Login problems
Login problems?
Having problems connecting to a host on JASMIN? Details of how to login to JASMIN can be found here, but this article may help to resolve login problems. It provides information for the following issues:
login1.jasmin.ac.uk
If you are unable to login to a login server e.g. login1.jasmin.ac.uk
then
look carefully at any error messages displayed as this can help diagnose what
is wrong:
1) “Connection reset by peer”
This suggests a problem with the configuration of your machine or local network. Connections to JASMIN login servers are allowed from a specific set list of network domains (the domain is the part after the host name e.g. myhost. mylocalnetwork.ac.uk ). For this to happen, 2 things need to be in place:
Use the tool provided on the JASMIN accounts portal to check that your IP address does indeed resolve:
Visit https://accounts.jasmin.ac.uk/services/reverse_dns_check/ with your browser, or do the following at the command line, on the machine from which you’re trying to connect:
curl https://accounts.jasmin.ac.uk/services/reverse_dns_check
Depending on your system, this will either provide output to the terminal (via stdout) or on some systems this might save the output in the file “reverse_dns_check”. You may need to look in that file for the result.
See check network details for further information on how to interpret the result from this.
Most institutional networks for UK universities and partner organisations are on our allow list, which is updated on request. However if you are trying to connect from your home broadband, then please be aware that this is not the the preferred route, for security reasons. If you connect from home, please be aware that:
One solution is to connect via your VPN to your institution first. This assigns you another IP address belonging to that institution, but you need to repeat the checks above to make sure that address resolves (not all do).
Another option, if you have SSH terminal access to a machine at your institution from where you can also make outgoing SSH connections, is that you connect from your local machine to the machine at your institution, then make the outward SSH connection to JASMIN from there. In this case, you need to have your JASMIN SSH key loaded on your local machine first, and remember to include the -A flag for “agent forwarding” for ALL the intermediate steps.
If all else fails, you can use the “contingency route” provide by login2.jasmin.ac.uk (see article for further details), but you will be limited in what you can do / connect to within JASMIN as a result. We prefer all users to connect from their institutional network.
2) “Permission denied”
Here, the most likely cause is that the SSH key which your client is presenting does not match the one in your JASMIN account. This can be for a number of reasons:
Check that you are following the method suitable for your operating system
Note that connections using NoMachine NX don’t require an authentication agent: this can be a good alternative if you’re having problems.
3) “The authenticity of host ’nnnn (
Your local computer stores a list of all the other SSH hosts which it has
successfully connected to in the past. If you use an intermediate host like a
login server to make onward connections to a sci machine, the login host will
maintain another such list. In both cases there should be a
file~/.ssh/known_hosts
(so one in your local home directory on your own
machine, and one in your JASMIIN home directory)
When the SSH client first contacts the host for the SSH connection, it checks to see if the remote host is one that it recognises. If this check fails, you may get a message like the following:
Message 1:
The authenticity of host 'nnnn (<ip address>)' can't be established.
ECDSA key fingerprint is SHA256:8QY9iBcOQFyEYkpOtBUU8WQGeADb0DyMff01BRuvYls.
ECDSA key fingerprint is MD5:f9:19:c4:5f:2b:fa:ed:aa:34:86:c9:23:dd:1c:44:30.
Are you sure you want to continue connecting (yes/no)?
Message 2:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The ECDSA host key for nnnn has changed,
and the key for the corresponding IP address <IP address>
has a different value. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/users/username/.ssh/known_hosts:62
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:Evr7U40sEGSLVypfafLYtbF2oYvGDuBxTyrALdx11pk.
Please contact your system administrator.
Add correct host key in /home/users/username/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/users/username/.ssh/known_hosts:115
ECDSA host key for nnnn has changed and you have requested strict checking.
Host key verification failed.
This can happen when:
~/.ssh/known_hosts
filesci1
vs sci1.jasmin.ac.uk
)Message 1 means that you don’t have an entry for that host in your
~/.ssh/known_hosts
file. In most cases, you can safely reply “yes” and the
SSH connection should proceed as normal from then on.
If you get message 2, and are confident that the change is for a legitimate
reason, the solution is to modify your ~/.ssh/known_hosts
file, removing the
entries for that host (there may be more than one, as above for sci1
vs
sci1.jasmin.ac.uk
) by deleting those lines. Next time you try and connect,
you will get message 1, but can reply “yes” and the SSH connection should
proceed as normal.
Note: If you’re using a graphical SFTP or SCP client for data transfers, the error messages above may be hidden and so it can be harder to establish the reason for failure. Using a terminal session (in MobaXterm on Windows, or Mac/Linux terminal) to the problem host will likely reveal the messages and enable you to follow the steps above to solve the problem.
Here, there are 3 main possibilities:
1) You have not set up agent forwarding correctly on your local machine.
****This allows your ssh key to be used for logging in from login1.jasmin.ac.uk
to
other machines. To check, run the following command on the login server:
echo "$SSH_AUTH_SOCK"
This should display something that looks similar to (but not identical to)
/tmp/ssh-RNjiHr2844/agent.2844
If nothing is displayed then it indicates that agent forwarding is not working. Please read how to login and make sure you are running ssh-agent (or similar), have loaded your private key and are using the -A option on your ssh command for the connection to the login server. NX users should make sure that the “agent forwarding” option is ticked when setting up a connection profile.
2) Some hosts within JASMIN are restricted to particular (groups of) users.
The “sci” servers (e.g. sci1.jasmin.ac.uk
) and “xfer” machines (e.g.
xfer1.jasmin.ac.uk
) should be available to all with jasmin-login
access
(see above). However, some other machines are restricted to particular project
participants and require special permission to use. For example, the high-
performance transfer servers hpxfer[12].jasmin.ac.uk
requires the
hpxfer access role, which can be applied for at the JASMIN accounts portal,
as can most roles currently in use.
3) There is a problem with the host you are trying to connect to.
Occasionally there may be problems with the host (machine) which you are trying to connect to. The sci servers (particularly the high-memory host jasmin-sci3) experience very high usage loads and occasionally run out of resources. This may prevent you from logging in. In some circumstances ask you for a password: this is normally a sign that something is wrong with the machine, since passwords are not used for host logins on JASMIN, so there is no point in trying to enter your account password or SSH passphrase at this point. In this case please contact us using the help beacon below.
If you still have problems then please contact us using the help beacon below. It would be helpful if you can include as much of the following information as possible:
ls -l ~/.ssh
On some terminal sessions the usual instructions for starting the ssh-agent session and adding the key may give the following error:
ssh-add ~/.ssh/id_rsa_jasmin
Could not open a connection to your authentication agent.
If you get this message, please try either:
modifying the method you use to start the ssh-agent, to:
eval $(ssh-agent -s)
(and then trying to load the key again)
or see below (if using MobaXterm) which now has a better way of loading the SSH key.
Please follow the instructions for MobaXterm (which
include a video to show how to load your key into its own ssh-agent, MobAgent
).
These instructions have changed with more recent versions of MobaXterm, and
replace the need to use the ssh-add
command, so please make sure that both the
version you are using, and your method, are up to date!
Please note that even if your initial connection to (for example) your university host does not require your JASMIN SSH key, you should still load the key AND enable agent forwarding, for your initial connection to that host, so that the key can be used for the subsequent connection to the JASMIN login host. This actually applies to any connection method, not just MobaXterm.