Wiki DIFA

Strumenti Utente

Strumenti Sito

Ti trovi qui: start » oph » cluster » access
oph:cluster:access

Differenze

Queste sono le differenze tra la revisione selezionata e la versione attuale della pagina.

Link a questa pagina di confronto

Entrambe le parti precedenti la revisioneRevisione precedente
Prossima revisione		Revisione precedente
oph:cluster:access [2025/01/30 08:22] – [Step 1: Connecting to the cluster] Update IP e hash chiavi diego.zuccato@unibo.itoph:cluster:access [2026/03/16 11:11] (versione attuale) – [Step 0: Getting an account] diego.zuccato@unibo.it
Linea 22: Linea 22:
 __**Valid UniBo credentials are in any case necessary to obtain an account and to be able to access the cluster (for external users temporary credentials must be obtained first).**__ __**Valid UniBo credentials are in any case necessary to obtain an account and to be able to access the cluster (for external users temporary credentials must be obtained first).**__
  
-New users will be able to access the cluster after 7.00am of the day after the one they have been added to the access group. The home folder of every new user is **automatically created at the time of the first access** to the cluster.+New users will be able to access the cluster soon (~5 minutes) after being added to the access group. The home folder of every new user is **automatically created at the time of the first access** to the cluster.
  
 Individual **accounts remain valid until termination of the conditions granting access rights** to the cluster (as e.g. until termination of DIFA affiliation, end of the Master/PhD thesis, end of the research collaboration for external users) and the computing responsibles of each sector have the duty to remove users from the respective access groups upon expiration of such access rights. Individual **accounts remain valid until termination of the conditions granting access rights** to the cluster (as e.g. until termination of DIFA affiliation, end of the Master/PhD thesis, end of the research collaboration for external users) and the computing responsibles of each sector have the duty to remove users from the respective access groups upon expiration of such access rights.
Linea 33: Linea 33:
  
 There are **multiple independent Frontend Login Nodes:** There are **multiple independent Frontend Login Nodes:**
-  * ''137.204.165.41'' (ophfe1) +  * ophfe1 (137.204.165.41) 
-  * ''137.204.165.42'' (ophfe2) +  * ophfe2 (137.204.165.42) 
-  * ''137.204.165.43'' (ophfe3)+  * ophfe3 (137.204.165.43) **reserved -- VM for some special tasks**
  
-The **connection procedure** requires the use of the [[https://fisica-astronomia.unibo.it/it/dipartimento/servizi-tecnici-e-amministrativi/servizi-tecnici-informatici/servizi-informatici/servizio_bastion|Bastion's SSH host service]], that allows 'mediated' ssh access to resources on the department's network, avoiding direct external exposure of services and drastically improving network security. To connect from the terminal use the following syntax:+The **connection procedure** requires the use of the bastion, that allows 'mediated' ssh access to resources on the department's network, avoiding direct external exposure of services and drastically improving network security. To connect from the terminal use the following syntax:
  
   *** STAFF MEMBERS** with e.g. UniBo email address ''donald.duck7@unibo.it'' can connect to the cluster with the command:<code>   *** STAFF MEMBERS** with e.g. UniBo email address ''donald.duck7@unibo.it'' can connect to the cluster with the command:<code>
-  ssh -J donald.duck7@137.204.165.34 donald.duck7@137.204.165.41+  ssh -J donald.duck7@bastion-nav.difa.unibo.it donald.duck7@ophfe1
 </code> </code>
  
   *** STUDENTS** with e.g. UniBo email address ''mickey.mouse4@studio.unibo.it'' can connect to the cluster with the **same command**:<code>   *** STUDENTS** with e.g. UniBo email address ''mickey.mouse4@studio.unibo.it'' can connect to the cluster with the **same command**:<code>
-  ssh -J mickey.mouse4@137.204.165.34 mickey.mouse4@137.204.165.41+  ssh -J mickey.mouse4@bastion-nav.difa.unibo.it mickey.mouse4@ophfe1
 </code> </code>
 followed by their UniBo institutional password (twice). followed by their UniBo institutional password (twice).
  
-This will do a two-step connection, first to 137.204.165.34 which is the **bastion host**, then to the cluster frontend. To avoid specifying it every time, you can simply add the following lines to ''~/.ssh/config'':+This will do a two-step connection, first to bastion-nav.difa.unibo.it (137.204.165.34) which is the **bastion host**, then to the specified cluster frontend. To avoid specifying it every time, you can simply add the following lines to ''~/.ssh/config'':
   Host bastion-nav   Host bastion-nav
-    Hostname 137.204.165.34+    Hostname bastion-nav.difa.unibo.it
     User     your.loginname     User     your.loginname
      
-  Host 137.204.165.41 137.204.165.42 137.204.165.43 +  Host ophfe1 ophfe2
     User      your.loginname     User      your.loginname
     ProxyJump bastion-nav     ProxyJump bastion-nav
  
-After having added such lines, you can simply use ''ssh 137.204.165.41'' as usual.+After having added such lines, you can simply use ''ssh ophfe1''.
  
 <WRAP round important 100%>For some users in PERSONALE their account does not match the mail address (so called "cambio UPN"). It's always possible to use: <WRAP round important 100%>For some users in PERSONALE their account does not match the mail address (so called "cambio UPN"). It's always possible to use:
-  ssh -l mail.address@unibo.it 137.204.165.41+  ssh -l mail.address@unibo.it ophfe1
 or even: or even:
-  ssh mail.address@unibo.it@137.204.165.41+  ssh mail.address@unibo.it@ophfe1
 </WRAP> </WRAP>
 'User' line in ''~/.ssh/config'' also accepts the mail address. 'User' line in ''~/.ssh/config'' also accepts the mail address.
  
 Graphic windows require a connection with X11 forwarding, which can be established with the ''ssh'' options ''-X'' and/or ''-Y'' (rarely needed, **might expose your client to attacks**:!:). In general, connecting with: Graphic windows require a connection with X11 forwarding, which can be established with the ''ssh'' options ''-X'' and/or ''-Y'' (rarely needed, **might expose your client to attacks**:!:). In general, connecting with:
-<WRAP center 40%>''ssh -X albert.einstein9@137.204.165.41''</WRAP>+<WRAP center 40%>''ssh -X albert.einstein9@ophfe1''</WRAP>
 is enough to use graphical tools. is enough to use graphical tools.
  
Linea 79: Linea 79:
   It is also possible that a host key has just been changed.   It is also possible that a host key has just been changed.
   The fingerprint for the ECDSA key sent by the remote host is   The fingerprint for the ECDSA key sent by the remote host is
-  SHA256:aoqtNWk0OvSDuWAMV1y7l3E9ofdI6TKBEJxpGpPoYH4. +  SHA256:uR0mI0jPbLhSd/1HISczCCpoK9OZLOs+uqQx9b1CDjU. 
-it's probably because you connected to the old Str957-cluster (replaced by ophfe1) and server's ssh key have been changed.+it's probably because you connected to the old Str957-cluster (replaced by ophfe1) and server's ssh key have been changed (or you connected to the old bastion and are now connecting to bastion-nav).
  
-**CHECK** that the displayed key is one of these:+**CHECK** that the displayed key **for bastion-nav** is one of these:
   * **ECDSA**: D5hNeP9NbU/OFjPyxlp7nsryHq9Sl9WKC3ef7rUaQg4   * **ECDSA**: D5hNeP9NbU/OFjPyxlp7nsryHq9Sl9WKC3ef7rUaQg4
   * **ED25519**: uR0mI0jPbLhSd/1HISczCCpoK9OZLOs+uqQx9b1CDjU   * **ED25519**: uR0mI0jPbLhSd/1HISczCCpoK9OZLOs+uqQx9b1CDjU
   * **RSA**: NUJz6tcBoz+xxOroOUeQnqQrvH99RpmS5e9io/KwYm4   * **RSA**: NUJz6tcBoz+xxOroOUeQnqQrvH99RpmS5e9io/KwYm4
 then then
-  ssh-keygen -R 137.204.165.41+  ssh-keygen -R bastion-nav.difa.unibo.it
 to remove old fingerprint from your PC. to remove old fingerprint from your PC.
 +
 +Keys for ophfe1 and ophfe2 have not been changed and their hashes are:
 +  * ophfe1:
 +    * **ECDSA**: aoqtNWk0OvSDuWAMV1y7l3E9ofdI6TKBEJxpGpPoYH4
 +    * **ED25519**: J7k3kS0BWspWcPNdq0Dkyuhoj3z1gnrZOCT0r+BWx2Q
 +    * **RSA**: bgydnQeWV3puQNHJ9hjEKo2ziLriWC/ypVWNTp1C6/k
 +  * ophfe2:
 +    * **ECDSA**: aoqtNWk0OvSDuWAMV1y7l3E9ofdI6TKBEJxpGpPoYH4
 +    * **ED25519**: J7k3kS0BWspWcPNdq0Dkyuhoj3z1gnrZOCT0r+BWx2Q
 +    * **RSA**: bgydnQeWV3puQNHJ9hjEKo2ziLriWC/ypVWNTp1C6/k
  
 Now you can retry the ssh connection: it will tell you that it can't verify server's identity and show key hash. **Verify (again)** that the key hash is from the list above, and accept it (iif it matches). Now you can retry the ssh connection: it will tell you that it can't verify server's identity and show key hash. **Verify (again)** that the key hash is from the list above, and accept it (iif it matches).
 </WRAP> </WRAP>
- 
  
oph/cluster/access.1738225375.txt.gz · Ultima modifica: da diego.zuccato@unibo.it
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki