Connect to Linux
There are three distinct ways to connect to a login node.
- Use SSH to open a Linux shell on a login node, which provides a text-only interface.
- Use SSH together with X-Windows, which sends any interactive graphics back to your machine window-by-window through an SSH tunnel.
- Use VNC to get a remote desktop with multiple text and graphics windows. This is not as straightforward as it sounds, due to the need to set up a secure tunnel for the remote desktop first.
These instructions are intended mainly for users of personal computers and workstations. However, much of the material carries over to mobile computing platforms such as tablets and smartphones. You will have to locate and download an app to enable SSH or VNC connectivity; even a browser plug-in may suffice.
Whichever method you choose, at your first login, you will be challenged for a new password. Find help at Changing a Password at First Login. You will also be asked for an ssh passphrase. You can just leave this blank; hit the Enter key in response.
Using Secure Shell
For basic command-line access, a Secure Shell (SSH) client will give you a remote command shell on one of the login nodes.
- Nearly all Unix/Linux varieties (including Mac) already have a built-in SSH2 implementation, required by our clusters.
- If you are coming from a Microsoft Windows machine, an SSH2 client must first be installed, as described below.
- The non-secure predecessor of SSH, telnet, is disabled for security reasons.
Linux users
To connect to the second login node with ssh, you simply open a terminal window and type
localhost$ ssh username@linuxlogin2.cac.cornell.edu
Mac users
OS X on the Mac is built on a version of Unix, so ssh is available directly from the Terminal application.
- Navigate in the Finder to the Applications folder and Utilities sub-folder.
- Error creating thumbnail: Unable to save thumbnail to destination
- Then double-click on the Terminal application to see a Bash command-line.
- Error creating thumbnail: Unable to save thumbnail to destination
- As in Linux, simply type "ssh username@linuxlogin.cac.cornell.edu" into this window.
- Navigate in the Finder to the Applications folder and Utilities sub-folder.
Windows users
Secure Shell (ssh) clients work nicely as long as they support the SSH2 protocol. As mentioned, telnet is disabled for security reasons. A popular client for Windows is the free PuTTY client.
- The simplest installation is to download the Windows installer, called putty-0.61-installer.exe, and run it. This installs PuTTY into your Start menu.
- To connect, start PuTTY, then type in a host name such as linuxlogin1.cac.cornell.edu or linuxlogin2.cac.cornell.edu, and click "Open".
- Error creating thumbnail: Unable to save thumbnail to destination
Using X-Windows
X-Windows or X11 is the longstanding Unix mechanism for displaying interactive graphics in a window. Your "X server" software runs locally, but it is capable of displaying windows that have been generated either locally or remotely. An "X client" on a remote machine can create X-Windows for local display, but it is necessary first to establish a shell on that machine using SSH.
Appropriate use
Among other things, X-Windows gives you the ability to display a GUI that originates on a login node. However, this ability does NOT imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. Such usage is not only contrary to CAC policy, it is disrespectful toward other users, because the login node may become unresponsive through your actions.
Linux users
The standard way to use X-Windows is to tunnel the X-Windows protocol through an ssh connection. If you open your ssh session with the -X option, it will automatically set up the necessary tunnel and environment variables.
localhost$ ssh -X username@linuxlogin1.cac.cornell.edu linuxlogin$ echo $DISPLAY localhost:11.0 linuxlogin$ xclock&
You can see that your DISPLAY environment variable is set and test it with xclock. There is another option to use a trusted version of X-windows forwarding
linuxlogin1$ ssh -Y compute-3-48.v4linux
Th trusted version is necessary for forwarding X11 connections from a compute node to the login node, then back to your client machine.
Mac users
If you start ssh with the -X or -Y option, X-Windows should start up automatically. You can then try the "xclock" test, as described above for Linux.
X11 is preinstalled on Macs starting with OS X 10.6 (Snow Leopard). For Mac OS X 10.5 (Leopard), you may need to install X11 in order for X-Windows applications to launch. If there is no X11 application in the Applications->Utilities folder, you'll have to find your OS X install disk. From the Mac OS X Server Introduction to Command-Line Administration, "The X11 server and an application to access X windows from the Finder are available as an optional installation in the Optional Installs folder of your installation disc (X11 is in the Applications package)."
Windows users
Along with your ssh client (e.g., PuTTY), you will need to install an X-Windows server on your Windows machine.
- Xming - Open Source. A shareware contribution will get you a version with improved performance for graphics (GLX). There are two pieces to download
- Error creating thumbnail: Unable to save thumbnail to destination
- Xming-mesa (public domain release). There are two links together, one for Xming, one for Xming-mesa. Either will work, but Xming-mesa has some newer features that might come in handy some time.
- Xming-fonts (public domain release)
- Xming - Open Source. A shareware contribution will get you a version with improved performance for graphics (GLX). There are two pieces to download
If you purchase the website release of Xming, remember to install the Xming-fonts, as well.
- OpenText's Exceed and Exceed 3D - Cornell no longer has a site license. Installing Exceed 3D will improve performance of graphics applications. Exceed installs several icons under the Start menu. Choose the one that just says "Exceed" because it starts the program in multi-window mode, which is what we want.
Here is how to start a session using PuTTY and Xming.
- Start Xming from the Start menu. It will appear briefly and disappear except for an X in the application tray.
- Start PuTTY.
- In the window that appears, type a host name, linuxlogin1.cac.cornell.edu or linuxlogin2.cac.cornell.edu.
- Use the tree menu on the left to set X11 forwarding. It's in the Connection > SSH branch.
- Error creating thumbnail: Unable to save thumbnail to destination
- For PuTTY 0.61 only - In the "Auth" section of the SSH branch, go to GSSAPI and uncheck "Attempt GSSAPI authentication". This will prevent an annoying "Access denied" message from appearing in your terminal window.
- You can return to the Session category and Save this session's configuration for future use. Give it a logical name like linuxlogin.
- Click Open, and it will connect to a login node.
- Test your X-Windows setup by typing
xclock
You should see a clock appear in the corner of your screen. You can stop it by typing Ctrl-c in the terminal window.
Using VNC
VNC lets you see a whole Linux desktop from the login node on your computer. Using SSH and X-Windows is generally faster, and uses a lot less of the login node's resources, but VNC can be much faster if you are doing visualization on the login node from off campus.
For security reasons, we are requiring all VNC connections to be tunneled inside ssh. You will therefore need to be able to connect to the login nodes using SSH. Because the firewall running on linuxlogin blocks all incoming ports except for ssh, VNC connections must be made over a ssh tunnel as described below.
Appropriate use
VNC gives you the ability to establish a remote desktop on the login nodes, but this ability does NOT imply that you are permitted to run compute-intensive, GUI-driven applications on these machines. Such usage is not only contrary to CAC policy, it is disrespectful toward other users, because the login node may become unresponsive through your actions.
Here is a good example of how to use VNC appropriately. By following these steps you can run (say) Abaqus in GUI-driven mode on a compute node that has been allocated to you through an interactive batch job.
- Open a VNC connection to linuxlogin through an ssh tunnel using the instructions below, in order to gain access to a Linux desktop. Make sure two terminal windows are available on this desktop.
- In one of the terminal windows, submit an interactive job to the queue of your choice (add the #PBS -I directive to your job submission script).
- Once the job starts, you will be given a command prompt on your assigned machine. Note the result of "hostname". There is no need to enter further commands at this prompt (except to exit the job).
- Go to the other terminal window and open a second ssh connection to the compute node using "ssh -Y <userid>@<hostname>"
- This new ssh session will tunnel X-Windows from the compute node back to the VNC desktop. Therefore (if Abaqus is on your path), you can now open the Abaqus GUI using "abaqus cae -mesa".
Initial setup (You only need to do this once)
- Install a VNC client if one isn't installed. TightVNC works well, but so do others.
- Login to linuxlogin1 or linuxlogin2, and set the password for your VNC server using the "vncpasswd" command.
Start your VNC server
- On linuxlogin, start the VNC server using the "vncserver" command like this:
vncserver -geometry 1024x768 -localhost
The geometry numbers, 1024x768, specify the size, in pixels, of the desktop.
- You will need to get the display number from the output of the vncserver command:
New 'linuxlogin.cac.cornell.edu:1 (shl1)' desktop is linuxlogin.cac.cornell.edu:1 Starting applications specified in /home/gfs01/shl1/.vnc/xstartup Log file is /home/gfs01/shl1/.vnc/linuxlogin.cac.cornell.edu:1.log
- vncserver is running on port 5900 + display number. In the above example, the display number is :1, therefore vncserver is running on port 5901.
Connect your VNC client
- Set up ssh forwarding on your client computer. Let's say the port number on linuxlogin is 5901 (as above), and your CAC userid is uid12. From Linux, type into a terminal:
ssh -L 10000:localhost:5901 uid12@linuxlogin.cac.cornell.edu
From Windows, ssh clients such as PuTTY can do X11 port forwarding. See VNCTunnelWindows.
- Leave this ssh session running on your local client computer. (It can run in the background.)
- Launch your VNC client program. Connect to localhost:10000. When prompted, type in your VNC server password.
To disconnect your client
- Close the vnc client program.
- Disconnect the ssh forwarding session (i.e., kill it).
To reconnect your client
- Restart port forwarding with ssh, using the same remote port number as before.
- Again connect the VNC client to localhost:10000.
When you are all done
- On linuxlogin, type this command to shut down the VNC server
vncserver -kill :<display number>
- If you merely log out from linuxlogin, it will leave the VNC server running. You must shut down the VNC server explicitly when you are finished with it. (Actually this can be a nice feature.)
Passwordless SSH
Create ssh Key Pair
Your ssh key pair will only need to be created once. You will not need to repeat this step. You can complete this step from either a Linux or Windows login node. If this is your first login to a CAC login node, it will ask you to change your password. This will become your password for connecting to the nodes.
Create your ssh key pair by logging into the linux login node (linuxlogin.cac.cornell.edu), which will begin the process of creating the keys; you can use the defaults or empty responses for all prompts.
Alternatively, you can create your ssh key pair on the linux login node by logging into the Windows login node (winx64login.cac.cornell.edu), opening a Command Prompt window, and running plink.exe to connect to the linux login node, as shown in this example:
>"C:\Programs Files (x86)\Putty\plink.exe" %USERNAME%@linuxlogin.cac.cornell.edu Password: Enter Your Password Rocks 5.0 (V) Profile built 12:54 06-May-2008 Kickstarted 09:22 06-May-2008 ----------------------------------------------------------- Welcome to the Center for Advanced Computing Cluster! ----------------------------------------------------------- Please send your questions to help@cac.cornell.edu ----------------------------------------------------------- It doesn't appear that you have set up your ssh key. This process will make the files: /home/gfs01/cacshl1/.ssh/id_rsa.pub /home/gfs01/cacshl1/.ssh/id_rsa /home/gfs01/cacshl1/.ssh/authorized_keys Generating public/private rsa key pair. Enter file in which to save the key (/home/gfs01/cacshl1/.ssh/id_rsa): Press Enter to accept default Created directory '/home/gfs01/cacshl1/.ssh'. Enter passphrase (empty for no passphrase): Press Enter to accept default Enter same passphrase again: Press Enter to accept default Your identification has been saved in /home/gfs01/cacshl1/.ssh/id_rsa. Your public key has been saved in /home/gfs01/cacshl1/.ssh/id_rsa.pub.
After this is done, type "exit" to log out of the linux login node.
Convert ssh Private Key for Putty / Plink
Next run PuTTYgen to generate public and private keys to be used with PuTTY and Plink:
- Log in to winx64login.tc.cornell.edu (if you are not already)
- Run C:\Program Files (x86)\Putty\puttygen.exe.
- Select Import Key from the Conversions menu and select H:\.ssh\id_rsa in your home directory. And click on the Open button.
- Click on the "Save Private Key" button.
- Click on "Yes" when asked to save the private key without a passphrase.
- Save the private key as private.ppk in the .ssh directory inside your home directory.
- Close (choose File, then Exit)
- To confirm you have converted the ssh private key successfully, do:
"C:\Program Files (x86)\Putty\plink.exe" -i %HOMEDRIVE%\.ssh\private.ppk %USERNAME%@linuxlogin.cac.cornell.edu
It may notify you that "The server's host key is not cached in the registry." Type "y" to "store the key in cache."
- You should now be logged into linuxlogin without being prompted for a password. Stay logged in for the next step.