Multi Factor Authentication (MFA)#
Multi Factor Authentication (MFA) is an augmented level of security. As the name suggests, MFA requires additional steps with human intervention when authenticating.
MFA is mandatory for accessing the Access: Terminal Interface on the following VSC clusters:
Login to Open OnDemand#
KU Leuven/UHasselt Users from all VSC sites can access the Open OnDemand portal at KU Leuven site. For that, proceed to the Open OnDemand portal. If you are affiliated with KU Leuven, click on the KU Leuven logo. Otherwise, click on the VSC logo to choose your institute. You will be then forwarded to the Identity Provider (IdP) of your institute to complete the authentication procedure. Once that succeeds, you will automatically login to the Open OnDemand homepage.
Connecting with an SSH agent#
Note
Additional access restrictions (for instance when connecting from abroad or from a non-managed laptop) may apply, which require that you first authorize your connection on the VSC Firewall. See this page for more information.
Using an SSH Agent allows to store so-called SSH certificates which then are made available to any other client program needing to use that same connection. Getting an SSH certificate involves MFA but this only needs to be performed once since a certificate can be used multiple times as long as it remains valid.
There are two ways to acquire such an SSH certificate:
Works with any SSH client, including PuTTY and MobaXterm.
Uses the step CLI. On Windows, only works from PowerShell or the
Command Prompt, not from GUI clients such as PuTTY and MobaXterm.
VSC clusters that accept these certificates:
Once you have a certificate loaded into your agent, it can be used as long as the agent remains alive and the certificate itself has not expired (they have a lifetime of 16 hours). Do not forget to set up your client so that it contacts your SSH agent when opening new connections (thereby making use of the certificates). For a few common clients the corresponding documentation pages are listed below.
Connecting without an SSH agent#
Most clients (such as PuTTY or MobaXterm) can also be made to work without an SSH Agent. Keep in mind, however, that this approach tends to be less convenient since each new connection will require multi-factor authentication.
Certain clients (such as FileZilla or sshfs)
furthermore do not show you the firewall
link needed for the MFA and hence can only function in combination with an SSH
agent holding an SSH certificate.
This being said, the agentless procedure runs as follows:
Connect to a Tier-2 login node using your chosen client application (e.g. MobaXterm).
The application is then supposed to show the link to complete the MFA procedure (similar to the previous section).
After passing the MFA challenge, you should now be connected to a login node. In plain SSH connections a successful login is rewarded with a welcome message:
