under Saved Sessions, such as ssh clear x11.

Step 2: Enable X11 Forwarding

1. In the left-hand menu, select Connection > SSH > X11.
2. Check Enable X11 forwarding.
3. Return to Session.
4. Click Save to save the updated configuration.

Step 3: Connect

1. Make sure your local X11 server is running.
2. Select your saved PuTTY session.
3. Click Load, then Open.
4. Enter your Rice NetID and NetID password when prompted.
5. Complete Duo authentication as required.

After connecting, you can test X11 forwarding by launching a simple graphical application available on the CLEAR system.