NEMO2/SSH-Login-Disabled-Data-Transfer
Copying Data from NEMO2 While SSH Login is Disabled
While interactive SSH login is temporarily disabled, you can still transfer data
to and from NEMO2 by registering a command SSH key restricted to
rsync. This page walks you through the setup.
Important:
- This only works on login2.
- Your running jobs are not affected and continue to run normally.
Step 1: Create a Command SSH Key
Follow the instructions for registering a Command Key, using
rrsync to restrict the key to read-only access. With
-ro, the key only allows downloading (copying) data from NEMO2 to
your local machine; uploading data to NEMO2 with this key is not possible.
Use the following values when registering the key:
| Field | Value |
|---|---|
| Command | /usr/local/bin/rrsync -ro / |
| From (IP range) | University IP range X.X.0.0/16
|
Note: Replace X.X.0.0/16 with the actual IP range of your own
university/institution.
Tip: You can look up your current IP address at wieistmeineip.scc.kit.edu to determine the correct range for your institution.
University of Freiburg users:
When you visit wieistmeineip.scc.kit.edu, it
shows your external (public) IP address. However, if you reach NEMO2 over an
internal IP address (e.g. a 10.x.x.x network), you must register
that internal/local IP address instead. If you want to use your external IP
address, you need to use the external university network — either via a jump host or
by activating the VPN.
Step 2: Use rsync on login2
Once your command key has been approved, you can use it with rsync
on login2 as follows.
To view the available files:
rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:
To copy files:
rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:myfiles/ myfiles/
Replace <USER> with your username and id_ed25519_rrsync
with the private key you registered as the command key.
Passphrase-protected key?
If your private key is protected with a passphrase, add it to your local
ssh-agent once before running the commands above, otherwise you
will be prompted for the passphrase on every rsync call:
ssh-add ~/.ssh/id_ed25519_rrsync
Note: You can also configure a matching entry in your ~/.ssh/config
instead of passing -e "ssh -i ..." on every command. Remember that this
only works with login2.