Setting up SSH on Windows

Using SSH on Windows with MFA

Both PuTTY and SecureCRT can be used for connecting to CSAIL Linux hosts without passwords. Kerberos tickets allow passwordless logins.

Prerequisites & Requirements

1. Setup CSAIL DUO
   Sign in to https://duo.csail.mit.edu/ and configure your preferences.
2. Jump Host Requirement for Slurm Nodes
   Connecting to Slurm compute nodes and cluster infrastructure requires routing through the CSAIL jump host (jump.csail.mit.edu), regardless of whether you are on campus or connected via VPN.
3. Install VPN (for Off-Campus Access)
   If you need to SSH to general CSAIL systems from outside the CSAIL network, install and connect to the MIT VPN. Note that while the VPN provides network access to internal machines, it does not bypass the jump host requirement for Slurm nodes. Inbound SSH connections to the public login server login.csail.mit.edu and jump.csail.mit.edu remain open.
4. Setup Kerberos for Windows
   For secure, passwordless SSH login to CSAIL systems, please first setup Kerberos for Windows. VS Code/Cursor (and presumably Claude) will never work with Kerberos for Windows, and will never work with controlpersist-style sockets because Windows does not support those socket types and these IDEs use non-standard SSH clients.

Connecting via OpenSSH (PowerShell / Command Prompt / WSL)

If you are using Windows OpenSSH in PowerShell, Command Prompt, or Windows Subsystem for Linux (WSL), create or update ~/.ssh/config to route through the jump host by default:

HashKnownHosts yes
VerifyHostKeyDNS ask
CanonicalizeHostname always
CanonicalDomains csail.mit.edu

Host *.csail.mit.edu 128.52.* 128.30.* 128.31.*
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

Host jump.csail.mit.edu login.csail.mit.edu
  VerifyHostKeyDNS yes

Host *.csail.mit.edu !jump.csail.mit.edu !login.csail.mit.edu 128.52.* 128.30.* 128.31.*
  ProxyJump jump.csail.mit.edu

PuTTY

For PuTTY, v.0.61 or later, create a Saved Session with CSAIL-specific settings.

The example below uses our public login server as the host, but you can substitute jump.csail.mit.edu or the CSAIL host of your choice. To connect to Slurm compute nodes, configure jump.csail.mit.edu as a proxy under Connection -> Proxy.

In PuTTY Configuration

1. In Session, set Host Name to login.csail.mit.edu (or jump.csail.mit.edu) and use csail login (or csail jump) as the session name under “Saved Settings”.
2. Connection -> SSH -> Auth -> GSSAPI, set “Allow GSSAPI credential delegation” to YES.
3. In Connection -> Data, set “Auto-login username” to your CSAIL username.
4. Click “Save”.

To use

1. Connect to the MIT VPN if off campus. Inbound SSH connections to the public login server login.csail.mit.edu and jump.csail.mit.edu remain open.
2. Get Kerberos Tickets.
3. Click csail login (or csail jump), click Load, and then click Open.

SecureCRT

Install SecureCRT.

The example below uses our public login server as the host, but you can substitute jump.csail.mit.edu or the CSAIL host of your choice.

Create a New Session

1. Connect to the MIT VPN if off campus.
2. Get Kerberos Tickets.
3. Open SecureCRT. The quick connect dialog box will open.
4. Hostname: Enter login.csail.mit.edu or jump.csail.mit.edu.
   1. Port: 22 (default)
   2. Firewall: None (default)
   3. Username: Enter your CSAIL username (do not include @csail.mit.edu).
5. Under Authentication select the following in order:
   1. Keyboard Interactive
   2. GSSAPI
6. Session Name: Enter a name like CSAIL Login or jump.csail.mit.edu.
7. Click Connect.
8. If you get a New Host Key prompt, click Accept & Save.

Connecting a session

1. Connect to the MIT VPN if off campus.
2. Get Kerberos Tickets.
3. After you create a new session above, your settings will save in a session with the name you saved.
4. Click File -> Connect, open your saved session.