moved

docs.it4i/anselm-cluster-documentation/outgoing-connections.md

+Outgoing connections
+====================
+
+Connection restrictions
+-----------------------
+Outgoing connections, from Anselm Cluster login nodes to the outside world, are restricted to following ports:
+
+|Port|Protocol|
+|---|---|
+|22|ssh|
+|80|http|
+|443|https|
+|9418|git|
+
+!!! Note "Note"
+	Please use **ssh port forwarding** and proxy servers to connect from Anselm to all other remote ports.
+
+Outgoing connections, from Anselm Cluster compute nodes are restricted to the internal network. Direct connections form compute nodes to outside world are cut.
+
+Port forwarding
+---------------
+
+### Port forwarding from login nodes
+
+!!! Note "Note"
+	Port forwarding allows an application running on Anselm to connect to arbitrary remote host and port.
+
+It works by tunneling the connection from Anselm back to users workstation and forwarding from the workstation to the remote host.
+
+Pick some unused port on Anselm login node  (for example 6000) and establish the port forwarding:
+
+```bash
+local $ ssh -R 6000:remote.host.com:1234 anselm.it4i.cz
+```
+
+In this example, we establish port forwarding between port 6000 on Anselm and port 1234 on the remote.host.com. By accessing localhost:6000 on Anselm, an application will see response of remote.host.com:1234. The traffic will run via users local workstation.
+
+Port forwarding may be done **using PuTTY** as well. On the PuTTY Configuration screen, load your Anselm configuration first. Then go to Connection->SSH->Tunnels to set up the port forwarding. Click Remote radio button. Insert 6000 to Source port textbox. Insert remote.host.com:1234. Click Add button, then Open.
+
+Port forwarding may be established directly to the remote host. However, this requires that user has ssh access to remote.host.com
+
+```bash
+$ ssh -L 6000:localhost:1234 remote.host.com
+```
+
+Note: Port number 6000 is chosen as an example only. Pick any free port.
+
+### Port forwarding from compute nodes
+
+Remote port forwarding from compute nodes allows applications running on the compute nodes to access hosts outside Anselm Cluster.
+
+First, establish the remote port forwarding form the login node, as [described
+above](outgoing-connections.html#port-forwarding-from-login-nodes).
+
+Second, invoke port forwarding from the compute node to the login node. Insert following line into your jobscript or interactive shell
+
+```bash
+$ ssh  -TN -f -L 6000:localhost:6000 login1
+```
+
+In this example, we assume that port forwarding from login1:6000 to remote.host.com:1234 has been established beforehand. By accessing localhost:6000, an application running on a compute node will see response of remote.host.com:1234
+
+### Using proxy servers
+
+Port forwarding is static, each single port is mapped to a particular port on remote host. Connection to other remote host, requires new forward.
+
+!!! Note "Note"
+	Applications with inbuilt proxy support, experience unlimited access to remote hosts, via single proxy server.
+
+To establish local proxy server on your workstation, install and run SOCKS proxy server software. On Linux, sshd demon provides the functionality. To establish SOCKS proxy server listening on port 1080 run:
+
+```bash
+local $ ssh -D 1080 localhost
+```
+
+On Windows, install and run the free, open source [Sock Puppet](http://sockspuppet.com/) server.
+
+Once the proxy server is running, establish ssh port forwarding from Anselm to the proxy server, port 1080, exactly as [described above](outgoing-connections/#port-forwarding-from-login-nodes).
+
+```bash
+local $ ssh -R 6000:localhost:1080 anselm.it4i.cz
+```
+
+Now, configure the applications proxy settings to **localhost:6000**. Use port forwarding  to access the [proxy server from compute nodes](outgoing-connections/#port-forwarding-from-compute-nodes) as well .

docs.it4i/anselm-cluster-documentation/shell-and-data-access.md

+Shell access and data transfer
+==============================
+
+Interactive Login
+-----------------
+The Anselm cluster is accessed by SSH protocol via login nodes login1 and login2 at address anselm.it4i.cz. The login nodes may be addressed specifically, by prepending the login node name to the address.
+
+|Login address|Port|Protocol|Login node|
+|---|---|
+|anselm.it4i.cz|22|ssh|round-robin DNS record for login1 and login2|
+|login1.anselm.it4i.cz|22|ssh|login1|
+|login2.anselm.it4i.cz|22|ssh|login2|
+
+The authentication is by the [private key](../../../get-started-with-it4innovations/accessing-the-clusters/shell-access-and-data-transfer/ssh-keys/)
+
+!!! Note "Note"
+	Please verify SSH fingerprints during the first logon. They are identical on all login nodes:
+
+	29:b3:f4:64:b0:73:f5:6f:a7:85:0f:e0:0d:be:76:bf (DSA)
+	d4:6f:5c:18:f4:3f:70:ef:bc:fc:cc:2b:fd:13:36:b7 (RSA)
+
+Private key authentication:
+
+On **Linux** or **Mac**, use
+
+```bash
+local $ ssh -i /path/to/id_rsa username@anselm.it4i.cz
+```
+
+If you see warning message "UNPROTECTED PRIVATE KEY FILE!", use this command to set lower permissions to private key file.
+
+```bash
+local $ chmod 600 /path/to/id_rsa
+```
+
+On **Windows**, use [PuTTY ssh client](../../../get-started-with-it4innovations/accessing-the-clusters/shell-access-and-data-transfer/putty/putty/).
+
+After logging in, you will see the command prompt:
+
+```bash
+                                            _
+                       /\                  | |
+                      /  \   _ __  ___  ___| |_ __ ___
+                     / /\ \ | '_ \/ __|/ _ \ | '_ ` _ \
+                    / ____ \| | | \__ \  __/ | | | | | |
+                   /_/    \_\_| |_|___/\___|_|_| |_| |_|
+
+
+                        http://www.it4i.cz/?lang=en
+
+Last login: Tue Jul  9 15:57:38 2013 from your-host.example.com
+[username@login2.anselm ~]$
+```
+
+Example to the cluster login:
+
+<tty-player controls src=/src/anselm/login_anselm.ttyrec></tty-player>
+
+>The environment is **not** shared between login nodes, except for [shared filesystems](../storage/storage/#section-1).
+
+Data Transfer
+-------------
+Data in and out of the system may be transferred by the [scp](http://en.wikipedia.org/wiki/Secure_copy) and sftp protocols.  (Not available yet.) In case large volumes of data are transferred, use dedicated data mover node dm1.anselm.it4i.cz for increased performance.
+
+|Address|Port|Protocol|
+|---|---|
+|anselm.it4i.cz|22|scp, sftp|
+|login1.anselm.it4i.cz|22|scp, sftp|
+|login2.anselm.it4i.cz|22|scp, sftp|
+|dm1.anselm.it4i.cz|22|scp, sftp|
+
+The authentication is by the [private key](../../../get-started-with-it4innovations/accessing-the-clusters/shell-access-and-data-transfer/ssh-keys/)
+
+!!! Note "Note"
+	Data transfer rates up to **160MB/s** can be achieved with scp or sftp.
+
+    1TB may be transferred in 1:50h.
+
+To achieve 160MB/s transfer rates, the end user must be connected by 10G line all the way to IT4Innovations and use computer with fast processor for the transfer. Using Gigabit ethernet connection, up to 110MB/s may be expected.  Fast cipher (aes128-ctr) should be used.
+
+!!! Note "Note"
+	If you experience degraded data transfer performance, consult your local network provider.
+
+On linux or Mac, use scp or sftp client to transfer the data to Anselm:
+
+```bash
+local $ scp -i /path/to/id_rsa my-local-file username@anselm.it4i.cz:directory/file
+```
+For example how to using scp command:
+<tty-player controls src=/src/anselm/transfer_scp_anselm.ttyrec></tty-player>
+
+```bash
+local $ scp -i /path/to/id_rsa -r my-local-dir username@anselm.it4i.cz:directory
+```
+
+or
+
+```bash
+local $ sftp -o IdentityFile=/path/to/id_rsa username@anselm.it4i.cz
+```
+For example how to using sftp command:
+<tty-player controls src=/src/anselm/transfer_sftp_anselm.ttyrec></tty-player>
+
+Very convenient way to transfer files in and out of the Anselm computer is via the fuse filesystem [sshfs](http://linux.die.net/man/1/sshfs)
+
+```bash
+local $ sshfs -o IdentityFile=/path/to/id_rsa username@anselm.it4i.cz:. mountpoint
+```
+
+Using sshfs, the users Anselm home directory will be mounted on your local computer, just like an external disk.
+
+Learn more on ssh, scp and sshfs by reading the manpages
+
+```bash
+$ man ssh
+$ man scp
+$ man sshfs
+```
+
+On Windows, use [WinSCP client](http://winscp.net/eng/download.php) to transfer the data. The [win-sshfs client](http://code.google.com/p/win-sshfs/) provides a way to mount the Anselm filesystems directly as an external disc.
+
+More information about the shared file systems is available [here](../../storage/storage/).

docs.it4i/anselm-cluster-documentation/vpn-access.md

+VPN Access
+==========
+
+Accessing IT4Innovations internal resources via VPN
+---------------------------------------------------
+
+!!! Note "Note"
+	**Failed to initialize connection subsystem Win 8.1 - 02-10-15 MS patch**
+
+    Workaround can be found at [vpn-connection-fail-in-win-8.1](../../get-started-with-it4innovations/accessing-the-clusters/shell-access-and-data-transfer/vpn-connection-fail-in-win-8.1.html)
+
+For using resources and licenses which are located at IT4Innovations local network, it is necessary to VPN connect to this network. We use Cisco AnyConnect Secure Mobility Client, which is supported on the following operating systems:
+
+-   Windows XP
+-   Windows Vista
+-   Windows 7
+-   Windows 8
+-   Linux
+-   MacOS
+
+It is impossible to connect to VPN from other operating systems.
+
+VPN client installation
+------------------------------------
+
+You can install VPN client from web interface after successful login with LDAP credentials on address <https://vpn1.it4i.cz/anselm>
+
+![](../../img/login.jpeg)
+
+According to the Java settings after login, the client either automatically installs, or downloads installation file for your operating system. It is necessary to allow start of installation tool for automatic installation.
+
+![](../../img/java_detection.jpeg)
+
+![](../../img/executionaccess.jpeg)
+
+![](../../img/executionaccess2.jpeg)
+
+After successful installation, VPN connection will be established and you can use available resources from IT4I network.
+
+![](../../img/successfullinstalation.jpeg)
+
+If your Java setting doesn't allow automatic installation, you can download installation file and install VPN client manually.
+
+![](../../img/instalationfile.jpeg)
+
+After you click on the link, download of installation file will start.
+
+![](../../img/downloadfilesuccessfull.jpeg)
+
+After successful download of installation file, you have to execute this tool with administrator's rights and install VPN client manually.
+
+Working with VPN client
+-----------------------
+
+You can use graphical user interface or command line interface to run VPN client on all supported operating systems. We suggest using GUI.
+
+Before the first login to VPN, you have to fill URL **https://vpn1.it4i.cz/anselm** into the text field.
+
+![](../../img/firstrun.jpg)
+
+After you click on the Connect button, you must fill your login credentials.
+
+![](../../img/logingui.jpg)
+
+After a successful login, the client will minimize to the system tray.
+If everything works, you can see a lock in the Cisco tray icon.
+
+![](../../img/anyconnecticon.jpg)
+
+If you right-click on this icon, you will see a context menu in which you can control the VPN connection.
+
+![](../../img/anyconnectcontextmenu.jpg)
+
+When you connect to the VPN for the first time, the client downloads the profile and creates a new item "ANSELM" in the connection list. For subsequent connections, it is not necessary to re-enter the URL address, but just select the corresponding item.
+
+![](../../img/Anselmprofile.jpg)
+
+Then AnyConnect automatically proceeds like in the case of first logon.
+
+![](../../img/loginwithprofile.jpeg)
+
+After a successful logon, you can see a green circle with a tick mark on the lock icon.
+
+![](../../img/successfullconnection.jpg)
+
+For disconnecting, right-click on the AnyConnect client icon in the system tray and select **VPN Disconnect**.