メインコンテンツまでスキップ
This page is not translated yet. 日本語 is switched on so the navigation and URLs can be tested; the text below is the English original. Use the language selector in the header to switch back, or see the documentation home.

SSH Access

SSH gives you a terminal into a Rescale workstation or job cluster from your own machine. Use it when you want a command line instead of the NiceDCV desktop, when you need to script file transfers with scp or rsync, or when you want to forward a port from the head node back to a local browser or client. SSH is authenticated with a public/private keypair you configure once in your Rescale job settings; from that point on, every cluster and workstation you launch accepts connections from that key.

When to use SSH versus the desktop​

Both options connect to the same machine, but they are good for different jobs:

  • Use the NiceDCV desktop when you need a GUI: CAD, pre/post-processing, solver GUIs, or anything graphics-heavy. See Connect to your desktop for the browser and native client options.
  • Use SSH when you want a shell for monitoring logs, running CLI utilities, editing configs, or moving files with scp, rsync, or sftp. SSH is also the right tool for automation and any workflow that does not need a display.
  • Use an SSH tunnel when you want to reach a service running on the head node (a Jupyter server, a dashboard, a license tool's web UI) from a browser on your local machine. Tunneling forwards a local port to a port on the cluster.

You can run both at the same time; they do not conflict.

Configuring your SSH key​

You only need to do this once per Rescale account. The same key works for all future clusters and workstations.

On Linux or macOS​

  1. Open a terminal and check for existing keys:

    ls -al ~/.ssh

  2. If you do not already have a keypair you want to use, generate one. Rescale recommends a 4096-bit RSA key:

    ssh-keygen -b 4096

    Accept the default file location (~/.ssh/id_rsa) unless you have a reason to change it. You can optionally set a passphrase.

  3. Lock down the .ssh directory so only you can read it:

    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/id_rsa

  4. Copy the contents of the public key. On macOS:

    pbcopy < ~/.ssh/id_rsa.pub

    On Linux, print it and copy the output:

    cat ~/.ssh/id_rsa.pub

On Windows with PuTTY​

  1. Download and install PuTTY. The installer includes PuTTYgen and Pageant.
  2. Launch PuTTYgen.
  3. Under Type of key to generate, select SSH-2 RSA.
  4. Click Generate and move the mouse over the window to seed randomness until the progress bar fills.
  5. Click Save private key and save it somewhere you will remember. Setting a passphrase is recommended.
  6. In the Public key for pasting into OpenSSH authorized_keys file box, right-click, choose Select All, then Copy.

Using Pageant (also bundled with PuTTY) to hold the private key in memory saves you from re-entering the passphrase for every connection.

Registering your public key with Rescale​

Once the key is on your clipboard:

  1. On the Rescale platform, click your email in the top-right corner and choose Account.
  2. Open Job Settings from the left nav.
  3. Paste your public key into the SSH Public Key field and click Save.
  4. Optionally, restrict inbound access with the Access Restriction (CIDR range) field. You can pick Everywhere, My Current IP Address, or a custom CIDR. Custom CIDRs are useful for locking access to a corporate VPN or office network.

From this point on, every cluster and workstation you launch allows SSH from keys matching this public key (and from the IP ranges you specified).

Access Restriction applies to new resources

Changes to the CIDR range apply to clusters you launch after the change. Existing clusters keep the rules they had at launch. Re-launch if you need to tighten access to a running resource.

Connecting from Linux or macOS​

Once a workstation or job cluster is running, Rescale exposes the head node's public IP and a username (for example uprod_qpWia). Two ways to connect:

  • Copy SSH Command. On the cluster or workstation's Status tab, click Copy SSH Command, paste it into a terminal, and press Enter.

  • By hand. In the Job Logs section of the Status tab, find the line that shows the job username and public IP. Then run:

    ssh uprod_qpWia@107.23.132.81

    Replace the username and IP with your own. If the cluster uses a non-default SSH port (typically 32100 or 22; check the status line), add -p <port>.

If you set a passphrase on your key, your OS will prompt for it. Your shell lands in ~/work/shared, which is the working directory for batch jobs. Process output lives in ~/work/process_output.log.

Connecting from Windows with PuTTY​

  1. Launch PuTTY.
  2. In Host Name (or IP address), enter the public IP from the Job Logs section.
  3. Set the Port to match the port shown next to the IP (typically 32100 or 22).
  4. In the left panel, expand SSH and click Auth.
  5. Under Private key file for authentication, click Browse and select the .ppk file you saved from PuTTYgen.
  6. Click Open to start the session.

The first connection shows a PuTTY Security Alert because the host key is not cached. Click Yes to continue. At the login as: prompt, enter the job username and press Enter.

Creating an SSH tunnel​

Tunnels let you reach a port on the head node from your local machine. On Linux and macOS:

ssh -L 8888:localhost:8888 uprod_qpWia@107.23.132.81

This forwards local port 8888 to port 8888 on the head node. Point your local browser at http://localhost:8888 to reach whatever is listening there (for example a Jupyter notebook).

In PuTTY, the same is configured under Connection then SSH then Tunnels:

  1. Enter a Source port (the local port).
  2. Enter a Destination of the form localhost:<remote-port>.
  3. Click Add, then Open to start the tunneled session.

For recurring tunnels (for example, always forwarding the same monitoring ports when a workstation starts), you can script the SSH command or use an ~/.ssh/config entry with LocalForward. The Rescale knowledge base has a walkthrough of automating tunnels for workstation job monitoring (linked in the citations below).