Difference between revisions of "Connect to Linux"

From CAC Documentation wiki
Jump to navigation Jump to search
(minor cleanup)
 
(38 intermediate revisions by 5 users not shown)
Line 1: Line 1:
 +
These instructions are written primarily for users trying to log in to a CAC login node, taking linuxlogin as an example; however, the same methods should work for nearly any remote Linux machine.
 +
'''Note:''' If you are trying to connect to a [[Red Cloud Linux Instances|Red Cloud Linux instance]], please see the specific [[Red_Cloud_Linux_Instances#Accessing_Instances|connection instructions]] in the documentation first.  There are also [[Red_Cloud_Linux_Instances#Troubleshooting|troubleshooting steps]] to help you if you get stuck.
 +
 
__TOC__
 
__TOC__
There are three distinct ways to connect to a login node:
+
 
# [[Getting_started#Using_Secure_Shell | Use SSH]] to open a Linux shell on a login node, which provides a text-only interface.
+
There are three distinct ways to connect to a remote Linux machine:
# [[Getting_started#Using_Secure_Shell | Use SSH]] together with [[Getting_started#Using_X-Windows | X-Windows]], which sends any interactive graphics back to your machine window-by-window through an SSH tunnel.
+
# [[Getting_Started#Using_Secure_Shell | Use SSH]] to open a Linux shell on a login node, which provides a text-only interface.
# [[Getting_started#Using_VNC | Use VNC]] to get a remote desktop with multiple text and graphics windows. This is not as straightforward as it sounds, due to the need to set up a secure tunnel for the remote desktop first.
+
# [[Getting_Started#Using_Secure_Shell | Use SSH]] together with [[Getting_Started#Using_X-Windows | X-Windows]], which sends any interactive graphics back to your machine window-by-window through an SSH tunnel.
 +
# [[Getting_Started#Using_VNC | Use VNC]] to get a remote desktop with multiple text and graphics windows. This is not as straightforward as it sounds, due to the need to set up a secure tunnel for the remote desktop first.
  
 
These instructions are intended mainly for users of personal computers and workstations. However, much of the material carries over to mobile computing platforms such as tablets and smartphones. You will have to locate and download an app to enable SSH or VNC connectivity; even a browser plug-in may suffice.
 
These instructions are intended mainly for users of personal computers and workstations. However, much of the material carries over to mobile computing platforms such as tablets and smartphones. You will have to locate and download an app to enable SSH or VNC connectivity; even a browser plug-in may suffice.
  
Whichever method you choose, at your first login, you will be challenged for a new password. Find help at [[Getting_started#Change_a_password_at_first_login | Changing a Password at First Login]]. You will also be asked for an ssh passphrase. You can just leave this blank; hit the <tt>Enter</tt> key in response.
+
Whichever method you choose, at your first login, you will be challenged for a new password (this does not apply to Red Cloud resources). Find help at [[Getting_Started#Change_a_password_at_first_login | Changing a Password at First Login]]. You will also be asked for an ssh passphrase. You can just leave this blank; hit the <tt>Enter</tt> key in response.
  
=====Using Secure Shell=====
+
====Using Secure Shell====
 
For basic command-line access, a Secure Shell (SSH) client will give you a remote command shell on one of the login nodes.
 
For basic command-line access, a Secure Shell (SSH) client will give you a remote command shell on one of the login nodes.
 
:* Nearly all Unix/Linux varieties (including Mac) already have a built-in SSH2 implementation, required by our clusters.
 
:* Nearly all Unix/Linux varieties (including Mac) already have a built-in SSH2 implementation, required by our clusters.
Line 17: Line 21:
 
'''''Linux users:'''''
 
'''''Linux users:'''''
  
To connect to the second login node with ssh, you simply open a terminal window and type
+
To connect to the CAC general login node with ssh, you simply open a terminal window and type
  localhost$ ssh username@linuxlogin.cac.cornell.edu
+
  localhost$ ssh <your_CAC_username>@linuxlogin.cac.cornell.edu
  
'''''Mac OS X users:'''''
+
'''''Mac users:'''''
  
OS X on the Mac is built on a version of Unix, so ssh is available directly from the Terminal application.
+
macOS is built on a version of Unix, so ssh is available directly from the Terminal application.
 
:*One option is to use the shortcut <tt>'''cmd-space'''</tt> to open Spotlight and then type <tt>"Terminal"</tt> to open a Terminal window.
 
:*One option is to use the shortcut <tt>'''cmd-space'''</tt> to open Spotlight and then type <tt>"Terminal"</tt> to open a Terminal window.
 
Otherwise:
 
Otherwise:
Line 29: Line 33:
 
:*Then double-click on the Terminal application to see a Bash command-line.
 
:*Then double-click on the Terminal application to see a Bash command-line.
 
:*:[[Image:MacTerminalWindow.png]]
 
:*:[[Image:MacTerminalWindow.png]]
:*As in Linux, simply type "ssh username@linuxlogin.cac.cornell.edu" into this window.
+
:*As in Linux, simply type "ssh <your_CAC_username>@linuxlogin.cac.cornell.edu" into this window.
  
 
'''''Windows users:'''''
 
'''''Windows users:'''''
  
Secure Shell (ssh) clients work nicely as long as they support the SSH2 protocol. As mentioned, telnet is disabled for security reasons. A popular client for Windows is the free [//www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY client].
+
Secure Shell (ssh) clients work nicely as long as they support the SSH2 protocol. As mentioned, telnet is disabled for security reasons. A popular client for Windows is the free [http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY client].
:* The simplest installation is to download the [//chiark.greenend.org.uk/~sgtatham/putty/download.html Windows installer], called '''putty-0.65-installer.exe''', and run it. This installs PuTTY into your Start menu.
+
:* The simplest installation is to download the [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Windows installer] (having the file extension .msi) and run it. This installs PuTTY into your Start menu.
 
:* To connect, start PuTTY, then type in a host name such as linuxlogin.cac.cornell.edu, and click "Open".
 
:* To connect, start PuTTY, then type in a host name such as linuxlogin.cac.cornell.edu, and click "Open".
 
:*:[[Image:Putty_address.jpg|Setting the host name in PuTTY]]
 
:*:[[Image:Putty_address.jpg|Setting the host name in PuTTY]]
 +
:* Tip for advanced users: a slight inconvenience of PuTTY is that in order to use [[Passwordless SSH]], your private key must first be converted into PuTTY's special "PPK" format using PuTTYgen.
 +
 +
When choosing an SSH client, one consideration is how well other SSH-related tools are integrated, such as SCP (secure copy) and SFTP (secure file transfer protocol). With PuTTY, you can use the separate PSFTP client or PSCP command to transfer files back and forth. But PuTTY is just one choice; other clients for Windows exist.
 +
 +
:* [https://mobaxterm.mobatek.net/ MobaXterm] has a free Home Edition. It gives you not just SSH, but integrated SFTP/SCP, X-Windows, VNC desktop, and quite a few other useful connectivity tools, all within one convenient client.
 +
:* [https://token2shell.com/ Token2Shell] is a non-free commercial product available from the Microsoft Store. It provides SSH along with SFTP/SCP; however, it does not have X-Windows or VNC.
  
=====Using X-Windows=====
+
A completely different approach is to create a self-contained Linux environment within Windows and use the usual Linux commands.
 +
:* [https://docs.microsoft.com/en-us/windows/wsl/about Windows Subsystem for Linux (WSL)], free from Microsoft, allows you to run Ubuntu or another popular Linux distro within Windows 10 or Windows Server 2019. This allows you to use command-line SSH, SFTP, and SCP plus many other useful Linux tools. WSL does not come with an X server, but if you install one for Windows (see below), you can even install and run a VNC client for Linux in WSL.
 +
:* [http://x.cygwin.com Cygwin/X] is free and open-source. It includes an xterm within which you can run OpenSSH commands such as SSH, SFTP, and SCP. Unlike WSL, it includes an X server. While it does not provide a VNC client, plenty of native-Windows VNC clients are available (see below).
  
X-Windows or X11 is the longstanding Unix mechanism for displaying interactive graphics in a window. Your "X server" software runs locally, but it is capable of displaying windows that have been generated either locally or remotely. An "X client" on a remote machine can create X-Windows for local display, but it is necessary first to establish a shell on that machine using SSH.
+
====Using X-Windows====
  
'''''Appropriate use'''''
+
X-Windows (also called X11) is the longstanding Unix mechanism for displaying interactive graphics in a window. Your "X server" software runs locally, but it is capable of displaying windows that have been generated either locally or remotely. An "X client" on a remote machine can create X-Windows for local display, but it is necessary first to establish a shell on that machine using SSH.
 +
 
 +
'''''Appropriate use:'''''
  
Among other things, X-Windows gives you the ability to display a GUI that originates on a login node. However, this ability does '''''NOT''''' imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. Such usage is not only contrary to CAC policy, it is disrespectful toward other users, because the login node may become unresponsive through your actions.
+
Among other things, X-Windows gives you the ability to display a GUI that originates on a login node. However, this ability does '''''NOT''''' imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. On linuxlogin, such usage is contrary to CAC policy. On other shared resources, it is disrespectful toward other users because the login node may become unresponsive through your actions.
  
 
'''''Linux users:'''''
 
'''''Linux users:'''''
  
 
The standard way to use X-Windows is to tunnel the X-Windows protocol through an ssh connection. If you open your ssh session with the '''-X''' option, it will automatically set up the necessary tunnel and environment variables.
 
The standard way to use X-Windows is to tunnel the X-Windows protocol through an ssh connection. If you open your ssh session with the '''-X''' option, it will automatically set up the necessary tunnel and environment variables.
  localhost$ ssh -X username@linuxlogin.cac.cornell.edu
+
  localhost$ ssh -X <your_CAC_username>@linuxlogin.cac.cornell.edu
 
  linuxlogin$ echo $DISPLAY
 
  linuxlogin$ echo $DISPLAY
 
  localhost:11.0
 
  localhost:11.0
  linuxlogin$ xclock&
+
  linuxlogin$ gs
You can see that your DISPLAY environment variable is set and test it with xclock. There is another option to use a trusted version of X-windows forwarding
+
If all goes well, you should see a valid setting for your DISPLAY environment variable, then have a blank window presented to you by gs (Ghostscript, the PostScript and PDF previewer). If not, check the target system to make sure <tt>xorg-x11-xauth</tt> has been installed. Note, if gs is not installed on the machine you're logging into, you can try another X client such as xclock, xlogo, emacs, etc.
  linuxlogin$ ssh -Y compute-3-48.v4linux
+
 
Th trusted version is necessary for forwarding X11 connections from a compute node to the login node, then back to your client machine.
+
The <tt>-Y</tt> option is much like <tt>-X</tt>, but it uses a trusted version of X-windows forwarding.
 +
  cluster-login-node$ ssh -Y compute-1-37
 +
When you're working on a cluster, the trusted (-Y) version is necessary for forwarding X11 connections in two steps: from a compute node to the login node, then back to your client machine.
  
'''''Mac OS X users:'''''
+
'''''Mac users:'''''
  
If you start ssh with the '''-X''' or '''-Y''' option, X-Windows should start up automatically. You can then try the "xclock" test, as described above for Linux.  
+
In order to use X-Windows on a Mac, an X11 server needs to be installed on the system.
 +
The recommended X11 server for use on a Mac is provided by the XQuartz project.
 +
XQuartz used to be included with Mac OS X installations (versions 10.5 through 10.7),
 +
but is no longer included and must be [https://www.xquartz.org/ downloaded] and installed manually.
 +
After installing XQuartz, be sure to restart your Mac before using X11.
 +
 +
Once XQuartz is installed you should start ssh with the <tt>-X</tt> or <tt>-Y</tt> option,
 +
which will cause the X11 server to start automatically on your Mac.
 +
You can then try the "gs" test in the shell, as described above for Linux.  
  
X11 is preinstalled on Macs starting with OS X 10.6 (Snow Leopard). For Mac OS X 10.5 (Leopard), you may need to install X11 in order for X-Windows applications to launch. If there is no X11 application in the Applications->Utilities folder, you'll have to find your OS X install disk. From the ''Mac OS X Server Introduction to Command-Line Administration,'' "The X11 server and an application to access X windows from the Finder are available as an optional installation in the Optional Installs folder of your installation disc (X11 is in the Applications package)."
 
  
 
'''''Windows users:'''''
 
'''''Windows users:'''''
  
Along with your ssh client (e.g., PuTTY), you will need to install an X-Windows server on your Windows machine.
+
A few of the SSH clients mentioned above come with a bundled X server. Otherwise, along with your SSH client (e.g., PuTTY), you will generally need to install an X-Windows server on your Windows machine.
:* [//straightrunning.com/XmingNotes/ Xming] - Open Source. A shareware contribution will get you a version with improved performance for graphics (GLX). There are two pieces to download
+
:* [http://sourceforge.net/projects/vcxsrv VcXsrv] - Open Source, and still being actively maintained. Works with Windows 10. Note that freeware solutions like this one can often work very well, but as always, the installation and use of such packages comes with no guarantees.
 +
:* [http://www.straightrunning.com/XmingNotes/ Xming] - Open Source/Proprietary. Even though the public domain release of Xming is quite old, it still works fine with Windows 10. For a donation, you can download a more up-to-date "website release" with improved performance for graphics (GLX) and other enhancements. There are two pieces to download:
 
:*:[[Image:Xming-download.jpg]]
 
:*:[[Image:Xming-download.jpg]]
:** Xming-mesa (public domain release). There are two links together, one for Xming, one for Xming-mesa. Either will work, but Xming-mesa has some newer features that might come in handy some time.
+
:** Xming or Xming-mesa (public domain release). There are two links together, one for Xming, one for Xming-mesa. Either will work, but Xming-mesa has some newer features that might come in handy some time.
 
:** Xming-fonts (public domain release)
 
:** Xming-fonts (public domain release)
 
If you purchase the website release of Xming, remember to install the Xming-fonts, as well.
 
If you purchase the website release of Xming, remember to install the Xming-fonts, as well.
:* OpenText's [//cit.cornell.edu/services/software_licensing/available/exceed.cfm Exceed and Exceed 3D] - Cornell no longer has a site license. Installing Exceed 3D will improve performance of graphics applications. Exceed installs several icons under the Start menu. Choose the one that just says "Exceed" because it starts the program in multi-window mode, which is what we want.
 
  
Here is how to start a session using PuTTY and Xming.
+
Here are some other X-server possibilities for Windows:
 +
:* [http://x.cygwin.com Cygwin/X] - Open Source. Cygwin is much more that just an X-Windows server. It actually creates an entire Linux-like environment within Windows.
 +
:* [https://token2shell.com/x410/ X410] - Commercial product from the same company that produces Token2Shell, available from the Microsoft Store.
 +
 
 +
Here is how to start a X-Windows-capable session using PuTTY and either VcXsrv or Xming.
  
# Start Xming from the Start menu. It will appear briefly and disappear except for an X in the application tray.
+
# Start VcXsrv or Xming from the Start menu. It will appear briefly and disappear except for an X in the application tray. (Note, the first time you start VcXsrv, you will need to do a few configuration steps.)
 
# Start PuTTY.
 
# Start PuTTY.
# In the window that appears, type a host name, <tt>linuxlogin.cac.cornell.edu</tt>.
+
# In the window that appears, type a host name, e.g., <tt>linuxlogin.cac.cornell.edu</tt>.
# Use the tree menu on the left to set X11 forwarding.  It's in the <tt>Connection > SSH branch</tt>.
+
# Use the tree menu on the left to set X11 forwarding.  It's in the <tt>Connection > SSH</tt> branch.
 
#:[[Image:Putty_x11forwarding.jpg|Setting X11 forwarding in PuTTY]]
 
#:[[Image:Putty_x11forwarding.jpg|Setting X11 forwarding in PuTTY]]
# For PuTTY 0.61 only - In the "Auth" section of the SSH branch, go to GSSAPI and uncheck <tt>"Attempt GSSAPI authentication"</tt>.  This will prevent an annoying <tt>"Access denied"</tt> message from appearing in your terminal window.
 
 
# You can return to the Session category and Save this session's configuration for future use.  Give it a logical name like linuxlogin.
 
# You can return to the Session category and Save this session's configuration for future use.  Give it a logical name like linuxlogin.
# Click Open, and it will connect to a login node.
+
# Click Open, and it will connect to the CAC general login node.
# Test your X-Windows setup by typing
+
# Note for PuTTY 0.61 and above - If an <tt>"Access denied"</tt> message appears in your terminal window for no good reason, you can prevent this annoyance in future sessions by going to the "GSSAPI" area in the "Auth" section of the SSH branch, and unchecking the <tt>"Attempt GSSAPI authentication"</tt> box there.
  xclock
+
 
You should see a clock appear in the corner of your screen. You can stop it by typing <tt>Ctrl-c</tt> in the terminal window.
+
Whichever Windows client and X server you choose, you should test your X-Windows setup by typing the command for Ghostscript, which is a PostScript and PDF previewer:
 +
  gs
 +
A blank window should appear on your screen. You can stop it by typing <tt>Ctrl-c</tt> in the terminal window.
 +
 
 +
'''If this test fails''', check to make sure <tt>xorg-x11-xauth</tt> has been installed on the target system. Also, if you are using a Linux-like shell in Windows (WSL or Cygwin/X), there are a couple of other things to check:
 +
:* Make sure you have specified <tt>ssh -X</tt> or <tt> ssh -Y</tt> as necessary.
 +
:* Type <tt>echo $DISPLAY</tt> in your shell to make sure this environment variable is set locally; if not, enter the following command (which you can add to your .bashrc)
 +
export DISPLAY=localhost:0.0
 +
 
 +
====Using VNC====
  
=====Using VNC=====
+
[http://en.wikipedia.org/wiki/Vnc VNC] lets you see a whole Linux desktop on a remote computer from your local computer.
 +
Connecting to Linux via SSH and X-Windows is efficient in that it uses a lot less of the remote computer's resources,
 +
but VNC can be much faster if you are doing visualization on the remote computer from off campus.
  
[http://en.wikipedia.org/wiki/Vnc VNC] lets you see a whole Linux desktop from the login node on your computer.
+
TigerVNC server has been installed on linuxlogin so you can try VNC there. If you would like to use VNC on a private cluster managed by CAC, please ask your PI to request the VNC installation. Note, a Linux desktop manager is a required part of a VNC installation; GNOME is often a good choice (as is xfce, for those who prefer a minimal desktop).
Using SSH and X-Windows is generally faster, and uses a lot less of the login node's resources,
 
but VNC can be much faster if you are doing visualization on the login node from off campus.
 
  
For security reasons, we are requiring all VNC connections to be tunneled inside ssh. You will therefore need to be able to connect to the login nodes [[Getting_started#Using_Secure_Shell | using SSH]]. Because the firewall running on linuxlogin blocks all incoming ports except for ssh, VNC connections must be made over a ssh tunnel as described below.
+
For security reasons, CAC requires all VNC connections to be tunneled inside ssh. You will therefore need to be able to connect to the remote computer [[Getting_Started#Using_Secure_Shell | using SSH]]. The firewalls running at CAC for all login nodes (e.g., linuxlogin) commonly block all incoming ports except for ssh, so VNC connections must be made over a ssh tunnel as described below.
  
 
'''''Appropriate use'''''
 
'''''Appropriate use'''''
  
VNC gives you the ability to establish a remote desktop on the login nodes, but this ability does '''''NOT''''' imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. Such usage is not only contrary to CAC policy, it is disrespectful toward other users, because the login node may become unresponsive through your actions.
+
VNC gives you the ability to establish a remote desktop on a login node, but this ability does '''''NOT''''' imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. On linuxlogin, such usage is contrary to CAC policy. On other shared resources, it is disrespectful toward other users because the login node may become unresponsive through your actions.
  
 
Here is a good example of how to use VNC appropriately.  By following these steps you can run (say) Abaqus in GUI-driven mode on a compute node that has been allocated to you through an interactive batch job.
 
Here is a good example of how to use VNC appropriately.  By following these steps you can run (say) Abaqus in GUI-driven mode on a compute node that has been allocated to you through an interactive batch job.
# Open a VNC connection to linuxlogin through an ssh tunnel using the instructions below, in order to gain access to a Linux desktop. Make sure two terminal windows are available on this desktop.
+
# Open a VNC connection to the login node through an ssh tunnel using the instructions below, in order to gain access to a Linux desktop. Make sure two terminal windows are available on this desktop.
# In one of the terminal windows, submit an interactive job to the queue of your choice (add the #PBS -I directive to your job submission script).
+
# In one of the terminal windows, submit an interactive job to the queue of your choice.
 
# Once the job starts, you will be given a command prompt on your assigned machine. Note the result of "hostname". There is no need to enter further commands at this prompt (except to exit the job).
 
# Once the job starts, you will be given a command prompt on your assigned machine. Note the result of "hostname". There is no need to enter further commands at this prompt (except to exit the job).
 
# Go to the other terminal window and open a second ssh connection to the compute node using "ssh -Y <userid>@<hostname>"
 
# Go to the other terminal window and open a second ssh connection to the compute node using "ssh -Y <userid>@<hostname>"
 
# This new ssh session will tunnel X-Windows from the compute node back to the VNC desktop. Therefore (if Abaqus is on your path), you can now open the Abaqus GUI using "abaqus cae -mesa".
 
# This new ssh session will tunnel X-Windows from the compute node back to the VNC desktop. Therefore (if Abaqus is on your path), you can now open the Abaqus GUI using "abaqus cae -mesa".
  
'''''Initial setup'''''
+
'''''Local setup for all platforms'''''
''(You only need to do this once)''
 
  
:* Install a VNC client if one isn't installed. [http://www.tightvnc.com/ TightVNC] works well, but so do others.
+
:* Install a local VNC client on your local machine if one isn't installed already. For Linux, TigerVNC is a popular choice. On Mac, you can use the built-in [http://osxdaily.com/2013/04/05/vnc-client-mac-os-x-screen-sharing/ Screen Sharing] app. For Windows, [http://www.tightvnc.com/ TightVNC] works well, but so do others.  
:* Login to linuxlogin, and set the password for your VNC server using the "vncpasswd" command.
 
  
'''''Start your VNC server'''''
+
'''''Starting your remote VNC server (do these steps from an ssh shell)'''''
  
:* '''On linuxlogin''', start the VNC server using the "vncserver" command like this:
+
:* Use ssh to log in to the remote Linux computer.
 +
:* Set the password for your VNC server using the <tt>vncpasswd</tt> command.
 +
:* Start the VNC server using the <tt>vncserver</tt> command like this:
 
   vncserver -geometry 1024x768 -localhost
 
   vncserver -geometry 1024x768 -localhost
The geometry numbers, 1024x768, specify the size, in pixels, of the desktop.
+
The geometry numbers 1024x768 (or other numbers of your choosing) specify the size of the desktop in pixels.
 
:* You will need to get the display number from the output of the vncserver command:
 
:* You will need to get the display number from the output of the vncserver command:
  
 
   New 'linuxlogin.cac.cornell.edu:1 (shl1)' desktop is linuxlogin.cac.cornell.edu:1
 
   New 'linuxlogin.cac.cornell.edu:1 (shl1)' desktop is linuxlogin.cac.cornell.edu:1
   Starting applications specified in /home/gfs01/shl1/.vnc/xstartup
+
   Starting applications specified in /home/fs01/shl1/.vnc/xstartup
   Log file is /home/gfs01/shl1/.vnc/linuxlogin.cac.cornell.edu:1.log
+
   Log file is /home/fs01/shl1/.vnc/linuxlogin.cac.cornell.edu:1.log
  
 
:* vncserver is running on port 5900 + display number. In the above example, the display number is :1, therefore vncserver is running on port 5901.
 
:* vncserver is running on port 5900 + display number. In the above example, the display number is :1, therefore vncserver is running on port 5901.
  
'''''Connect your VNC client'''''
+
'''''Set up your ssh tunnel'''''
 +
''(Do these steps on your local computer)''
  
:* Set up ssh forwarding on your client computer. Let's say the port number on linuxlogin is 5901 (as above), and your CAC userid is uid12. From Linux, type into a terminal:
+
:* Let's say the port number on linuxlogin is 5901 (as above), and your CAC userid is uid12.
 +
:* '''From Linux''', in order to start ssh port forwarding or tunneling to that port, type into a terminal:
 
    
 
    
 
   ssh -L 10000:localhost:5901 uid12@linuxlogin.cac.cornell.edu
 
   ssh -L 10000:localhost:5901 uid12@linuxlogin.cac.cornell.edu
'''From Windows''', ssh clients such as PuTTY can do X11 port forwarding. See [[VNC Tunnel Windows]].
 
  
'''For MacOS X users''', see [[CAC VPN Server for MacOS Users |here]]
+
:* '''From macOS''', open a Terminal and enter the Linux command above.
 +
:* '''From Windows''', ssh clients such as PuTTY can do port forwarding (tunneling); see [[VNC Tunnel Windows]].
 
:* Leave this ssh session running on your local client computer. (It can run in the background.)
 
:* Leave this ssh session running on your local client computer. (It can run in the background.)
:* Launch your VNC client program. Connect to localhost:10000. When prompted, type in your VNC server password.
+
 
 +
'''''Connect your VNC client'''''
 +
 
 +
:* Launch your VNC client program. Connect it to localhost:10000. When prompted, type in your VNC server password.
 +
:* A nice GNOME desktop should appear!
 +
:* If a pop-up asks you to authenticate, just cancel it. See [https://askubuntu.com/questions/959353/disable-gnome-software-from-loading-at-startup this link] for how to prevent the annoying "Authenticate" pop-up from appearing in your future vncserver sessions.
  
 
'''''To disconnect your client'''''
 
'''''To disconnect your client'''''
  
:* Close the vnc client program.
+
:* Close the VNC client program.
 
:* Disconnect the ssh forwarding session (i.e., kill it).
 
:* Disconnect the ssh forwarding session (i.e., kill it).
  
Line 148: Line 190:
 
'''''When you are all done'''''
 
'''''When you are all done'''''
  
:* On linuxlogin, type this command to shut down the VNC server
+
:* It may not be possible to to log out from the Linux desktop. But even if this appears to work, it will leave the VNC server running.
 +
:* When you are finished with your session, shut down all your applications in the desktop, disconnect (close) it, and type this command into a separate ssh session to shut down the VNC server completely:
 +
 
 
   vncserver -kill :<display number>
 
   vncserver -kill :<display number>
:* If you merely log out from linuxlogin, it will leave the VNC server running. You must shut down the VNC server explicitly when you are finished with it. (Actually this can be a nice feature.)
 
  
=====Passwordless SSH=====
+
====Passwordless SSH====
 +
 
 +
An alternative to password-based authentication is public key authentication (PKA). SSH has a well-established mechanism for making use of a public/private key pair.
 +
 
 +
'''Note''': setting this up for yourself is completely optional! On CAC private clusters where an SSH key pair is required for intra-cluster communications, one will be created for you when first log in to the head node, and you never need to worry about it.
 +
 
 +
''''' How it works '''''
 +
 
 +
:* When you connect via SSH, instead of entering a password, you provide the name of an identity file on your computer. This is your private key, part of a public/private key pair.
 +
:* The computer you are connecting to must already have the matching public key stored in a special location. On Linux systems, it should be found among the list of public keys in the file <tt>~/.ssh/authorized_keys</tt>.
 +
:* Upon receiving your initial SSH request, the remote computer encrypts a message using one of the public keys in <tt>~/.ssh/authorized_keys</tt>. It sends the encrypted message to your computer.
 +
:* Your local SSH client attempts to decrypt this message using the private key file you specified. The decrypted message is then sent back to the remote computer.
 +
:* The remote computer checks whether your client succeeded in decrypting the message. If so, you have proven your identity. If not, it tries the next public key until all are exhausted.
 +
 
 +
Clearly, if you want to make use of this mechanism, you will need to set up a public/private key pair!
  
''''' Create ssh key pair '''''
+
''''' Create an SSH key pair '''''
  
Your ssh key pair will only need to be created once. You will not need to repeat this step. You can complete this step from either a Linux or Windows login node. If this is your first login to a CAC login node, it will ask you to [[Getting_Started#Change_a_password_at_first_login|change your password]]. This will become your password for connecting to the nodes.
+
Your ssh key pair will only need to be created once. You will not need to repeat this step. You can complete this step from linuxlogin.cac.cornell.edu, the general Linux login node, or from the login node of a private cluster. (If this is your first login to a CAC login node, it will ask you to [[Getting_Started#Change_a_password_at_first_login|change your password]]; this will become your password for connecting to CAC login nodes in the future.) The steps to create your key pair are as follows:
  
Create your ssh key pair by logging into the linux login node (linuxlogin.cac.cornell.edu), which will begin the process of creating the keys; you can use the defaults or empty responses for all prompts.
+
mkdir .ssh
 +
chmod 700 .ssh
 +
cd .ssh
 +
ssh-keygen (and take all default options)
 +
cat id_rsa.pub >> authorized_keys
  
Alternatively, you can create your ssh key pair on the linux login node by logging into the Windows login node (winx64login.cac.cornell.edu), opening a Command Prompt window, and running <tt>plink.exe</tt> to connect to the linux login node, as shown in this example:
+
As a final step, you need to copy the private key, <tt>id_rsa</tt>, to the computer that you will be logging in from.
 
<pre>>"C:\Programs Files (x86)\Putty\plink.exe" %USERNAME%@linuxlogin.cac.cornell.edu
 
Password: Enter Your Password
 
Rocks 5.0 (V)
 
Profile built 12:54 06-May-2008
 
  
Kickstarted 09:22 06-May-2008
+
'''''Linux and macOS users:'''''
-----------------------------------------------------------
 
Welcome to the Center for Advanced Computing Cluster!
 
-----------------------------------------------------------
 
Please send your questions to help@cac.cornell.edu
 
-----------------------------------------------------------
 
  
 +
You'll want to put the private key in the <tt>~/.ssh</tt> directory. You may wish to call this key <tt>id_rsa</tt> for convenience, BUT be careful not to overwrite an existing key with that name. Let's say you decide instead to call your new private key <tt>cac_id_rsa</tt> on your local computer, just to be safe. You MUST change permissions on this key to keep it private:
  
It doesn't appear that you have set up your ssh key.
+
chmod 600 ~/.ssh/cac_id_rsa
This process will make the files:
 
    /home/gfs01/cacshl1/.ssh/id_rsa.pub
 
    /home/gfs01/cacshl1/.ssh/id_rsa
 
    /home/gfs01/cacshl1/.ssh/authorized_keys
 
  
Generating public/private rsa key pair.
+
Now you're ready to use passwordless SSH to connect to linuxlogin. From a terminal in macOS or Linux, you do the following:
Enter file in which to save the key (/home/gfs01/cacshl1/.ssh/id_rsa): Press Enter to accept default
 
Created directory '/home/gfs01/cacshl1/.ssh'.
 
Enter passphrase (empty for no passphrase): Press Enter to accept default
 
Enter same passphrase again: Press Enter to accept default
 
Your identification has been saved in /home/gfs01/cacshl1/.ssh/id_rsa.
 
Your public key has been saved in /home/gfs01/cacshl1/.ssh/id_rsa.pub.
 
</pre>
 
  
After this is done, type '''"exit"''' to log out of the linux login node.
+
ssh -i ~/.ssh/cac_id_rsa <your_CAC_username>@linuxlogin.cac.cornell.edu
  
''''' Convert ssh Private Key for Putty / Plink '''''
+
'''''Windows users:'''''
  
Next run PuTTYgen to generate public and private keys to be used with PuTTY and Plink:
+
The way to proceed in Windows depends on the SSH client you are using. Here, we cover PuTTY as an example. The first step is to use PuTTYgen to convert the SSH private key for use with PuTTY and plink.
  
:* Log in to <tt>winx64login.tc.cornell.edu </tt>(if you are not already)
+
:* Run <tt>"C:\Program Files (x86)\Putty\puttygen.exe"</tt>.
:* Run <tt>C:\Program Files (x86)\Putty\puttygen.exe</tt>.
+
:* Select <tt>Import Key</tt> from the <tt>Conversions</tt> menu and enter <tt>C:\Users\<your_local_username>\.ssh</tt> in the address bar, assuming this is where you placed your private key in your home directory. Then, select the <tt>id_rsa</tt> file and click on the <tt>Open</tt> button.
:* Select <tt>Import Key</tt> from the <tt>Conversions</tt> menu and select <tt>H:\.ssh\id_rsa</tt> in your home directory. And click on the <tt>Open</tt> button.
 
 
<center>[[image:LoadPrivateKey.jpg]]</center>
 
<center>[[image:LoadPrivateKey.jpg]]</center>
 
:* Click on the <tt>"Save Private Key"</tt> button.   
 
:* Click on the <tt>"Save Private Key"</tt> button.   
 
<center>[[image:SavePrivateKey.jpg]]</center>
 
<center>[[image:SavePrivateKey.jpg]]</center>
 
:* Click on "Yes" when asked to save the private key without a passphrase.
 
:* Click on "Yes" when asked to save the private key without a passphrase.
:* Save the private key as private.ppk in the .ssh directory inside your home directory.
+
:* Save the private key as <tt>private.ppk</tt> in the <tt>.ssh</tt> directory inside your home directory.
 
<center>[[image:SpecifyPrivateKey.jpg]]</center>
 
<center>[[image:SpecifyPrivateKey.jpg]]</center>
 
:* Close (choose File, then Exit)
 
:* Close (choose File, then Exit)
 
:* To confirm you have converted the ssh private key successfully, do:
 
:* To confirm you have converted the ssh private key successfully, do:
<pre>"C:\Program Files (x86)\Putty\plink.exe" -i %HOMEDRIVE%\.ssh\private.ppk %USERNAME%@linuxlogin.cac.cornell.edu</pre>
+
<pre>"C:\Program Files (x86)\Putty\plink.exe" -i %USERPROFILE%\.ssh\private.ppk <your_CAC_username>@linuxlogin.cac.cornell.edu</pre>
 
It may notify you that "The server's host key is not cached in the registry." Type "y" to "store the key in cache."
 
It may notify you that "The server's host key is not cached in the registry." Type "y" to "store the key in cache."
:* You should now be logged into linuxlogin without being prompted for a password. Stay logged in for the next step.
+
:* If everything was done correctly, you should now be logged into linuxlogin without being prompted for a password. Type <tt>exit</tt> to log out.
 +
In PuTTY, you will want to update your Saved Session for linuxlogin to use the new key. Load the linuxlogin session. Navigate to "Connection > SSH > Auth", browse to <tt>%USERPROFILE%\.ssh</tt> and open the <tt>id_rsa</tt> file. Go back to Session and click Save. Now you won't need to enter a password for linuxlogin ever again!

Latest revision as of 18:10, 16 October 2019

These instructions are written primarily for users trying to log in to a CAC login node, taking linuxlogin as an example; however, the same methods should work for nearly any remote Linux machine. Note: If you are trying to connect to a Red Cloud Linux instance, please see the specific connection instructions in the documentation first. There are also troubleshooting steps to help you if you get stuck.

There are three distinct ways to connect to a remote Linux machine:

  1. Use SSH to open a Linux shell on a login node, which provides a text-only interface.
  2. Use SSH together with X-Windows, which sends any interactive graphics back to your machine window-by-window through an SSH tunnel.
  3. Use VNC to get a remote desktop with multiple text and graphics windows. This is not as straightforward as it sounds, due to the need to set up a secure tunnel for the remote desktop first.

These instructions are intended mainly for users of personal computers and workstations. However, much of the material carries over to mobile computing platforms such as tablets and smartphones. You will have to locate and download an app to enable SSH or VNC connectivity; even a browser plug-in may suffice.

Whichever method you choose, at your first login, you will be challenged for a new password (this does not apply to Red Cloud resources). Find help at Changing a Password at First Login. You will also be asked for an ssh passphrase. You can just leave this blank; hit the Enter key in response.

Using Secure Shell

For basic command-line access, a Secure Shell (SSH) client will give you a remote command shell on one of the login nodes.

  • Nearly all Unix/Linux varieties (including Mac) already have a built-in SSH2 implementation, required by our clusters.
  • If you are coming from a Microsoft Windows machine, an SSH2 client must first be installed, as described below.
  • The non-secure predecessor of SSH, telnet, is disabled for security reasons.

Linux users:

To connect to the CAC general login node with ssh, you simply open a terminal window and type

localhost$ ssh <your_CAC_username>@linuxlogin.cac.cornell.edu

Mac users:

macOS is built on a version of Unix, so ssh is available directly from the Terminal application.

  • One option is to use the shortcut cmd-space to open Spotlight and then type "Terminal" to open a Terminal window.

Otherwise:

  • Navigate in the Finder to the Applications folder and Utilities sub-folder.
    MacApplicationsFolder.png
  • Then double-click on the Terminal application to see a Bash command-line.
    MacTerminalWindow.png
  • As in Linux, simply type "ssh <your_CAC_username>@linuxlogin.cac.cornell.edu" into this window.

Windows users:

Secure Shell (ssh) clients work nicely as long as they support the SSH2 protocol. As mentioned, telnet is disabled for security reasons. A popular client for Windows is the free PuTTY client.

  • The simplest installation is to download the Windows installer (having the file extension .msi) and run it. This installs PuTTY into your Start menu.
  • To connect, start PuTTY, then type in a host name such as linuxlogin.cac.cornell.edu, and click "Open".
    Setting the host name in PuTTY
  • Tip for advanced users: a slight inconvenience of PuTTY is that in order to use Passwordless SSH, your private key must first be converted into PuTTY's special "PPK" format using PuTTYgen.

When choosing an SSH client, one consideration is how well other SSH-related tools are integrated, such as SCP (secure copy) and SFTP (secure file transfer protocol). With PuTTY, you can use the separate PSFTP client or PSCP command to transfer files back and forth. But PuTTY is just one choice; other clients for Windows exist.

  • MobaXterm has a free Home Edition. It gives you not just SSH, but integrated SFTP/SCP, X-Windows, VNC desktop, and quite a few other useful connectivity tools, all within one convenient client.
  • Token2Shell is a non-free commercial product available from the Microsoft Store. It provides SSH along with SFTP/SCP; however, it does not have X-Windows or VNC.

A completely different approach is to create a self-contained Linux environment within Windows and use the usual Linux commands.

  • Windows Subsystem for Linux (WSL), free from Microsoft, allows you to run Ubuntu or another popular Linux distro within Windows 10 or Windows Server 2019. This allows you to use command-line SSH, SFTP, and SCP plus many other useful Linux tools. WSL does not come with an X server, but if you install one for Windows (see below), you can even install and run a VNC client for Linux in WSL.
  • Cygwin/X is free and open-source. It includes an xterm within which you can run OpenSSH commands such as SSH, SFTP, and SCP. Unlike WSL, it includes an X server. While it does not provide a VNC client, plenty of native-Windows VNC clients are available (see below).

Using X-Windows

X-Windows (also called X11) is the longstanding Unix mechanism for displaying interactive graphics in a window. Your "X server" software runs locally, but it is capable of displaying windows that have been generated either locally or remotely. An "X client" on a remote machine can create X-Windows for local display, but it is necessary first to establish a shell on that machine using SSH.

Appropriate use:

Among other things, X-Windows gives you the ability to display a GUI that originates on a login node. However, this ability does NOT imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. On linuxlogin, such usage is contrary to CAC policy. On other shared resources, it is disrespectful toward other users because the login node may become unresponsive through your actions.

Linux users:

The standard way to use X-Windows is to tunnel the X-Windows protocol through an ssh connection. If you open your ssh session with the -X option, it will automatically set up the necessary tunnel and environment variables.

localhost$ ssh -X <your_CAC_username>@linuxlogin.cac.cornell.edu
linuxlogin$ echo $DISPLAY
localhost:11.0
linuxlogin$ gs

If all goes well, you should see a valid setting for your DISPLAY environment variable, then have a blank window presented to you by gs (Ghostscript, the PostScript and PDF previewer). If not, check the target system to make sure xorg-x11-xauth has been installed. Note, if gs is not installed on the machine you're logging into, you can try another X client such as xclock, xlogo, emacs, etc.

The -Y option is much like -X, but it uses a trusted version of X-windows forwarding.

cluster-login-node$ ssh -Y compute-1-37

When you're working on a cluster, the trusted (-Y) version is necessary for forwarding X11 connections in two steps: from a compute node to the login node, then back to your client machine.

Mac users:

In order to use X-Windows on a Mac, an X11 server needs to be installed on the system. The recommended X11 server for use on a Mac is provided by the XQuartz project. XQuartz used to be included with Mac OS X installations (versions 10.5 through 10.7), but is no longer included and must be downloaded and installed manually. After installing XQuartz, be sure to restart your Mac before using X11.

Once XQuartz is installed you should start ssh with the -X or -Y option, which will cause the X11 server to start automatically on your Mac. You can then try the "gs" test in the shell, as described above for Linux.


Windows users:

A few of the SSH clients mentioned above come with a bundled X server. Otherwise, along with your SSH client (e.g., PuTTY), you will generally need to install an X-Windows server on your Windows machine.

  • VcXsrv - Open Source, and still being actively maintained. Works with Windows 10. Note that freeware solutions like this one can often work very well, but as always, the installation and use of such packages comes with no guarantees.
  • Xming - Open Source/Proprietary. Even though the public domain release of Xming is quite old, it still works fine with Windows 10. For a donation, you can download a more up-to-date "website release" with improved performance for graphics (GLX) and other enhancements. There are two pieces to download:
    Xming-download.jpg
    • Xming or Xming-mesa (public domain release). There are two links together, one for Xming, one for Xming-mesa. Either will work, but Xming-mesa has some newer features that might come in handy some time.
    • Xming-fonts (public domain release)

If you purchase the website release of Xming, remember to install the Xming-fonts, as well.

Here are some other X-server possibilities for Windows:

  • Cygwin/X - Open Source. Cygwin is much more that just an X-Windows server. It actually creates an entire Linux-like environment within Windows.
  • X410 - Commercial product from the same company that produces Token2Shell, available from the Microsoft Store.

Here is how to start a X-Windows-capable session using PuTTY and either VcXsrv or Xming.

  1. Start VcXsrv or Xming from the Start menu. It will appear briefly and disappear except for an X in the application tray. (Note, the first time you start VcXsrv, you will need to do a few configuration steps.)
  2. Start PuTTY.
  3. In the window that appears, type a host name, e.g., linuxlogin.cac.cornell.edu.
  4. Use the tree menu on the left to set X11 forwarding. It's in the Connection > SSH branch.
    Setting X11 forwarding in PuTTY
  5. You can return to the Session category and Save this session's configuration for future use. Give it a logical name like linuxlogin.
  6. Click Open, and it will connect to the CAC general login node.
  7. Note for PuTTY 0.61 and above - If an "Access denied" message appears in your terminal window for no good reason, you can prevent this annoyance in future sessions by going to the "GSSAPI" area in the "Auth" section of the SSH branch, and unchecking the "Attempt GSSAPI authentication" box there.

Whichever Windows client and X server you choose, you should test your X-Windows setup by typing the command for Ghostscript, which is a PostScript and PDF previewer:

gs

A blank window should appear on your screen. You can stop it by typing Ctrl-c in the terminal window.

If this test fails, check to make sure xorg-x11-xauth has been installed on the target system. Also, if you are using a Linux-like shell in Windows (WSL or Cygwin/X), there are a couple of other things to check:

  • Make sure you have specified ssh -X or ssh -Y as necessary.
  • Type echo $DISPLAY in your shell to make sure this environment variable is set locally; if not, enter the following command (which you can add to your .bashrc)
export DISPLAY=localhost:0.0

Using VNC

VNC lets you see a whole Linux desktop on a remote computer from your local computer. Connecting to Linux via SSH and X-Windows is efficient in that it uses a lot less of the remote computer's resources, but VNC can be much faster if you are doing visualization on the remote computer from off campus.

TigerVNC server has been installed on linuxlogin so you can try VNC there. If you would like to use VNC on a private cluster managed by CAC, please ask your PI to request the VNC installation. Note, a Linux desktop manager is a required part of a VNC installation; GNOME is often a good choice (as is xfce, for those who prefer a minimal desktop).

For security reasons, CAC requires all VNC connections to be tunneled inside ssh. You will therefore need to be able to connect to the remote computer using SSH. The firewalls running at CAC for all login nodes (e.g., linuxlogin) commonly block all incoming ports except for ssh, so VNC connections must be made over a ssh tunnel as described below.

Appropriate use

VNC gives you the ability to establish a remote desktop on a login node, but this ability does NOT imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. On linuxlogin, such usage is contrary to CAC policy. On other shared resources, it is disrespectful toward other users because the login node may become unresponsive through your actions.

Here is a good example of how to use VNC appropriately. By following these steps you can run (say) Abaqus in GUI-driven mode on a compute node that has been allocated to you through an interactive batch job.

  1. Open a VNC connection to the login node through an ssh tunnel using the instructions below, in order to gain access to a Linux desktop. Make sure two terminal windows are available on this desktop.
  2. In one of the terminal windows, submit an interactive job to the queue of your choice.
  3. Once the job starts, you will be given a command prompt on your assigned machine. Note the result of "hostname". There is no need to enter further commands at this prompt (except to exit the job).
  4. Go to the other terminal window and open a second ssh connection to the compute node using "ssh -Y <userid>@<hostname>"
  5. This new ssh session will tunnel X-Windows from the compute node back to the VNC desktop. Therefore (if Abaqus is on your path), you can now open the Abaqus GUI using "abaqus cae -mesa".

Local setup for all platforms

  • Install a local VNC client on your local machine if one isn't installed already. For Linux, TigerVNC is a popular choice. On Mac, you can use the built-in Screen Sharing app. For Windows, TightVNC works well, but so do others.

Starting your remote VNC server (do these steps from an ssh shell)

  • Use ssh to log in to the remote Linux computer.
  • Set the password for your VNC server using the vncpasswd command.
  • Start the VNC server using the vncserver command like this:
 vncserver -geometry 1024x768 -localhost

The geometry numbers 1024x768 (or other numbers of your choosing) specify the size of the desktop in pixels.

  • You will need to get the display number from the output of the vncserver command:
 New 'linuxlogin.cac.cornell.edu:1 (shl1)' desktop is linuxlogin.cac.cornell.edu:1
 Starting applications specified in /home/fs01/shl1/.vnc/xstartup
 Log file is /home/fs01/shl1/.vnc/linuxlogin.cac.cornell.edu:1.log
  • vncserver is running on port 5900 + display number. In the above example, the display number is :1, therefore vncserver is running on port 5901.

Set up your ssh tunnel (Do these steps on your local computer)

  • Let's say the port number on linuxlogin is 5901 (as above), and your CAC userid is uid12.
  • From Linux, in order to start ssh port forwarding or tunneling to that port, type into a terminal:
 ssh -L 10000:localhost:5901 uid12@linuxlogin.cac.cornell.edu
  • From macOS, open a Terminal and enter the Linux command above.
  • From Windows, ssh clients such as PuTTY can do port forwarding (tunneling); see VNC Tunnel Windows.
  • Leave this ssh session running on your local client computer. (It can run in the background.)

Connect your VNC client

  • Launch your VNC client program. Connect it to localhost:10000. When prompted, type in your VNC server password.
  • A nice GNOME desktop should appear!
  • If a pop-up asks you to authenticate, just cancel it. See this link for how to prevent the annoying "Authenticate" pop-up from appearing in your future vncserver sessions.

To disconnect your client

  • Close the VNC client program.
  • Disconnect the ssh forwarding session (i.e., kill it).

To reconnect your client

  • Restart port forwarding with ssh, using the same remote port number as before.
  • Again connect the VNC client to localhost:10000.

When you are all done

  • It may not be possible to to log out from the Linux desktop. But even if this appears to work, it will leave the VNC server running.
  • When you are finished with your session, shut down all your applications in the desktop, disconnect (close) it, and type this command into a separate ssh session to shut down the VNC server completely:
 vncserver -kill :<display number>

Passwordless SSH

An alternative to password-based authentication is public key authentication (PKA). SSH has a well-established mechanism for making use of a public/private key pair.

Note: setting this up for yourself is completely optional! On CAC private clusters where an SSH key pair is required for intra-cluster communications, one will be created for you when first log in to the head node, and you never need to worry about it.

How it works

  • When you connect via SSH, instead of entering a password, you provide the name of an identity file on your computer. This is your private key, part of a public/private key pair.
  • The computer you are connecting to must already have the matching public key stored in a special location. On Linux systems, it should be found among the list of public keys in the file ~/.ssh/authorized_keys.
  • Upon receiving your initial SSH request, the remote computer encrypts a message using one of the public keys in ~/.ssh/authorized_keys. It sends the encrypted message to your computer.
  • Your local SSH client attempts to decrypt this message using the private key file you specified. The decrypted message is then sent back to the remote computer.
  • The remote computer checks whether your client succeeded in decrypting the message. If so, you have proven your identity. If not, it tries the next public key until all are exhausted.

Clearly, if you want to make use of this mechanism, you will need to set up a public/private key pair!

Create an SSH key pair

Your ssh key pair will only need to be created once. You will not need to repeat this step. You can complete this step from linuxlogin.cac.cornell.edu, the general Linux login node, or from the login node of a private cluster. (If this is your first login to a CAC login node, it will ask you to change your password; this will become your password for connecting to CAC login nodes in the future.) The steps to create your key pair are as follows:

mkdir .ssh
chmod 700 .ssh
cd .ssh
ssh-keygen (and take all default options)
cat id_rsa.pub >> authorized_keys

As a final step, you need to copy the private key, id_rsa, to the computer that you will be logging in from.

Linux and macOS users:

You'll want to put the private key in the ~/.ssh directory. You may wish to call this key id_rsa for convenience, BUT be careful not to overwrite an existing key with that name. Let's say you decide instead to call your new private key cac_id_rsa on your local computer, just to be safe. You MUST change permissions on this key to keep it private:

chmod 600 ~/.ssh/cac_id_rsa

Now you're ready to use passwordless SSH to connect to linuxlogin. From a terminal in macOS or Linux, you do the following:

ssh -i ~/.ssh/cac_id_rsa <your_CAC_username>@linuxlogin.cac.cornell.edu

Windows users:

The way to proceed in Windows depends on the SSH client you are using. Here, we cover PuTTY as an example. The first step is to use PuTTYgen to convert the SSH private key for use with PuTTY and plink.

  • Run "C:\Program Files (x86)\Putty\puttygen.exe".
  • Select Import Key from the Conversions menu and enter C:\Users\<your_local_username>\.ssh in the address bar, assuming this is where you placed your private key in your home directory. Then, select the id_rsa file and click on the Open button.
LoadPrivateKey.jpg
  • Click on the "Save Private Key" button.
SavePrivateKey.jpg
  • Click on "Yes" when asked to save the private key without a passphrase.
  • Save the private key as private.ppk in the .ssh directory inside your home directory.
SpecifyPrivateKey.jpg
  • Close (choose File, then Exit)
  • To confirm you have converted the ssh private key successfully, do:
"C:\Program Files (x86)\Putty\plink.exe" -i %USERPROFILE%\.ssh\private.ppk <your_CAC_username>@linuxlogin.cac.cornell.edu

It may notify you that "The server's host key is not cached in the registry." Type "y" to "store the key in cache."

  • If everything was done correctly, you should now be logged into linuxlogin without being prompted for a password. Type exit to log out.

In PuTTY, you will want to update your Saved Session for linuxlogin to use the new key. Load the linuxlogin session. Navigate to "Connection > SSH > Auth", browse to %USERPROFILE%\.ssh and open the id_rsa file. Go back to Session and click Save. Now you won't need to enter a password for linuxlogin ever again!