cat > layouts/partials/flex/body-beforecontent.html << 'EOF'
☰
Navigation :

Setting up SSH on MacOS

Using SSH on MacOS

Prerequisites

  1. Setup CSAIL DUO

    • Sign in to https://duo.csail.mit.edu/ and configure your preferences.
    • If you attempt to SSH to systems requiring DUO before this is configured, you will be denied access and presented with a link to configure your DUO preferences:
$ ssh user@login.csail.mit.edu
user@login.csail.mit.edu's password:
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
user@login.csail.mit.edu: Permission denied (publickey,gssapi-with-mic,keyboard-interactive).
  1. Optionally, configure Kerberos for CSAIL environment.

SSH Access Requirements

Inbound SSH connections from outside the CSAIL network to most internal systems are blocked by default. Additionally, connecting to Slurm nodes and cluster infrastructure requires routing through the CSAIL jump host (jump.csail.mit.edu), regardless of whether you are connecting from outside or inside the internal CSAIL network (Ethernet or CSAILPrivate).

While alternative access paths like the Campus VPN or IP allowlisting exist for general internal machines, they do not bypass the jump host requirement for Slurm nodes and will require interactive DUO authentication on every single SSH connection.

Configuring CSAIL SSH via Jump Host for macOS 14+

All macOS users should configure SSH to route through the CSAIL jump host by default.

Two steps are required:

  1. Place the configuration below into the .ssh/config file within your local home directory (/Users/$YOU/.ssh/config).
  2. Create the control socket directory ~/.ssh/cm_socket by opening a terminal and running: 
    mkdir -p ~/.ssh/cm_socket

This default setup ensures seamless connection to all CSAIL systems and Slurm nodes from any network location using Kerberos authentication while reusing DUO sessions.

HashKnownHosts yes
VerifyHostKeyDNS ask
CanonicalizeHostname always
CanonicalDomains csail.mit.edu

Host *.csail.mit.edu 128.52.* 128.30.* 128.31.*
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ForwardAgent yes
  # If you have a different local username uncomment the following line
  # and fill in your CSAIL User Name
  # User <CSAIL Name User>
  # ForwardX11 yes
  

Host jump.csail.mit.edu login.csail.mit.edu
  VerifyHostKeyDNS yes
  ControlMaster auto
  ControlPersist 10h
### This directory must be manually created! ###
  ControlPath ~/.ssh/cm_socket/%C
#  If running AFS, comment-out the line above and uncomment the line below.
#  ControlPath /run/user/%i/cm_socket/%C
Host *.csail.mit.edu !jump.csail.mit.edu !login.csail.mit.edu 128.52.* 128.30.* 128.31.*
  ProxyJump jump.csail.mit.edu

The configuration above allows you to connect to hosts using either their fully qualified domain names (e.g., ssh login.csail.mit.edu or ssh node-name.csail.mit.edu) or their short names (e.g., ssh login or ssh node-name).

If you want to use X11 forwarding (to run remote graphical utilities such as MATLAB or xterm), ensure XQuartz is installed on your Mac and uncomment ForwardX11 yes in the file.

Once you save the file, set the correct permissions so that only your user account can read and write to it:

chmod 600 ~/.ssh/config
chown $USER ~/.ssh/config