Differences

This shows you the differences between two versions of the page.

--- institute_lorentz:institutelorentz_remoteaccess [2021/01/27 08:25] – lenocil
+++ institute_lorentz:institutelorentz_remoteaccess [2022/11/29 12:27] (current) – [SSH access/tunnelling behind firewalls] lenocil
@@ Line 3: / Line 3: @@
 Following are some examples that demonstrate the concept of SSH tunnelling. For  alternative methods of connection, please see the relevant documentation.
+SSH access to our servers requires you to set up [[institute_lorentz:2fa|two-factor authentication]] (2FA) on your account for security reasons.
 :!: The examples below have been tested with OpenSSH v7.3+.
@@ Line 64: / Line 65: @@
 ==== Example 4 ====
-Establish a web browser connection to a Jupyter Notebook session running on node marisXX when outside the IL intranet ((This method will only work if you have a slurm-controlled running jupyter session on marisXX. See [[institute_lorentz:xmaris|xmaris]] ))
+Establish a web browser connection to a Jupyter Notebook session running on node marisXX when outside the IL intranet ((This method will only work if you have a slurm-controlled running jupyter session on marisXX. See [[institute_lorentz:xmaris|xmaris]]. \\ You are strongly encouraged to use [[institute_lorentz:xmaris#web_access|xmaris OOD]] facilities nonetheless. ))
 <code>
@@ Line 84: / Line 85: @@
 Browse to ''http://localhost:YYYY''.
+===== SSH access/tunnelling behind firewalls =====
+There are situations in which SSH could be forbidden by firewall settings of the internet service provider. Think of countries which limit freedom of speech for example. Luckily Lorentz Institute provides its members with a special access server to overcome these restrictions.
+In a nutshell, IL offers SSL-wrapped SSH access, that is it conceals SSH connections using the SSL protocol which is the protocol used by the world wide web to serve ''https'' connections. In other words, to the eavesdropper your SSH connection will just look like a normal web connection.
+The set up on your side is rather simple and requires only editing a file on the SSH client you wish to use, e.g. laptop, workstation, etc..
+Add the following stanza to your SSH client config file((The same result is obtained by executing directly ''ssh -o ProxyCommand="openssl s_client -quiet -connect access.lorentz.leidenuniv.nl:443" ssh.lorentz.firewall'' on the command line.)) (''~/.ssh/config'' on most GNU/Linux distros)
+<code bash>
+Host ssh.lorentz.firewall
+  ProxyCommand openssl s_client -connect access.lorentz.leidenuniv.nl:443 -servername lorentz -quiet
+  User <Your IL username>
+</code>
+Then to initiate a SSL-wrapped SSH connection open a terminal and type
+<code bash>
+$ ssh ssh.lorentz.firewall
+depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
+verify return:1
+depth=1 C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
+verify return:1
+depth=0 C = NL, ST = Zuid-Holland, O = Universiteit Leiden, CN = access.lorentz.leidenuniv.nl
+verify return:1
+--------------------------------------------------
+    Welcome to the Lorentz Institute workstations
+    Access is allowed for authorized users only.
+    Any abuse will be tracked.
+    Helpdesk     Room HL40[7-9]   Tel 8484
+    https://helpdesk.lorentz.leidenuniv.nl
+    support@lorentz.leidenuniv.nl
+--------------------------------------------------
+READ THIS CAREFULLY BEFORE PROCEEDING:
+-------------------------------------
+https://ilorentz.org/wiki/doku.php?id=institute_lorentz
+Last login: Tue May 17 09:36:49 2022 from XX.XX.XX.XX
+*****
+$
+</code>
+When the connection is initiated you will be able to double-check the SSL certificate details, especially the ''CN'' entry (see above) which must correspond to our server ''access.lorentz.leidenuniv.nl''. Then upon a successful authentication, you will be let in and be able to use the command line as usual.
+Similarly it is possible to initiate an SSL-wrapped SSH SOCKS proxy connection useful to protect your browser sessions from eavesdroppers  as in the example below. Provided you set up your SSH client config as described above, type
+<code bash>
+ssh -ND 8888 ssh.lorentz.firewall
+</code>
+then modify your browser settings to instruct it to redirect all connections to a SOCKS proxy listening on ''localhost'' post ''8888''.

Computer Documentation Wiki

User Tools

Site Tools

Differences

Page Tools