Changes between Version 40 and Version 41 of HowTo/LoginToNodes

Timestamp:

08/21/12 16:25:06 (12 years ago)

Author:

nriga@bbn.com

Comment:

--

HowTo/LoginToNodes

@@ -1 +1 @@
 [[PageOutline]]
-This page describes how to login to hosts that you have reserved through the GENI AM API. 
+This page describes how to login to hosts that you have reserved through the GENI AM API. For any comments please contact us at [mailto:help@geni.net].
 
 = Login to GENI hosts =
@@ -52 +52 @@
 
 ==== Other tools ====
-If you used another tool to reserve your resources, then you should figure out how to get the output of the sliverstatus command. If you can't figure this out please send us an [mailto:help@geni.net email] and let us which tool you used to reserve your resources. 
+If you used another tool to reserve your resources, then you should figure out how to get the output of the sliverstatus command. If you can't figure this out please send us an [mailto:help@geni.net email] and let us which tool you used. 
 
 == Get a copy of your ssh key ==
-When you reserve your resources, the tool that you use for the reservation also installs one or more public keys on the hosts so that you can get ssh access to the compute resources. In order to ssh to the machines you will need to get a copy of the private ssh key that correspond to the installed public keys. As before how to get a copy of the needed ssh key depends on the specific tool. 
+When you reserve your resources, the tool that you use for the reservation also installs one or more public keys on the hosts so that you can get ssh access. In order to ssh to the machines you will need to get a copy of the private ssh key that correspond to the installed public keys. As before, how to get a copy of the needed ssh key depends on the specific tool. 
 
 ==== Using Flack ====
@@ -69 +69 @@
 If you made your reservation with Omni then you will need to access the host where your Omni is installed to get a copy of your SSH Key. If you use the host that has Omni installed to ssh to your nodes then you skip to  [wiki:HowTo/LoginToNodes#OmniReadyToLoginScript this section]. If you just want to get a copy of your private key and use it for logging into your nodes from another host, then you should :
   1. Login to the host where you have Omni installed
-  2. Open your omni configuration file. For most users this file is located at ~/.gcf/omni_config. Also when you run any command with omni, it prints the location of the configuration file towards the top. 
+  2. Open your omni configuration file. For most users this file is located at ~/.gcf/omni_config. '''Tip''': When you run any command with omni, it prints the location of the configuration file towards the top. 
   3. In the omni_config file there should be a section about your user that has an attribute called `keys', that has a list of all the public keys that are installed in the nodes. Usually in the same directory as the public keys there are also the private keys (a private key usually has the same name as the public key but without the '.pub' extension.
-  4. Copy the private key over to your host, either by using [http://en.wikipedia.org/wiki/Secure_copy scp] or any other file transfer protocol. You can also just copy-paste the contents of the file. 
+  4. Copy the private key over to your host, either by using [http://en.wikipedia.org/wiki/Secure_copy scp] or any other file transfer program. You can also just copy-paste the contents of the file. 
 
 ==== Other tools ====
@@ -81 +81 @@
 
 ====  Linux/Mac OS/Windows Cygwin ====
-In a Linux or a Mac host do the following :
+Follow these steps:
   1. Open a terminal
   2. Ensure that your private key has the right permissions. Type :
@@ -93 +93 @@
 
 ==== Windows Putty ====
-If you are using putty on a windows machine then follow these steps:
+If you are using putty on a windows machin, follow these steps:
    1. Convert your private key to the format that putty is expecting to. To do this use the puttygen program. For more information look [https://apps.state.or.us/tech/htdocs/putty/Chapter8.html#8.2.12 here]
-   2. Create a new session that uses the username, hostname and port that you have gathered. Also under the authentication menu make sure you point the key field to the key that you generated in putty format. 
+   2. Create a new session that uses the username, hostname and port that you have gathered. Under the authentication menu make sure you point the key field to the key that you generated with puttygen. 
 
 == Omni !ReadyToLogin Script == 
@@ -128 +128 @@
 window you can omit the 'xterm -e' part. 
 
+
 = Troubleshoot/Useful tips =
-=== I am trying to login to the hosts and I am prompted for a password ===
-When you trying to login to GENI hosts you should only be prompted for your ssh passphrase. If you are prompted for a password then there is
-something wrong. Things you can try:
-   * '''change the permissions of your private key''' .  If while trying to login you get a warning that says :
+=== I am trying to login to the hosts and I am prompted for a password. ===
+When you are trying to login to GENI hosts you should only be prompted for your ssh passphrase. If you are prompted for a password then there is
+something wrong. Things that might be wrong:
+   * '''the permissions of your private key''' .  If while trying to login you get a warning that says :
     {{{
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@ -147 +148 @@
 If you have tried everything but you still can't login, email us at [mailto:help@geni.net].
 
+=== My GENI host is behind a firewall. ===
+Some hosts in GENI are behind a firewall. In most cases where nodes are behind a firewall, there is one or more machines that are accessible from the public internet that can be used as "stepping stones" to access these machines, i.e. you should login to them first and then login to the hosts that are behind the firewall. Currently in GENI the two most common cases of nodes that are behind a firewall are:
+   * '''Wide Area ProtoGENI hosts in Internet 2 !PoPs''' : Any node in Utah can be used as a "stepping stone". If your slice doesn't already have a host in Utah, then you should add a VM in Utah that you will use for this purpose. 
+   * '''Mesoscale hosts in some campuses''': If you are using nodes in [wiki:TangoGENI Mesoscale] that are behind a firewall, you can use ops.pgeni.gpolab.bbn.com as a "stepping stone". You can login to ops.pgeni.gpolab.bbn.com using the your pgeni credentials file as your private key. 
+Once you have determined which host you will use as your stepping stone (pub_host from now on)  to get to the host behind the firewall(priv_host from now on), you have several options:
+ 1. '''Recommended''' Use the `-A` ssh option to enable forwarding of the authentication agent. So try :
+    {{{
+ssh -A <username>@<pub_host>
+}}}
+      Then from <pub_host> you can ssh to the private host without the need to upload your private key to <pub_host>.
+    {{{
+user@<pub_host>$> ssh <username>@<priva_host>
+}}}
+ 2. If the above option does not work then you can try using [https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding ssh port forwarding] to get to your host. The main idea is that you will forward a local port on the client to go through the connection to <pub_host> and from there to ssh to <priv_host>. If you want to do this in command line then first login to the public host:
+ {{{
+ssh -L <local port>:<priv_host>:22 <username>@<pub_host> 
+}}}
+ 
+   Then on a different terminal, try logging to the private host through the local port :
+ {{{
+ssh -i <private key> <username>@localhost -p <local port>
+}}}
+
+   You can also modify the ssh configuration file to that effect. This way it is easier to port-forward multiple firewalled hosts by adding the following lines in the file :
+ {{{
+Host <pub_host_alias>
+  Hostname <pub_host>
+  LocalForward <local port1> <priv_host_1>:22
+  LocalForward <local port2> <priv_host_2>:22
+  user <username>
+
+Host <priv_host_alias_1>
+  Hostname localhost
+  port <local port1>
+  user <username>
+
+Host <priv_host_alias_2>
+  Hostname localhost
+  port <local port2>
+  user <username>
+}}} 
+   Then on one terminal do :
+ {{{
+ssh <pub_host_alias>
+}}}
+
+   And on another terminal:
+ {{{
+ssh <priv_host_alias_1>
+}}}
+
 === Managing SSH Keys ===
 
@@ -154 +206 @@
 <table border="0">
      <tr>
-  <td>  Depending on which type of OS You are using, there are ways to make the management of ssh keys and pathphrases simpler. In most linux systems there is a program called <a href='http://en.wikipedia.org/wiki/Ssh-agent'> ssh-agent</a> that runs automatically when you login and can help you manage your ssh keys so that you don't have to type your passphrase every time you login.      
+  <td>  Depending on which type of OS You are using, there are ways to make the management of ssh keys and pathphrases simpler. In most linux systems there is a program called <a href='http://en.wikipedia.org/wiki/Ssh-agent'> ssh-agent</a> that runs automatically when you login and can help you manage your ssh keys so that you don't have to type your passphrase every time you use it.      
 <ul>
- <li> <b> Mac OS </b>  If you are on OSX Leopard or later, ssh-agent runs automatically for you. It will also integrate with the <a href='http://en.wikipedia.org/wiki/Keychain_(Mac_OS)'> Keychain</a> that is a program for managing identities, passwords, etc. The first time that you use your private key to login to a machine, a keychain window will pop-up offering to store your passphrase, if you want to avoid the hustle of typing in your passphrase every time you want to login you should click on that option. </li>
+ <li> <b> Mac OS </b>  If you are on OSX Leopard or later, ssh-agent runs automatically for you. It also integrates `ssh-agent` with the <a href='http://en.wikipedia.org/wiki/Keychain_(Mac_OS)'> Keychain</a> that is a program for managing identities, passwords, etc. The first time that you use your private key to login to a machine, a keychain window will pop-up offering to store your passphrase, if you want to avoid the hustle of typing in your passphrase every time you want to login you should click on that option. </li>
  <li> <b>Linux systems</b> : : In most other Linux systems  ssh-agent  should be automatically started for you. If you want to test whether ssh-agent` runs for you try typing on a terminal: <code>ssh-add</code>. If it is running then you can execute the following command:</li>
 </ul>
@@ -173 +225 @@
 
 === Simplify the ssh command ===
-If you don't want to always specify the '-i' command when you try to login to your hosts, then you can modify your ssh config file to use your key by default. The default location for your ssh configuration file is at  `~/.ssh/config`. For more information on the ssh configuration files use `man ssh_config`. If you want to setup your configuration so that it affects only your current hosts then you can add these lines to your configuration file for each host :
+If you don't want to always specify the '-i' command when you try to login to your hosts, then you can modify your ssh config file to use your key by default. The default location for your ssh configuration file is at  `~/.ssh/config`. For more information on the ssh configuration files use `man ssh_config`. If you want to setup your configuration so that it affects only your GENI hosts then you can add these lines to your configuration file for each host :
 
 {{{
@@ -184 +236 @@
 
 Now you can simply run `ssh <your_alias>`, where <your_alias> can be any nickname you choose. 
-
-=== Logging in to host behind firewalls ===
-Some hosts in GENI are behind a firewall. In most cases where nodes are behind a firewall, there is one or more machines that are accessible from the public internet that can be used as "stepping stones" to access these machines, i.e. you should login to them first and then login to the hosts that are behind the firewall. Currently in GENI the two most common cases of nodes that are behind a firewall are:
-   * '''Wide Area ProtoGENI hosts in Internet 2 PoPs''' : Any node in Utah can be used as a "stepping stone". If you slice doesn't have a host in Utah, then you should add a VM in Utah that you will use for this purpose. 
-   * '''Mesoscale hosts in some campuses''': If you are using nodes in [wiki:TangoGeni Mesoscale] that are behind a firewall, you can use ops.pgeni.gpolab.bbn.com as a "stepping stone". You can login to ops.pgeni.gpolab.bbn.com using the your pgeni credentials file as your private key. 
-Once you have determined with host you will use as your stepping stone (pub_host from now on)  to get to the host behind the firewall(priv_host from now on), you have several options:
- 1. '''Recommended''' Use the `-A` ssh option to enable forwarding of the authentication agent. So try :
-    {{{
-ssh -A <username>@<pub_host>
-}}}
-      Then from <pub_host> you can ssh to the private host without the need to upload your private key to <pub_host>.
-    {{{
-user@<pub_host>$> ssh <username>@<priva_host>
-}}}
- 2. If the above option does not work then you can try using [https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding ssh port forwarding] to get to your host. The main idea is that you will forward a local port on the client to go through the connection to <pub_host> and from there to ssh to <priv_host>. If you want to do this in command line then first login to the public host:
- {{{
-ssh -L <local port>:<priv_host>:22 <username>@<pub_host> 
-}}}
- 
-   Then on a different terminal, try logging to the private host through the local port :
- {{{
-ssh -i <private key> <username>@localhost -p <local port>
-}}}
-
-   You can also modify the ssh configuration file to that effect. This way it is easier to port-forward multiple firewalled hosts by adding the following lines in the file :
- {{{
-Host <pub_host_alias>
-  Hostname <pub_host>
-  LocalForward <local port1> <priv_host_1>:22
-  LocalForward <local port2> <priv_host_2>:22
-  user <username>
-
-Host <priv_host_alias_1>
-  Hostname localhost
-  port <local port1>
-  user <username>
-
-Host <priv_host_alias_2>
-  Hostname localhost
-  port <local port2>
-  user <username>
-}}} 
-   Then on one terminal do :
- {{{
-ssh <pub_host_alias>
-}}}
-
-   And on another terminal:
- {{{
-ssh <priv_host_alias_1>
-}}}