Remote Access

SSH Protocol

The Secure SHell protocol is a cryptographic network protocol meant to allow secure connections on an otherwise unsecured network.

While this page will focus on how to use the ssh command, bundled in the openssh package, to obtain login prompts on CS machines and for file transferts, note that it can be used for many networking task including port forwarding, tunneling, network filesystems, etc.

Remote Login

The syntax to login to a remote machine is as follow:

$ ssh USERNAME@HOSTNAME.DOMAIN

Here you will want to use your CS username (see the Accounts section for more information) or your "first.last" name for McGill campus login (not recommanded).

All available public resources (and their hostnames) are listed under the Resources section. The domain will always be cs.mcgill.ca for all CS machines.

For example, I could type

$ ssh dlevac@lab1-1.cs.mcgill.ca

to login to one of the workstation in TR 3110 or

$ ssh dlevac@teaching.cs.mcgill.ca

to login to our public general purpose server.

Note that if you want to invoke graphical application over SSH, you will need to specify the -Y option to allow forwarding of X graphical data (will only work on Linux), as follow:

$ ssh -Y dlevac@teaching.cs.mcgill.ca

File Transfert

openssh includes many utility for file transfert. The simplest to use, if you are used to the cp command, is probably scp, which uses almost the same syntax:

$ scp [-r] SOURCE_USERNAME@SOURCE_FQDN:SOURCE_PATH DESTINATION_USERNAME@DESTINATION_FQDN:DESTINATION_PATH

where FQDN stands for "Fully Qualified Domain Name" which basically mean HOSTNAME.DOMAIN. The -r option can be used to specify we wish to copy directories.

Here are some examples of file transfert, note that if the source or destination host is not specified, it is assumed to be the local host.

$ scp test_file dlevac@teaching.cs.mcgill.ca:~/

will send the test file in the current working directory on my local host to my home directory on teaching.cs.mcgill.ca.

$ scp dlevac@cs-1.cs.mcgill.ca:/tmp/a dlevac@cs-2.cs.mcgill.ca:/tmp/b

would send the file /tmp/a on host cs-1 to /tmp/b on host cs-2.

Other file transfert utility includes sftp and rsync, but they are beyond the scope of this documentation.

SSH Keys

Password authentication for remote login can become tedious on top of being a security liability. SSH keys, based on public key cryptography, will allow you to remotely login without a password.

The idea is that you will create 2 files: a public and a private one. You will copy the public key file on every machine you want access to without using a password (in CS, your home directory is the same everywhere, so you do not need to copy the file at all).

When you try logging in without password to a machine that knows your public key; it will authenticate you by asking your machine a question that can only be answered by knowing what the private key is. Thus, it will be your responsability to ensure the private key remains private.

Obviously, most of this will happen in the background. To generate an SSH key, simply run the following command:

$ ssh-keygen -b 4096

By default it will write your public key to $HOME/.ssh/id_rsa.pub and your private key to $HOME/.ssh/id_rsa. If you decided to encrypt your private key for more security, by choosing a passphrase, you can make your SSH agent remember the passphrase for the current session by running the command:

$ ssh-add

If you ran the key generation command on a CS machine, you are good to go. Otherwise, copy your public key to $HOME/.ssh/id_rsa.pub on every machine you want to be able to connect to without a password. You may want to use the special command

$ ssh-copy-id USERNAME@FQDN

to handle the distribution of your public key.

SSH on Windows

The openssh package is now available natively on Windows since version 1803. It can thus be invoked directly from the cmd program. If that is unsatisfactory to you, you can take a look into a GUI application like MobaXterm (recommanded) or PuTTY (legacy option).

Being Nice

When using a CS machine remotely, we ask you to be concious of other users and make sure not to run a task that will deplete the machine resources. In the case of memory, it is very application dependant, but if you suspect your task will hog the CPU, you can lower its priority with the nice command as follow:

$ nice -n 10 COMMAND

The argument to the -n option can be anything between 0 (normal priority) and 20 (lowest priority).

VPN

The department offer a VPN through PPTP and IPSec through the following 2 servers, depending on which protocol your client supports:

  • pptp.cs.mcgill.ca
  • ipsec.cs.mcgill.ca

The IPSec protocol is newer and should be preferred if your client supports it.

Use your Computer Science username in the username field.

Select the "password" authentication method (if configurable) and enter your Computer Science password.

If using IPSec, select the "shared key" machine authentication method. The shared key for our VPN server is "fish"