cat > layouts/partials/flex/body-beforecontent.html << 'EOF'
☰
Navigation :

Setting up SSH on MacOS

Using SSH on MacOS

Prerequisites

  1. Setup CSAIL DUO

    • Sign in to https://duo.csail.mit.edu/ and configure your preferences.
    • If you attempt to SSH to systems requiring DUO before this is configured, you will be denied access and presented with a link to configure your DUO preferences:
$ ssh user@login.csail.mit.edu
user@login.csail.mit.edu's password:
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
Please enroll at [https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN](https://api-f9e5e8b6.duosecurity.com/frame/portal/v4/enroll?code=1fc14591696012e7&akey=DAY2HO8ZVB7D9PBIZINN)
user@login.csail.mit.edu: Permission denied (publickey,gssapi-with-mic,keyboard-interactive).
  1. Optionally, configure Kerberos for CSAIL environment.

SSH Access Requirements

If you are using our suggested configuration below, you should be able to connect without further steps.

Inbound SSH connections from outside the CSAIL network to most internal systems are blocked by default. Additionally, connecting to Slurm nodes and cluster infrastructure requires routing through the CSAIL jump host (jump.csail.mit.edu), regardless of whether you are connecting from outside or inside the internal CSAIL network (Ethernet or CSAILPrivate).

While alternative access paths like the Campus VPN or IP allowlisting exist for general internal machines, they do not bypass the jump host requirement for Slurm nodes and will require interactive DUO authentication on every single SSH connection.

Configuring CSAIL SSH via Jump Host for macOS 14+

All macOS users should configure SSH to route through the CSAIL jump host by default.

Place the configuration below at the top of the .ssh/config file within your local home directory (/Users/$YOU/.ssh/config).

This default setup ensures seamless connection to all CSAIL systems and Slurm nodes from any network location using Kerberos authentication while reusing DUO sessions.

HashKnownHosts yes
VerifyHostKeyDNS ask
CanonicalizeHostname always
CanonicalDomains csail.mit.edu

# all CSAIL hosts use GSSAPI
Host *.csail.mit.edu 128.52.* 128.30.*
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ForwardAgent yes
  # If you have a different local username uncomment the following line
  # and fill in your CSAIL username
  # User <CSAIL username>

Host *.csail.mit.edu !jump.csail.mit.edu 128.52.* 128.30.*
  ProxyJump jump.csail.mit.edu

Host jump.csail.mit.edu
  ControlMaster auto
  ControlPersist 30m
  ControlPath ~/.ssh/cm-%r@%h:%p

# NOTE: if you are on a laptop or other systems that switches 
# networks the Control Socket will need to be manually removed
# in order for it to get recreated on the new network:
#
# rm ~/.ssh/cm-*
#
# The symptom is new ssh session hanging prior to connection
# It is always safe to run this command though it will require 
# Duo auth on re-establish the connection.

The configuration above allows you to connect to hosts using either their fully qualified domain names (e.g., ssh login.csail.mit.edu or ssh node-name.csail.mit.edu) or their short names (e.g., ssh login or ssh node-name).

If you want to use X11 forwarding (to run remote graphical utilities such as MATLAB or xterm), ensure XQuartz is installed on your Mac and uncomment ForwardX11 yes in the file.

Once you save the file, set the correct permissions so that only your user account can read and write to it:

chmod 600 ~/.ssh/config
chown $USER ~/.ssh/config