Dear DECF User.
This message applies to anyone who needs to ssh to any DECF computers, including kepler.berkeley.edu and Linux cluster. Please ignore this message if you don't SSH to DECF servers. If you don't know what SSH is, you can safely ignore this message. If you don't know anything about private/public keys, you can probably ignore this message as well.
Between now and the end of February, we will be migrating all of our 70+ servers from Secure Shell SSH to OpenSSH in order to comply with Campus Minimum Security Standards. Users who use OpenSSH will now be able to scp to our servers, which they can not do right now.
There are some implementation differences between OpenSSH and Secure Shell SSH. Specifically, public/private keys generated by OpenSSH server are not compatible with SecureShell SSH.
1. What is the migration plan?
Since there are a large number of servers, the plan is to convert them in batches. We will convert Archipelagoes, Reindeer clusters first, then 1171/1111 clusters and kepler together. We want to address any migration issues between our machines first. kepler.berkeley.edu is last as this is the login machine and users login in remotely may encounter some issues.
The migration timeline is as follows:
2/1 - 2/5 Install OpenSSH on Archipelagos and Reindeer cluster
2/6 - 2/11 Install OpenSSH on 1111 & 1171 Etcheverry clusters
2/12, 9PM Convert kepler.berkeley.edu to OpenSSH
2. How does this affect me?
For 99% of users users, nothing will change. We have worked behind the scenes to convert all SecureShell SSH keys to OpenSSH. This means that if you ssh between DECF cluster machines, you should see no difference other than a warning that you're adding new hostkeys keys. We have identified around 20 users who have keys with passphrases, which we were unable to convert. These users will be notified separately with instructions.
3. I use Secure Shell SSH as a client, does this affect me?
If you're using a Windows Secure Shell SSH client, this should not
affect you when you connect to kepler.berkeley.edu. Please see
question #6 if you have problems.
If you're coming from a Unix machine, you *may* encounter an error
message. Please also see answer to question #6. If you're running a
batch script that connects to kepler, please see question #5.
4. I use openssh as a client, does this affect me?
You may see a hostkey has changed error message when you try to
connect to kepler. Please see question
#6. Another possible problem is if you use passphrases, please see
question #7.
5. I run a script that ssh's to kepler.berkeley.edu directly, will this
affect me?
If your script is between DECF clusters, you shouldn't run into any
issues because we converted your keys for you. If your script is
between your own machine and our machine, you most likely were one of
the 20 users we identified and should have received an email with
detailed instructions. If not, please email
consult@newton.berkeley.edu
6. What if I get an error message when I try to login?
You may get dire "WARNING" message stating that a
key has changed and maybe something bad has happened. You
can fix the problem by deleting the key mentioned in the
warning message on the client end. A new key will be added the next
time you log in. For any other types of error message, please email
consult@newton.berkeley.edu
7. I generated a public/private hostkey pair use a passphrase to login to
kepler.berkeley.edu or the cluster machines. Does this affect me?
If your passphrase or null passphrase set up is between DECF machines,
you will not be affected because we converted your keys for you
already.
If your setup is between your machine and our machine, you may
encounter a problem. This will only happen if you are running Secure
Shell SSH on your end as a client. (On unix machines, type ssh -V to
see what type of SSH client you're running) You should have received
an email from us with detailed instructions. If not, please email
us. You basically have to convert your keys to the right format due
to compatibility issues between the two server types.
Instructions for converting Secure Shell SSH keys to OpenSSH are at:
http://www.decf.berkeley.edu/help/apps/ssh/index.html
Subscribe To
Posts
Comments