Connecting

Before Connecting

Before you can connect to LaPalma, you need to have an account on that machine. Accounts are related to projects, if you are IAC's staff, please, contact us sending an email to res_support@iac.es and we will inform you about how to ask for a project on LaPalma. If you don't belong to IAC, then you should ask for time submitting a proposal in the RES website. Accounts are personal and non-transferrable, once a project is created, new accounts can be added by the project leader (asking for it to res_support@iac.es for IAC's users or through the RES website for other users).

Note for IAC users

Users that already have an IAC account have to use the same credentials to access LaPalma (in a similar way as with the burros, but with two-factor authentication). By default, your IAC account does not provide access to LaPalma4, but feel free to contact us and we will enable the access.

Login nodes

LaPalma has two login nodes. Users from the IAC can connect to both of them, whereas external users can only access one.

  • lapalma1.iac.es: this is the common login node, and it is accessible externally. However, it does not allow outbound connections to the internet.

  • lapalma2.iac.es: it is only accessible from the IAC internal network but allows some outbound connections.

    Warning

    lapalma2.iac.es external outbound connections is still work-in-progress. It will be available soon.

Note that they share the same Lustre file system.

Connecting to LaPalma

You must use Secure Shell (ssh) tools to login into or transfer file into LaPalma. We do not accept incoming connections from protocols as telnet, ftp, rlogin, rcp, or rsh commands. Once you are logged into LaPalma you cannot make outgoing connections for security reasons.

LaPalma uses two-factor authentication to provide extra security. This is accomplished by the using opkssh, a tool that must be installed in the users machines to handle authentication. At first setup, follow these steps to configure opkssh.

Once you have configured opkssh, you can log into the Identity Provider:

opkssh login

and the public key will be generated. Then, you can get into LaPalma system, connecting to the login node: lapalma1.iac.es.

Login for RES users

Users that access the system via the RES, should login in the identity provider (the window that opens when running opkssh login) using their email and password. Then, when connecting to the login node via ssh they should use their resh account.

Here you have an example of logging into LaPalma from a UNIX environment:

[mymachine]$ opkssh login
INFO[0000] listening on http://127.0.0.1:3000/
INFO[0000] press ctrl+c to stop
INFO[0000] Opening browser to http://localhost:3000/login
# A web browser should open now, where you must enter your credentials
Writing opk ssh public key to /home/usertest/.ssh/id_ecdsa-cert.pub and corresponding secret key to /home/usertest/.ssh/id_ecdsa
[...]
[mymachine]$ ssh -l usertest lapalma1.iac.es
+----------------------------------------------------------------------+
|                                                                      |
|        Welcome to LaPalma                                            |
|                                                                      |
|                                                                      |
| * Please contact res_support@iac.es for questions at any time        |
|                                                                      |
+----------------------------------------------------------------------+
usertest@login1:~>$

Most of these applications are graphical and you will have to fill some information in some of the fields offered, in the field 'Host name' or 'Remote Host name' you will need to introduce: lapalma1.iac.es. After this procedure you may be logged into LaPalma.

The first time that you connect to the LaPalma system secure shell needs to interchange some initial information to establish the communication. This information consists of the acceptance of the RSA key of the remote host, you must answer 'yes' or 'no' to confirm the acceptance of this key. If you cannot get access to the system after following this procedure, first consult SSH section for an extended information about Secure Shell, or you can contact us.

Login node

Once you are connected into the machine, you will be presented with a UNIX shell prompt and you will normally be in your home ($HOME) directory. If you are new to UNIX, you will have to learn the basics before you could do anything useful.

The machine in which you will be logged in will be LaPalma (login1). This machine acts as front ends, and are used typically for editing, compiling, preparation/submission of batch executions and as a gateway for copying data inside or outside LaPalma.

Caution

It is not permitted the execution of cpu-bound programs on this node, if some compilation needs much more cputime than the permitted, this needs to be done through the batch queue system. It is not possible to connect directly to the compute nodes from the login nodes, all resource allocation is done by the batch queue system.

Graphical applications

You could execute graphical applications from the login node, to do that the only way is tunnelling all the graphical traffic through the Secure shell connection established.

You will need to have an Xserver running on your local machine to be able to show the graphical information. Most of the UNIX flavors have an X server installed by default. In a Windows environment, you will probably need to download and install some type of X server emulator.

The second step in order to be able to execute graphical applications is to enable in your secure shell connection the forwarding of the graphical information through the secure channel created. This is normally done adding the -X flag to your normal ssh command used to connect to LaPalma. Here you have an example:

[mymachine]$ ssh -X usertest@lapalma1.iac.es
+----------------------------------------------------------------------+
|                                                                      |
|        Welcome to LaPalma                                            |
|                                                                      |
|                                                                      |
| * Please contact res_support@iac.es for questions at any time        |
|                                                                      |
+----------------------------------------------------------------------+
usertest@login1:~>$

Two-factor authentication setup

In order to comply with the latest security standards, for accessing LaPalma, the users must use two-factor authentication. In the current setup, the authentication flow is managed by the IAC's Identity Provider (IdP). New users will automatically be added to this IdP.

To interface the IdP with LaPalma, we use the opkssh utility, which generates a pair of ssh keys associated with an identity on the IdP.

Installation of opkssh

Installing opkssh does not required administrator privileges, as it is a simple executable file. You can find detailed instructions in their website.

For each operating system, download the binary as:

  • Linux:

    • amd64:

      curl -L github.com/openpubkey/opkssh/releases/latest/download/opkssh-linux-amd64 -o opkssh
chmod +x opkssh

    • arm64:

      curl -L github.com/openpubkey/opkssh/releases/latest/download/opkssh-linux-arm64 -o opkssh
chmod +x opkssh

  • Windows

    • amd64:

      winget install openpubkey.opkssh --source winget

  • macOS

    • amd64:

      curl -L github.com/openpubkey/opkssh/releases/latest/download/opkssh-osx-amd64 -o opkssh
chmod +x opkssh

    • arm64:

      curl -L github.com/openpubkey/opkssh/releases/latest/download/opkssh-osx-arm64 -o opkssh
chmod +x opkssh

Test that the binary has been correctly downloaded and it is executable:

./opkssh -v
opkssh version 0.12.0

In Linux and MacOS, for ease of use, place the executable somewhere in your PATH environment variable so that you can simply call it as opkssh from any directory.

PATH environment variable

You can inspect its value on Linux/MacOS with echo $PATH. Likely there is already some directories in your $HOME where you can place the executable, for example /home/user/.local/bin. In that case, simply move opkssh to that location and it will be available to be called later.

First configuration

We need to provide opkssh with some information about the IdP, to do so, first generate the configuration file running opkssh login --create-config. This will show a message similar to:

created client config file at /home/user/.opk/config.yml

Open that configuration file, remove all its content and paste the following:

---
default_provider: IAC-IdP

providers:
  - alias: IAC-IdP
    issuer: https://jergo.ll.iac.es/realms/IAC-IdP
    client_id: opkssh
    redirect_uris:
      - http://localhost:3000/login-callback
      - http://localhost:10001/login-callback
      - http://localhost:11110/login-callback

SSH key generation

After the configuration is done, each day that you wish to log into LaPalma, you must first run opkssh login. This will open the IdP webpage where you must fill your credentials. On your first login on the IdP, you must configure your OTP code using standard applications (e.g., Google Authenticator, FreeOTP).

After the login is successful, a SSH key will be generated and you can login normally to LaPalma using ssh. The SSH key last for 8 hours, during which you can access LaPalma without running opkssh login again.

SSH

ssh is a program that enables secure logins over an insecure network. It encrypts all the data passing both ways, so that if it is intercepted it cannot be read. It also replaces the old an insecure tools like telnet, rlogin, rcp, ftp, etc. ssh is a client-server software. Both machines must have ssh installed for it to work.

We have already installed an ssh server in our machines. You must have installed an ssh client in your local machine. ssh is available without charge for almost all versions of Unix. IAC recommend the use of OpenSSH client that can be downloaded from http://www.openssh.org, but any client compatible with SSH version 2 can be used.

To accomplish a login in LaPalma with ssh you have to provide a public key. If you have not got already one you can generate one by authenticating against the IAC Identity Provider.