Login¶

The primary way to access NHR@KIT systems is via SSH to the dedicated login nodes. Login is only possible to these login nodes — direct access to compute nodes is not available.

Full details including individual node names are in the Connecting via SSH section.

All logins require two-factor authentication (2FA). The default login method is a time-based one-time password (TOTP) combined with your service password. As an alternative, SSH keys can be used to avoid entering the OTP and password on every connection after an initial 2FA login.

Access from outside allowed networks requires a VPN connection to your home institution. See Network access & VPN.

JupyterHub is available as a browser-based alternative for interactive work. Additional services such as remote visualization and IDE integration also use SSH as their transport layer and therefore require an active SSH connection.

To connect for the first time:

1. Check network access — be on an allowed network or connect via VPN. See Network access & VPN.
2. Look up your username — find your login username on FeLS. See Username lookup.
3. Set up two-factor authentication — register a TOTP token on FeLS. See Two-Factor Authentication.
4. Connect via SSH — use the appropriate login hostname for your system. See Connecting via SSH.
5. Respect the login node usage policy — login nodes are shared resources. Do not run compute jobs on them. See Login node usage policy.

Prerequisites¶

Network access & VPN¶

Access to NHR@KIT systems is restricted to IP addresses from the following networks:

• KIT internal networks
• All universities and universities of applied sciences in Baden-Württemberg
• All Helmholtz member institutions
• All NHR centres
• Many academic and scientific institutions in Germany (some only reachable via IPv6)

If your device is on one of these networks (e.g. on campus or connected to campus WiFi), you can connect directly. From outside these networks (e.g. from a home office), establish a VPN connection to your home institution first.

If you are unable to connect and cannot use a VPN from one of the listed institutions — in particular if you are located outside Germany — navigate to https://wieistmeineip.scc.kit.edu/ and provide the displayed IP addresses to the support team. We will then find the best way to get you access.

Username lookup¶

Use this username in all SSH commands, e.g. ssh username@hk2-x86.scc.kit.edu. The username in this example would be ka_ej4555.

Two-Factor Authentication¶

A two-factor authentication (2FA) mechanism is enforced for all logins on NHR@KIT systems. In addition to the service password, a one-time password (OTP) must be entered on every login.

NHR@KIT uses six-digit, time-based One-Time Passwords (TOTP). These are generated either by a hardware token or by a software token — a software application running on a separate device.

Before first use, the token must be registered for the NHR@KIT service on FeLS. Once registered, it generates a new six-digit code every 30 seconds. Each code is valid only once and only for a short time window.

To register a token, log into FeLS and navigate to Overview → My Tokens (Übersicht → Meine Tokens). See Token Management for step-by-step instructions.

The most common approach is to use a smartphone or tablet as a software token. Recommended apps:

Any application compatible with the TOTP standard (RFC 6238) can be used.

SSH Keys (optional)¶

SSH keys can be used as an alternative to password-based login. Two types are supported:

• Interactive keys — for regular interactive logins. Requires one initial 2FA login to activate the key; afterwards no password or OTP is needed. With an SSH key pair generated using a FIDO2/U2F hardware security key (ed25519-sk), no TOTP is required at all.
• Command keys — for automated workflows (e.g. scripts, data transfers). Restricted to a single command and IP address, and require administrator approval.

See SSH Keys for setup instructions.

Connecting via SSH¶

After finishing the registration process, the systems are ready for SSH-based login.

Recommended SSH clients:

• OpenSSH: Supports interactive logins and remote file transfers on Linux, macOS, and Windows. On Windows, OpenSSH is pre-installed and available in Windows Terminal and PowerShell.
• MobaXterm: Supports interactive logins, remote file transfers, and X11 forwarding on Windows. See MobaXterm for setup instructions.

To log in, run one of the following commands and replace username with your actual username:

$ ssh username@hk2-x86.scc.kit.edu   # x86_64 partition
$ ssh username@hk2-a64.scc.kit.edu   # ARM64 partition

$ ssh username@ftp-x86.scc.kit.edu   # x86_64 nodes
$ ssh username@ftp-a64.scc.kit.edu   # ARM64 nodes

Login process¶

A successful login goes through the following steps:

flowchart LR
    A["ssh user@host"] --> B[TOTP\none-time password]
    B --> C[Service\npassword]
    C --> D[Login established]

1. Run ssh username@<hostname>. The connection is established and the system prompts for authentication.
2. The system asks for a One-Time Password. Generate one using the Software or Hardware Token registered on FeLS (see Two-Factor Authentication) and enter it at the Your OTP: prompt. If this prompt does not appear and you go straight to the Password: prompt, your username was not recognised — check that you are using the correct login username (see Username lookup) or that your registration is complete.
3. The system asks for your service password. Enter it at the Password: prompt. The prompt does not echo characters while you type — this is normal.
4. You are greeted by the system banner followed by a shell prompt.

If you are using OpenSSH and need X11 forwarding for GUI applications, add the -X parameter:

$ ssh -X username@hk2-x86.scc.kit.edu

Login node usage policy¶

The login nodes are shared resources. Permitted activities include:

• Viewing and editing files
• Executing batch system commands (sbatch, salloc, squeue, etc.)
• Compiling small to medium-sized code bases
• Short pre- and post-processing runs on a small number of cores

Everything that occupies cores for more than a few minutes must be submitted to the batch system. This includes long-running compilations and pre- or post-processing runs.

Any compute job found running on the login nodes will be terminated without further notice.

See also: Terms of Use & Policies