Changes
Page history
Update Documentation
authored
Sep 13, 2024
by
Roland Pabel
Hide whitespace changes
Inline
Side-by-side
Documentation.md
View page @
abc9fda1
### 2FA
### 2FA
To secure access to RAMSES, we use Two-Factor-Authentication (2FA/MFA).
To secure access to RAMSES, we use Two-Factor-Authentication (2FA/MFA).
-
The first factor is an SSH public key. Please send your SSH
*public*
key to
-
The first factor is an SSH public key. Please send your SSH
*public*
key to
the HPC team.
the HPC team.
...
@@ -10,7 +11,7 @@ your account, see the PDF.
...
@@ -10,7 +11,7 @@ your account, see the PDF.
After you have succesfully enrolled in Duo and prepared your SSH Key, please
After you have succesfully enrolled in Duo and prepared your SSH Key, please
send me a short mail to pabel@uni-koeln.de .
send me a short mail to pabel@uni-koeln.de .
PLEASE NOTE: putting the key in your home in cheops just makes it possible for
**
PLEASE NOTE
**
: putting the key in your home in cheops just makes it possible for
me to take this file to ramses. But it doesn't happen automatically, I have to
me to take this file to ramses. But it doesn't happen automatically, I have to
do that. That is why I ask you to send me an email when you have completed SSH
do that. That is why I ask you to send me an email when you have completed SSH
and Duo setup, so I know I can create your account on ramses.
and Duo setup, so I know I can create your account on ramses.
...
@@ -26,41 +27,49 @@ with a passphrase:
...
@@ -26,41 +27,49 @@ with a passphrase:
You can create a modern key (ed25519) using
You can create a modern key (ed25519) using
```
ssh-keygen -t ed25519 -C "Your Name"
ssh-keygen -t ed25519 -C "Your Name"
```
and it should be created as ~/.ssh/id_ed25519(.pub)
and it should be created as ~/.ssh/id_ed25519(.pub)
Then
copy
the id_ed25519.pub
to cheops as ramses-ssh.pub
.
Then
send us
the
**
id_ed25519.pub
**
file
.
If your ssh on your computer is old, it will not know the key type ed25519.
If your ssh on your computer is old, it will not know the key type ed25519.
In this case use
In this case use
```
ssh-keygen -t rsa -b 4096 -C "Your Name"
ssh-keygen -t rsa -b 4096 -C "Your Name"
```
and
copy
the file ~/.ssh/id_rsa.pub instead.
and
send us
the file ~/.ssh/id_rsa.pub instead.
Please set a password on the ssh key (it will ask you for one during ssh-
Please set a password on the ssh key (it will ask you for one during ssh-
keygen) and use the ssh-agent to load the file into memory:
keygen) and use the ssh-agent to load the file into memory:
On most Linux and Macs this is pre-installed, you can check with the command
On most Linux and Macs this is pre-installed, you can check with the command
"
ssh-add -l
"
. This should not return an error, but usually
`
ssh-add -l
`
. This should not return an error, but usually
"This agent has no identities". Then add your key:
"This agent has no identities". Then add your key:
```
ssh-add [ path to your key file, ~/.ssh/id_rsa or id_ed25519 ]
ssh-add [ path to your key file, ~/.ssh/id_rsa or id_ed25519 ]
```
You can usually just run ssh-add since ssh-add can find the files on its own.
You can usually just run ssh-add since ssh-add can find the files on its own.
ssh-add asks for the password you set in the ssh-keygen step and afterwards
ssh-add asks for the password you set in the ssh-keygen step and afterwards
"
ssh-add -l
"
should list your key like this:
`
ssh-add -l
`
should list your key like this:
```
# ssh-add -l
# ssh-add -l
4096 SHA256:RGqC9iR+ayXlLPXOSfRYWZ7yU8wnhG7iJ3KMzs7s7ao .ssh/id_rsa (RSA)
4096 SHA256:RGqC9iR+ayXlLPXOSfRYWZ7yU8wnhG7iJ3KMzs7s7ao .ssh/id_rsa (RSA)
```
You can now use it within your session without having to re-enter your SSH Key
You can now use it within your session without having to re-enter your SSH Key
password.
password.
If you already have access to RAMSES but you are using the CHEOPS key, I
If you already have access to RAMSES but you are using the CHEOPS key, I
advise you to create your own SSH key on your local machine/laptop and then
advise you to create your own SSH key on your local machine/laptop and then
add the public key to your .ssh/authorized_keys file in your home on RAMSES.
add the public key to your
`
.ssh/authorized_keys
`
file in your home on RAMSES.
Any text editor will work for this.
Any text editor will work for this.
...
@@ -68,6 +77,7 @@ Any text editor will work for this.
...
@@ -68,6 +77,7 @@ Any text editor will work for this.
There are 4 login servers:
There are 4 login servers:
ramses1.itcc.uni-koeln.de up to ramses4.itcc.uni-koeln.de
ramses1.itcc.uni-koeln.de up to ramses4.itcc.uni-koeln.de
Do not use ramses2 or ramses3, they are for internal use only for now.
When you log into ramses1, a verification request is automatically
When you log into ramses1, a verification request is automatically
pushed to your Duo App on your phone.
pushed to your Duo App on your phone.
...
@@ -86,8 +96,6 @@ rpabel2@ramses1:~>
...
@@ -86,8 +96,6 @@ rpabel2@ramses1:~>
Even though the message "Autopushing..." appears twice, only one push is
Even though the message "Autopushing..." appears twice, only one push is
executed and only one verification is needed.
executed and only one verification is needed.
Do not use ramses2 or ramses3, they are for internal use only for now.
On ramses4, you can choose different Cisco Duo authenticators, if you have
On ramses4, you can choose different Cisco Duo authenticators, if you have
configured any:
configured any:
...
@@ -105,7 +113,7 @@ Passcode or option (1-1):
...
@@ -105,7 +113,7 @@ Passcode or option (1-1):
You can also enter here the 6-digit TOTP Passcode that is shown in the Duo
You can also enter here the 6-digit TOTP Passcode that is shown in the Duo
App. This code changes every 30 seconds.
App. This code changes every 30 seconds.
*PLEASE NOTE*
: Be carefull with scripted logins: Any login attempt with your SSH
*
*PLEASE NOTE*
*
: Be carefull with scripted logins: Any login attempt with your SSH
Key that triggers Duo Autopush is counted by Duo. If you don't respond in your
Key that triggers Duo Autopush is counted by Duo. If you don't respond in your
App, your account will be blocked after 10 attempts (and has to be unlocked by
App, your account will be blocked after 10 attempts (and has to be unlocked by
an admin).
an admin).
...
@@ -139,35 +147,36 @@ copy your files yourself.
...
@@ -139,35 +147,36 @@ copy your files yourself.
### SUBMITTING JOBS
### SUBMITTING JOBS
There are several partitions/queues in slurm intended for general usage:
There are several partitions/queues in slurm intended for general usage:
“smp”: default partition, with 136 smp nodes
“bigsmp”: partition with 8 bigsmp nodes
-
“smp”: default partition, with 136 smp nodes
“interactive”: partition with 8 interactive nodes, dedicated for interactive
-
“bigsmp”: partition with 8 bigsmp nodes
usage
-
“interactive”: partition with 8 interactive nodes, dedicated for interactive usage
“gpu”: partition with 10 gpu nodes with the following gpu types:
-
“gpu”: partition with 10 gpu nodes with the following gpu types: h100:38, h100_1g.12gb:1, h100_2g.24gb:3, h100_3g.47gb:1, h100_4g.47gb:1
h100:38, h100_1g.12gb:1, h100_2g.24gb:3, h100_3g.47gb:1, h100_4g.47gb:1
-
“future”: partition with one aurora and one mi210 node, the partition will be split and renamed in the future
“future”: partition with one aurora and one mi210 node, the partition will be
split and renamed in the future
The corresponding node types are:
The corresponding node types are:
smp: 192 cores, 750G RAM
-
smp: 192 cores, 750G RAM
bigsmp: 192 cores, 3000G RAM
-
bigsmp: 192 cores, 3000G RAM
interactive: 192 cores, 1500G RAM
-
interactive: 192 cores, 1500G RAM
gpu: 96 cores, 1500G RAM
-
gpu: 96 cores, 1500G RAM
Without specifying a partition explicitly with the “-p” parameter, the “smp”
Without specifying a partition explicitly with the “-p” parameter, the “smp”
partition will be chosen automatically.
partition will be chosen automatically.
In order to get access to GPU cards, make sure to specify the “gpu” partition
In order to get access to GPU cards, make sure to specify the “gpu” partition
as well as the type and number of GPU cards with the “-G” parameter, e.g.
as well as the type and number of GPU cards with the “-G” parameter, e.g.
“-p gpu -G h100:2” in order to get 2x H100 GPU Cards. Types like “h100_2g.
“-p gpu -G h100:2” in order to get 2x H100 GPU Cards. Types like “h100_2g.
24gb” are instances of the H100 card created by MIG partitioning, they behave
24gb” are instances of the H100 card created by MIG partitioning, they behave
like a separate device.
like a separate device.
Each user has a default group account in slurm which corresponds to his
Each user has a default group account in slurm which corresponds to his
workgroup (not uniuser/hpcuser/smail). For each job the right group account
workgroup (not uniuser/hpcuser/smail). For each job the right group account
must be specified with the “-A” parameter. Without it the default group account
must be specified with the “-A” parameter. Without it the default group account
will be chosen automatically. The default group account can be found out by
will be chosen automatically. The default group account can be found out by
executing the following command:
executing the following command:
```
sacctmgr show assoc -n user=$USER format=Account
sacctmgr show assoc -n user=$USER format=Account
```
If you encounter any problems, please write to hpc-mgr@uni-koeln.de .
If you encounter any problems, please write to hpc-mgr@uni-koeln.de .