Hero Image
ITC's current SSH host keys (ECDSA, ED25519, and RSA)

ITC SSH Host Keys

The ITC remote login servers, "rainbow.nmt.edu" and "login.nmt.edu", have host keys used by the ssh service to verify their identity to you. To prevent disruption, these remain the same in use for an extended time, and are only rotated when it is prudent security policy to do so. Three encryption options are offered by the servers, and depending upon which your ssh client auto-negotiates to use, you will see one of three keys to verify our identity.

Fingerprints for the three current key options, activated in May 2026, are:

The first time you connect to rainbow or login, ssh will print out the selected fingerprint, and ask if it should continue connecting. As long is the fingerprint is one of the three above, it is safe to continue connecting. Your ssh client will save the identity to verify future connections. If this fingerprint was not one of the three provided above, close out PowerShell and ssh, and contact the ITC Service Desk (575-835-5700 or help@nmt.edu) as soon as possible. This indicates a man-in-the-middle computer attack.

If ITC needed to rotate the host keys since your last connection, your ssh client will print an error message beginning with "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" and exit. Embedded in this message is the fingerprint for the key that was offered by the server. If this fingerprint was not one of the three provided above, close out PowerShell and ssh, and contact the ITC Service Desk (575-835-5700 or help@nmt.edu) as soon as possible. This indicates a man-in-the-middle computer attack. If the new key in the error message does match one above, it is safe to forget the old one and learn the new one. Do this with the command "ssh-keygen -R rainbow.nmt.edu" or "ssh-keygen -R login.nmt.edu" (the capitalization of "R" is important), and reconnect.