Linux remote login access at SLAC

Overview

Secure Shell (SSH) access to systems on SLAC’s networks is only allowed via approved SSH bastion hosts. See the Approved Bastion Hosts for SSH Inbound Connections knowledge base article for more information.

For SLAC IT Storage Platform access, group creation and information please see the link.

Which hosts can I login to with SSH?

The following machines can be used for remote SSH access to SLAC. These bastion hosts use Active Directory credentials for authentication, not Heimdal "Unix" credentials.

Bastion hosts accessible to anyone with SLAC Active Directory credentials

If you need to ssh into SLAC from the outside and VPN is not available, please SSH to jump.slac.stanford.edu and then SSH into your on-site work computer.

Only minimal operating system tools will be installed.

Tools to support interactive usage will not be installed.

Scientific computing bastion hosts

These bastion hosts are accessible from non-SLAC networks.

How to use SSH to login

• SSH using hostname

ssh username@jump.slac.stanford.edu

-or- 

ssh jump.slac.stanford.edu -l username

• SSH using IP address

ssh username@192.168.1.3

• If you are already logged into a SLAC host, then all you need to supply is the hostname or IP address

ssh rocky9

ssh 192.168.1.3

Windows SSH Specific Issue

Windows 10/11 built-in SSH client uses an outdated OpenSSL version, causing compatibility issues. If you encounter SSH connection issues on Windows.

ssh -m hmac-sha2-512 username@rocky9.slac.stanford.edu

For a permanent fix, edit your SSH config file at %UserProfile%\.ssh\config and add:

Host rocky9.slac.stanford.edu
    User username
    MACs hmac-sha2-512

Replace username with your actual username.

Using ProxyCommand for SSH Connections

If connecting through a proxy or jump host, configure your SSH client to use a ProxyCommand:

Edit your SSH config file (~/.ssh/config on Linux/Mac or %UserProfile%\.ssh\config on Windows):

Host rocky.slac.stanford.edu
    User username
    MACs hmac-sha2-512
    ProxyCommand ssh -W %h:%p username@jump.slac.stanford.edu

Host ubuntu-lts.slac.stanford.edu
    User username
    MACs hmac-sha2-512
    ProxyCommand ssh -W %h:%p username@jump.slac.stanford.edu

The -W %h:%p flag in the ProxyCommand option does the following:

• -W tells SSH to establish a direct TCP tunnel from your local machine, through a proxy or jump host, to the final SSH destination.
• %h automatically expands to the destination hostname you're connecting to.
• %p automatically expands to the destination port number (typically port 22 for SSH).z

Replace username with your actual username.

Related Information

Linux at SLAC

Approved Bastion Hosts for SSH Inbound Connections

Troubleshoot SSH Issues Guide

SDF Information

S3DF Information

SSHFS