Differences

This shows you the differences between two versions of the page.

--- doku:vpn_ssh_access [2017/03/31 09:04] – [Using SSH keys and SSH agent to connect to VSC] ir
+++ doku:vpn_ssh_access [2024/02/16 11:39] (current) – Jump host in ssh configuration file mpfister
@@ Line 8: / Line 8: @@
 Common ways of connecting are either the use of a VPN or a SSH gateway provided by the university.
-See also [[doku:vsc3quickstart|Login]], and  [[doku:win2vsc|Connecting from windows]].
+See also [[pandoc:introduction-to-vsc:02_connecting_to_vsc:connecting_to_vsc|Login and data transfer]], and  [[doku:win2vsc|Connecting from windows]].
 === VPN services ===
-  * University of Vienna: [[http://zid.univie.ac.at/en/services/services-from-a-z/v/vpn-virtual-private-network|English]] [[http://zid.univie.ac.at/vpn/|German]]
+  * University of Vienna: [[http://zid.univie.ac.at/en/vpn|English]] [[http://zid.univie.ac.at/vpn/|German]]
-  * TU Vienna: [[http://www.zid.tuwien.ac.at/en/tunet_the_network_of_the_tu_vienna/vpn/remote_access/|English]] [[http://www.zid.tuwien.ac.at/tunet/vpn/|German]]
+  * TU Vienna: [[https://www.it.tuwien.ac.at/en/services/network-and-servers/tuvpn|English]] [[https://www.it.tuwien.ac.at/services/netzwerk-und-server/tuvpn|German]]
   * University of Innsbruck: [[http://www.uibk.ac.at/zid/netz-komm/vpn/|German]]
-  * University of Graz: [[http://it.uni-graz.at/de/fernzugriff/login-datenzugriff/vpn/|German]]
+  * University of Graz: [[https://it.uni-graz.at/de/services/zugang-zum-uninetz/vpn/|German]]
-  * TU Graz: [[https://sso.tugraz.at/idp/Authn/GenericAuthn| Web Single Sign-On]]
+  * TU Graz: [[http://portal.tugraz.at/portal/page/portal/zid/netzwerk/zugang/vpn| Web Single Sign-On]]
 === SSH Gateway ===
-Users can connect first to any linux machine within a university and then connect further to VSC. Some universities provide a dedicated SSH gateway (contact your local IT services if you don't know how to connect):
+Users can connect first to any linux machine within a university and then connect further to VSC. Some universities provide a dedicated SSH gateway (contact your local IT services if you don't know how to connect).
-  * TU Graz: [[https://sso.tugraz.at/idp/Authn/GenericAuthn|SSH gateway]]
 ====== Using SSH keys and SSH agent to connect to VSC ======
@@ Line 40: / Line 39: @@
 -rw-r--r-- 1 user user  394 Dec  6 09:15 /home/user/.ssh/id_rsa.pub
 </code>
+See also [[doku:sshkeygen|sshkeygen]].
 ==== remote machine ====
   * Preparing the remote machine for logging in with your key: On the remote machine the contents of your 'id_rsa.pub' file have to be added to the 'authorized_keys' file in the '.ssh' directory. Login to the remote machine and use a text editor of your choice to do this. Afterwards check if the permissions of the 'authorized_keys' file are correct:<code>
@@ Line 47: / Line 46: @@
 </code>Alternatively you can copy the key via the ''ssh-copy-id'' command:<code>user@remote_host:~$ ssh-copy-id <username>@vsc3.vsc.ac.at</code>
-  * Logging in with ssh-keys: For using the ssh-keys, they must be added to the so-called ssh-agent. Most window managers have a ssh-agent running by default and if a connection with an applicable key is opened you are asked to enter the passphrase. The ssh-agent will then store the passphrase and reuse it for further connection attempts with this private/public key pair.
+  * Logging in with ssh-keys: For using the ssh-keys,
+    * they may be added to the so-called ssh-agent. Most window managers have a ssh-agent running by default and if a connection with an applicable key is opened you are asked to enter the passphrase. The ssh-agent will then store the passphrase and reuse it for further connection attempts with this private/public key pair.
+    * Alternatively, the ssh-key may be given as parameter (-i) or
+    * written to ''~/.ssh/config'' (see below).
-  * Connecting to **VSC-2** or **VSC-3** via ssh-key: ''ssh -p 27 <username>@vsc2.vsc.ac.at'' or ''ssh -p 27 <username>@vsc3.vsc.ac.at'', respectively.
+==== Connecting to VSC-4 or VSC-5 via ssh-key: ====
+<code>
+ssh -p 27 <username>@vsc4.vsc.ac.at     # or
+ssh -p 27 <username>@vsc5.vsc.ac.at
+</code>
+=== Using a jump host ===
+It is also possible to use SSH keys if the machine to which one wants to login is reachable only over one or several hops in between. To do this, use the command ''-J'' to specify the jump host. Prerequisite is that on all remote hosts the public key has been added to the ''authorized_keys'' file as described above. For example, a connection to VSC-5 over the ''login.univie.ac.at'' machine would look like this :
+<code>
+user@host:~$ ssh -p27 -X -t -J <uni_username>@login.univie.ac.at <vsc_username>@vsc5.vsc.ac.at
+</code>
+==== Parameters in .ssh/config ====
+Parameters may be written, e.g. on a per-host basis, to ''~/.ssh/config'' of the local machine (see also ''man ssh_config'' (agent and X11 forwarding may be enabled if permanently required):
+<code>
+Host vsc5.vsc.ac.at vsc5
+  Port 27
+  User vsc_username
+#  ForwardAgent yes
+  IdentityFile id_rsa
+  IdentitiesOnly yes
+#  ForwardX11 yes
+</code>
+=== Using a jump host ===
+A configuration for automatically using a jump host could look like this:
+<code>
+Host vsc5.vsc.ac.at vsc5
+  User vsc_username
+  ProxyJump login.univie.ac.at
-  * Forwarding the ssh-agent over multiple servers: If the machine to which one wants to login is reachable only over one or several hops in between, the ssh-agent of the local machine can be forwarded to the machines in between using the '-A' option of the 'ssh' command. Prerequisite is that on all remote hosts the public key has been added to the 'authorized_keys' file as described above. For example, a connection to VSC-3 over the 'login.univie.ac.at' machine would look like this :<code>
+Host login.univie.ac.at
-user@host:~$ ssh -p27 -X -A -t <uni_username>@login.univie.ac.at ssh -p27 -X <vsc_username>@vsc3.vsc.ac.at
+  User uni_username
-</code> To issue the parameter '-A' for certain hosts, an entry in ''.ssh/config'' (see also ''man ssh_config'') could look like:<code>
-Host vsc3.vsc.ac.at
-  ForwardAgent yes
 </code>