Getting started | Logging in | Protecting your token | Replacing or returning a token

Getting started

YubiKey authentication tokens enable authorized users to access a variety of UCAR resources. These include high performance computing systems managed by CISL (see below) and the virtual private network (VPN).

YubiKey token

To be able to use your YubiKey token, you first need to complete this acknowledgement form and fax it to 303-497-1840. Within two business days, you will be called and given your personal identification number (PIN) so you can log in.

By signing the acknowledgement form, you agree to fulfill your responsibilities as a user.

In addition, you acknowledge that acceptance of this token constitutes an understanding that the token is export controlled such that export/re-export to Cuba, Iran, Syria, North Korea, or Sudan is strictly prohibited.

Special requirement for Mac OS X systems only

A user with admin privileges who can tell the system to permanently recognize the token must plug the token in initially. This will let you avoid having to go through three dialog boxes every time you log in.

When the dialog box asks you to press the key to the right of the SHIFT key, touch the button on the token instead.

Logging in

To log in to a CISL system—Cheyenne, in this example—use the ssh command and your UCAR username as shown. It requires the use of Secure Shell (SSH) access.

ssh -X -l username cheyenne.ucar.edu

The system will prompt you to enter a token response.

Using keyboard-interactive authentication.

To respond:

  • Insert your YubiKey token in a USB port. If you have a MacBook or other computer or mobile device with a USB-C port, you will need a USB-C adapter.
  • Type your PIN into the “Token_Response” field.
  • Lightly touch the button on your token. (The button is not activated by pressure. Rather, it reacts to contact with your finger.) This will insert a new one-time password and you will be logged in.

You can open more than one login session, but you must complete the authentication process for each session before opening another one.

Protecting your token

Here are some tips for taking proper care of this electronic device.

  • Keep it away from magnets, microwaves, electrostatic shock, and X-rays. (Security checkpoints, such as those at airports, are OK.)
  • Do not expose it to temperatures below -5 degrees Fahrenheit, above 120 degrees, or above 90 degrees for sustained periods. (Avoid leaving it on your car’s dashboard on a hot day, for example.)

Replacing or returning a token

Contact the CISL Help Desk if you need to replace or exchange your YubiKey token.

Users who lose or damage a YubiKey token or fail to return it when required will be billed $25. The fee can be paid by credit card on the UCAR Payment Web Site or billed to the user's NCAR program number.

For security reasons, the CISL Help Desk cannot routinely arrange temporary access for users who forget to bring a CRYPTOCard or YubiKey to work. If you are out of town and need emergency access, contact cislhelp@ucar.edu for assistance.


If you return a token intact within three months after having paid for it, we will issue a credit to your credit card or to the NCAR division that paid for the token if you provide a receipt or other documentation that the charge was approved.


See Returning your token.