Connecting to MPCDF Systems

How do I log in to MPCDF machines?

All MPCDF compute resources run Linux. Access is provided exclusively via SSH with two-factor authentication (2FA).

To connect from the public internet, first log in to a gateway machine, then connect to your target system from there.

The standard command-line client is OpenSSH, available on Linux, macOS, and Windows. Use the ssh command to connect, and tools like ssh-keygen and ssh-add to manage your SSH keys.

For convenience, create a configuration file at ~/.ssh/config to define host aliases and connection parameters. For more details, see our SSH configuration guide.

What are the SSH gateway machines?

The following gateway machines are available for SSH connections from the internet:

Gateway	Reboot Schedule
`gate1.mpcdf.mpg.de`	Tuesdays at 3:45 AM (German local time)
`gate2.mpcdf.mpg.de`	Saturdays at 3:45 AM (German local time)

These machines provide a small home directory and serve as jump hosts to the HPC systems. Note: Gateway machines are rebooted weekly, so user sessions are not persistent.

For more details, including host key fingerprints, see the gateway machines documentation.

How can I tunnel through the gateway machines?

Configure an SSH tunnel to connect directly to a target machine through a gateway. The recommended method is ProxyJump (for OpenSSH 7.3 and newer). For older versions, use ProxyCommand.

Using the ProxyJump flag:

ssh -J YOUR_USERNAME@gate1.mpcdf.mpg.de YOUR_USERNAME@viper.mpcdf.mpg.de

Using your SSH config file:

Simplify the connection by adding the following to your ~/.ssh/config file:

Host gate
    Hostname gate1.mpcdf.mpg.de
    User YOUR_USERNAME
    ServerAliveInterval 120

Host viper
    Hostname viper.mpcdf.mpg.de
    User YOUR_USERNAME
    ProxyJump gate

With this configuration, connect to Viper by simply running:

ssh viper

How can I avoid repeatedly typing my password?

Use SSH’s ControlMaster feature to establish a connection once and reuse it for subsequent logins. This is particularly useful when combined with ProxyJump.

Note: ControlMaster is limited to 10 sessions by default.

Here is an example configuration for your ~/.ssh/config file that sets up ControlMaster for the gate and raven hosts:

Host gate
    Hostname gate.mpcdf.mpg.de
    User YOUR_USERNAME
    ServerAliveInterval 120
    ControlMaster auto
    ControlPersist 12h
    ControlPath ~/.ssh/master-%C

Host raven
    Hostname raven.mpcdf.mpg.de # or a specific login node like raven02i.mpcdf.mpg.de
    User YOUR_USERNAME
    ControlMaster auto
    ControlPersist 12h
    ControlPath ~/.ssh/master-%C
    # For OpenSSH 7.3 and newer:
    ProxyJump gate
    # For older OpenSSH versions:
    # ProxyCommand ssh -W %h:%p gate

After adding this configuration, connect to Raven with:

ssh raven

You will only need to enter your password and OTP once. Subsequent connections, including scp and rsync, will reuse the existing connection.

Note: This configuration works on Linux and macOS. For Windows, use PuTTY’s “Share SSH connections if possible” feature to achieve a similar result.

How can I connect to HPC systems with Visual Studio Code (VSCode)?

Connect to our HPC systems using VSCode with the Remote - SSH extension.

To avoid authentication issues and resource limits, follow these steps:

Set up ControlMaster: Configure an SSH ControlMaster as described above. Connect to a specific login node (e.g., raven03i or viper03i) rather than the generic hostname.
Install the extension: Install the Remote-SSH extension from the VSCode Marketplace.
Configure VSCode settings: In VSCode, open the settings and disable remote.SSH.useLocalServer and remote.SSH.useExecServer.
Connect: Restart VSCode and connect to your target login node.

Note: Due to the wide variety of user configurations, we cannot provide support for VSCode beyond these instructions.

How do I connect from a Windows machine?

The ProxyJump configuration described above is compatible with the VSCode Remote-SSH extension and the OpenSSH client in PowerShell. However, ControlMaster is not supported on Windows.

For detailed instructions on using PuTTY and WinSCP, see our step-by-step guides:

What if my connection fails with “Corrupted MAC on input”?

This error can occur on Windows with native OpenSSH clients due to stricter encryption algorithms on our gateway systems. To resolve this, specify a different MAC (Message Authentication Code) algorithm.

On the command line:

ssh -m hmac-sha2-256-etm@openssh.com YOUR_USERNAME@gate1.mpcdf.mpg.de

In your ~/.ssh/config file:

Host gate
    Hostname gate1.mpcdf.mpg.de
    User YOUR_USERNAME
    MACs hmac-sha2-256-etm@openssh.com

Is two-factor authentication (2FA) required?

Yes, 2FA is mandatory for all connections. For more information, see the 2FA FAQ.

How can I improve `ssh`/`scp`/`sftp` performance?

To improve single-stream performance for ssh, scp, and sftp, use the aes128-ctr cipher.

On the command line:

ssh -c aes128-ctr YOUR_USERNAME@gate1.mpcdf.mpg.de

In your ~/.ssh/config file:

Host gate
    Hostname gate1.mpcdf.mpg.de
    User YOUR_USERNAME
    Ciphers aes128-ctr

What should I do if I see an SSH host key warning?

If you receive a host key warning, it may be due to a recent maintenance operation. We announce host key changes via email and on this documentation page. You can verify the current host keys in the gateway machines documentation.

If you are unsure, contact the MPCDF helpdesk for assistance.

How can I run GUI applications on MPCDF systems?

You can run applications with graphical user interfaces (GUIs) on our systems using one of the following methods.

X11 Forwarding

You can forward X11 displays to your local machine via SSH.

To connect with X11 forwarding:

ssh -C -Y YOUR_USERNAME@gate1.mpcdf.mpg.de

Or, add the following to your ~/.ssh/config file:

Host gate
    Hostname gate1.mpcdf.mpg.de
    User YOUR_USERNAME
    Compression yes
    ForwardX11 yes
    ForwardX11Trusted yes

The -C flag enables compression, which can improve performance. While most Linux systems have a built-in X server, macOS and Windows users will need to install one, such as XQuartz (for macOS) or Xming (for Windows).

For graphically intensive applications, we recommend using VNC.

VNC

You can run a persistent VNC server on the login nodes of the HPC systems. This allows you to run GUI applications without X11 forwarding. Alternatively, you can use our web-based remote visualization service to launch VNC sessions on dedicated resources (with a time limit).

Remote Visualization Service

For applications that require hardware-accelerated OpenGL rendering, our web-based remote visualization service provides access to GPUs on select HPC systems.