View source for Offsite Access

__TOC__

==Secure Access Policy (includes SSH and VPN info)==
===What is the Secure Access policy?===

External network connections to MCS resources shall not use clear text reusable passwords for authentication.  Additionally, SSH connections without VPN tunneling will not use reusable passwords for authentication.
	
===What does that mean to me?===

It means that if you're using a network to access MCS resources from outside MCS office space, you must use some mechanism to hide your password from being "sniffed" or otherwise captured in transit to the MCS network, especially without your knowledge.

Note: As of April 26, 2003, machines in MCS are, by default, disallowing any password-based authentication on connections initiated from outside the MCS firewall including wireless.  The list of machines to which you can SSH directly is: 

*General Login
**login1.mcs.anl.gov
**login2.mcs.anl.gov
**login3.mcs.anl.gov
**login4.mcs.anl.gov
::(The above can all be accessed as "login.mcs.anl.gov")


These machines require SSH keys for login.  See the [[SSH_keys| SSH Key FAQ]] for details.  If you use the VPN, you can SSH direct to any machine (except those listed above) you can use onsite, using your password as authentication.

The current RSA key fingerprint for the login machines will show up as one of the following depending on OS, and version of ssh you are connecting with.

- RSA key fingerprint is 32:ae:2e:3a:41:1d:06:ab:00:e0:43:b7:13:ff:3f:7c.

- RSA key fingerprint is SHA256:I/3YpntSAgCpC/CHl/ULXA2elt4GEb+huvJtXoFEOyc.

If you see a warning message that the key has changed and either of the above two keys are listed as the new key, it is the right machine, and you should follow the instructions given in the error message so you can login properly.

''NOTE''
*Login machines are meant for login/access purposes only. We will not tolerate any compiling or running of code or any type of resource intensive processes. They are meant to provide a gateway to other resources here in MCS where you can do you computation/testing
*/sandbox no longer exists on the logins. It has been re-tasked to be /scratch and as such will be cleaned out periodically. Currently any file that hasn't changed in 7 days will be deleted from /scratch. This new policy should hopefully help to keep the area from filling up and still provide a local disk to drop files temporarily.

===How do I log in?===

The MCS Systems Group has installed the Secure Shell (SSH) server on all UNIX systems that it maintains.  You can use this protocol from anywhere on the Internet to connect to the above listed MCS computing resources, provided you are set up for SSH key-based login.  If the host to which you need to connect is not in that list, you can either SSH from one of the hosts above, or you can use the [https://credentials.anl.gov/VPN/index.htm VPN] client first.

Other protocols may also be available, depending on circumstance.
	
===How do I transfer files?===

You're probably asking this question because you're used to using the old Internet protocol FTP.  There are several ways to work around the fact that this protocol uses reusable clear text passwords:

* Use SCP or SFTP to transfer files over SSH.  
**[http://winscp.net/eng/index.php Windows client]
**[http://www.apple.com/downloads/macosx/internet_utilities/fugu.html Mac OS X GUI client].  Mac OS X has ssh, scp and sftp built in.
**linux and unix machines typically have ssh, scp and sftp installed by default.

Authenticated FTP is not supported.

===Where do I get SSH software for my computer?===

This depends on what kind of computer you are using and whether you are an employee of Argonne's MCS Division.

Most unix and linux machines have SSH and its associated utilities installed by default.  If you're running your own unix/linux machine, you should know how to get these packages.

Mac OS X machines include SSH and its associated utilities by default.

Windows clients: [http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY], [http://www.cygwin.com/ cygwin], [http://www.google.com/search?q=free+windows+SSH+clients others]

===What is port forwarding, and how do I set it up?===

Port forwarding is a technique where an insecure protocol (like FTP, X, POP3) is tunneled through a secure protocol (like SSH).  This is a good way to continue to use your familiar protocols in a secure way.
====Using SSH Port Forwarding with X on UNIX or Mac OS X====

This is easy, just use ssh -Y <hostname> and your X display settings will be sent to the remote machine, and all X Windows will open on your own display.

If you have a $DISPLAY set properly, and use ssh to connect to another system, ssh will automatically set $DISPLAY on the remote end and set up everything for you.  All you have to do is start your favorite X application on the remote end.  Check to make sure you're not setting your $DISPLAY in any of your startup files.  Also, never use xhost +, especially in your startup files, as it's a big security hole.

If you're using a Mac OS X computer, remember that X11 is not installed by default.  Instructions on installing X11 on Mac can be found at [http://xquartz.macosforge.org/trac The Xquartz site].

====Using SSH Port Forwarding with X on Microsoft Windows====

Use Cygwin.  See [[Windows#X_Windows| Windows instructions]].  Follow the Unix instructions above after cygwin is installed.

==Windows interaction==
===What do I need to do to be able to interact with the ANL or MCS Windows domain?===

If you are trying to access any ANL Application (FAVOR, Dayforce, GetThere, etc.) you can use [https://dash.anl.gov/vpn/index.html Dssh]

Use the [http://www.anl.gov/employees/working-remotely/virtual-private-network-vpn VPN].

You'll need to be added to the access list before you can use the VPN. You can contact the CELS Help Desk by emailing help@cels.anl.gov, this will generate a ticket to them and they will let you know when you have been added and can start using the VPN.