Networking
**********

Here we describe some of the networking commands in detail.  These enable you to access other systems from the Unix Cluster and vice versa.

Logging into another computer
=============================

telnet
------

rsh and rlogin
--------------

slogin and ssh
--------------

ssh,1 and slogin,1 are "secure" replacements for rsh,1 and rlogin,1.  You may wish to use them because:

  * They provide a convenient method for accessing the Unix Cluster from off-site, since (a) rsh access to the Unix Cluster is restricted to a few domains, and (b) ssh optionally offers compression which offers improved throughput on low bandwidth connections.

  * Finally, ssh knows how to forward AFS tokens to remote machines, so you may wish to use ssh within the Unix Cluster.

The primary documentation is via the manpages: ssh,1, sshd,8, slogin,1, scp,1, ssh-keygen,1, ssh-agent,1, ssh-add,1.

The main ssh web site is http://www.ssh.fi/sshprotocols2/.  (Note that the Unix Cluster is currently running version 1.2.x of ssh.)

A nice tutorial on ssh is at http://www.tac.nyc.ny.us/~kim/ssh/.  This includes pointers to more information.

There is also http://w3.pppl.gov/~karney/ssh-sem.txt with PPPL specific information.

There are three primarly ways in which a connection to a remote host can be authorized by ssh.

 1. by prompting for a password for the remote host

 2. by an rsh-style file named ~/.rhosts (or ~/.shosts) on the remote host.  See rhosts,4

 3. by the use of private and public keys, so-called RSA authentication

The first two should be easy to use.  The third requires some a little more work to set up, but is more secure and does not require that the host you're connecting from be already known to the remote host.

ssh with RSA authentication
...........................

You need to do the following once:

 1. Run ssh-keygen as follows

          $ ssh-keygen
          ...
          Enter file in which to save the key (~/.ssh/identity): [RETURN]
          Enter passphrase: [ENTER A GOOD PASS PHRASE TO PROTECT THE PRIVATE KEY]
          Enter the same passphrase again: [DITTO]
          ...

     This creates a private-public key pair in ~/.ssh/identity and ~/.ssh/identity.pub.  The first file is protected by (a) Unix permissions, and (b) your pass phrase.  The second file only needs to be protected against writing by anyone except you.

 2. Create ~/.ssh/authorized_keys:

          cp ~/.ssh/identity.pub ~/.ssh/authorized_keys

 3. Create ~/.ssh/authorized_keys on any remote systems you want to access.  E.g., on hecate.princeton.edu

          mkdir ~/.ssh
          chmod 755 ~/.ssh

     and use ftp,1 to transfer the local copy of ~/.ssh/authorized_keys to hecate.princeton.edu.

 4. Near the beginning of your ~/.xsession, put

          eval `ssh-agent -s`
          ssh-add < /dev/null &

     OR

          eval `ssh-agent -c`
          ssh-add < /dev/null &

     depending on whether your ~/.xsession is a /bin/sh or /bin/csh script.  Look at the first line of the file to find out.

     At the end of ~/.xsession (after the invocation of the window manager), put

          eval `ssh-agenet -k -s`

     or

          eval `ssh-agenet -k -c`

     Your ~/.xsession may then look like:

          #! /bin/sh
          . /etc/env.default

          eval `ssh-agent -s`                # ADDITION
          ssh-add < /dev/null                # ADDITION

          xrdb $HOME/.Xresources

          xterm -ls -T `hostname` -n `hostname` -geo 80x50+105+5 &
          twm

          eval `ssh-agenet -k -s`            # ADDITION

 5. [OPTIONAL]  Create a file ~/.ssh/config containing

          Host *.nersc.gov
          User u12345

          Host hecate.princeton.edu
          Port 1515

     where u12345 is your NERSC user name.  (This step means that you won't have to supply a -l u12345 argument to ssh.)  The port-specification for hecate connects you to the AFS-aware version of sshd on that machine.  If you want to use compression on certain connections, this can be configured here too (see ssh,1).

Once per X session

When you start an X session on your X terminal, the ssh-add command in ~/.xsession will pop up a window for you to enter your pass phrase.

ssh examples
............

Installing ssh on other machines
................................

In order to access the Unix Cluster from a remote machine, you will need to have ssh installed on that machine.  You should ask the system administrator to do this.  In addition, if your site has AFS, ask for the AFS patches to ssh to be made.  The AFS patches are available at http://www.monkey.org/~dugsong/ssh-afs-kerberos.html.

[In fact, most of the functionality of ssh is available even if it's not installed by a system administrator.]

Accessing files on another computer
===================================

ftp
---

rcp and scp
-----------

rsync
-----