This changeover will occur Oct 1, 2000. Be prepared!
Load your new client, if necessary [ instructions for NT], test it out, and let us know if you have any problems. Many people already use ssh by default when accessing linux machines. The only major change you will see is that you will no longer be able to use xstart in exceed; you will need to launch an ssh client and then launch xterms from it. We have tested various access modes and have had no trouble getting to D0 machines and opening x-windows once an appropriate ssh client was available. This note provides instructions for getting one. If you have trouble with these instructions, or have questions about ssh access, please email helpdesk@fnal.gov.
This is the first step in meeting the requirements for Strong Authentication.
With ssh in place, there are no other barriers preventing the installation
of Strong Authentication and it will be installed shortly thereafter. At
that time telnet and rlogin will be available for authenticated users.
An announcement will be made when the installation is completed and users
will be encouraged to take this time to familiarize themselves with and
work within the Strengthened Realm before Kerberos principles are absolutely
required. We encourage those who are not yet aware
of or have not seen the documentation for Strong Authentication at Fermilab
to read it. It can be found here
.
If you are using unix, your system almost certainly has ssh already
installed. We are using ssh1. If it is not installed (it is the default
on Fermi RedHat), get your system administrator to install it. If you are
using NT, you will need to install an ssh1 client. You will not be able
to use xstart to reach the D0 computers. Exceed sends passwords unencrypted
which is really not a good thing. One machine (d0chb) will be a temporary
gateway where telnet access is allowed and ssh will then be required to
access D0mino or other D0 machines. This machine however will not allow
users to authenticate and enter the Strengthened Realm. This is only a
TEMPORARY solution if your plans do not include the replacement of a x-terminal
or you have offsite machines that will not participate in the Fermilab
Strong Authentication realm. Requests
for Cryptocards [link not yet working - under construction] should
be made if you expect to need x terminal or non-authenticated machine access.