Login
8 minute read
Requirements
A user account is required to access HPCC’s research computing infrastructure. How to obtain a user account is described here. A new user’s login credentials (username and password) are emailed to the address provided in the corresponding account request. For external users it is important to know that the below Password+DUO multifactor authenication system is only available to UCR users. Thus, external users have to use the alternative SSH Key based authentication method, which is both secure and convenient to use.
The login instructions of this page are organized in three main sections:
A. SSH Login from Terminal
Terminal-based login is the most feature-rich method for accessing HPC
resources. Web-based alternatives via JupyterHub and
RStudio Server are also provided. To access the HPCC
cluster with the standard ssh protocol, users want to follow steps 1-3. Only
step 1 is required after setting up ssh key based access.
1. Type the following ssh login command from a terminal application, where <username> needs to be replaced by the actual account name of a user. The <> characters indicate a placeholder and need to be removed. Next, press enter to execute the ssh command.
ssh -X <username>@cluster.hpcc.ucr.edu
The -X argument enables X11 support, which is required for opening GUI applications on remote systems.
2. Type your password and hit enter. Note, when typing the password the cursor will not move and nothing is printed to the screen. If ssh key access is enabled, both the password and Duo steps will be skipped automatically during the log in process.
3. Follow the Duo multifactor authenication instructions printed to the screen. As external users do not have access to UCR’s Duo system, they can only log in via the alternative ssh key method. How to enable ssh keys is described here. Note, Duo will be bypassed if ssh key based login is enabled. This can be more conveniet than Duo when accessing the cluster frequently.
If the login is performed via a GUI application, which is an option in MobaXterm,
then one can provide the same login information given under the above ssh
commad in the corresponding fields of the login window as follows:
- Host name:
cluster.hpcc.ucr.edu - User name: …
- Password: …
Importantly, after the first login into a new account (or a password reset),
users need to change their password with the passwd command and then follow
the on-screen instructions. This requires to enter the current password once
and the new password twice. New passwords need to be at least 8 characters
long and meet at least 3 of the following requirments: lowercase character,
uppercase character, number, and punctuation character.
What to do if password/Duo is not working? If this happens then most often the login is blocked because a password was typed too many times incorrectly, or not changed after the first login (see above). To correct this, please request a password reset by emailing support@hpcc.ucr.edu. Remember, password/Duo based access is only possible if a user’s UCR NetID matches the corresponding HPCC username. If this is not the case then UCR users can request to change their HPCC user account name to their NetID or use the ssh key based access method.
Terminal Options
Various ssh terminal applications are available for all major operating systems. Examples include:
- macOS: built-in macOS Terminal or iTerm2
- Windows: MobaXterm is a very feature rich terminal option for Windows users. Putty is an alternative, but outdated and not recommended anymore. Here are annimated usage introductions for MobaXterm.
- Linux: a wide range of Terminal applications is available for Linux. Usually, the default terminal available on a Linux distribution will be sufficient.
- ChromeOS: after enabling Linux apps on Chromebooks one can use the default terminal that is similar to those on Linux systems.
Remote Graphics Support
X11 support is included in the terminal applications of most OSs. This includes MobaXterm on Windows, Linux and ChromeOS terminals. On macOS systems, users need to run XQuartz in the background to enable X11 graphics display support. XQuartz can be downloaded from here (also see this video here). Note, XQuartz is optional if remote graphics support is not needed.
Additional Authentication Details
In early 2022 the HPCC adopted a more secure authentication method for logging
into its clusters. Passwords alone will no longer be allowed for SSH or file
tansfer protocols. Instead Password+DUO or SSH
Keys will be required. Because Password+DUO authentication
requires a UCR NetID, this access method is only available to UCR users for
both ssh and file transfer protocols (e.g. sFTP or SCP). Thus, external
users need to use the alternative ssh key method. To enable ssh key access,
external users need to email their public key to
support@hpcc.ucr.edu (see below for details).
Password+Duo
Users familiar with UCR’s Duo system can log in to HPCC’s clusters by following the
on screen instructions during the ssh login. For new users, instructions
for UCR’s Duo Multifactor Authenication system are available
in this PDF
and on UCR’s MyAccount
page. Importantly, the login via the Password+DUO method will only work if a
user’s NetID matches the username of the corresponding HPCC account. If
this is not the case then the HPCC username can be changed to a user’s NetID.
This change can be initiated by emailing suppor@hpcc.ucr.edu.
As mentioned above, external users will not have access to UCR’s Duo system, and thus have to use
the alternative ssh key access method to log in to HPCC’s resources.
SSH Keys
SSH keys are an access credential used by the Secure Shell (SSH) protocol. For this a key pair is
created comprised of a private key and a public key. The private key remains on a user’s system and should
not be shared. The public key will be uploaded to the remote system, here ~/.ssh directory of a user’s account
on the HPCC cluster. SSH key based access works analogous to how a key and a lock are used in the real world, where
one uniquely fits into the other. Access can only be established if the private key on a user’s system fits the
public key on the remote system.
The following introduces how to create an ssh key pair from the command-line in a terminal and upload the public key to the remote system. The latter upload will only work if a user can access the remote system, e.g. via temporary Password+DUO access. User without this option have to email their public ssh key to suppor@hpcc.ucr.edu so that the systems administrator can upload the public key for them. Additional details on ssh key generation and uploads are provided here. This includes GUI based based options. However, we highly recommend to use the command-line option on all OSs which are much more straigthforward to use, including MobaXterm on Windows.
(a) SSH Key Creation
An ssh key pair can be created with the following commands in a terminal application of all major operating systems, including Windows, macOS, Linux and ChromeOS. Note, the following commands need to be executed on a user’s local computer (not the cluster).
1. Create SSH directory
mkdir -p ~/.ssh
2. Create key pair (private and public)
ssh-keygen -t rsa -f ~/.ssh/id_rsa
Follow the prompts and complete the processes. Once the command has completed, one will find two files in the ~/.ssh directory of
a user account.
3. Inspect ~/.ssh directory
ls ~/.ssh/
id_rsa
id_rsa.pub
(b) SSH Key Upload
The id_rsa and id_rsa.pub files are the private and public keys,
respectively. The private key should never be shared with anyone. This means it
should not be emailed or uploaded to a remote system. Only the public key will
be uploaded to the remote system, here HPCC user account. Specifically, the public key will
be stored in a file called authorized_keys under a directory called ~/.ssh.
If not present yet both need to be created. Note, ~/ refers to the higest (root)
level of a user account.
1. Upload of first public ssh key
If the authorized_keys doesn’t exist yet, the following scp command can be run from a user’s system.
This command will create the ~/.ssh/authorized_keys file and populate it with the public key.
scp .ssh/id_rsa.pub username@cluster.hpcc.ucr.edu:.ssh/authorized_keys
2. Upload of subsequent public ssh keys
If the authorized_keys file already exists, one can append the new public key as follows.
scp .ssh/id_rsa.pub username@cluster.hpcc.ucr.edu:tmpkey && ssh username@cluster.hpcc.ucr.edu "cat tmpkey >> ~/.ssh/authorized_keys && rm tmpkey"
3. Check ssh key based access
To test whether ssh key based access is functional, the following log in should work without asking for a password. However, it may ask for a passphrase if the ssh key pair was created this way.
ssh <username>@cluster.hpcc.ucr.edu
(c) Additional Details on SSH Keys
See here.
B. Web-based Access
Web-based HPCC cluster access is provided via OnDemand, allowing users to launch JupyterHub, RStudio, VSCode, Desktop Sessions, and more all from their web browser. All jobs will run on compute nodes, meaning that resources are dedicated to your instance and provide the best performance possible for these applications.
Alternatively we host instances of RStudio Server and JupyterHub, though resources are
shared for all users accessing them, so performance is likely to be worse than what you would get through OnDemand. For load balancing RStudio Server
has two instances: RStudio Server 1 and RStudio Server 2. If one of these services
is slow or not available, users want to choose the alternative instance. A much more efficient method for using RStudio Server are
custom compute node instances using srun. This option is described here.
Related options for Jupyter are outlined here.
Users with an HPCC cluster account can access them with the same login credential used for ssh access.
C. Data Sharing Access
Users accessing HPCC’s infrastructure mainly for file transfers and data sharing want to follow the corresponding instructions on the Data Sharing page. Users with accounts restricted to data sharing have to provide their public SSH Key when accesing the system for the first time by following the instructions in the SSH Key section above.