How
to get access to the
cluster:
Any modern Linux distribution
with OpenSSH configured with gssapi and
Kerberos configured for the FNAL.GOV
realm should be able to connect to the
UAF cluster through the load
balancer.
First check if you already
have an account on the cluster. To check
click
here. It is assumed that you already
have a Fermilab ID, FNALU account and
kerberos principal. If not visit the
"Get
an Account" section.
Access to the UAF cluster is controlled
by a load balancing switch which
redirects incoming connections to the
least busy node.
Connecting to the UAF
from a Linux PC
To connect to the UAF cluster you need to
have kerberos and openssh with gss
support installed on your system. This is
already included in Scientific Linux
4. In addtion you will need get the
krb5.conf
file for Fermilab and save it as
/etc/krb5.conf .
Edit ~/.ssh/config and add
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
To connect to the UAF cluster
:
Get an addressless and
forwardable kerberos ticket for the
FNAL.GOV kerberos
realm:
/usr/krb5/bin/kinit -n -f
user@FNAL.GOV
or
/usr/kerberos/bin/kinit -A -f
user@FNAL.GOV
You will be prompted for your
kerberos password in the FNAL.GOV
realm.
To verify that you have an
addressless and forwardable kerberos
ticket:
klist -a -f
Connect to the cluster:
ssh
cmslpc.fnal.gov
KNOWN ISSUES and WORK
AROUNDS
1) To log into the cluster from an SLC
machine kinit -A -f user@FNAL.GOV
ssh -2 user@cmslpc.fnal.gov
2) MAC users who have updated their ssh
to a version greater than 3.8 will need
to use both
the -X and -Y options on
the ssh command line:
ssh -X -Y cmslpc
This will enable X11
forwarding.
The versions of ssh that do not work with
the load balancer are the ones that do
not support gss api or do not handle the
redirection correctly and break afs
authentication. The ones known not to
work correctly are:
- OpenSSH with gssapi support
in SL3 breaks afs
authentication
- WRQ Reflection X ssh client (based
on OpenSSH 3.6.2 with gssapi) breaks
afs authentication
- Any Fermi OpenSSH before 3.5p1f12
breaks afs authentication.
For these versions the UAF direct
access nodes must be used if you would
like to access your afs area to edit
your public_html directory.
UAF direct access
nodes. Other versions of ssh for Linux
or Windows PC's may not work correctly
(i.e. AFS authentication error messages
at login) with the load balancer. If
accessing the UAF through the load
balancer produces error messages, you can
try accessing the UAF cluster through one
of the following direct access
nodes:
- ssh
cmslpc11.fnal.gov
- ssh cmslpc12.fnal.gov
The direct acces UAF nodes are
equivalent to other UAF nodes except that
they can be accessed directly.
Non-kerberized ssh
clients Any ssh client without kerberos
authentication can be used to connect to
the UAF cluster. A Cryptocard is used to
generate a password in this
case.
Connecting to the UAF from a
Windows
PC.
Connecting to the UAF cluster
through the load balancer from a Windows
PC is known to work with Kerberized
PuTTY. Other terminal programs such as
WRQ Relection ssh and openssh for Cygwin
only work with the direct access nodes
(see above). Directions are given below
for establishing a connection to the
CMSLPC with Kerberized PuTTY. Directions
for installing Cygwin/X or Xming, both
free X server for Windows, are also
given. These packages are optional
since commercial alternatives such as WRQ
Reflection and Exceed exist. Also
included are directions for using WinSCP
and OpenAFS for Windows to access files
in your
account.
Kerberos and
PuTTY: A patched
version of PuTTY which supports
Kerberos/gssapi authentication can be
found at
http://sweb.cz/v_t_m/putty/PuTTY-0.58-GSSAPI-2005-07-24.zip.
Download the zip file to your desktop and
unzip it. You will also need to download
and install MIT Kerberos for Windows. The
Kerberos for Windows installer can be
found at
The MIT Kerberos download
page.
- To get
your Kerberos ticket :
- Select Start ->All
Programs->Kerberos for
Windows->Network Identity
Manager
- Enter your Kerberos principal,
password and FNAL.GOV for the realm and
click Login.
- To
connect to the UAF for the first time
with PuTTY :
- Double click on the PuTTY icon in
the directory where you downloaded the
putty.exe file.
- In the PuTTY configuration
window:
- select
Session and enter cmslpc.fnal.gov in
the HostName field
- select
Connection and enter your username in
the Auto-login username field
- select
Connection->SSH->Tunnels and
check “Enable X11
forwarding”
- select
Connection->SSH and
check "2 only" for "Preferred SSH protocol version"
- select
Session and enter UAF in the Saved
Sessions field and click Save
- double
click on UAF in the Saved Sessions
list
-
- To
connect to the UAF with PuTTY :
- Double click the PuTTY icon.
- In the PuTTY configuration
window:
- select
Session and double click on UAF in the
Saved Sessions list
-
-
Kerberos and
SFTP:
A version of WinSCP
which supports kerberos authentication
for SFTP transfers can be downloaded from
Sourceforge.net.
Use this program to transfer files to and
from the LPC cluster. Because the afs
authentication does not work correctly,
you can only read from your home
directory on afs with WinSCP. However,
you can read and write from /uscms/home
and /uscms_data/d1 with
WinSCP.
-
To connect to the UAF for the
first time with WinSCP
:
- Click Start ->All
Programs->WinSCP->WinSCP or the
WinSCP icon on the
desktop.
-
Check the Advanced option
checkbox
-
Select Preferences ->
Integration -> and specify the path
to PuTTY in External
applications
-
Select SSH ->
Authentication and check the boxes for
Kerberos 5
authentication
-
Click
Save
-
Enter cmslpc.fnal.gov in Host
Name
-
Enter your username in User
Name
-
Click
Save
-
Click
Login
-
To connect to the LPC cluster
with WinSCP
:
-
Click Start ->All
Programs->WinSCP->WinSCP or the
WinSCP icon on the
desktop.
-
Select the previously saved
session
-
Click on
Login
X
servers:
Cygwin/X and
Xming
are implementations of X11 on the Windows
platform. With X11 forwarding enabled in
PuTTY and an X server running, programs
like Root and emacs can be displayed on
the Windows
desktop.
To install Cygwin/X follow the
download and installation directions from
the
user's
guide.
-
- After
installing Cygwin/X copy
c:\cygwin\X11R6\bin\startxwin.bat to
the desktop. Edit startxwin.bat and
remove the line
- run xterm -e /usr/bin/bash -l
To start the Xserver double
click on
startxwin.bat.
OpenAFS:
Files from your afs home area
can be accessed through AFS. The OpenAFS
client for Windows allows users to access
their files in
AFS.
- The OpenAFS
client for Windows can be downloaded
from here.
- During the installation enter
fnal.gov as the AFS cell. After
installation is complete you will be
required to reboot to activate the
OpenAFS
client.
After rebooting the OpenAFS
client will prompt you to enter your AFS
username and password to obtain an AFS
ticket. This prompt can be canceled since
the AFS ticket can be obtained using
aklog.
-
To get your AFS
ticket:
- Obtain your Kerberos ticket as
described above.
- Select Start ->All
Programs->HPCMP
Kerberos->aklog
- To access
AFS files:
- Select Start ->All
Programs->OpenAFS->Authetication
or the padlock icon in the system
tray.
- In the AFS client window select
Drive Letters and click on Add.
Enter the path in AFS that you want to
access.
- Select Start->My Computer and
double click on the newly created drive
letter.
|
