Logging In To Fermilab Nodes

Fermilab maintains several machines for interactive login by Mu2e members. The full suite of Mu2e software and development tools is deployed on these machines. Mu2e members may compile, link and run Mu2e code on these machines and they may also submit grid jobs. This web page describes how to log in to these machines.

Table of Contents

• Introduction
• Logging in from Linux or Macs
  • Allowing remote nodes to Open a Window on your Linux or Mac Laptop or Desktop
  • ssh on Very Old MACs
  • kerberos ticket lifetimes on a Mac
• Logging in From PC's

Introduction

The interactive login nodes come in two groups:

1. mu2evm.fnal.gov This is a pool of virtual machines within the General Purpose Computing Farm (GPCF), the main interactive computing facility for use by the Intensity Frontier experiments. If you login to mu2evm you will be assigned to one of the machines in the pool, currently mu2egpvm01 through 05.
2. detsim.fnal.gov. This is a 32 core machine with no OS virtualization. The home disk and the scratch disk on this machine are different from those seen by the GPCF machines. Otherwise this machine is identical to the GPCF machines, in particular they also see the mu2e bluearc disks.

For additional details of Fermilab supported computing resources that are available to Mu2e, see the web page about CPU, Disk and Tape available at Fermilab.

You can only log in to the above nodes if you have a Fermilab computer account. The only permitted access method is kerberized ssh.

Logging in from Linux or Macs

From a Unix or Mac system you need to issue the following commands to log into one of the Fermilab interactive machines:

> kinit -l 6d -f
> ssh -AKX -l your_kerberos_principal mu2egpvm01.fnal.gov

The -f argument to kinit requests a forwardable kerberos ticket; this means that when you are logged in to your target machine you can request services that ask for kerberos authentication. Otherwise you just have permission to get into the machine, not to get further authorization once there. The -AK argument to ssh requests ssh to forward your forwardable ticket. The X argument might or might not be necessary: see the next section.

If your username on your desktop/laptop is he same as your kerberos principal, you may omit the "-l your_kerberos_principal".

You may need to download and install the current krb5.conf and consult the authentication page, this Mac kerberos article, the Mac at Fermilab page, and the web page with suggestions on how to resolve ssh problems.

9/2015 - Users switching from OSX 10.9.5 to OSX 10.10.5 have noticed that their ticket lifetime defaults to 10h instead of the 26h that is standard at the lab. The solution is to update krb5.conf. At this time, this official source was not up-to-date, so the working conf file had to be downloaded directly from the authentication expert, Frank Nagy.

1/2017: Problems logging into lab Linux machines from Sierra: the lab's offical answer

Allowing remote nodes to Open a Window on your Linux or Mac Laptop or Desktop

Mac OS X users can acquire the X.Org X Window System disk image at xquartz.org .

If you use Scientific Linux Fermi (SLF) it is normally configured so that when you use ssh on your laptop to log in to a remote node ( like detsim or one of the GPCF nodes), software running on that remote node is permitted to open a new window on your laptop display. If this does not work, add the -X or -Y options to your ssh command:

> ssh -X -AK -l your_kerberos_principal detsim.fnal.gov

kerberos ticket lifetimes on a Mac

ssh on Very Old MACs

Logging in From PC's

Fermilab does not officially support logging in to one of the Mu2e interative nodes from a PC. We are trying to change this. Your options are:

• One recommended option is to install cygwin, http://www.cygwin.com, which provides a Linux-like environment for Windows. You can install kerberized ssh in this environment. Consult with the Service Desk to learn how to configure ssh to work correctly.
• The service desk may recommend Reflection software. You can run terminals on a remote linux host and display the terminal and other xwindows on your PC, and use ftp to move files.
• Another recommended option is to use putty. Follow the putty instructions for CMS users; start at the section on "Connecting to the LPC Cluster from a Windows PC" and ignore CMS specific information.
• You can install SLF as a guest virtual OS hosted by your Windows machine.
• Purchase and install WRQ, which is X-Windows software that runs on PCs; configure it to do kerberized ssh. The Service Desk may be able to help with this configuration because they support WRQ but only for Fermilab employees. You need to pay for WRQ and non-employees are not covered by the Fermilab license.
• You can configure your machine for dual boot and install both Linux and Windows. Boot to Linux when you wish to log in to Fermilab. This is very inconvenient if you need to switch from one OS to the other frequently.

Security, Privacy, Legal