How to Setup password-less Logins

WARNING: This page is obsolete.

Please look at https://atlas-software.docs.cern.ch/analysis/analysis_tutorial/basicSetup/passwordless_login/.

Step1: Kerberos Configuration (for lxplus)

Linux

First, ensure that kerberos authentication works on your machine. If you need to set it up, see these instructions. To test, do

\kinit <your lxplus username>@CERN.CH

and check if klist -f shows "F" in the flags section.

if your site cannot configure kerberos, then you can also put this in your login scripts after ATLAS_LOCAL_ROOT_BASE is defined:

export KRB5_CONFIG=$ATLAS_LOCAL_ROOT_BASE/user/krb5.conf

and retry the kinit command above.

MacOS

To your local directory:

• either download krb5-MacOS.conf
• or copy /cvmfs/atlas.cern.ch/repo/ATLASLocalRootBase/user/krb5-MacOS.conf

Define this (eg in your .bash_login script and open a new terminal session on your Mac)

• export KRB5_CONFIG=<path>/krb5-MacOS.conf

To test, do

\kinit --keychain <your lxplus username>@CERN.CH

and check if klist -f shows "F" in the flags section.

Note that the above test saved the password in your keychain. From now on, when you do kinit <your lxplus username>@CERN.CH you will not be asked for your password.

Step 2: SSH Keys and Password-less login for non-lxplus machine (eg Tier3 and University)

• Create a key and enter a password (It is dangerous to not set a passphrase for shell accounts. Your only protection is your passphrase. This is particularly important for laptops.).
  

      ssh-keygen -b 4096 -t rsa 

  Note that the default key file will be id_rsa and id_rsa.pub but you can create it with a different name (in case you need different keys for different remote hosts but try not to do that unless you have good reason !) by adding the option -f ~/.ssh/<filename>.

• Copy the public key to your remote machine; replace <username> and <remote machine name> below.

    ssh-copy-id -i $HOME/.ssh/id_rsa <username>@<remote machine name>

Step 3: Create ssh Configuration File

Linux

• Create this file : mkdir -p ~/.ssh/controlmasters
• Create a file ~/.ssh/config. There is a template you can copy from $ATLAS_LOCAL_ROOT_BASE/user/sshConfig) or cut and paste from https://gitlab.cern.ch/atlas-tier3sw/ATLASLocalRootBase/-/raw/master/user/sshConfig?ref_type=heads

Make sure the permissions of the ~/.ssh directory and its contents have permissions set correctly; an example is

  chmod 700 ~/.ssh
  chmod 600 ~/.ssh/id_rsa
  chmod 644 ~/.ssh/config ~/.ssh/id_rsa.pub

MacOS

This will work only for Mac OS X.

You can store your identity file on your keychain so that your password will not be prompted. Do this once:

• ssh-add --apple-use-keychain ~/.ssh/id_rsa

* Create this file : mkdir -p ~/.ssh/controlmasters * Create a file ~/.ssh/config. There is a template you can copy from $ATLAS_LOCAL_ROOT_BASE/user/sshConfig) or cut and paste from https://gitlab.cern.ch/atlas-tier3sw/ATLASLocalRootBase/-/raw/master/user/sshConfig?ref_type=heads

Make sure the permissions of the ~/.ssh directory and its contents have permissions set correctly; an example is

  chmod 700 ~/.ssh
  chmod 600 ~/.ssh/id_rsa
  chmod 644 ~/.ssh/config ~/.ssh/id_rsa.pub

Usage

For lxplus, you will use kerberos authentication and it should not ask you for a password.

• get a valid ticket (lasts for 24h at most) - MacOS users with kerberos stored in Keychains do not need to do this step
  • kinit <your lxplus username>@CERN.CH
• With a valid ticket (klist will show validity):
  • ssh lxplus.cern.ch

Starting from September 2025, lxplus logins will require 2FA (2 Factor Authentication) after login. The ~/.ssh/config file has contromasters defined so that you need to only enter 2FA once for the first ssh session, whose connection will be shared by subsequent ssh connections.

For other machines, you will be asked for your ssh public key password (not your login password to the machine).

Some Useful Commands

if you make changes in login scripts, do not log out of the terminal session until you successfully test using another terminal session.

• Controlmaster useful commands:
  • To bypass controlmaster;
    • ssh -S none <hostname>
  • To check if an active controlmaster exists;
    • ssh -O check <hostname>
  • To stop an active controlmaster (keeps all active sessions open)
    • ssh -O stop <hostname>
  • To stop and exit all current controlmaster sessions (will not close sessions if you have used -O stop first);
    • ssh -O exit <hostname>

• Tip: (not on lxplus) define in the your .bash_profile an alias for kinit so that you can do a simple kinit to get your valid ticket. eg
  • alias kinit="\kinit desilva@CERN.CH"

• Tip: use the -A option for ssh to forward your authentication (see next section). eg:
  • alias lxplus="ssh -A lxplus.cern.ch"

• ssh-keygen -t rsa -p to change the passphrase of your ssh key. (or to add a passphase if you have a key without one now)

• ssh-keygen -l -f ~/.ssh/id_rsa.pub tells you information about your key; if the first field is not 4096, you may want to regenerate this with stronger 4k encryption.

• If you want to tunnel to another machine at CERN, use lxtunnel. This is what I do for example for logging in as a different user through tunnelling (not the -J option): alias aibuild3='export KRB5CCNAME =FILE:$HOME/.ssh/atlast3_krb5; \kinit -c $KRB5CCNAME atlast3@CERN.CH; ssh -J atlast3@lxtunnel.cern.ch atlast3@aibuild003.cern.ch; unset KRB5CCNAME '

• Example to tunnel into atlasgw machines which are accessible only on cern.ch: ssh -A -J lxtunnel.cern.ch atlasgw.cern.ch

• Note that with Safari (MacOS), you should be able to login to atlas protected pages with Kerberos one-click. For Firefox, see Firefox kerberos SSO page.

• if you use gitlab, you can add your ssh keys too:
  • login
  • Click on the top right corner (user pull down menu) and click on Preferences
  • From the icon next to "User Settings"on the top left, select "SSH Keys" and follow the instructions.

So far, the only advantage you have is security - not having to transmit the password of the remote account. Now let's take this one step further so that you can avoid having to type in the passphrase more than once.

Using ssh-agent

If you are using a Mac, Keychains will store your ssh key passphrase so you will not have to type it each time. This way, it is really painless to remote login to any machine which has your public key. However, take care not to leave your desktop unlocked when you are away.

You will not need to do anything else for Linux either if you are on a GUI desktop or if you had logged in from a machine with ssh -A .... to forward the authentication agent to the new machine's session. SSH agent forwarding is useful if your private key is on system A, and you need to log in to system C via system B because A does not have direct network access to C. This avoids the need to store your private key on system B. Also look at "ForwardAgent" in the ssh_config man page to see an alternative to the -A command line option.

If your OS does not have ssh agent, eg you are not logged into a GUI Linux machine, you can run sshAgent manually once on that machine per session. The script attached to this Twiki page, when sourced, will start an ssh agent for your machine.

-- AsokaDeSilva - 15 May 2008