SSH overview

There are a bunch of CSAIL-specific things you need to know about using SSH at CSAIL:

• You cannot SSH directly to most CSAIL machines from outside the CSAIL network; except for a few machines like login.csail.mit.edu, SSH traffic is blocked at the network border. You need to go through a “jumphost”. The command-line way to do that is

  ssh -J jump.csail.mit.edu me@myserver.csail.mit.edu
  

  but we provide an SSH configuration you can use that automates that so you don’t need the -J jump.csail.mit.edu every time.

• We require two-factor authentication with Duo, using either SMS text messages or the Duo app on your phone. (If you have a YubiKey security token you want to use for that purpose instead, we can set that up for you.)
• Taken in combination, those two restrictions would mean you’d need to both explicitly invoke a jumphost and answer a Duo prompt each time you SSH to a CSAIL host. To make that less painful, we provide a suggested SSH configuration which will make this transparent when SSHing to CSAIL machines, so you can just type

  ssh me@myserver.csail.mit.edu
  

  without specifying the jump host, and you will be prompted for Duo authentication much less often. This configuration will

  • automatically go through CSAIL’s jumphost when connecting to CSAIL hosts
  • maintain a persistent connection to that jumphost for a while, such that if you keep connecting repeatedly you don’t need to authenticate with Duo each time. (The first Duo authentication persists as long as the jumphost connection is kept open.)
• To protect against brute-force password-guessing attacks, if you fail SSH authentication enough times in a short space of time, the host you’re SSHing from will be temporarily blocked. That can mean it’s important to debug connection problems carefully and deliberately, and it means that automated things that SSH repeatedly must not just keep trying if an SSH connection fails.

Other things we may want to mention or link to here

• passwordless (but still dual-factor) authentication with local Kerberos tickets
• Keypair authentication incomaptible with AFS
• AFS, Kerberos, and SSH interactions
• special cases (just to mention in passing):
  • OpenStack SSH to ubuntu
  • non-CSAIL-Linux machines.