> home > support > FAQ > ssh_forwarding

Logging into HPCx without a password

Logging in without a password

To enable TotalView to connect to your parallel programs, you must be able to log in to HPCx using ssh without supplying a password. Having logged in to HPCx, you must also allow subsequent processes (such as TotalView) to use ssh in the same way; this is termed "Agent Forwarding". This involves configuring ssh appropriately on both HPCx and your local machine.

Agent forwarding on HPCx

All users should edit the file ~/.ssh/config on login.hpcx.ac.uk so that it includes the line:

  ForwardAgent yes

Agent forwarding on your workstation

This is done differently depending on whether you are logging in to HPCx from a Unix or Windows machine.

Note on logging in from a Windows machine

To display graphical applications you must already be running an X-server such as eXceed. The way in which you should configure agent forwarding depends on how exactly how you log in to HPCx. If you prefer to run "ssh" from an existing Unix window then you need to follow the instructions for Unix. However, if you log in using a Windows implementation of ssh (such as PuTTY) then you must follow the instructions for Windows machine.

Agent forwarding on a Unix machine

You should do the following:

Edit ~/.ssh/config on your local workstation to include the line
```
  ForwardAgent yes
```
On your workstation, issue the command:
```
  ssh-keygen -b 1024 -C "A Comment" -t dsa
```
This will save a private key in ~/.ssh/id_dsa and a public key in ~/.ssh/id_dsa.pub. You should enter a passphrase when prompted. Note that you must keep this passphrase as secure as your HPCx password.
Copy the public key, namely ~/.ssh/id_dsa.pub, to login.hpcx.ac.uk in the file ~/.ssh/authorized_keys2 (or append to the current version). Each entry must take the form of a single long line with no carriage returns.
Log in to HPCx from your local workstation. You should see something similar to:
```
  Enter passphrase for key '~/.ssh/id_dsa':
```
and you should be logged on once the passphrase is entered.

You must now automate the use of the key so that the passphrase is entered once rather than for every individual login. On your local workstation run:

  user@workstation$ eval `ssh-agent`
  Agent pid 12345
  user@workstation$ ssh-add
  Enter passphrase for /home/user/.ssh/id_dsa: 
  Identity added: /home/user/.ssh/id_dsa (/home/user/.ssh/id_dsa)

(note that the quotes around `ssh-agent` are back-quotes, usually top-left key on a standard keyboard, not normal quotes).

This caches your passphrase so that you will not need to re-enter it for subsequent logins from this session. If you now issue

  user@workstation$ ssh login.hpcx.ac.uk

then you should be logged in without having to supply any additional passphrases or passwords. Once you can do this, you should be able to run TotalView on HPCx.

Agent forwarding on a Windows machine

A simple way to do this is to use Puttygen, part of the PuTTY suite available from http://www.chiark.greenend.org.uk/~sgtatham/putty/. If you use the automatic PuTTY installer then it may fail if you select the "Associate .PPK files (PuTTY Private Key) with Pageant" box. If this causes a problem then you should uncheck this option and do the association by hand later on (by right-clicking on a ".PPK" file and choosing "open with").

You should run Puttygen and then:

Select one of the SSH2 type keys: SSH2RSA or SSH2DSA. This is a personal choice but DSA is considered more secure. Click the "generate" button and move the mouse as requested.
Add a good passphrase (more than one word can be used) to the key and optionally change the comment. Save the public key (pubkey.txt) and private key (something.ppk).
Before exiting Puttygen, cut and paste the public key text from the window into the file ~/.ssh/authorized_keys2 on login.hpcx.ac.uk.
Start Putty and edit the configuration for your login.hpcx.ac.uk session so that you select Allow agent forwarding in Category Connection => SSH => Auth

The login process may then be automated with an agent. The PuTTY agent for this is called Pageant. Once you have associated ".PPK" files with Pageant, you simply need to double-click on your private key file and enter the appropriate passphrase. After you have done this you should be able to log in to HPCx using PuTTY without having to specify a password.

Running graphical applications via ssh

It is possible to configure ssh to automatically forward the output of graphical applications to your workstation. For this to work, you must NOT set the DISPLAY variable by hand; it will be set automatically for you. Normally this should simply happen, but if you are having problems you can try the following:

add the following line to your ~/.ssh/config files:
```
  ForwardX11 yes
```
If you are using PuTTY from a PC, edit the configuration for your login.hpcx.ac.uk session so that in addition to agent forwarding you select Enable X11 forwarding in Category Connection => SSH => Tunnels

Certain ssh implementations feature trusted X11 forwarding (-Y option for ssh) which can also be used to resolve potential DISPLAY problems. spacer

http://www.hpcx.ac.uk/support/FAQ/ssh_forwarding.html

contact email - www@hpcx.ac.uk