Iribe

2019-04-02T18:27:10Z

Sabobbin: Created page with " == Printers == https://wiki.umiacs.umd.edu/umiacs/index.php/Umiacs_Public_Printers == Conference Rooms == Conference rooms are scheduled with UMD’s Google Calendar syst..."

== Printers ==
https://wiki.umiacs.umd.edu/umiacs/index.php/Umiacs_Public_Printers

== Conference Rooms ==

Conference rooms are scheduled with UMD’s Google Calendar system along with a touch panel outside the room. The touch panel quickly allows you to see if the room is reserved by turning red or green if the room is open. You can walk up to the panel and reserve the room if it is unoccupied within the next 12 hours. There are huddle rooms that are only scheduled by the touch panels and are for small short term quick meetings or personal phone calls.

You can see our documentation on all the huddle and conference room spaces in the Iribe Center in our public Wiki.

Our conference rooms have different capabilities based on the size of the room you are using. For launch day we are still working on a number of the capabilities in these rooms and you should be able to plug in your laptop to display to the screen and projector. In the future we will outline and give sessions on how to utilize the different functionalities in our conference rooms.

== Mailroom ==
The new mailroom is 5109 and is on the 5th floor.

NautilusThumbnails

2018-10-02T19:06:46Z

Sabobbin: Created page with " == Disable Nautilus Thumbnail Feature (RHEL)== * Open a file browser window * In the top bar click 'File -> Preferences' **File:Nautilus-preferences.png | thumb|center|380..."

== Disable Nautilus Thumbnail Feature (RHEL)==
* Open a file browser window
* In the top bar click 'File -> Preferences'
**[[File:Nautilus-preferences.png | thumb|center|380px]]
* Navigate to the 'Search & Preview' tab.
**[[File:Nautilus-preview.png | thumb|center|280px]]
* Under the thumbnails section select 'Never'
* Exit the window.

== Clean up existing thumbnail files==
Thumbnails are stored in the following directory:
<pre>~/.cache/thumbnails/</pre>
Removing that directory will clean up the thumbnails.

==Checking Thumbnail space usage==
The following command shows the current disk space utilization of the thumbnails:
<pre>du -sh ~/.cache/thumbnails/ </pre>

File:Nautilus-preview.png

2018-10-02T18:29:38Z

Sabobbin:

File:Nautilus-preferences.png

2018-10-02T18:28:58Z

Sabobbin:

MFA

2018-04-23T12:41:39Z

Sabobbin: Created page with "{{Note | This page is a work in progress, and covers a feature currently being tested/deployed}} Multi-factor authentication (MFA) is a method of confirming a user's claimed i..."

{{Note | This page is a work in progress, and covers a feature currently being tested/deployed}}
Multi-factor authentication (MFA) is a method of confirming a user's claimed identity in which a user is granted access only after successfully presenting 2 or more pieces of evidence (or factors) to an authentication mechanism. Valid factors include:
* knowledge (something they and only they know)
* possession (something they and only they have)
* inherence (something they and only they are)

UMIACS Utilizes the Duo security platform to allow mobile devices to server as a second factor.

== Common Tasks ==
* Getting Started
* [[MFA/Duo_Recovery | Replacing a lost Duo MFA device.]]

WebSpace

2018-01-29T15:40:21Z

Sabobbin:

UMIACS provides web space hosting for research/lab pages and user pages.

==Main Website and Lab Pages==

<pre>http://www.umiacs.umd.edu</pre>

Users can access the main website and lab sites for editing in two ways:
* From Unix as /fs/www - and can be remotely accessed by [[SFTP]] to a supported Unix host (eg. [[OpenLAB]])
* From Windows as \\fluidfs.pc.umiacs.umd.edu\www-umiacs - and remotely accessed by the same file share over the [[VPN]]

Faculty members and authorized users can modify their own public profiles on the main UMIACS homepage. For instructions, see [[ContentManagement]].

==Personal Web Space==

<pre>http://www.umiacs.umd.edu/~username</pre>

Users can access their website for editing two ways:

* From Unix as /fs/www-users/username - and can be remotely accessed via [[SFTP]] to a supported UNIX host (eg. [[OpenLAB]])
* From Windows as \\fluidfs.pc.umiacs.umd.edu\www-users\username - and remotely accessed by the same file share over the [[VPN]]

In general, large datasets related to a Labs research should go into the specific lab's web tree, not the individual users. Remember that users' webpage is not permanently maintained once the user leaves UMIACS.

==Adding A Password Protected Folder To Your Web Space==

1) Create the directory you want to password protect or <tt>cd</tt> into the directory you want to password protect

2) Create a file called ''.htaccess'' (<tt> vi .htaccess</tt>) in the directory you wish to password protect.

3) In the file you just created type the following lines

<pre>
AuthUserFile "/your/directory/here/".htpasswd
AuthName "Secure Document"
AuthType Basic
require user username
</pre>

For example, if you were going to protect the <tt>/fs/www-users/username/private</tt> directory and you want the required name to be <tt>class239</tt>, then your file would look like this:
<pre>
AuthUserFile /fs/www-users/username/private/.htpasswd
AuthName "Secure Document"
AuthType Basic
require user class239
</pre>

4) Create a file called ''.htpasswd'' in the same directory as ''.htaccess''. You create this file by typing in <tt>htpasswd -c .htpasswd ''username''</tt> in the directory area to be protected.

In the example above, the username is <tt>class239</tt> so you would type <tt>htpasswd -c .htpasswd class239</tt>

You will be prompted to enter the password you want. The ''.htpasswd'' file will be created in the current directory and will contain an encrypted version of the password.

To later change the username, edit the ''.htaccess'' file and change the username. If you want to later change the password, just retype the above line in step 4 and enter the new password at the prompt.

==Restricting Content based on IP address==
It is possible to have pages on your webspace only accessible to clients connecting from certain IP addresses. In order to accomplish this, cd in to the directory you wish to restrict, and edit your ''.htaccess'' or ''httpd.conf'' file. The example below shows how to make content only viewable to clients connecting from the UMD wifi in Apache 2.2.

<pre style="white-space: pre-wrap;
white-space: -moz-pre-wrap;
white-space: -pre-wrap;
white-space: -o-pre-wrap;
word-wrap: break-word;">SetEnvIF X-Forwarded-For "^128\.8\.\d+\.\d+$" UMD_NETWORK
SetEnvIF X-Forwarded-For "^129\.2\.\d+\.\d+$" UMD_NETWORK
SetEnvIF X-Forwarded-For "^192\.168\.\d+\.\d+$" UMD_NETWORK
SetEnvIF X-Forwarded-For "^206\.196\.(?:1[6-9][0-9]|2[0-5][0-9])\.\d+$" UMD_NETWORK
SetEnvIF X-Forwarded-For "^10\.\d+\.\d+\.\d+$" UMD_NETWORK
Order Deny,Allow
Deny from all
Allow from env=UMD_NETWORK
</pre>

The SetEnvIF directive will modify one's environment if the specified attribute matches the provided regular expression. In this example, IP addresses that are forwarded from an IP within UMD's IP space are tagged with UMD_NETWORK. Then, all traffic to the example directory is blocked unless it has the UMD_NETWORK tag. See the following pages for a more in depth explanation of the commands used.

[https://httpd.apache.org/docs/2.2/howto/htaccess.html .htaccess], [https://httpd.apache.org/docs/2.2/mod/mod_setenvif.html#setenvif SetEnvIf], [https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order Order], [https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#deny Deny], [https://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow Allow]

== Hosting websites in UMIACS Object Store ==
Please refer to the [https://obj.umiacs.umd.edu/obj/help | UMIACS Object Store Help Page] for details on hosting a website in the UMIACS Object Store.

Network/VPN

2018-01-04T15:41:44Z

Sabobbin:

UMIACS current provides VPN access through a Pulse Secure SSL VPN.

==Getting Connected==
* [[Network/VPN/Windows|Configuring a Windows SSL VPN Connection]]
* [[Network/VPN/OSX|Configuring a macOS VPN Connection]]
* '''Mobile Devices:'''
:* [[Network/VPN/IOS | Configuring an iOS device]]
Once connected to the VPN you can use the [[Remote_Desktop| Remote Desktop client]] to access a Windows machine, as well as access other UMIACS resources.

== Enabling MultiFactor Authentication ==
* [[Network/VPN/MFA|Setup Pulse VPN for MFA]]

SecureShell

2017-11-13T19:34:48Z

Sabobbin:

Secure Shell (or [http://en.wikipedia.org/wiki/Secure_Shell SSH]) is a network protocol allowing two computers to exchange data securely over an insecure network. By default, use of SSH brings the user to a terminal, but the protocol can be used for other types of data transfer such as [[SFTP]] and [[SCP]].

==Connecting to an SSH Server==
Under Linux and macOS the following command from a terminal will connect a client computer to the UMIACS [[OpenLAB]].
# ssh bkirz@openlab.umiacs.umd.edu
This will give you access to a terminal on any one of the [[OpenLAB]] servers. Note that by default you will not have access to applications that require X11 to run.

All UMIACS Windows hosts are installed with SSH Secure Shell Client. Alternatively, users can install these software on their personal machines:

* [http://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY]
* [http://ttssh2.sourceforge.jp/ ttssh2]

Alternatively, all users can launch terminal sessions [[JuniperVPNTerminalSession| through the Juniper VPN web interface.]]

==X11 Forwarding==
By default, SSH only gives the user shell access to a host. Enabling X11 Forwarding allows users to run applications with Graphical User Interfaces.

Under Linux and macOS, the following command from a terminal will connect a client computer to the UMIACS [[OpenLAB]] using X11 Forwarding.
# ssh '''-Y''' bkirz@openlab.umiacs.umd.edu

Under macOS, [http://xquartz.macosforge.org/landing/ xQuartz] is required on the client machine to forward X sessions from the remote session.

If you do not have Cygwin, you will need to forward X through
[http://sourceforge.net/projects/vcxsrv/ VcXsrv] or
[http://www.straightrunning.com/XmingNotes/ Xming].
First, enable X forwarding on your secure ssh client. The option is under tunneling in the ssh client settings, shown below. This only has to be done once.

[[Image:sshXForward.jpg]]

Next, click save in the main ssh appication window to save this setting.

After this has been done, every time you want to use X forwarding, you need to make sure VcXsrv or Xming has been started (it will appear in your task tray) through the start menu programs.
Now, you will be able to use Xwindow programs from your ssh client.

==SSH Tunneling==

You can tunnel one or more ports through an SSH connection such that your packets will look like they are coming from the host you are tunneling to. This is helpful for services that you would be normally blocked by a firewall.

Please see the [[SecureShellTunneling]] page for more information.

==SSH Keys (and Passwordless SSH)==

There are some situations where it is important to be able to ssh without entering a password. This is mostly required when working in clusters. This is done using ssh keys. Instead of authenticating with a password, ssh can use a pre-defined set of encryption keys to establish an authorized connection.
To setup passwordless ssh, do the following.

First, you will need to create a ssh [http://en.wikipedia.org/wiki/Key_pair key pair]. It is possible to use a password that you will need to enter at the beginning of your work session. This is preferable as it is more secure but may cause problems for some clustered work, particularly our TORQUE/MAUI clusters. If you simply hit '''[enter]''', you will never be prompted for a password when ssh'ing which can lead to security problems.

# To create a '''''passwordless''''' key, type the following, and then hit enter to place the keys in the default directory. '''NOTE: This is ''REQUIRED'' for our [[ClusterGuide|TORQUE/MAUI]]-based clusters!''' <pre> # ssh-keygen -N ""</pre>
#: Alternatively, to create a '''''passphrase-protected''''' (more-secure) key, type the following. Do not use this option if you plan to use any of our [[ClusterGuide|TORQUE/MAUI]]-based clusters.<pre> # ssh-keygen</pre>
#This will produce two files, '''id_rsa''' and '''id_rsa.pub''', the private and public keys, respectively. The default location will be ~/.ssh/. For the purposes of this tutorial we'll assume this default. Once you've created the keys, you will need to put them into place as follows:
# chmod 700 ~/.ssh
# chmod 600 ~/.ssh/id_rsa
# touch ~/.ssh/authorized_keys2
# chmod 600 ~/.ssh/authorized_keys2
# cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys2
# rm ~/.ssh/id_rsa.pub

*It is '''very''' important that you keep your private key secure! Ensure that it is chmod'd to 600 and that you do not put it anywhere visible to other users!
*You must also make sure that no other users may write to your .ssh directory. This includes making sure that your home directory is not writable by group. Your home directory should be chmod'd to 750 or 700 to make sure of this. If the group write bit is set, your ssh keys '''WILL NOT WORK'''

If you did not select a passphrase when you generated your keys, you can now ssh without a password. If you did select a passphrase, you will need to activate the keys as follows:

# ssh-agent [SHELL]
# ssh-add -t [TIME]

In this case, "[SHELL]" is your preferred shell and "[TIME]" is the amount of time you'd like the key to be active in seconds. So, the following would start a bash shell with passwordless ssh active for 30 minutes:

# ssh-agent bash
# ssh-add -t 1800

You will be prompted for your passphrase and, when entered correctly, you will be able to ssh without entering a password.

To disable this functionality, simply delete your private key file ('''~/.ssh/id_rsa''') and remove the public key from your '''~/.ssh/authorized_keys2''' file.

==Verify remote host SSH fingerprint==
The SSH protocol relies on host keys to verify the identify of a given host. Each host as a unique key for the various different protocols supported. When connecting to a remove host for the first time, or when the remote host's local host key configuration has changed, you may see the following prompt:
<pre>
$ ssh sabobbin@openlab
The authenticity of host 'openlab (128.8.132.247)' can't be established.
RSA key fingerprint is 25:83:aa:df:f5:ad:5f:08:c9:8a:a3:5d:97:8b:48:1f.
Are you sure you want to continue connecting (yes/no)?
</pre>
It is considered best practice to verify the key fingerprint with the actual key of the host. UMIACS maintains a reference of SSH key fingerprints available at the following link:
https://gitlab.umiacs.umd.edu/staff/ssh-fingerprints/blob/master/fingerprints

It is important to note that each key type has a different fingerprint. Depending on your local configuration, your client may prefer a specific type of key. The following commands can be used to determine the fingerprint of a given key type on a remote host:

<pre>
$ ssh-keyscan -t rsa openlab.umiacs.umd.edu > key
# openlab.umiacs.umd.edu SSH-2.0-OpenSSH_7.4
$ ssh-keygen -l -f key
2048 25:83:aa:df:f5:ad:5f:08:c9:8a:a3:5d:97:8b:48:1f openlab.umiacs.umd.edu (RSA)
</pre>

If you have any questions, or notice a discrepancy, please submit a request to staff@umiacs.umd.edu.

===Windows / Putty Verification===
Those who user putty to connect to remote hosts, the prompt will be similar to the following:

[[File:Putty ssh host key prompt.png]]

If the host key reported by putty matches the [https://gitlab.umiacs.umd.edu/staff/ssh-fingerprints/blob/master/fingerprints Documented entry for that host], it is safe to click 'yes'. If they do not match, please report the issue to [mailto:staff@umiacs.umd.edu staff@umiacs.umd.edu]

===Other Platforms===
* [https://winscp.net/eng/docs/faq_hostkey WinSCP]

==Long Running Processes==
If you are dealing with a long running process that is inhibiting your ability to work regularly, you may want to run your processes inside a screen on the host that you're connecting to. This way, if the connection is dropped for any reason the screen session will automatically detach on the host and will continue running so that you can reattach it at a later time when you've connected again. Please see our documentation on [[Screen | GNU Screen]] for more information.

==Further Information==
[http://www.openssh.org/ OpenSSH]

[http://www.openssh.com/windows.html Windows Clients]

2016-07-07T12:45:49Z

Sabobbin:

Sabobbin:

Computational Resources are physical and virtual machines within UMIACS.

==Current Offerings==
;[[Services/Compute/HPC | High Performance Computing (HPC)]]
;;[[Services/Compute/LabSpecific | Lab Specific Compute Resources]]
;[[Services/Compute/UserSupported | User-Supported Compute Resources]]
;[[Service/Compute/Virtualization | Virtualization ]]