Course · RCC ClusterDocs

Class 1: safe access to RCC

New workstation or first RCC experience?

Complete RCC Expedition Light for the required first-use path. Use RCC Expedition for a self-contained local course covering workstation security/patching, SSH/Linux basics, the research/clinical network boundary, Slurm, storage, data transfer, and reproducible workflows.

The course is datensparsam and does not report learner progress to RCC. This page remains the conventional step-by-step reference tutorial.

Before configuring SSH, read the one-page explanation of the jump host, shell host, and Slurm workers.

Learning objectives

By the end of this class you can:

• explain the difference between your SSH private key and the server host key;
• explain why an RCC browser passkey and an SSH key are different credentials;
• verify that an SSH client is installed;
• identify a suitable RCC public key without displaying the private key;
• validate the RCC SSH configuration before connecting;
• make one controlled login test;
• install VS Code and the Remote - SSH extension as the recommended interface for most coding and analysis preparation;
• open a narrowly scoped remote project and configure safe search exclusions;
• transfer a file with scp or sftp to the shell host without sharing an account.

Security model in plain language

Your private key stays on your computer. RCC receives only the public key. The server's digital identity lets your computer verify that it reached an approved RCC service. Use the host-verification information in the current RCC instructions. A changed identity is not fixed by disabling checking; stop and confirm it through an independent institutional channel.

Do not email private keys, copy a colleague's key, register one key for several human accounts, or share a browser session. When a colleague needs access, add their own account to the project.

Browser sign-in and SSH are separate credentials

Your RCC username is one human identity, but RCC can authenticate that identity in different ways:

• web services use the RCC sign-in/SSO flow and may use a password, passkey, or another enrolled factor;
• SSH and VS Code Remote SSH use your registered SSH public key;
• account recovery or sensitive account actions may use separate step-up or recovery credentials.

A YubiKey can hold more than one kind of credential. A browser/WebAuthn passkey and an OpenSSH *-sk key are not the same credential merely because they are on the same physical key.

Read How RCC authentication fits together before adding, replacing, or deleting passkeys, YubiKey credentials, recovery codes, or SSH keys.

First-time client setup

Create a dedicated Ed25519 key protected by a strong passphrase.

If you have a compatible FIDO2 hardware authenticator, prefer ssh-keygen -t ed25519-sk -f ~/.ssh/id_rcc. The private material remains on the authenticator and normally requires your physical presence.

On macOS or Linux:

ssh-keygen -t ed25519 -f ~/.ssh/id_rcc

On Windows PowerShell:

ssh-keygen -t ed25519 -f "$HOME\.ssh\id_rcc"

Register only id_rcc.pub through the approved RCC account workflow. The file without .pub is the private key and stays on your computer.

Use the current SSH configuration supplied through an approved RCC channel. Do not reconstruct it from an old screenshot or a colleague's saved settings. Its safe shape includes both the gateway and the destination:

Host rcc-login
  HostName login.ikim.uk-essen.de
  User YOUR_RCC_USERNAME
  IdentityFile ~/.ssh/id_rcc
  IdentitiesOnly yes
  ForwardAgent no

Host shellhost c? c?? c??? d?? g?-? g?-??
  HostName %h.ikim.uk-essen.de
  User YOUR_RCC_USERNAME
  IdentityFile ~/.ssh/id_rcc
  IdentitiesOnly yes
  ProxyJump rcc-login
  ForwardAgent no

Use shellhost for normal login. The additional node patterns support a node assigned by an active Slurm interactive allocation; they do not permit work outside Slurm. The rcc-login account is forwarding-only and will not provide an interactive shell. Do not test it with ssh rcc-login; ProxyJump uses it automatically when you connect to the destination.

Inspect the effective configuration without connecting:

ssh -G shellhost

Gate 1A: local readiness

macOS or Linux

bash exercises/readiness/rcc-readiness.sh

Windows PowerShell

powershell -ExecutionPolicy Bypass -File exercises/readiness/Test-RccReadiness.ps1

The gate checks software and configuration. It does not contact RCC unless you explicitly add --live or -Live.

Gate 1B: one bounded SSH test

First verify the published RCC host identity through an independent institutional channel. Then run exactly one attempt:

bash exercises/readiness/rcc-readiness.sh --live

The test uses strict host-key checking, disables password prompts, permits one connection attempt, and times out quickly. Stop after repeated failures and use the troubleshooting page rather than creating a retry loop.

Gate 1C: VS Code

The same readiness script checks whether VS Code and the Microsoft Remote - SSH extension are present. Terminal SSH must work before VS Code is tested.

For most users, this is the normal day-to-day interface after the connection test passes. Open the code repository or smallest useful project subdirectory, not an entire home, group, or project-storage tree. VS Code does not create a Slurm allocation: use its terminal to submit and inspect jobs, not to run a sustained analysis directly.

Before searching, exclude data, results, environments, package trees, and workflow caches. Review extensions and Workspace Trust because remote extensions and repository tasks can run with your RCC account's permissions. The VS Code reference contains copyable settings and the restored ClusterDocs performance advice.

Web data transfer

Inside the hospital network, use your individual RCC username and normal RCC sign-in flow. External access may require an additional factor. Do not solve access problems by using a shared project account.

Transfer files with scp, sftp, or rsync to the shell host; the jump host only forwards the connection. The browser-based RCC Files portal is not yet released. Confirm the project and destination before uploading. Read Storage and transfer for the commands.

Reference companion: Use Account access, SSH, and VS Code for account-request details, diagnostics, Remote SSH, and light SSHFS mounts. Use Storage and transfer for larger data movement, archives, checksums, and object-storage boundaries.

Knowledge check

Completion gate

• The local readiness gate reports SSH and configuration as ready.
• A single live test succeeds.
• VS Code can open the same configured RCC target.
• You can explain where your private SSH key is stored without showing it.
• You can explain why web sign-in credentials, recovery credentials, and SSH keys are related to one RCC identity but are not interchangeable.