@@ -17,6 +17,11 @@ exercises: 10
1717
1818::::::::::::::::::::::::::::::::::::::::::::::::::
1919
20+ ``` {r, echo=FALSE}
21+ # Source the external configuration script
22+ source("load_config.R")
23+ ```
24+
2025## Secure Connections
2126
2227The first step in using a cluster is to establish a connection from our laptop
@@ -56,7 +61,7 @@ When logging in to a laptop, tablet, or other personal device, a username,
5661password, or pattern are normally required to prevent unauthorized access. In
5762these situations, the likelihood of somebody else intercepting your password is
5863low, since logging your keystrokes requires a malicious exploit or physical
59- access. For systems like {{ site. remote. host }} running an SSH server, anybody
64+ access. For systems like `` r config$ remote$ host`` running an SSH server, anybody
6065on the network can log in, or try to. Since usernames are often public or easy
6166to guess, your password is often the weakest link in the security chain. Many
6267clusters therefore forbid password-based login, requiring instead that you
@@ -80,16 +85,18 @@ In this section you will create a pair of SSH keys:
8085- a private key which you keep on your own computer, and
8186- a public key which can be placed on any remote system you will access.
8287
83- > ## Private keys are your secure digital passport
84- >
85- > A private key that is visible to anyone but you should be considered
86- > compromised, and must be destroyed. This includes having improper permissions
87- > on the directory it (or a copy) is stored in, traversing any network that is
88- > not secure (encrypted), attachment on unencrypted email, and even displaying
89- > the key on your terminal window.
90- >
91- > Protect this key as if it unlocks your front door. In many ways, it does.
92- > {: .caution}
88+ ::::::::::::::::::::::::::::::::::::::::: caution
89+
90+ ## Private keys are your secure digital passport
91+
92+ A private key that is visible to anyone but you should be considered
93+ compromised, and must be destroyed. This includes having improper permissions
94+ on the directory it (or a copy) is stored in, traversing any network that is
95+ not secure (encrypted), attachment on unencrypted email, and even displaying
96+ the key on your terminal window.
97+
98+ Protect this key as if it unlocks your front door. In many ways, it does.
99+ ::::::::::::::::::::::::::::::::::::::::::::::::::
93100
94101Regardless of the software or operating system you use, * please* choose a
95102strong password or passphrase to act as another layer of protection for your
@@ -111,8 +118,6 @@ common approaches to this:
1111183 . Nothing is * less* secure than a private key with no password. If you
112119 skipped password entry by accident, go back and generate a new key pair
113120 * with* a strong password.
114-
115-
116121::::::::::::::::::::::::::::::::::::::::::::::::::
117122
118123#### SSH Keys on Linux, Mac, MobaXterm, and Windows Subsystem for Linux
@@ -121,7 +126,7 @@ Once you have opened a terminal, check for existing SSH keys and filenames
121126since existing SSH keys are overwritten.
122127
123128``` bash
124- {{ site. local. prompt }} ls ~ /.ssh/
129+ ` r config $ local$ prompt` ls ~ /.ssh/
125130```
126131
127132If ` ~/.ssh/id_ed25519 ` already exists, you will need to specify
@@ -140,7 +145,7 @@ produce a stronger key than the `ssh-keygen` default by invoking these flags:
140145 extension added.
141146
142147``` bash
143- {{ site. local. prompt }} ssh-keygen -a 100 -f ~ /.ssh/id_ed25519 -t ed25519
148+ ` r config $ local$ prompt` ssh-keygen -a 100 -f ~ /.ssh/id_ed25519 -t ed25519
144149```
145150
146151When prompted, enter a strong password with the
@@ -165,7 +170,7 @@ If key generation failed because ed25519 is not available, try using the older
165170check for an existing key:
166171
167172``` bash
168- {{ site. local. prompt }} ls ~ /.ssh/
173+ ` r config $ local$ prompt` ls ~ /.ssh/
169174```
170175
171176If ` ~/.ssh/id_rsa ` already exists, you will need to specify choose a different
@@ -177,7 +182,7 @@ name for the new key-pair. Generate it as above, with the following extra flags:
177182 rather than PEM.
178183
179184``` bash
180- {{ site. local. prompt }} ssh-keygen -a 100 -b 4096 -f ~ /.ssh/id_rsa -o -t rsa
185+ ` r config $ local$ prompt` ssh-keygen -a 100 -b 4096 -f ~ /.ssh/id_rsa -o -t rsa
181186```
182187
183188When prompted, enter a strong password with the
@@ -233,7 +238,7 @@ type it in again.
233238Open your terminal application and check if an agent is running:
234239
235240``` bash
236- {{ site. local. prompt }} ssh-add -l
241+ ` r config $ local$ prompt` ssh-add -l
237242```
238243
239244- If you get an error like this one,
@@ -245,7 +250,7 @@ Open your terminal application and check if an agent is running:
245250 ... then you need to launch the agent as follows:
246251
247252 ``` bash
248- {{ site. local. prompt }} eval $( ssh-agent)
253+ ` r config $ local$ prompt` eval $( ssh-agent)
249254 ```
250255
251256 ::::::::::::::::::::::::::::::::::::::::: callout
@@ -258,7 +263,7 @@ Open your terminal application and check if an agent is running:
258263 shell commands that can be used to reach it -- but * does not execute them!*
259264
260265 ``` bash
261- {{ site. local. prompt }} ssh-agent
266+ ` r config $ local$ prompt` ssh-agent
262267 ```
263268
264269 ``` output
@@ -283,7 +288,7 @@ Open your terminal application and check if an agent is running:
283288Add your key to the agent, with session expiration after 8 hours:
284289
285290``` bash
286- {{ site. local. prompt }} ssh-add -t 8h ~ /.ssh/id_ed25519
291+ ` r config $ local$ prompt` ssh-add -t 8h ~ /.ssh/id_ed25519
287292```
288293
289294``` output
@@ -302,27 +307,40 @@ See the [PuTTY documentation][putty-agent].
302307
303308### Transfer Your Public Key
304309
305- {% if site.remote.portal %}
306- Visit [ {{ site.remote.portal }}] ({{ site.remote.portal }}) to upload your SSH
307- public key. (Remember, it's the one ending in ` .pub ` !)
308-
309- {% else %}
310- Use the ** s** ecure ** c** o** p** y tool to send your public key to the cluster.
311-
312- ``` bash
313- {{ site.local.prompt }} scp ~ /.ssh/id_ed25519.pub {{ site.remote.user }}@{{ site.remote.login }}:~ /
310+ ``` {r, eval=is.null(config$remote$portal), echo=FALSE, results="asis"}
311+ cat(
312+ paste(
313+ "```bash\n",
314+ config$local$prompt,
315+ " scp ~/.ssh/id_ed25519.pub ",
316+ config$remote$user,
317+ "@",
318+ config$remote$login,
319+ ":~/\n```",
320+ sep="")
321+ )
314322```
315323
316- {% endif %}
324+ ``` {r, eval=!is.null(config$remote$portal), echo=FALSE, results="asis"}
325+ cat(
326+ paste(
327+ "Visit [",
328+ config$remote$portal,
329+ "](",
330+ config$remote$portal,
331+ ") to upload your SSH public key. (Remember, it's the one ending in `.pub`!)",
332+ sep="")
333+ )
334+ ```
317335
318336## Log In to the Cluster
319337
320338Go ahead and open your terminal or graphical SSH client, then log in to the
321- cluster. Replace ` {{ site. remote. user }} ` with your username or the one
339+ cluster. Replace `` r config$ remote$ user` ` with your username or the one
322340supplied by the instructors.
323341
324342``` bash
325- {{ site. local. prompt }} ssh {{ site. remote. user }}@{{ site. remote. login }}
343+ ` r config $ local$ prompt` ssh ` r config $ remote$ user` @ ` r config $ remote$ login`
326344```
327345
328346You may be asked for your password. Watch out: the characters you type after
@@ -340,9 +358,9 @@ connected to the local system and the remote system will typically be different
340358for every user. We still need to indicate which system we are entering commands
341359on though so we will adopt the following convention:
342360
343- - ` {{ site. local. prompt }} ` when the command is to be entered on a terminal
361+ - `` r config$ local$ prompt` ` when the command is to be entered on a terminal
344362 connected to your local computer
345- - ` {{ site. remote. prompt }} ` when the command is to be entered on a
363+ - `` r config$ remote$ prompt` ` when the command is to be entered on a
346364 terminal connected to the remote system
347365- ` $ ` when it really doesn't matter which system the terminal is connected to.
348366
@@ -356,28 +374,28 @@ computer we are logged onto can be checked with the `hostname` command. (You
356374may also notice that the current hostname is also part of our prompt!)
357375
358376``` bash
359- {{ site. remote. prompt }} hostname
377+ ` r config $ remote$ prompt` hostname
360378```
361379
362380``` output
363- {{ site. remote. host }}
381+ `r config$ remote$ host`
364382```
365383
366384So, we're definitely on the remote machine. Next, let's find out where we are
367385by running ` pwd ` to ** p** rint the ** w** orking ** d** irectory.
368386
369387``` bash
370- {{ site. remote. prompt }} pwd
388+ ` r config $ remote$ prompt` pwd
371389```
372390
373391``` output
374- {{ site. remote. homedir }}/{{ site. remote. user }}
392+ `r config$ remote$ homedir`/`r config$ remote$ user`
375393```
376394
377395Great, we know where we are! Let's see what's in our current directory:
378396
379397``` bash
380- {{ site. remote. prompt }} ls
398+ ` r config $ remote$ prompt` ls
381399```
382400
383401``` output
@@ -390,7 +408,7 @@ other filesystems. If they did not, your home directory may appear empty. To
390408double-check, include hidden files in your directory listing:
391409
392410``` bash
393- {{ site. remote. prompt }} ls -a
411+ ` r config $ remote$ prompt` ls -a
394412```
395413
396414``` output
@@ -399,13 +417,11 @@ double-check, include hidden files in your directory listing:
399417```
400418
401419In the first column, ` . ` is a reference to the current directory and ` .. ` a
402- reference to its parent (` {{ site. remote. homedir }} ` ). You may or may not see
420+ reference to its parent (`` r config$ remote$ homedir` ` ). You may or may not see
403421the other files, or files like them: ` .bashrc ` is a shell configuration file,
404422which you can edit with your preferences; and ` .ssh ` is a directory storing SSH
405423keys and a record of authorized connections.
406424
407- {% unless site.remote.portal %}
408-
409425### Install Your SSH Key
410426
411427::::::::::::::::::::::::::::::::::::::::: callout
@@ -416,8 +432,6 @@ Policies and practices for handling SSH keys vary between HPC clusters:
416432follow any guidance provided by the cluster administrators or
417433documentation. In particular, if there is an online portal for managing SSH
418434keys, use that instead of the directions outlined here.
419-
420-
421435::::::::::::::::::::::::::::::::::::::::::::::::::
422436
423437If you transferred your SSH public key with ` scp ` , you should see
@@ -428,32 +442,28 @@ If the `.ssh` folder was not listed above, then it does not yet
428442exist: create it.
429443
430444``` bash
431- {{ site. remote. prompt }} mkdir ~ /.ssh
445+ ` r config $ remote$ prompt` mkdir ~ /.ssh
432446```
433447
434448Now, use ` cat ` to print your public key, but redirect the output, appending it
435449to the ` authorized_keys ` file:
436450
437451``` bash
438- {{ site. remote. prompt }} cat ~ /id_ed25519.pub >> ~ /.ssh/authorized_keys
452+ ` r config $ remote$ prompt` cat ~ /id_ed25519.pub >> ~ /.ssh/authorized_keys
439453```
440454
441455That's all! Disconnect, then try to log back into the remote: if your key and
442456agent have been configured correctly, you should not be prompted for the
443457password for your SSH key.
444458
445459``` bash
446- {{ site. remote. prompt }} logout
460+ ` r config $ remote$ prompt` logout
447461```
448462
449463``` bash
450- {{ site. local. prompt }} ssh {{ site. remote. user }}@{{ site. remote. login }}
464+ ` r config $ local$ prompt` ssh ` r config $ remote$ user` @ ` r config $ remote$ login`
451465```
452466
453- {% endunless %}
454-
455-
456-
457467[ gh-ssh ] : https://docs.github.com/en/authentication/connecting-to-github-with-ssh
458468[ keepass ] : https://keepass.info
459469[ bitwarden ] : https://bitwarden.com
@@ -463,14 +473,12 @@ password for your SSH key.
463473[ ssh-agent ] : https://www.ssh.com/academy/ssh/agent
464474[ putty-agent ] : https://tartarus.org/~simon/putty-prerel-snapshots/htmldoc/Chapter9.html#pageant
465475
466-
467476:::::::::::::::::::::::::::::::::::::::: keypoints
468477
469478- An HPC system is a set of networked machines.
470479- HPC systems typically provide login nodes and a set of worker nodes.
471- - The resources found on independent (worker) nodes can vary in volume and type (amount of RAM, processor architecture, availability of network mounted filesystems, etc.).
480+ - The resources found on independent (worker) nodes can vary in volume and type
481+ (amount of RAM, processor architecture, availability of network mounted
482+ filesystems, etc.).
472483- Files saved on one node are available on all nodes.
473-
474484::::::::::::::::::::::::::::::::::::::::::::::::::
475-
476-
0 commit comments