Setting up SSH on Ubuntu
On CSAIL Ubuntu, sshd is enabled by default, but without the “keytab” file necessary for Kerberos-based passwordless login, so some of these steps are necessary there as well. There are five steps you need to take to turn on SSH and enable passwordless remote login using your Kerberos tickets:
- First, ensure that your machine has a stable hostname (that
hostname.csail.mit.edu does not contain “dynamic”.) If it does, register a hostname first in WebDNS (CSAIL Login required), then dhreg (CSAIL Login required). - Ask the sysadmins to generate a keytab for your host (e-mail help@csail.mit.edu with the name of your machine)
- Install the keytab. From the machine:
sudo install -o root -g root -m 600 /afs/csail/group/tig/keytabs/$USER/$HOSTNAME.keytab \
/etc/krb5.keytab
(If you are using tcsh, substitute the name of your machine for $HOSTNAME.)
- Remove the keytab from afs:
rm /afs/csail.mit.edu/group/tig/keytabs/$USER/$HOSTNAME.keytab
- (Re)start sshd:
sudo rm /etc/ssh/sshd_not_to_be_run
sudo /etc/init.d/ssh restart
/etc/ssh/sshd_not_to_be_run won’t be there on CSAIL Linux
machines, nor on servers, so don’t worry if you get an error from that
command. But if it is there you’ll need to remove it.
SSH Client Configuration (Jump Host Required)
All SSH connections to CSAIL systems—and specifically connections to Slurm compute nodes and cluster infrastructure—require routing through the CSAIL jump host (jump.csail.mit.edu). On CSAIL Linux, this routing is built into the default system profile. For non-CSAIL Ubuntu or custom user environments, create a ~/.ssh/config file as shown below to set up the jump host by default.
Routing through jump.csail.mit.edu satisfies authentication policies for Slurm nodes while reusing active control sockets to minimize DUO prompts.
SSH is automatically configured on CSAIL Linux hosts. If you’re curious, you can read /etc/ssh/ssh_config on any CSAIL system.
`` luggage