Difference between revisions of "Accessing the clusters"

Revision as of 08:42, 8 August 2016

Who can access the HPC clusters of ID SIS HPC

The clusters of ID SIS HPC are open to all members of ETH and can even be used by external users that have a collaboration with a research group at ETH Zurich. Members of ETH have immediate access to the clusters and can login with their NETHZ credentials. Members of other institutes who have a collaboration with a research group at ETH may use the HPC clusters for the purpose of said collaboration. Their counterpart ("sponsor") at ETH must ask the local IT support group (ISG) of the corresponding department to create a NETHZ guest account for them, including e-mail address and VPN service. Once the NETHZ guest account has been created, they can access the clusters like members of the ETH.

Legal compliance

The HPC clusters of ID SIS HPC are subject to ETH's acceptable use policy for IT resources (Benutzungsordnung für Telematik an der ETH Zürich, BOT). In particular:

• Accounts are strictly personal.
• You must not share your account (password, ssh keys) wih anyone else.
• You must not use someone else's account, with our without their consent.
• If you suspect that someone used your account, change your password and contact cluster support.

In case of abuse, the offender's account may be blocked temporarily or closed. System administrators are obliged by law to investigate abusive or illegal activities and report them to the relevant authorities.

Security

Access to the HPC clusters of ID SIS HPC is only possible via secure protocols ( ssh, sftp, scp, rsync). Further more users need to connect to the clusters from inside the ETH network. If users would like to connect from a computer, which is not inside the ETH network, then they need to establish a VPN connection first.

First login

On the first login, users need to accept the cluster's usage rules. Afterwards their account is created automatically. Please find below the user agreement for the Euler cluster as an example:

Please note that the Euler cluster is subject to the "Acceptable Use Policy
for Telematics Resources" ("Benutzungsordnung fuer Telematik", BOT) of ETH
Zurich and relevant documents (http://tinyurl.com/ethz-bot), in particular:

  * your Euler account (like your NETHZ account) is *strictly personal*
  * you are responsible for all activities done under your account
  * you must keep your password secure and may not give it to a 3rd party
  * you may not share your account with anyone, including your supervisor
  * you may not use someone else's account, with or without their consent
  * you must comply with all civil and criminal laws (copyright, privacy,
    data protection, etc.)
  * any violation of these rules and policies may lead to administrative
    and/or legal measures

Before you can proceed you must confirm that you have read, understood,
and agree to the rules and policies mentioned above.

SSH

Users connect to the HPC clusters via the SSH protocol. For this purpose they need to have an SSH client installed. The information required to connect to an HPC cluster, is the hostname of the cluster and user credentials (username, password).

Linux, Mac OS X

Open a shell (Terminal in OS X) and use the standard ssh command

ssh username@hostname

where username is your NETHZ username and the hostname can be found in the table shown above. If for instance user leonhard would like to access the Euler cluster, then the command would be

ssh leonhard@euler.ethz.ch

Windows

Since Windows does not provide an SSH client as part of the operating system, users need to download a third-party software in order to be able to establish SSH connections.

Widely used SSH clients are for instance PuTTY and Cygwin. When users start the SSH client, it should be sufficient to specify the hostname of the cluster one would like to connect to and start the connection. Afterwards, the users will be prompted to enter their NETHZ credentials.

X11

The clusters of ID SIS HPC use the X window System (X11) to display a program's graphical user interface (GUI) on a users workstation.

Linux

Xorg (X11) is normally installed by default as part of most Linux distributions. If you are using a version newer than 1.16, then please have a look at the troubleshooting section at the bottom of this wiki page.

Mac OS X

Since X11 is no longer included in OS X, you must install XQuartz. If you are using a version newer than 2.7.8, then please have a look at the troubleshooting section at the bottom of this wiki page.

Windows

X11 is not supported by Windows. Users need to install a third-party application in order to use X11 forwarding. Widely used X11 servers are for instance Cygwin/X, Xming.

VPN

When connecting from outside of the ETH network to one of the HPC clusters of ID SIS HPC, one first needs to establish a VPN connection. A VPN client can be downloaded from https://sslvpn.ethz.ch.

Troubleshooting

Permission denied

If you enter 3 times a wrong password, then you will get a permission denied error:

samfux@bullvalene:~$ ssh sfux@euler.ethz.ch
sfux@euler.ethz.ch's password: 
Permission denied, please try again.
sfux@euler.ethz.ch's password: 
Permission denied, please try again.
sfux@euler.ethz.ch's password: 
Permission denied (publickey,password,hostbased).
samfux@bullvalene:~$

In case you receive a "Permission denied" error, please check if you entered the correct password. If you think that your account has been corrupted, then please contact the service desk of IT services of ETH Zurich.

If you enter a wrong password too many times or in a high frequency, then we might block access to the clusters for your account, because it could be correupted. If you account has been blocked by the HPC group, then please contact cluster support.

Timeout

If you try to login and receive a timeout error, then it is very likely that you tried to connect from outside of the ETH network to one of the HPC clusters.

samfux@bullvalene ssh -Y mhoes@euler.ethz.ch
ssh: connect to host euler.ethz.ch port 22: Connection timed out

Please either connect from the inside of the ETH network, or establish a VPN connection.

Indirect GLX rendering error

When using an SSH connection with X11 forwarding enabled, newer versions of the Xorg server show an error message, when the graphical user interface of an application is started:

X Error of failed request: BadValue (integer parameter out of range for operation)
  Major opcode of failed request: 153 (GLX)
  Minor opcode of failed request: 3 (X_GLXCreateContext)
  Value in failed request: 0x0
  Serial number of failed request: 27
  Current serial number in output stream: 30

This error is cause by starting your X11 server without enabling the setting for indirect GLX rendering (iglx), that is required for X11 forwarding. Up to version 1.16 of the Xorg server, the setting iglx, has been enabled by default. With version 1.17, the default has changed from +iglx to -iglx. Now the setting needs to be enabled either in the Xorg configuration file or with a command line setting, when starting the Xorg server manually. For Xquartz versions up to 2.7.8, the iglx setting is enabled by default. If you would like to use XQuartz 2.7.9 or newer, then please make sure that you enable the iglx setting when the X-server is started.

This problem is described in the following article:

https://www.phoronix.com/scan.php?page=news_item&px=Xorg-IGLX-Potential-Bye-Bye

External links