Changes between Version 1 and Version 2 of TransparentMultiHopSSHNewLobby


Ignore:
Timestamp:
2021-07-07T14:40:25+02:00 (3 years ago)
Author:
Pieter Neerincx
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • TransparentMultiHopSSHNewLobby

    v1 v2  
    88The existing {{{lobby.hpc.rug.nl}}} will shortly be replaced by a new machine with the same name. This new machine currently has no DNS entry yet; the example config below is for the new {{{lobby}}} jumphost and is based on its IP address only.
    99
    10 Note that previously there was also a jumphost named lobby.hpc.rug.nl, but this one has been deprecated. Furthermore there many other machines specified in the example config like {{{flexo}}} and {{{bender}}}. Please remove all entries for these machines from your {{{~/.ssh/config}}} file:
    11  * The only line that should remain in your ~/.ssh/config for our machines is
     10Note that previously there was also a jumphost named {{{lobby.hpc.rug.nl}}}, but this one has been deprecated. Furthermore there many other machines specified in the example config like {{{flexo}}} and {{{bender}}}. Please remove all entries for these machines from your {{{~/.ssh/config}}} file:
     11 * The only line that should remain in your ~/.ssh/config for the UMCG Research HPC machines is:
     12   {{{
     13   Include conf.d/*
     14   }}}
    1215 * Additional lines that are required to access our machines are added to a separate {{{~/.ssh/conf.d/calculon}}} file now.
    1316
    … …  
    1720 * On the machine from which you want to connect
    1821   * Make sure you have a **''~/.ssh''** folder with generated SSH keys linked to your account. See [wiki:RequestAccount] for instructions.
    19    * Create **''~/.ssh/tmp''** and **''~/.ssh/conf.d''** folders. Open a terminal and type the following command:
     22   * Create **''~/.ssh/tmp''** and **''~/.ssh/conf.d''** subfolders and configuration files if they did not already exist and make sure they have the right permissions. Open a terminal and type the following command:
    2023{{{
    21 mkdir -p ~/.ssh/tmp
    22 mkdir -p ~/.ssh/conf.d
     24mkdir -p -m 700 "${HOME}/.ssh/"
     25mkdir -p -m 700 "${HOME}/.ssh/tmp/"
     26mkdir -p -m 700 "${HOME}/.ssh/conf.d/"
     27touch "${HOME}/.ssh/config"
     28touch "${HOME}/.ssh/conf.d/lobby"
     29chmod -R go-rwx "${HOME}/.ssh"
    2330}}}
    24    * Create a **''~/.ssh/config''** file if it does not exist yet.
    25    * Add to your **''~/.ssh/config''** something like the following:
     31   * Add the following line to your **''~/.ssh/config''**:
     32{{{
     33Include conf.d/*
     34}}}
     35     Important: this **''Include''** directive must precede any lines containing **''Host''** or **''Match''** directives, otherwise the **''Include''** will only apply to a specific set of hosts.
    2636{{{
    2737#
    … …  
    3444
    3545#
    36 # Generic stuff: prevent timeouts
     46# Host settings.
    3747#
    38 Host *
    39         ServerAliveInterval 60
    40         ServerAliveCountMax 5
    41 
     48Host lobby*
     49    #
     50    # Default account name when not specified explicitly.
     51    #
     52    User youraccount
     53    #
     54    # Prevent timeouts
     55    #
     56    ServerAliveInterval 60
     57    ServerAliveCountMax 5
     58    #
     59    # We use public-private key pairs for authentication.
     60    # Optionally: specify the path to your RSA private key it is not in the default location.
     61    # Do not use password based authentication as fallback,
     62    # which may be confusing and won't work anyway.
     63    #
     64    #IdentityFile "~/.ssh/id_rsa"
     65    PasswordAuthentication No
     66    #
     67    # Multiplex connections to
     68    #   * reduce lag when logging in to the same host in a second terminal
     69    #   * reduce the amount of connections that are made to prevent excessive DNS lookups
     70    #     and to prevent getting blocked by a firewall, because it thinks we are executing a DoS attack.
     71    #
     72    # Name/location of sockets for connection multiplexing are configured using the ControlPath directive.
     73    # In the ControlPath directive %C expands to a hashed value of %l_%h_%p_%r, where:
     74    #    %l = local hostname
     75    #    %h = remote hostname
     76    #    %p = remote port
     77    #    %r = remote username
     78    # This makes sure that the ControlPath is
     79    #   * a unique socket that is local to machine on which the sessions are created,
     80    #     which means it works with home dirs from a shared network file system.
     81    #     (as sockets cannot be shared by servers.)
     82    #   * not getting to long as the hash has a fixed size not matter how long %l_%h_%p_%r was.
     83    #
     84    ControlMaster auto
     85    ControlPath ~/.ssh/tmp/%C
     86    ControlPersist 1m
    4287#
    43 # Generic stuff: share existing connections to reduce lag when logging into the same host in a second shell
     88# Expand short jumphost names to FQDN or IP address.
    4489#
    45 ControlMaster auto
    46 ControlPath ~/.ssh/tmp/%h_%p_%r
    47 
     90Host lobby
     91    HostName 195.169.22.135
    4892#
    49 ##
    50 ### RUG HPC v2 hosts in *.hpc.rug.nl domain with DNS.
    51 ##
    52 #
    53 Host *peregrine pg-interactive !*.hpc.rug.nl
    54         HostName %h.hpc.rug.nl
    55         User prefix-youraccount
    56 
    57 #
    58 ##
    59 ### UMCG Research IT HPC v2 hosts in *.hpc.rug.nl domain.
    60 ##
    61 #
    62 #  A. With DNS entry.
    63 #
    64 Host foyer lobby *calculon *cher-ami !*.hpc.rug.nl
    65         HostName %h.hpc.rug.nl
    66         User prefix-youraccount
    67 
    68 #
    69 ##
    70 ### GCC HPC v2 hosts in *.gcc.rug.nl domain.
    71 ##
    72 #
    73 Host *flexo *bender *gattaca* !*.gcc.rug.nl
    74         HostName %h.gcc.rug.nl
    75         User prefix-youraccount
    76 
    77 #
    78 ##
    79 ### Proxy settings for multi-hop SSH.
    80 ##
    81 #
    82 # The syntax in all the ProxyCommand rules below assumes your private key is in the default location.
    83 # The default location is:
    84 #  ~/.ssh/id_rsa for keys generated with the RSA algorithm.
    85 #  ~/.ssh/id_dsa for keys generated with the DSA algorithm.
    86 # In case your private key file is NOT in the default location you must:
    87 #  1. Specify the path to your private key file on the command line when logging in with SSH.
    88 #     For example:
    89 #         $> ssh -i ~/.ssh/some_other_key.file prefix-youraccount@proxy_server+destination_server
    90 #  2. Add the path to your private key file in the ProxyCommand rules below.
    91 #     For example:
    92 #         Host proxy_server+*
    93 #             PasswordAuthentication No
    94 #             ProxyCommand ssh -X -q -i ~/.ssh/some_other_key.file prefix-youraccount@$(echo %h | sed 's/+[^+]*$//').some.sub.domain -W $(echo %h | sed 's/^[^+]*+//'):%p
    95 #
    96 
    97 #
    98 # Universal proxy settings for triple-hop SSH.
     93# Universal jumphost settings for triple-hop SSH.
    9994#
    10095Host *+*+*
    101         ProxyCommand ssh -X -q $(echo %h | sed 's/+[^+]*$//') -W $(echo %h | sed 's/^[^+]*+[^+]*+//'):%p
    102 
     96    ProxyCommand ssh -x -q $(echo %h | sed 's/+[^+]*$//') -W $(echo %h | sed 's/^[^+]*+[^+]*+//'):%p
    10397#
    104 # Double-hop proxy settings for HPC V2 & V3 environment servers in *.hpc.rug.nl or *.umcg.nl domain.
     98# Double-hop SSH settings to connect via specific jumphosts.
    10599#
    106 Host lobby+* foyer+*
    107         PasswordAuthentication No
    108         ProxyCommand ssh -X -q prefix-youraccount@$(echo %h | sed 's/+[^+]*$//').hpc.rug.nl -W $(echo %h | sed 's/^[^+]*+//'):%p
    109 Host passage+* gate+*
    110         PasswordAuthentication No
    111         ProxyCommand ssh -X -q prefix-youraccount@$(echo %h | sed 's/+[^+]*$//').umcg.nl -W $(echo %h | sed 's/^[^+]*+//'):%p
     100Host lobby+*
     101    ProxyCommand ssh -x -q $(echo "${JUMPHOST_USER:-%r}")@$(echo %h | sed 's/+[^+]*$//') -W $(echo %h | sed 's/^[^+]*+//'):%p
    112102#
    113 # Sometimes port 22 for the SSH protocol is blocked by firewalls; in that case you can try to use SSH on port 80 as fall-back.
    114 # Do not use port 80 by default for SSH as it officially assigned to HTTP traffic and some firewalls will cause problems when trying to route SSH over port 80.
     103# Sometimes port 22 for the SSH protocol is blocked by firewalls; in that case you can try to use SSH on port 443 as fall-back.
     104# Do not use port 443 by default for SSH as it is officially assigned to HTTPS traffic
     105# and some firewalls will cause problems with SSH traffic over port 443.
    115106#
    116 Host lobby80+* foyer80+*
    117         PasswordAuthentication No
    118         ProxyCommand ssh -X -q prefix-youraccount@$(echo %h | sed 's/+[^+]*$//').hpc.rug.nl -W $(echo %h | sed 's/^[^+]*+//'):%p -p 80
    119 
     107Host lobby443+*
     108    ProxyCommand ssh -x -q $(echo "${JUMPHOST_USER:-%r}")@$(echo %h | sed 's/443+[^+]*$//') -W $(echo %h | sed 's/^[^+]*+//'):%p -p 443
    120109}}}
    121    Replace all occurences of '''prefix-youraccount''' with:[[BR]]
    122    '''prefix''' = based on your organization. Usually either '''umcg''' or '''lifelines''' [[BR]]
    123    '''youraccount''' = your account on calculon.hpc.rug.nl = your account on umcg.hpc.rug.nl = etc.[[BR]][[BR]]
     110   Replace all occurences of '''youraccount''' with the accountname you received from the UMCG HPC helpdesk.[[BR]][[BR]]
    124111   If you are **not** on a Mac or on a very old one you may have to comment the ''# Generic stuff: only for MacOS clients'' section at the top of example **''~/.ssh/config''**[[BR]][[BR]]
    125    * Make sure you are the only one who can access your ~/.ssh folder. Type the following command in a terminal:
    126 {{{
    127 chmod -R go-rwx ~/.ssh
    128 }}}
    129  * You can now for example connect to ''calculon.hpc.rug.nl'' with the account as specified by ''User'' via for example proxy server ''lobby.hpc.rug.nl'' using the alias lobby+calculon. Type the following command in a terminal:
     112 * You can now for example connect to the User Interface of the Calculon cluster named ''calculon'' with the account as specified in the ''User'' directive of your ''~/.ssh/config'' via the ''lobby'' jumphost using the alias ''lobby+calculon''. Type the following command in a terminal:
    130113{{{
    131114ssh lobby+calculon
    132115}}}
    133    In order to override the accountname specified in your ''~/.ssh/config'' you can use:
     116   In order to override the account name specified in your ''~/.ssh/config'' you can use:
    134117{{{
    135 ssh prefix-youraccount@lobby+calculon
     118ssh youraccount@lobby+calculon
    136119}}}
    137120   You can also transfer data with scp (secure copy) to copy files to your home dir on the cluster like this:
    … …  
    148131ssh proxy+intermediate_server+destination_server
    149132}}}
    150    In case you are on a network where the default port for SSH (22) is blocked by a firewall you can try to setup SSH over port 80 using an alias like this:
     133   In case you are on a network where the default port for SSH (22) is blocked by a firewall you can try to setup SSH over port 443 using an alias like this:
    151134{{{
    152 ssh lobby80+calculon
     135ssh lobby443+calculon
    153136}}}
    154137