Hprc banner tamu.png

Difference between revisions of "Two Factor"

From TAMU HPRC
Jump to: navigation, search
(Duo With FTP, SSH Clients)
(MobaXterm (Windows only))
 
(19 intermediate revisions by 7 users not shown)
Line 1: Line 1:
 
==Logging in With Two-Factor Authentication==
 
==Logging in With Two-Factor Authentication==
'''Starting November 4th, 2019''', two-factor authentication will be required to login to any cluster. This is most commonly done with Duo, which can be set up by following [https://hprc.tamu.edu/wiki/IT_Info#Two-Factor_Authentication_Requirement these instructions].
+
'''Starting November 4th, 2019, two-factor authentication will be required to login to any cluster.'''
 +
 
 +
This is most commonly done with Duo, which can be set up by following [https://hprc.tamu.edu/wiki/IT_Info#Two-Factor_Authentication_Requirement these instructions].
  
 
When enabled, the login prompt will add the following information following successful password entry:
 
When enabled, the login prompt will add the following information following successful password entry:
Line 27: Line 29:
 
'''NOTE: If you are facing issues with login, please ensure that your password is not saved in your FTP client, as this will not allow Duo to function properly.'''
 
'''NOTE: If you are facing issues with login, please ensure that your password is not saved in your FTP client, as this will not allow Duo to function properly.'''
  
===Filezilla===
+
===MobaXterm (Windows only)===
'''NOTE: Filezilla is known to require a two factor authentication for each file needing to be transferred. Due to this inefficiency, Filezilla is no longer recommended for file transfers.'''  
+
====Option 1:====
 +
1. On the top left corner of MobaXterm window, click 'Session' button.<br>
 +
[[File:moba-0.png | 700px | center]]
  
1. From the menu bar at the top of the screen select File > Site Manager
+
2. You will be prompted with a window which asks for your session settings.
  
2. Click the 'New Site' button
+
3. Enter the 'Remote Host' (e.g. faster.hprc.tamu.edu, grace.hprc.tamu.edu, etc.) you would like to connect to.
  
3. In the General settings tab, set the protocol to SFTP - SSH File Transfer Protocol
+
4. Select 'Specify', then enter your username (your NetID).
  
4. Set the host to the hostname of the cluster you're attempting to connect to (e.g. ada.tamu.edu)
+
5. Enter the 'Port Number' 22 (the default should be 22).<br>
 +
[[File:moba-1.png | 700px | center]]
  
5. Set the port to 22
+
6. Press enter.
  
6. Set the logon type to 'Interactive'
+
7. You will be prompt to authentication with Duo (either using mobile app, text message or call).
  
7. In the resulting dialog, select 'Do Not Save Passwords'
+
8. If you wish to open the session again, open the 'Session' tab on the left side of the screen and double-click the appropriate session to launch.<br>
 +
[[File:moba-2.png | 700px | center]]
  
8. In the next dialog, enter your NetID (NOT your UIN and NOT your full email)
+
====Option 2:====
  
9. If an 'Unknown host key' dialog appears, just click 'OK'
+
1. Select 'Start Local Terminal' in the home tab.
 +
[[File:Mobalocal.png | 800px | center]]
  
10. Continuing with login, an 'Enter password' dialog should apear. Enter your NetID password.
+
2. Type 'ssh NetID@cluster.tamu.edu', replacing the netID and cluster fields appropriately.  
  
11. A second 'Enter password' dialog will appear with the duo two factor authentication prompt. Choose your preferred option by entering the corresponding number into the password field, then click 'OK'
+
3. You will be prompted for your password with "netID@cluster.tamu.edu's password:." Do NOT type your password yet. Press 'Enter' until you are prompted with just "Password:."
  
12. On the secondary authentication device (e.g. mobile phone) approve the notification/phone call, and you will be logged into the cluster
+
4. Finally, type in your password and select a choice for Duo Authentication, once prompted.
  
===MobaXterm=== 
+
[[File:Twofactor.PNG | center]]
''Warning: we recommend not to save your session. This is known to cause issue with login.''
 
  
1. On the top left corner of MobaXterm window, click Session button.
 
  
2. You will be prompt with a window which asks for you Session settings.
+
'''File Transfer'''
  
3. Enter remote host (e.g. ada.tamu.edu, terra.tamu.edu, etc.)
+
1. On the top left corner of MobaXterm window, click Session button.
  
4. Select specify username, then enter your username (your netID).
+
2. Choose 'SFTP' session type.
  
5. Enter port number: 22 (the default should be 22).
+
3. Enter remote host (e.g. faster.hprc.tamu.edu, grace.hprc.tamu.edu, etc.) and username (your NetID).
  
6. Press enter.
+
4. Go to 'Advanced Sftp settings' and check '2-steps authentication' checkbox.  
  
7. You will be prompt to authentication with Duo (either using mobile app, text message or call).
+
5. Select 'Ok' to finish configuration of the SFTP session.
  
'''File Transfer'''
+
6. When you login with this SFTP session, there will be '''TWO''' pop-up windows. 
 +
* The first pop-up window will ask you for your password.  Enter your TAMU password here.
  
1. On the top left corner of MobaXterm window, click Session button.
+
[[File:Mobaxterm_password_prompt.png | 400px | center]]
  
2. Choose 'SFTP' session type.
+
* A second pop-up window will say "Duo two-factor login for NetID". Enter a number corresponding to one of your configured authentication methods (Push, Call, Text, Second device, etc). Select the appropriate option. '''Do not type your TAMU password again here.'''  
 
 
3. Enter remote host (e.g. ada.tamu.edu, terra.tamu.edu, etc.) and username (your netID).
 
 
 
4. Go to 'Advanced Sftp settings' and check '2-steps authentication' checkbox.
 
  
5. After you select 'Ok', you will be prompted with Duo Authentication method (Push, Call, Text, Second device, etc). Select the appropriate option. '''Do not type your TAMU password.''' 
+
[[File:Mobaxterm_duo_prompt.png | 800px | center]]
  
Example Duo Authentication methods (You won't see this, it is just to remind you of the format of Duo Authentication options)
+
'''Here are example Duo Authentication methods that would be shown when you SSH to a HPRC cluster login node.  You won't see this, it is just to remind you of the numbering format of Duo Authentication menu options.'''
  
 
<pre>
 
<pre>
Line 92: Line 94:
 
  3. Phone call to XXX-XXX-1234
 
  3. Phone call to XXX-XXX-1234
 
</pre>
 
</pre>
'''Your Duo settings will be different'''
+
 
 +
'''Your Duo settings will be different.'''
  
 
===WinSCP (Windows only)===
 
===WinSCP (Windows only)===
Line 108: Line 111:
 
6. Press Ok.
 
6. Press Ok.
  
Note: In most cases, the above steps should work. If they don't please follow these steps.
+
'''Note: In most cases, the above steps should work. If they don't please follow these steps.'''
  
 
3b. Starting with step 3. In the login windows, after you have entered your information (username, password, etc.) Click on advanced.
 
3b. Starting with step 3. In the login windows, after you have entered your information (username, password, etc.) Click on advanced.
Line 115: Line 118:
  
 
5b. Resume with step 3 specified in the above section.
 
5b. Resume with step 3 specified in the above section.
 
  
 
===File Transfer via Web Portal===
 
===File Transfer via Web Portal===
Line 132: Line 134:
  
 
For more information about OnDemand portal, please visit this [https://hprc.tamu.edu/wiki/SW:Portal link]
 
For more information about OnDemand portal, please visit this [https://hprc.tamu.edu/wiki/SW:Portal link]
 +
 +
===FileZilla===
 +
'''NOTE: FileZilla is known to require a two factor authentication for each file needing to be transferred. Due to this inefficiency, FileZilla is no longer recommended for file transfers.'''
  
 
===FAQ===
 
===FAQ===
Line 138: Line 143:
 
Your account will be locked after 7 failed login attempts. It will be automatically unlocked after 10 minutes. Please refer to above sections for updated instructions on how to use  
 
Your account will be locked after 7 failed login attempts. It will be automatically unlocked after 10 minutes. Please refer to above sections for updated instructions on how to use  
 
SSH, SFTP clients with duo authentication enabled.
 
SSH, SFTP clients with duo authentication enabled.
 +
 +
 +
[[ Category:HPRC ]] [[ Category:Ada ]] [[ Category:Terra ]] [[ Category:Grace ]]

Latest revision as of 23:35, 2 February 2023

Logging in With Two-Factor Authentication

Starting November 4th, 2019, two-factor authentication will be required to login to any cluster.

This is most commonly done with Duo, which can be set up by following these instructions.

When enabled, the login prompt will add the following information following successful password entry:

Duo two-factor login for netid

Enter a passcode or select one of the following options:

 1. Duo Push to XXX-XXX-1234
 2. Phone call to XXX-XXX-1234
 3. SMS passcodes to XXX-XXX-1234 (next code starts with: 9)

Passcode or option (1-3):

Any option can be selected. After successfully using Duo two-factor authentication, you will see the following message, be logged into your home directory, and can resume normal use.

Success. Logging you in...

Duo With FTP, SSH Clients

Before the implementation of two-factor authentication, FTP clients such as Filezilla or MobaXterm simply needed to send a username and password to successfully login. However, with the integration of Duo into the login process, the clusters must also send a prompt to select which form of two factor authentication to use. This extra step in the process requires some reconfiguring of the FTP client in order to successfully login.

NOTE: If you are facing issues with login, please ensure that your password is not saved in your FTP client, as this will not allow Duo to function properly.

MobaXterm (Windows only)

Option 1:

1. On the top left corner of MobaXterm window, click 'Session' button.

Moba-0.png

2. You will be prompted with a window which asks for your session settings.

3. Enter the 'Remote Host' (e.g. faster.hprc.tamu.edu, grace.hprc.tamu.edu, etc.) you would like to connect to.

4. Select 'Specify', then enter your username (your NetID).

5. Enter the 'Port Number' 22 (the default should be 22).

Moba-1.png

6. Press enter.

7. You will be prompt to authentication with Duo (either using mobile app, text message or call).

8. If you wish to open the session again, open the 'Session' tab on the left side of the screen and double-click the appropriate session to launch.

Moba-2.png

Option 2:

1. Select 'Start Local Terminal' in the home tab.

Mobalocal.png

2. Type 'ssh NetID@cluster.tamu.edu', replacing the netID and cluster fields appropriately.

3. You will be prompted for your password with "netID@cluster.tamu.edu's password:." Do NOT type your password yet. Press 'Enter' until you are prompted with just "Password:."

4. Finally, type in your password and select a choice for Duo Authentication, once prompted.

Twofactor.PNG


File Transfer

1. On the top left corner of MobaXterm window, click Session button.

2. Choose 'SFTP' session type.

3. Enter remote host (e.g. faster.hprc.tamu.edu, grace.hprc.tamu.edu, etc.) and username (your NetID).

4. Go to 'Advanced Sftp settings' and check '2-steps authentication' checkbox.

5. Select 'Ok' to finish configuration of the SFTP session.

6. When you login with this SFTP session, there will be TWO pop-up windows.

  • The first pop-up window will ask you for your password. Enter your TAMU password here.
Mobaxterm password prompt.png
  • A second pop-up window will say "Duo two-factor login for NetID". Enter a number corresponding to one of your configured authentication methods (Push, Call, Text, Second device, etc). Select the appropriate option. Do not type your TAMU password again here.
Mobaxterm duo prompt.png

Here are example Duo Authentication methods that would be shown when you SSH to a HPRC cluster login node. You won't see this, it is just to remind you of the numbering format of Duo Authentication menu options.

Enter a passcode or select one of the following options:

 1. Duo Push to XXX-XXX-1234
 2. Duo Push to iOS
 3. Phone call to XXX-XXX-1234

Your Duo settings will be different.

WinSCP (Windows only)

1. Open WinSCP. Click on new section located on the menu bar.

2. The above step will open the login windows.

3. Enter your relevant information (hostname: ada.tamu.edu, terra.tamu.edu, username, password, etc.)

4. Your will be shown our authentication banner. Click continue.

5. Another windows will be opened (Server prompt) asking for your duo options (text, push, phone call, etc.) Select what is appropriate for your case.

6. Press Ok.

Note: In most cases, the above steps should work. If they don't please follow these steps.

3b. Starting with step 3. In the login windows, after you have entered your information (username, password, etc.) Click on advanced.

4b. On the left pannel of Advanced Site Settings, select authentication. Check on "Attempt 'keyboard-interactive' authentication. Also select 'response with password to the first prompt'. Press Ok.

5b. Resume with step 3 specified in the above section.

File Transfer via Web Portal

An alternative option for file transfer is to use our web portal.

1. Go to https://portal.hprc.tamu.edu

2. Select the appropriate cluster.

3. On the top left corner of the website, you will see "Files". Click on Files menu.

4. Select the desired directory. This will open a new tab in your web browser.

5. In the new tab, you should be able to manipulate (download, upload, modify files) via the web interface.

For more information about OnDemand portal, please visit this link

FileZilla

NOTE: FileZilla is known to require a two factor authentication for each file needing to be transferred. Due to this inefficiency, FileZilla is no longer recommended for file transfers.

FAQ

1. My account is locked after several login attempts, what can I do?

Your account will be locked after 7 failed login attempts. It will be automatically unlocked after 10 minutes. Please refer to above sections for updated instructions on how to use SSH, SFTP clients with duo authentication enabled.