NEMO2/SSH-Login-Disabled-Data-Transfer

From bwHPC Wiki
Jump to navigation Jump to search

Copying Data from NEMO2 While SSH Login is Disabled

While interactive SSH login is temporarily disabled, you can still transfer data to and from NEMO2 by registering a command SSH key restricted to rsync. This page walks you through the setup.

Important:

  • This only works on login2.
  • Your running jobs are not affected and continue to run normally.

Step 1: Create a Command SSH Key

Follow the instructions for registering a Command Key, using rrsync to restrict the key to read-only access. With -ro, the key only allows downloading (copying) data from NEMO2 to your local machine; uploading data to NEMO2 with this key is not possible.

Use the following values when registering the key:

Field Value
Command 
/usr/local/bin/rrsync -ro /
From (IP range) University IP range X.X.0.0/16

Note: Replace X.X.0.0/16 with the actual IP range of your own university/institution.

Tip: You can look up your current IP address at wieistmeineip.scc.kit.edu to determine the correct range for your institution.

University of Freiburg users:

When you visit wieistmeineip.scc.kit.edu, it shows your external (public) IP address. However, if you reach NEMO2 over an internal IP address (e.g. a 10.x.x.x network), you must register that internal/local IP address instead. If you want to use your external IP address, you need to use the external university network — either via a jump host or by activating the VPN.

Step 2: Use rsync on login2

Once your command key has been approved, you can use it with rsync on login2 as follows.

To view the available files: 

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:

To copy files: 

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:myfiles/ myfiles/

Replace <USER> with your username and id_ed25519_rrsync with the private key you registered as the command key.

Workspace example: To view or copy the contents of a workspace, use its full path (/work/classic/<USER>-<WS_NAME>) instead of myfiles/.

To view the workspace contents: 

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/work/classic/<USER>-<WS_NAME>/

To copy the workspace contents: 

rsync -e "ssh -i ~/.ssh/id_ed25519_rrsync" <USER>@login2.nemo.uni-freiburg.de:/work/classic/<USER>-<WS_NAME>/ myfiles/

Passphrase-protected key?

If your private key is protected with a passphrase, add it to your local ssh-agent once before running the commands above, otherwise you will be prompted for the passphrase on every rsync call: 

ssh-add ~/.ssh/id_ed25519_rrsync

Note: You can also configure a matching entry in your ~/.ssh/config instead of passing -e "ssh -i ..." on every command. Remember that this only works with login2.

Retrieved from "https://wiki.bwhpc.de/wiki/index.php?title=NEMO2/SSH-Login-Disabled-Data-Transfer&oldid=16202"