Skip to content

Update mfa_login.rst #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
moravveji wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update mfa_login.rst #380

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6209a04
Update mfa_login.rst
moravveji Jan 15, 2024
b20e441
removing the mention of ssh keys
moravveji May 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion source/access/mfa_login.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Multi Factor Authentication (MFA)
the name suggests, requires multiple steps when authenticating. The following
two factors are necessary to connect to the KU Leuven clusters:

- A valid private key
- A valid private key (except when connecting via :ref:`Open OnDemand portal<ood_t2_leuven>`)
- Access to a VSC-associated university/institution account
Copy link
Copy Markdown
Contributor

@jooghe jooghe Apr 29, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Access to a VSC-associated university/institution account, with MFA authentication

Copy link
Copy Markdown
Collaborator

@stevenvdb stevenvdb Apr 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I even think nobody needs a private key anymore, the MFA is entirely within the institution authentication.

Copy link
Copy Markdown
Contributor Author

@moravveji moravveji Apr 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only scenario (that I know) where users require keys are NX/FileZilla/WinSCP users, which makes having ssh keys optional for new users.

Is this PR good to go? Or you still propose a change?

Copy link
Copy Markdown
Collaborator

@stevenvdb stevenvdb Apr 30, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only scenario (that I know) where users require keys are NX/FileZilla/WinSCP users, which makes having ssh keys optional for new users.

Is this PR good to go? Or you still propose a change?

Can you try to log in using for instance NX, without a key? For me that seems to work, I get a certificate without ever needing my key and that certificate suffices to connect with NX. This makes me think that the private SSH key is never used when connecting. Unless I am wrong about that (and maybe it is good to check with Peter), I would propose to remove the line A valid private key (except...) completely.

Copy link
Copy Markdown
Contributor

@jooghe jooghe May 2, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we do indeed need to list the cases when you still need a key. And I think it's best to make the distinction between the KU Leuven Tier-2 and the other VSC infrastructure.
Login in to Hortense with a terminal, you will need a key. However if you use the web interface I'm not sure if you need the key.

Copy link
Copy Markdown
Contributor Author

@moravveji moravveji May 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only scenario (that I know) where users require keys are NX/FileZilla/WinSCP users, which makes having ssh keys optional for new users.
Is this PR good to go? Or you still propose a change?

Can you try to log in using for instance NX, without a key? For me that seems to work, I get a certificate without ever needing my key and that certificate suffices to connect with NX. This makes me think that the private SSH key is never used when connecting. Unless I am wrong about that (and maybe it is good to check with Peter), I would propose to remove the line A valid private key (except...) completely.

I can always login to NX with my certificate. but, I think with e.g. FileZilla, you'd always need a key. If we ditch FileZilla/WinSCP in favor of globus, then of course, we do not require keys at all.


This approach ensures that if your private key is compromised, the person who
Expand Down