NEMO2/SSH-Login-Disabled-Data-Transfer

Copying Data from NEMO2 While SSH Login is Disabled

While interactive SSH login is temporarily disabled, you can still transfer data to and from NEMO2 by registering a command SSH key restricted to rsync. This page walks you through the setup.

Important:

• This only works on login2.
• Your running jobs are not affected and continue to run normally.

Step 1: Create a Command SSH Key

Follow the instructions for registering a Command Key, using rrsync to restrict the key to read-only access. With -ro, the key only allows downloading (copying) data from NEMO2 to your local machine; uploading data to NEMO2 with this key is not possible.

Use the following values when registering the key:

Field	Value
Command	/usr/local/bin/rrsync -ro /
From (IP range)	University IP range X.X.0.0/16

Note: Replace X.X.0.0/16 with the actual IP range of your own university/institution.

Tip: You can look up your current IP address at wieistmeineip.scc.kit.edu to determine the correct range for your institution.

University of Freiburg users:

When you visit wieistmeineip.scc.kit.edu, it shows your external (public) IP address. However, if you reach NEMO2 over an internal IP address (e.g. a 10.x.x.x network), you must register that internal/local IP address instead. If you want to use your external IP address, you need to use the external university network — either via a jump host or by activating the VPN.

Step 2: Use rsync on login2

Once your command key has been approved, you can use it with rsync on login2 as follows.

To view the available files:

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:

To copy files:

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:myfiles/ myfiles/

Replace <USER> with your username and id_ed25519_rrsync with the private key you registered as the command key.

Passphrase-protected key?

If your private key is protected with a passphrase, add it to your local ssh-agent once before running the commands above, otherwise you will be prompted for the passphrase on every rsync call:

ssh-add ~/.ssh/id_ed25519_rrsync

Note: You can also configure a matching entry in your ~/.ssh/config instead of passing -e "ssh -i ..." on every command. Remember that this only works with login2.