You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/access/ssh.md
+68-36Lines changed: 68 additions & 36 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,11 @@
3
3
4
4
Before accessing CSCS clusters using SSH, first ensure that you have [created a user account][account-management] that is part of a project that has access to the cluster, and have [multi factor authentification][mfa] configured.
5
5
6
-
It is not possible to authenticate with a username/password and user-created SSH keys: it is necessary to use a certified SSH key created using the CSCS SSHService, which is documented below.
6
+
[](){#sshservice}
7
+
## Generating Keys with SSHService
8
+
9
+
It is not possible to authenticate with a username/password and user-created SSH keys.
10
+
Instead, it is necessary to use a certified SSH key created using the CSCS SSHService.
7
11
8
12
!!! note
9
13
Keys are valid for 24 hours, after which a new key must be generated.
@@ -12,8 +16,6 @@ It is not possible to authenticate with a username/password and user-created SSH
12
16
The number of certified SSH keys is limited to **five per day**.
13
17
Once you have reached this number you will not be able to generate new keys until at least one of these key expires or keys are revoked.
14
18
15
-
## Generating Keys with SSHService
16
-
17
19
There are two methods for generating SSH keys using the SSHService, the [SSHService web app](https://sshservice.cscs.ch/) or by using a [command-line script](https://github.com/eth-cscs/sshservice-cli).
Once the key has been generated using either the CLI or web interface above, it is strongly reccomended that you add a password to the generated key using the [ssh-keygen](https://www.ssh.com/academy/ssh/keygen) tool.
85
89
86
-
Set up a passphrase on the private key:
87
90
```
88
91
ssh-keygen -f ~/.ssh/cscs-key -p
89
92
```
90
93
91
-
Add the key to the SSH agent:
94
+
## Logging In
95
+
96
+
To ensure secure access, CSCS requires users to connect through the designated jump host Ela (`ela.cscs.ch`) before accessing any cluster.
97
+
98
+
Before trying to log into your target cluster, you can first check that the SSH key generated above can be used to access Ela:
92
99
```
93
-
ssh-add -t 1d ~/.ssh/cscs-key
100
+
ssh -i ~/.ssh/cscs-key ela.cscs.ch
94
101
```
95
102
96
-
??? warning "Could not open a connection to your authentification agent"
97
-
If you see this error message, the ssh agent is not running.
98
-
You can start it with the following command:
99
-
```
100
-
eval $(ssh-agent)
101
-
```
102
-
103
-
Once the key has been configured, you can log in to CSCS' login system Ela:
To log into a target system at CSCS, you need to perform some additional setup to handle forwarding of SSH keys generated using the SSHService.
104
+
There are two alternatives detailed below.
107
105
108
-
# then jump to a cluster
109
-
> ssh clariden
110
-
```
106
+
### Adding Ela as a jump host in SSH Configuration
111
107
112
-
### Set up SSH Config
108
+
This approach configures Ela as a jump host and creates aliases for the systems that you want to access in `~/.ssh/config` on your laptop or PC.
109
+
The benefit of this approach is that once the `~/.ssh/config` file has been configured, no additional steps are required between creating a new key using MFA, and logging in.
113
110
114
-
To simplify logging in, you can edit (or create) the SSH configuration file `$HOME/.ssh/config` on your laptop or PC.
115
-
A simple configuration for that simplifies logging into [Clariden][clariden] is:
111
+
Below is an example `~./.ssh/config` file that facilitates directly logging into the Daint, Santis and Clariden clusters using `ela.cscs.ch` as a Jump host:
116
112
117
113
```
118
114
Host ela
119
115
HostName ela.cscs.ch
120
-
ForwardAgent yes
121
-
# replace with your CSCS username
122
-
User username
116
+
User cscsusername
117
+
IdentityFile ~/.ssh/cscs-key
118
+
119
+
Host daint
120
+
HostName daint.alps.cscs.ch
121
+
User cscsusername
122
+
ProxyJump ela
123
+
IdentityFile ~/.ssh/cscs-key
124
+
IdentitiesOnly yes
125
+
126
+
Host santis
127
+
HostName santis.alps.cscs.ch
128
+
ProxyJump ela
129
+
User cscsusername
130
+
IdentityFile ~/.ssh/cscs-key
131
+
IdentitiesOnly yes
123
132
124
133
Host clariden
125
134
HostName clariden.alps.cscs.ch
126
135
ProxyJump ela
127
-
# replace with your CSCS username
128
-
User username
136
+
User cscsusername
137
+
IdentityFile ~/.ssh/cscs-key
138
+
IdentitiesOnly yes
139
+
```
129
140
130
-
Host daint
131
-
HostName daint.alps.cscs.ch
132
-
ProxyJump ela
133
-
# replace with your CSCS username
134
-
User username
141
+
!!! note ""
142
+
:exclamation: Replace `cscsusername` with your CSCS username in the file above.
143
+
144
+
After saving this file, one can directly log into `daint.alps.cscs.ch` from your local system using the alias `daint`:
145
+
146
+
```
147
+
ssh daint
135
148
```
136
149
137
-
With this configuration, you can log into Clariden directly using the name clariden that was defined in `Host clariden`.
150
+
### Using SSH Agent
151
+
152
+
Alternatively, the [SSH authentification agent](https://www.ssh.com/academy/ssh/add-command) can be configured to manage the keys.
138
153
154
+
Each time a new key is generated using the [SSHService][sshservice], add the key to the SSH agent:
155
+
```
156
+
ssh-add -t 1d ~/.ssh/cscs-key
157
+
```
158
+
159
+
??? warning "Could not open a connection to your authentification agent"
160
+
If you see this error message, the ssh agent is not running.
161
+
You can start it with the following command:
162
+
```
163
+
eval $(ssh-agent)
164
+
```
165
+
166
+
Once the key has been configured, log into Ela using the `-A` flag, and then jump to the target system:
0 commit comments