• ssh is a program for logging securely into a remote machine and for executing commands on a remote machine
  • More precisely ssh is an SSH client using the SSH protocol

• We assume below that you have a my_login account on the remote remote_server computer, and you know your password
  • This page will also show some examples using the LSCE and IPSL Mésocentre ESPRI servers

• Instead of a password, you can also use a set of private and public keys and a passphrase
  • This is the only kind of authentication that will work if you need to use the IPSL Mésocentre ESPRI (aka ciclad and climserv)!

• Many programs are said to work over ssh when they implicitly use the ssh protocol to securely transfer their data from one server to another: scp (copy remote directories and files), rsync (synchronize remote directories and files), …

• Some history: before you were born, and the world and internet were a safer place, people used less secure programs like telnet, rlogin, rsh, ftp, …

• ssh [options] [my_login@]remote_server
  • If your login is the same on the local and remote computer, you can omit the optional my_login@ part:
    e.g. just use ssh ssh1.lsce.ipsl.fr
  • The first time you connect to a new server, ssh will ask if you are sure of what you are doing, and then store some unique information about the remote server in the known_hosts file (details).
    

    PS C:\Users\my_login> ssh ssh1.lsce.ipsl.fr
    The authenticity of host 'ssh1.lsce.ipsl.fr (157.136.66.99)' can't be established.
    ECDSA key fingerprint is SHA256:vMAvkidEg0EukP/RZwPAVuo5+TBegQFx1v8WN9pZLXg.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added 'ssh1.lsce.ipsl.fr,157.136.66.99' (ECDSA) to the list of known hosts.
    my_login@ssh1.lsce.ipsl.fr's password:

    
    ssh will automatically check this security information each time you connect to the same server, and warn you if something seems wrong

• Most common options:
  • -X: enable X11 forwarding. This option will allow you to use graphical programs on the remote server
    • If -X does not work, use -Y instead (Enable trusted X11 forwarding)
    • Using the -X/-Y option will automatically define the DISPLAY environment variable that is required by graphical programs on the remote server. Otherwise, DISPLAY will not be defined
      

      my_login@lsce5203:~$ echo $DISPLAY
      localhost:0.0
      
      my_login@lsce5203:~$ ssh ssh1.lsce.ipsl.fr
      Last login: Wed Jul  8 14:45:31 2020 from 176-142-31-75.abo.bbox.fr
      [my_login@ssh1 ~]$ echo $DISPLAY
      DISPLAY: Undefined variable.
      [my_login@ssh1 ~]$ logout
      Connection to ssh1.lsce.ipsl.fr closed.
      
      my_login@lsce5203:~$ ssh -X ssh1.lsce.ipsl.fr
      [my_login@ssh1 ~]$ echo $DISPLAY
      localhost:43.0

    • In order to display graphical windows, you also need to have a local X server running!
      An X server is basically a program running on your computer that understands the X Windows System protocol used by the remote server to display graphics
      • Linux computer: nothing to do, an X server is already running
      • Windows: install, configure and launch VcXsrv
      • Mac:

• -A: enable agent forwarding. This is useful when you use ssh keys and an ssh agent

• -t command: this option allows you to execute a specific command on the remote server (without displaying the output of the initial ssh). We use this mostly to chain ssh connections, when we want to automatically go through a specific gateway server to access another server
  e.g. ssh -A -X my_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix

• -v: verbose mode. Use this option only when you can't connect, or things don't seem to work correctly. Analyzing the verbose output when you start ssh should allow you, or the system administrators, to find out what is wrong

If you want to easily use ssh (with the appropriate options), you should define the following aliases in your ~/.bashrc configuration file

# Connecting to LSCE from outside the LSCE network
alias sobelix='ssh -A -X my_LSCE_login@ssh1.lsce.ipsl.fr -t ssh -A -X obelix'

# Connecting to LSCE from a computer on the LSCE network
alias obelix='ssh -A -X my_LSCE_login@obelix'

# Connecting to ciclad @ IPSL
alias ciclad='ssh -A -X my_ciclad_login@ciclad.ipsl.jussieu.fr'

ssh will store all its configuration text files in the ~/.ssh/ directory (C:\Users\your_windows_login\.ssh on Windows 10)

• known_hosts: the file were ssh stores security information about all the servers you have connected to (from the local computer)

• config: an optional configuration file

• authorized_keys, and possibly your private and public ssh keys

PuTTY is a convenient and user-friendly ssh client for Windows

• You want to start a graphical program on a remote server, but get a Can't open display: [NO VALUE DISPLAYED HERE] error
  

  $ xterm &
  $ xterm: Xt error: Can't open display:
  xterm: DISPLAY is not set
  $ echo $DISPLAY
  
  

  
  The DISPLAY variable is probably not defined because you have not specified the -X (or -Y) option when connecting to the remote server

• You want to start a graphical program on a remote server, but get a Can't open display: localhost:[SOME VALUE] error
  

  $ xterm &
  $ connect localhost port 6000: Connection refused
  xterm: Xt error: Can't open display: localhost:12.0

  
  The DISPLAY variable is defined correctly, but you probably don't have a local X server running

• Other types of errors: remember that you can run ssh in verbose mode to help you determine what is wrong (-v option)

Sometimes you just need to copy files from one remote server (or your desktop) to the other. The files can be securely copied over ssh with the scp command

Note: if you work with big data files, you should keep the files were they are instead of duplicating them, and move the data processing (your scripts, etc…) to the server where the files are located (e.g. the ciclad server at IPSL)

• scp [options] local_path_or_file [my_login@]remote_server:remote_path
  or scp [options] [my_login@]remote_server:remote_path_or_file local_path
  • If your login is the same on the local and remote computer, you can omit the optional my_login@ part

• Most common options:
  • -p: preserves modification times, access times, and modes from the original file.
    This option is very useful if you want the copied file(s) to have the same date/time as the original file(s). Otherwise, the time will be the time when you copy the file(s)
  • -r: recursively copy entire directories.
    You have to use this option if the source location is a directory. scp -r will copy the complete content of the directory (including sub-directories)

WinSCP is a convenient and user-friendly scp client for Windows

In some cases, you may want to synchronize the content of directories:

• because you are creating a backup
• because you have lots of files, possibly (very) big, and you don't want to start copying everything again if the copy fails due to temporary network problems
• …

In that case, you should use the rsync command, that will only copy files that are not already in the destination (and that have not changed since the previous copy).

rsync has lots of complex options and rules, and should be used carefully if you do not want to lose files. This page does not cover this topic. Use man rsync or ask somebody

• If you want to know more (options, etc…), check the man(ual) page on Linux: man ssh
• emacs

[ PMIP3 Wiki Home ] - [ Help! ] - [ Wiki syntax ]