NEMO2/SSH-Login-Disabled-Data-Transfer - Revision history

M Janczyk: /* Step 1: Create a Command SSH Key */

2026-07-11T12:02:01Z

Step 1: Create a Command SSH Key

← Older revision		Revision as of 14:02, 11 July 2026
Line 30:		Line 30:

	'''Note:''' Replace <code>X.X.0.0/16</code> with the actual IP range of your own		'''Note:''' Replace <code>X.X.0.0/16</code> with the actual IP range of your own
	university/institution.		university/institution. If you need to allow more than one range (e.g. an
			internal and an external one), you can specify multiple IP addresses/ranges at
			once, separated by a comma, e.g. <code>10.x.x.x/y,132.230.0.0/16</code>.

	'''Tip:''' You can look up your current IP address at		'''Tip:''' You can look up your current IP address at
Line 38:		Line 40:
	<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">		<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
	<p style="padding-left: 5px; margin: 0px;">'''University of Freiburg users:'''</p>		<p style="padding-left: 5px; margin: 0px;">'''University of Freiburg users:'''</p>
	~~When you visit~~ [https://wieistmeineip.scc.kit.edu/ wieistmeineip.scc.kit.edu], it		[https://wieistmeineip.scc.kit.edu/ wieistmeineip.scc.kit.edu] shows your
	~~shows your~~ '''external ~~(public) IP address~~'''. ~~However,~~ if ~~you~~ ~~reach~~ ~~NEMO2~~ ~~over~~ an		'''external''' IP. Inside the university network you usually have an '''internal'''
	~~'''internal IP address''' (e.g. a~~ <code>10.x.x.x</code> ~~network),~~ ~~you~~ ~~must~~ register		<code>10.x.x.x</code> address instead — register that one, or use a jump host
	~~that~~ ~~internal/local~~ IP ~~address~~ ~~instead~~. If you ~~want to~~ use ~~your~~ ~~external IP~~		(which has its own external-facing IP) or VPN. If you might use both, register
			both ranges separated by a comma.
	address, you need to use the external university network — either via a jump host or
	by activating the '''VPN'''.
	</div>		</div>

M Janczyk: /* Useful rsync Options */

2026-07-09T16:55:42Z

Useful rsync Options

← Older revision		Revision as of 18:55, 9 July 2026
Line 106:		Line 106:
	* <code>-z</code> — compress data during transfer (helps on slower connections)		* <code>-z</code> — compress data during transfer (helps on slower connections)
	* <code>-P</code> — show progress and allow resuming partially transferred files (equivalent to <code>--partial --progress</code>, so you don't need to add <code>--progress</code> separately)		* <code>-P</code> — show progress and allow resuming partially transferred files (equivalent to <code>--partial --progress</code>, so you don't need to add <code>--progress</code> separately)

	'''Not needed on NEMO2 (WEKA storage):''' <code>-x</code>/<code>--one-file-system</code>
	prevents rsync from crossing into other mounted filesystems while reading the
	source tree. Your NEMO2 home and workspace directories live entirely on the
	WEKA filesystem, so there are no other mounts nested underneath them — this
	option has no effect here and can be omitted. Also make sure not to pass
	<code>-a</code> (or any other option) twice.

	<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">		<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">

M Janczyk at 16:52, 9 July 2026

2026-07-09T16:52:27Z

← Older revision		Revision as of 18:52, 9 July 2026
Line 73:		Line 73:
	<code>/home/fr/fr_ab1234</code> with your own):		<code>/home/fr/fr_ab1234</code> with your own):
	<pre>		<pre>
	rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/home/fr/fr_ab1234/ myfiles/		rsync -ahzP -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/home/fr/fr_ab1234/ myfiles/
	</pre>		</pre>

	Replace <code><USER></code> with your username and <code>id_ed25519_rrsync</code>		Replace <code><USER></code> with your username and <code>id_ed25519_rrsync</code>
	with the private key you registered as the command key.		with the private key you registered as the command key. The <code>-a</code> option
			is required to copy folders recursively — without it, <code>rsync</code> only
			copies top-level files and skips directories. See
			[[#Useful_rsync_Options\|Useful rsync Options]] below for what the other options do.

	'''Workspace example:''' To view or copy the contents of a workspace, use its full		'''Workspace example:''' To view or copy the contents of a workspace, use its full
Line 89:		Line 92:
	To copy the workspace contents:		To copy the workspace contents:
	<pre>		<pre>
	rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/work/classic/<USER>-<WS_NAME>/ myfiles/		rsync -ahzP -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/work/classic/<USER>-<WS_NAME>/ myfiles/
	</pre>		</pre>

	== Useful rsync Options ==		== Useful rsync Options ==

	~~For~~ ~~larger~~ ~~transfers,~~ ~~the~~ ~~following~~ ~~options~~ ~~are~~ recommended:		The copy commands above already use these recommended options:
	<pre>		<pre>
	rsync -ahzP -e "ssh -i ~/.ssh/id_ed25519_rrsync" ~~<USER>@login2~~.~~nemo~~.~~uni-freiburg~~.~~de:/home/fr/fr_ab1234/ myfiles/~~		rsync -ahzP -e "ssh -i ~/.ssh/id_ed25519_rrsync" ...
	</pre>		</pre>

M Janczyk at 16:49, 9 July 2026

2026-07-09T16:49:39Z

@@ Line 56: / Line 56: @@
 </pre>
 <pre>
-rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:myfiles/ myfiles/
+rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/home/fr/fr_ab1234/ myfiles/
 </pre>
@@ Line 76: / Line 91: @@
 rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/work/classic/<USER>-<WS_NAME>/ myfiles/
 </pre>
 <div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">

M Janczyk: /* Step 2: Use rsync on login2 */

2026-07-09T16:31:44Z

Step 2: Use rsync on login2

@@ Line 63: / Line 63: @@
 Replace <code><USER></code> with your username and <code>id_ed25519_rrsync</code>
 with the private key you registered as the command key.
 <div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">

M Janczyk: M Janczyk moved page SSH-Login-Disabled-Data-Transfer to NEMO2/SSH-Login-Disabled-Data-Transfer without leaving a redirect

2026-07-09T16:19:28Z

M Janczyk moved page SSH-Login-Disabled-Data-Transfer to NEMO2/SSH-Login-Disabled-Data-Transfer without leaving a redirect

← Older revision	Revision as of 18:19, 9 July 2026
(No difference)

M Janczyk: Created page with "= Copying Data from NEMO2 While SSH Login is Disabled = While interactive SSH login is temporarily disabled, you can still transfer data to and from NEMO2 by registering a '''command SSH key''' restricted to `rsync`. This page walks you through the setup.

'''Important:'''
* This only works on '''login2'''. * Your runni..."

2026-07-09T16:18:57Z

Created page with "= Copying Data from NEMO2 While SSH Login is Disabled = While interactive SSH login is temporarily disabled, you can still transfer data to and from NEMO2 by registering a '''command SSH key''' restricted to <code>rsync</code>. This page walks you through the setup. <div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;"> <p style="padding-left: 5px; margin: 0px;">'''Important:'''</p> * This only works on '''login2'''. * Your runni..."

New page

= Copying Data from NEMO2 While SSH Login is Disabled =

While interactive SSH login is temporarily disabled, you can still transfer data
to and from NEMO2 by registering a '''command SSH key''' restricted to
<code>rsync</code>. This page walks you through the setup.

<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
<p style="padding-left: 5px; margin: 0px;">'''Important:'''</p>
* This only works on '''login2'''.
* Your running jobs are '''not affected''' and continue to run normally.
</div>

== Step 1: Create a Command SSH Key ==

Follow the instructions for registering a [[Registration/SSH#Step_2B:_Register_Command_Key|Command Key]], using
[[Registration/SSH/rrsync|rrsync]] to restrict the key to read-only access. With
<code>-ro</code>, the key only allows '''downloading''' (copying) data from NEMO2 to
your local machine; uploading data to NEMO2 with this key is not possible.

Use the following values when registering the key:

{| class="wikitable"
|-
! Field !! Value
|-
| Command || <pre>/usr/local/bin/rrsync -ro /</pre>
|-
| From (IP range) || University IP range <code>X.X.0.0/16</code>
|}

'''Note:''' Replace <code>X.X.0.0/16</code> with the actual IP range of your own
university/institution.

'''Tip:''' You can look up your current IP address at
[https://wieistmeineip.scc.kit.edu/ wieistmeineip.scc.kit.edu] to determine the
correct range for your institution.

<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
<p style="padding-left: 5px; margin: 0px;">'''University of Freiburg users:'''</p>
When you visit [https://wieistmeineip.scc.kit.edu/ wieistmeineip.scc.kit.edu], it
shows your '''external (public) IP address'''. However, if you reach NEMO2 over an
'''internal IP address''' (e.g. a <code>10.x.x.x</code> network), you must register
that internal/local IP address instead. If you want to use your external IP
address, you need to use the external university network — either via a jump host or
by activating the '''VPN'''.
</div>

== Step 2: Use rsync on login2 ==

Once your command key has been approved, you can use it with <code>rsync</code>
on '''login2''' as follows.

To view the available files:
<pre>
rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:
</pre>

To copy files:
<pre>
rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:myfiles/ myfiles/
</pre>

Replace <code><USER></code> with your username and <code>id_ed25519_rrsync</code>
with the private key you registered as the command key.

<div style="border: 3px solid #ffc107; background-color: #fff3cd; margin: 10px 0px 10px 0px;">
<p style="padding-left: 5px; margin: 0px;">'''Passphrase-protected key?'''</p>
If your private key is protected with a passphrase, add it to your local
<code>ssh-agent</code> once before running the commands above, otherwise you
will be prompted for the passphrase on every <code>rsync</code> call:
<pre>
ssh-add ~/.ssh/id_ed25519_rrsync
</pre>
</div>

<div style="border: 3px solid #6c757d; padding: 15px; background-color: #e2e3e5; margin: 10px 0;">
'''Note:''' You can also configure a matching entry in your <code>~/.ssh/config</code>
instead of passing <code>-e "ssh -i ..."</code> on every command. Remember that this
only works with '''login2'''.
</div>