Skip to content

Multi-factor authentication for SSH access

SSH (command-line) access to LDG clusters requires Duo multi-factor authentication once per day per system (currently CIT, LHO, LLO, and the two SSH portals — though the portals may ask every time).

Registering an LDG account

If you don't have a LIGO Data Grid (LDG) account, apply for one first:

Wait for a confirmation email from the CIT cluster admins before continuing below.

Enrollment

Enrollment happens automatically the first time you log in to a Duo-enabled server — see the two methods below. There's nothing to set up in advance.

Choose Duo Mobile app, not Touch ID or Windows Hello

During enrollment, choose the Duo Mobile app, not macOS Touch ID or Windows Windows Hello. Those two platform-biometric methods don't work over SSH — there's no browser there to complete the check in. They work fine for web logins, which do run through a browser. See the SSH vs. web comparison for the full picture. A hardware token (YubiKey 5 NFC) is also a supported alternative to a phone.

There are two ways to log in with SSH: an SSH portal, or an SSH proxy.

Method 1: using an SSH portal

Log in to an SSH portal, which lets you pick the cluster and machine you want from a menu — see the LDG connection guide for more detail.

Replace albert.einstein with your own username

The primary SSH portal is ssh.igwn.org, hosted at CIT:

ssh albert.einstein@ssh.igwn.org

The secondary SSH portal, ssh2.igwn.org, is hosted at IUCAA in India to provide redundancy if the primary portal is unavailable, and to reduce latency for users connecting from in and around the Indian subcontinent:

ssh albert.einstein@ssh2.igwn.org

Some older documentation refers to ssh.ligo.org / ssh2.ligo.org

Those hostnames should be replaced with ssh.igwn.org / ssh2.igwn.org.

If you haven't enrolled in Duo before, you'll see three enrollment links generated for your session, valid for a short time. Any one of the three works — copy one from your terminal into a browser address bar (don't copy the examples below, they're illustrative only):

Please enroll at https://api-4e2395ae.duosecurity.com/frame/portal/v4/enroll?code=f437387a4fedbb73&akey=DA7N3DC8X7Q67WQU4T9J

Please enroll at https://api-4e2395ae.duosecurity.com/frame/portal/v4/enroll?code=f0a5ec9db0165223&akey=DA7N3DC8X7Q67WQU4T9J

Please enroll at https://api-4e2395ae.duosecurity.com/frame/portal/v4/enroll?code=f53e56cf4532f780&akey=DA7N3DC8X7Q67WQU4T9J

On the enrollment page, choose Duo Mobile app — macOS may suggest Touch ID and Windows may suggest Windows Hello, but neither is supported here (see the warning above).

Method 2: using an SSH proxy

This method configures SSH to automatically proxy through the right host when you connect directly to a machine on one of the clusters. Steps 1–7 below apply to this method.

1. Create the proxy config files

Replace albert.einstein with your own username

Create the files below in ~/.ssh/, one per site you need to reach.

Host sshproxy
  Hostname sshproxy.ligo.caltech.edu
  User albert.einstein
  ControlMaster auto
  ControlPersist 2h
  ControlPath ~/.ssh/sockets/%r@%h:%p
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

Host *.ligo.caltech.edu
  User albert.einstein
  ForwardAgent yes
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ProxyJump sshproxy

Host sshproxy.ligo-wa.caltech.edu
  Hostname sshproxy.ligo-wa.caltech.edu
  User albert.einstein
  ControlMaster auto
  ControlPersist 2h
  ControlPath ~/.ssh/sockets/%r@%h:%p
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

Host *.ligo-wa.caltech.edu !sshproxy.ligo-wa.caltech.edu
  User albert.einstein
  ForwardAgent yes
  PubkeyAuthentication yes
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ProxyJump sshproxy.ligo-wa.caltech.edu

Host sshproxy.ligo-la.caltech.edu
  Hostname sshproxy.ligo-la.caltech.edu
  User albert.einstein
  ControlMaster auto
  ControlPersist 2h
  ControlPath ~/.ssh/sockets/%r@%h:%p
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes

Host *.ligo-la.caltech.edu !sshproxy.ligo-la.caltech.edu
  User albert.einstein
  ForwardAgent yes
  PubkeyAuthentication yes
  GSSAPIAuthentication yes
  GSSAPIDelegateCredentials yes
  ProxyJump sshproxy.ligo-la.caltech.edu

2. Create the sockets directory

mkdir -p ~/.ssh/sockets

3. Include the proxy configs from ~/.ssh/config

Add this line to the top of ~/.ssh/config:

Include ~/.ssh/citproxy ~/.ssh/lhoproxy ~/.ssh/lloproxy

4. Connect

Make sure an SSH agent is running:

eval "$(ssh-agent -s)"

(or check with ssh-add -l), then add your passphrase-protected key:

ssh-add ~/.ssh/my_password_protected_ssh_key

Now connect to a machine on the appropriate cluster, for example:

ssh ldas-grid.ligo.caltech.edu

If you haven't enrolled before, you'll see the same three enrollment links described in Method 1 above — use any one of them.

5. An enrollment example

Sample screenshots of the enrollment flow are available in the computing/iam/mfa screenshots directory.

6. Test your login

% ssh ldas-grid.ligo.caltech.edu
(albert.einstein@sshproxy.ligo.caltech.edu) Duo two-factor login for albert.einstein

Enter a passcode or select one of the following options:

 1. Duo Push to iOS

Passcode or option (1-1): 1
Success. Logging you in...

After typing 1, the Duo Mobile app on your phone will prompt you to verify the login.

No push notification? Use a passcode instead

Open the Duo app, select your LIGO account, tap Show to see a 6-digit passcode (e.g. 123 456), then enter that instead of 1 above. This works even if your phone has no cell signal, since it doesn't rely on receiving the push message.

7. Disabling Duo for a site

To stop using the SSH proxy method for a given site, comment out its Include line in ~/.ssh/config (prefix with #).

Using scp to transfer files

To use scp, first follow Method 2 above. Once an SSH socket connection is alive, scp can reuse it in the usual way.

Next steps