diff --git a/README.md b/README.md index 618599d..e024163 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ -***Globus Data Transfer outage scheduled for February 4th 2026 09:00-13:00 PST. [More details here](changelog.md)*** Welcome to the SLAC Shared Scientific Data Facility (S3DF) at SLAC National Accelerator Laboratory. -**Upcoming Maintenance on S3DF DTN nodes: 2026-04-21 10:00AM to 11:00AM PT. [More details here](changelog.md)** +**Starting on June 30th 2026, Multi-Factor Authentication with SLAC Account will be required for login bastion, DTN bastion and NoMachine services. [More details here](changelog.md)** + S3DF is a compute, storage, and network architecture designed to support massive scale analytics required by SLAC experimental facilities @@ -26,7 +26,7 @@ The table below lists various S3DF resources and where they can be found. | Resource | Access Point | | :--- | :--- | -| SSH | s3dflogin-mfa.slac.stanford.edu | +| SSH | s3dflogin.slac.stanford.edu | | SSH Key Service | https://s3df-sshkeys.slac.stanford.edu/ | | NoMachine | s3dfnx.slac.stanford.edu | | OnDemand | [https://s3df.slac.stanford.edu/ondemand](/ondemand ':ignore') | diff --git a/access.md b/access.md index 8008b92..98d84e2 100644 --- a/access.md +++ b/access.md @@ -12,19 +12,45 @@ In order to access S3DF, you must first obtain a [SLAC Account](accounts.md). Yo ## SSH You can connect using any SSH client, such as [OpenSSH](www.openssh.com) or [PuTTY](https://www.chiark.greenend.org.uk/~sgtatham/putty/), -to connect to the S3DF load-balanced bastion pool `s3dflogin-mfa.slac.stanford.edu`. -These hosts require multi-factor authentication; for more information on working with MFA systems, -please see [SSH and MFA](sshmfa_user.md). +to connect to the S3DF load-balanced bastion pool `s3dflogin.slac.stanford.edu`. +These hosts require multi-factor authentication; for more information on working with MFA systems, please see [SSH and MFA](sshmfa_user.md). Example: ``` -ssh @s3dflogin-mfa.slac.stanford.edu +ssh @s3dflogin.slac.stanford.edu ``` ?> Note that these nodes do not have access to storage (except for your home directory). From these bastion hosts, you should hop to an [Interactive Node](interactive-compute.md#interactive-pools) to access S3DF batch compute and storage. -?> Windows users may see an error message about a "*Corrupted MAC on input*" or "*message authentication code incorrect.*" The workaround is to add "*-m hmac-sha2-512*" to the ssh command, i.e. `ssh -m hmac-sha2-512 @s3dflogin-mfa.slac.stanford.edu` +?> Windows users may see an error message about a "*Corrupted MAC on input*" or "*message authentication code incorrect.*" The workaround is to add "*-m hmac-sha2-512*" to the ssh command, i.e. `ssh -m hmac-sha2-512 @s3dflogin.slac.stanford.edu` +### Connecting Directly to an Interactive Node +If you'd like to connect directly to an interactice node in one step, you can use the login node as a "jump proxy." + +#### On the Command Line +On the command line, it would look like this: +``` +ssh -J s3dflogin.slac.stanford.edu iana +``` +* The `-J` sets `s3dflogin.slac.stanford.edu` as the jump proxy host. +* `iana` is the target node relative to the jump proxy. +On execution, this command opens a connection to `s3dflogin.slac.stanford.edu` as normal, using MFA as normal. Then, instead of showing a terminal on the login node, a connection is immediately opened to the target node, `iana`. + +#### In your SSH Config +To configure a jump host in your SSH config (typically `~/.ssh/config`), you can define hosts like this: + +```ini +Host s3dflogin + Hostname s3dflogin.slac.stanford.edu +``` + +You can then define additional hosts and reference the jump proxy to "jump through to." +```ini +Host iana + Hostname iana + ProxyJump s3dflogin +``` +With these two entries in place, running `ssh iana` on your local machine will establish the proxy connection to `s3dflogin.slac.stanford.edu` and then connect to `iana` from there. Credentials will be prompted for as usual. ## NoMachine @@ -52,7 +78,7 @@ The S3DF NoMachine cluster can be accessed via: The S3DF NoMachine cluster can also be accessed in a browser by going to the following link: [https://s3dfnx.slac.stanford.edu:4443/](https://s3dfnx.slac.stanford.edu:4443/) - Enter your SLAC UNIX credentials to access the S3DF NoMachine web client. + Enter your SLAC account credentials to access the S3DF NoMachine web client. ?> The login method for S3DF NoMachine connections will be updated to use SLAC Account Single Sign-On (SSO) and Duo Multi-factor Authentication in the near future. For more information about SLAC SSO and MFA, see: [https://it.slac.stanford.edu/support/KB0010216](https://it.slac.stanford.edu/support/KB0010216) diff --git a/assets/nx_mfa.png b/assets/nx_mfa.png new file mode 100644 index 0000000..5c207d8 Binary files /dev/null and b/assets/nx_mfa.png differ diff --git a/beginnerguide.md b/beginnerguide.md index 064ddd1..f3f1919 100644 --- a/beginnerguide.md +++ b/beginnerguide.md @@ -20,7 +20,7 @@ This example provides a clear, step-by-step workflow for running software on S3D To start, connect to a bastion node using the following command: - ssh username@s3dflogin-mfa.slac.stanford.edu + ssh username@s3dflogin.slac.stanford.edu ### Connect to an Interactive Node diff --git a/changelog.md b/changelog.md index 766a98d..abc9da7 100644 --- a/changelog.md +++ b/changelog.md @@ -8,11 +8,23 @@ |When |Duration | What | | --- | --- | --- | +| June 30th 2026 | 10:00-12:00 PDT (planned) | Disabling legacy Unix authentication for public-facing S3DF bastion services. Once complete, **SLAC Account with MFA will be required for s3dflogin.slac.stanford.edu, s3dfdtn.slac.stanford.edu and NoMachine s3dfnx.slac.stanford.edu.** + +If you are unsure of your SLAC Account status, use the following link to check: +https://ad-account.slac.stanford.edu +The app will give you the option of provisioning your SLAC Account OR report “You already have SSO (windows) account”. + +You can test our SSH MFA workflow via the s3dflogin-mfa.slac.stanford.edu pool. We also provide an MFA-enabled SSH key management service. Full details can be found on this page: https://s3df.slac.stanford.edu/#/sshmfa_user +S3DF web services with central authentication already use MFA - this includes https://s3df.slac.stanford.edu/ondemand and https://coact.slac.stanford.edu . + +If you are unable to authenticate with MFA it’s possible your SLAC account may require reactivation or a password reset. +Please send email to s3df-help@slac.stanford.edu for assistance. ### Past |When |Duration | What | | --- | --- | --- | +| June 13th 2026 08:40-10:00 PDT | 1hr 20mins (unplanned) | Weka filesystem for k8s entered a degraded state and stopped serving I/Os. Support team succesfully recovered the cluster. | April 21st 2026 10:00-11:00 PDT | 1 hr (planned) | DTN nodes s3dfdtn.slac.stanford.edu, sdfdtn[001-006] will be rebooted during the maintenance window to apply security updates. This may interrupt currently-running transfers. Reboots will be done in batches to minimize disruption. | February 4th 2026 | 9:00-13:00 PST (planned) | Shutdown the Globus node  “sdfdtn004” for a network card upgrade. | March 18th 2026 11:00-12:00 PDT | 1 hr (planned) | DNS maintenance for s3dflogin s3dflogin-mfa s3dfdtn diff --git a/interactive-compute.md b/interactive-compute.md index eb0c274..6803efb 100644 --- a/interactive-compute.md +++ b/interactive-compute.md @@ -6,7 +6,7 @@ In order to access compute and storage resources in S3DF, you will need to log onto our interactive nodes. After, login to our bastion hosts either via a [ssh terminal session or via NoMachine](access.md), you will then need to ssh to one of the interactive pools to access the data, build/debug your code, run simple analyses, or submit jobs to the [batch system](batch-compute.md). If your organization has acquired dedicated resources for the interactive pools, use them; otherwise, you can connect to the S3DF shared interactive pool. -?> Note: After log in into our bastion hosts with `ssh s3dflogin-mfa.slac.stanford.edu`, you will need to then need to log into our interactive nodes to access batch compute and data. You can do this via `ssh ` within your ssh session (same terminal) to get into the bastion hosts. +?> Note: After log in into our bastion hosts with `ssh s3dflogin.slac.stanford.edu`, you will need to then need to log into our interactive nodes to access batch compute and data. You can do this via `ssh ` within your ssh session (same terminal) to get into the bastion hosts. The currently available pools are shown in the table below (The facility can be any organization, program, project, or group that interfaces with S3DF to acquire resources). diff --git a/sshmfa_user.md b/sshmfa_user.md index dd7ea72..fa5af30 100644 --- a/sshmfa_user.md +++ b/sshmfa_user.md @@ -2,15 +2,13 @@ ## SSH and Multi-Factor -Multi-Factor Authentication (MFA) provides an additional layer of security for users. As a preliminary rollout, MFA has been configured on the `s3dflogin-mfa.slac.stanford.edu` bastion hosts. **A SLAC Account is required**. There are two methods to SSH into S3DF using a SLAC Account - using a password and MFA challenge, or via centrally managed SSH Keys. - -?> The legacy SSH using SLAC Unix Computer accounts via `s3dflogin.slac.stanford.edu` will still be available as we introduce SSH with SLAC Accounts. **Once all S3DF users have been migrated to SLAC Accounts, we will deprecate all SLAC Unix SSH logon services and SLAC Accounts will be required for all SSH bastion logins.** `s3dflogin-mfa.slac.stanford.edu` is the current bastion name for SSH with SLAC Accounts until we complete this transition. +Multi-Factor Authentication (MFA) provides an additional layer of security for users. **A SLAC Account is required**. There are two methods to SSH into S3DF using a SLAC Account - using a password and MFA challenge, or via centrally managed SSH Keys. ## Passwords with MFA :id=passwords ?> If you do not already have Duo configured, please see SLAC's documentation [here](https://it.slac.stanford.edu/support/KB0010216) -1. When using password login, please use your SLAC Account (formerly "SLAC Windows account") credentials when connecting with SSH to `s3dflogin-mfa.slac.stanford.edu`. +1. When using password login, please use your SLAC Account (formerly "SLAC Windows account") credentials when connecting with SSH to `s3dflogin.slac.stanford.edu`. 2. You will be prompted for your SLAC Account password @@ -21,10 +19,20 @@ Multi-Factor Authentication (MFA) provides an additional layer of security for u * Enter option `2` to send an SMS message to your phone * Activate your registered security key (such as a Yubikey) +### NoMachine Passwords with MFA +Using the Mult-Factor Authentication flow with NoMachien (such as connecting to `sdfnx.slac.stanford.edu`) is largely the same as using SSH (as above). +After entering your username and password, you will be presented with this prompt: + +![NoMachine MFA prompt](assets/nx_mfa.png) +Your options are: +* Active your registered security key (such as a Yubikey) so its generated passcode is entired in the text field and push OK. +* Enter `1` in the text box and press OK to push a notification to your Duo app +* Enter `2` in the text box and press OK to send an SMS message to your phone + ## SSH Keys with MFA :id=sshkeys -To use SSH key login, public keys must be registered with the S3DF key management system in order to be used with `s3dflogin-mfa.slac.stanford.edu` bastion hosts. +To use SSH key login, public keys must be registered with the S3DF key management system in order to be used with `s3dflogin.slac.stanford.edu` bastion hosts. An SSH key can be used to log in as long as it is **valid**. * A **valid** key has been refreshed in the last **25 hours**