Deprecated Login Procedures

This page contains deprecated login procedures. If you have a LincPass or YubiKey, you should use the Step-based login instructions.

LincPass Users You can now change your password via Open OnDemand in lieu of SmallStep. Please see the video tutorial here.

Before accessing various SCINet resources, new users need to ssh either to Ceres or Atlas cluster and change the temporary password. Note that home directories on Atlas are not created right away, so it is recommended to wait a day after receiving email with the credentials before logging to Atlas cluster.

A video demonstration for changing your password can be found here. Please keep in mind that due to the recent password requirement change, the video is out of date. It will list more password requirements than necessary. The current requirements are found below:

AT LEAST 14 characters long
Your last 24 passwords cannot be reused.

Using ssh to Connect

From Windows 10

Windows 10 that is up to date has an ssh client in the Windows Power Shell. To use that client, click on the Start button and start typing “power”. Select Windows PowerShell from the list.

In the PowerShell window, you can type one of two options:

1) ssh user.name@ceres.scinet.usda.gov (for Ceres Connections)
2) ssh user.name@atlas-login.hpc.msstate.edu (for Atlas Connections)

NOTE: Be sure to replace “user.name” in both options above with your assigned username. NOTE: To paste into PowerShell, you will use a single right click. Using ctrl+v will result in an error.

It is also recommended to create a config file on your computer. You may do so using Notepad. The file you create must be titled “config” with no extension for this method to work properly (i.e. “config” not “config.txt”). Note: Do not copy the code into the terminal itself, it must be in a separate file.

Create a ~/.ssh/config file replacing USER.NAME with your actual username, all in lowercase. To save this config file to your .ssh folder, you must save it to your user folder. The path to the .ssh file is as follows: C>Users>(Your Account)>.ssh

Host ceres-login
HostName ceres.scinet.usda.gov
User USER.NAME
TCPKeepAlive yes
ServerAliveInterval 20
ServerAliveCountMax 30

Host atlas-login
HostName atlas-login.hpc.msstate.edu
User USER.NAME
TCPKeepAlive yes
ServerAliveInterval 20
ServerAliveCountMax 30

If you don’t want to use the config file method above, add the following title to the ssh command replacing USER.NAME with your actual username, all in lowercase.

ssh -o TCPKeepAlive=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=30 USER.NAME@ceres.scinet.usda.gov

and

ssh -o TCPKeepAlive=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=30 USER.NAME@atlas-login.hpc.msstate.edu

screenshot of logging in

To paste from a clipboard into PowerShell, perform single right click with the mouse and then press Enter. Please see below for a detailed guide on changing your password.

When Changing Your Temporary Password (Mandatory Prompt When First Connecting):

Enter either of the following:
- ssh user.name@ceres.scinet.usda.gov (preferrably you should attempt your login on Ceres first)
- ssh user.name@atlas-login.hpc.msstate.edu
Enter the 6-digit verification code generated by the Google Authenticator app when prompted.
Enter your temporary password found in your welcome email when prompted for the password.
When prompted for your “Current Password”, re-enter your temporary password. Do NOT enter a new password at this step.
Enter your “new password” twice when prompted. Note: The new password requirements are listed below the Mac and Linux instructions.

After updating your password, you will be prompted to answer Yes or No to entering a cell phone. It is strongly recommended to add a cell phone just in case you need to reset your Google Authenticator in the future. Enter “y” and then enter your 10 digit cell phone number with no dashes or parenthesis, as shown in the image below.

screenshot of cellphone entry

From Mac and Linux

Open a terminal window. We recommend setting up a config file to make logging in easier and use settings to provide a more stable connection. This can be done by creating a config file u sing the following code and then saving it to your .ssh file. The file you create must be titled “config” for this method to work properly. Note: Do not copy the code into the terminal itself, it must be a separate file on your computer.

Create a ~/.ssh/config entry similar to this, replacing USER.NAME with your actual username, all in lowercase:

Host ceres-login
HostName ceres.scinet.usda.gov
User USER.NAME
TCPKeepAlive yes
ServerAliveInterval 20
ServerAliveCountMax 30

Host atlas-login
HostName atlas-login.hpc.msstate.edu
User USER.NAME
TCPKeepAlive yes
ServerAliveInterval 20
ServerAliveCountMax 30

Note: To save this config file to your .ssh folder, you must save it to your user folder. However, the .ssh file is currently hidden to you. To reveal the hidden files, you will press and hold CMD + SHIFT + . (Period Key) when choosing a location to save your file. The .ssh file will now be visible for you to save the config file.

That will send a “keepalive” signal every 20 seconds and keep retrying for up to 30 failures. This also simplifies your login to just:

ssh ceres-login or ssh atlas-login

If you don’t want to use the config file method above, add the following title to the ssh command replacing USER.NAME with your actual username in lowercase.

ssh -o TCPKeepAlive=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=30 USER.NAME@ceres.scinet.usda.gov

and

ssh -o TCPKeepAlive=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=30 USER.NAME@atlas-login.hpc.msstate.edu

After typing ssh command, enter the 6-digit code verification code generated by the Google Authenticator app when prompted for the Verification Code. Note that when you type the code or the password, nothing will be shown on the screen. If system accepts the code it will prompt you for password.

Please Note: If you are connected to the SCINet VPN, you will not be prompted to enter the Google Authenticator Code. If you make a mistake entering the code, you will be prompted to enter the verification code once more, but you must wait for a new code to be generated.

screenshot of logging in

When Changing your Password (Mandatory Prompt when First Connecting):

Enter either of the following: $ ssh user.name@ceres.scinet.usda.gov OR ssh user.name@atlas-login.hpc.msstate.edu
Enter the 6-digit verification code generated by the Google Authenticator app when prompted.
Enter your temporary password found in your welcome email when prompted for the password.
When prompted for your “Current Password”, re-enter your temporary password.
Enter your “new password” twice when prompted.
Note: The new password requirements are listed below.

After updating your password, you will be prompted to answer Yes or No to entering a cell phone. It is strongly recommended to add a cell phone just in case you need to reset your Google Authenticator in the future. Enter “y” and then enter your cellphone number with no dashes or parenthesis, as shown in the image below.

Please Note: The system may no longer prompt you for your phone number.

screenshot of cellphone entry

Password Requirements

AT LEAST 14 characters long
Your last 24 passwords cannot be reused.

Multifactor Authentication

Federal computer systems are required to use multifactor authentication for site security. This means that a code is required in addition to a password to login to SCINet. If you’re ssh-ing to Ceres cluster from a connected site (where you already had to use second factor such as PIV/CAC), you probably won’t be prompted for a verification code. However the code is always required to ssh to the Atlas cluster and to use other SCINet resources, such as SCINet Galaxy or SCINet Forum. It’s also needed to connect to SCINet VPN.

You will need to install an app on a mobile device or a small program on your computer that will generate your verification codes. The app is initialized with your SCINet Google Authentication (GA) account, that is normally created along with your SCINet account.

To add your SCINet GA account to the app, you will need a key or a QR code, that you can find in your “Welcome to SCINet” email.

Note: If your SCINet account was created before January 2020, and a GA account was never created, attempt to login to the Ceres DTN node:

ssh <your SCINet username>@ceres-dtn-0.scinet.usda.gov

At the first attempt a GA account will be created for you and you will receive an email containing a key/code that should be used to initialize GA on your mobile device.

If you have already had GA installed and initialized but now need to either re-install GA or install it on a new device, and if you saved your SMS phone number in the system, you can reset GA account by going to https://ga.scinet.usda.gov/reset. After resetting your GA account you will receive an email containing a key/code that should be used to initialize GA on your mobile device.

Follow the instructions below to set up multifactor authentication on either your mobile Android device (recommended), Apple device (recommended), or on your computer.

Google Authenticator (GA) on Android

Requirements

To use Google Authenticator on your Android device, it must be running Android version 2.1 or later (other TOTP authenticators can be used if you prefer).

Downloading the app

Visit Google Play.
Search for Google Authenticator.
Download and install the application.

Setting up the app

Open the Google authenticator app on your mobile device.

screenshot of Google Authenticator Android app setup screen

If this is the first time you have used Authenticator, click the Add an account button. If you already use the app and are adding a new account, choose “Add an account” from the app’s menu.

screenshot of Google Authenticator Android app Add an Account screen

There are two ways to link your device to your account. Using QR code is easier but requires a barcode scanner which you can install if you don’t have it yet (Google Authenticator app will prompt you to install it). An alternative would be to use a Google Authenticator key as mentioned on the above screenshot.

Link phone using QR code

Select Scan a barcode. If the Authenticator app cannot locate a barcode scanner app on your phone, you might be prompted to download and install one. If you want to install a barcode scanner app so you can complete the setup process, press Install then go through the installation process. Once the app is installed, reopen Google Authenticator, display QR code on your computer by clicking on the link in the “Welcome to SCINet” email and point your camera at the QR code.

screenshot of barcode scanner app

Link phone manually with a GA key

Select Enter a provided key, then Enter account name, which is <your SCINet username>@ceres. Next, enter the Google Authenticator key from the “Welcome to SCINet” email into the box under Enter Key. Make sure you’ve chosen to make the key time-based and press “Save.”

screenshot of Google Authenticator Android app Enter Account Details screen

Verify

To verify the application is working correctly,

ssh <your SCINet username>@ceres-dtn-0.scinet.usda.gov

Enter the verification code currently displayed in Google Authenticator, then enter your SCINet password.

If your code is correct, you will be connected to Ceres’ data transfer node. If your code is incorrect and you’re prompted for a verification code again, wait for a new code to be generated on your phone, then enter it on your computer. If you’re still having trouble, verify that the time on your phone is correct.

After logging in the first time you will be prompted to save an SMS phone number in the system so an SMS message can be sent to you when a GA account reset is requested.

Contact scinet_vrsc@usda.gov if you need assistance.

Google Authenticator (GA) on Apple iOS iPhones and iPads

Requirements

To use Google Authenticator on your iPhone, iPod Touch, or iPad, you must have iOS 5.0 or later. In addition, in order to set up the app on your iPhone using a QR code, you must have a 3G model or later.

Downloading the app

Visit the App Store.
Search for Google Authenticator.
Download and install the application.

Setting up the app

On your iOS device, open the Google Authenticator application. Tap the plus icon. Tap “Time Based” (label 1).

screenshot of Google Authenticator iOS app Add Token screen with added labels

There are two ways to link your device to your account. Using a QR code is easier but requires a camera. An alternative would be to use a Google Authenticator key in the Key field (label 2c in above screenshot).

Link phone using QR code

Tap “Scan Barcode” (label 2a above) and then point your camera at the QR code on your computer screen (click on the link in the “Welcome to SCINet” email to access QR code).

Link phone manually with a GA key

In the box next to Account (label 2b above), enter your account name, which is <your SCINet username>@ceres . Then, enter the Google Authenticator key from the “Welcome to SCINet” email into the box next to “Key” (label 2c above) and tap “Done” (label 2d above).

Verify

To verify the application is working correctly,

ssh <your SCINet username>@ceres-dtn-0.scinet.usda.gov

Enter the verification code currently displayed in google authenticator and then enter your password.

After logging in the first time you will be prompted to save an SMS phone number in the system so an SMS message can be sent to you when a GA account reset is requested.

Contact scinet_vrsc@usda.gov if you need assistance.

Authentication on your computer using Authy

If you are unable to use a smart device for multifactor authentication you may use Authy on your PC for a second factor.

Authy can be downloaded from https://authy.com.

Click the download button then scroll down to the “Desktop” section and download the binary for your platform. (Windows or macOS)

Run the installer. This won’t require administrator privileges, but it will need to be run by each user of the machine.

The installer will need to tie your login to a phone number and an email address. The phone number can be either a land line or a cell phone.

The systems will want to send you a verification number. If you are not using a cell phone please select “voice call” (not SMS) for the verification.

After making your choice a code will be shown and you should receive a call or a text which you should respond to with the code on your screen.

You are now setup and can add your SCINet GA key to Authy.

To do so click the red “+” in the Authy app and enter the key from the email you received titled “Welcome to SCINet”.

You will need to enter the key from the email since Authy cannot use QR codes.

Now name the account and pick an icon.

Authy should now be displaying codes for use with Ceres. Each code is shown for 30 seconds and then a new code in generated automatically. Codes are only valid for a few seconds after they are displayed and cannot be reused.

Contact scinet_vrsc@usda.gov if you need assistance.

GA account reset

Users may need to reset GA accounts when switching or reinstalling their mobile devices that have GA application installed. GA account reset request will have to go though your supervisor or sponsor as we have no way of directly verifying your identity.

Frequently Asked Questions

It didn’t ask me for the Verification Code from Google Authenticator. What do I do?
If you are connected to the VPN, the code will be waived, no need to worry about entering it.

I can’t find the .ssh folder when saving my config file. Where is it located?
The .ssh file is usually hidden to you. You must show all hidden files when saving your file before you will be able to save to the .ssh file.

My password/Google Authenticator Verification Code isn’t showing up when I type it. What is wrong?
There is nothing wrong with your terminal, the password and GA Verification Code will never show when you type. That is why it is important to be careful when entering the information. For passwords, copy + paste are extremely helpful to avoid mistakes.

After creating my account and changing my temporary password, I was prompted for my cell phone. Should I include this?
It is highly recommended to include your cell phone when setting up your account. This will be used if you need to perform a self-reset on your Google Authenticator code. Without the cell phone in your account, you may need to reapply for a SCINet account.