Logging into the DCC
There are two ways to reach the Duke Compute Cluster. Both use your Duke NetID and Duo multifactor authentication, and neither requires the Duke VPN.
| Open OnDemand | SSH | |
|---|---|---|
| What it is | The DCC in your web browser | A terminal session on your own computer |
| Best for | New users, RStudio, Jupyter, and Linux desktop sessions | Submitting and monitoring jobs, scripting, file transfers |
| You need | A browser | An SSH client (built in on macOS and Linux) |
If you are not comfortable with the command line, start with Open OnDemand.
What Login Nodes Are For
As a shared computing resource, all work done on the DCC must be done by submitting jobs to the scheduler. Login nodes must not be used to execute computing tasks.
Acceptable use of login nodes includes:
- lightweight file transfers,
- script and configuration file editing,
- job submission and monitoring,
- BaseSpace BaseMount - users can use basemount to mount BaseSpace into their home directories.
Important!
To minimize disruption and ensure a comfortable working environment for users, resource limits are enforced on login nodes, and processes started there will automatically be terminated if their resource usage (including CPU time, memory and run time) exceeds those limits.
Web Access
Users who are not comfortable using the command line can access the DCC through Open OnDemand, which provides access to interactive sessions on the DCC through your browser. The Open OnDemand service provides access to the DCC through RStudio, Jupyter, or Linux desktop sessions.
SSH Access
Connecting over SSH takes three things: a terminal, one command, and your Duo approval. VPN is not required, but MFA is required.
Step 1: Open a Terminal
Select your operating system below. Your choice applies to every tabbed section on this page.
macOS includes an SSH client. Open the Terminal app, found in Applications > Utilities, or press Cmd+Space and type Terminal.
Linux includes an SSH client. Open your distribution's terminal application, or press Ctrl+Alt+T on most desktop environments.
Windows does not include a full-featured SSH client, so we recommend installing MobaXterm. Once it is installed, open MobaXterm and select Start local terminal.
You can also create a saved connection instead of typing the command each time: select Session, then SSH, enter dcc-login.oit.duke.edu as the remote host, select Specify username, and enter your Duke NetID.
Step 2: Connect
Run the following, replacing YOUR_NETID with your Duke NetID:
Enter your Duke password when prompted, then complete Duo authentication.
Your password will not appear on the screen while you type, not even as asterisks. This is normal. Type it and press Enter.
When you are logged in, your prompt will change to show a login node name, such as dcc-login-03.
Sample ssh login with multifactor
kk338@CDSS-5630 ~ % ssh kk338@dcc-login.oit.duke.edu
Password:
Duo two-factor login for kk338
Enter a passcode or select one of the following options:
1. Duo Push to XXX-XXX-4007
2. Phone call to XXX-XXX-4007
3. Phone call to XXX-XXX-9784
4. SMS passcodes to XXX-XXX-4007 (next code starts with: 2)
Passcode or option (1-4): 1
Success. Logging you in...
Last login: Tue Dec 21 11:07:41 2021 from xxx
################################################################################
# MOTD #
# My patch window is wednesday 03:00 #
################################################################################
kk338@dcc-login-03 ~ $
To end your session, type exit and press Enter.
Choosing an SSH Client
Linux and macOS systems generally come with an SSH client already installed, and you can use ssh directly from a terminal window. Windows users who prefer an alternative to MobaXterm may use PuTTY. Advanced Windows users may consider installing WSL2 (Windows Subsystem for Linux 2); see the installation instructions.
DCC support staff do not offer support for software installations on your local computer. Other SSH clients may or may not work, and clients that create persistent sessions to the DCC should be avoided.
SSH Keys
SSH keys are optional. First confirm that you can log in using your Duke password and Duo. After that, setting up an SSH key on your workstation can make future logins and file transfers easier by creating a secure key-based session instead of using your password with MFA.
Windows users: Run the commands below from MobaXterm's local terminal. They also work in Windows PowerShell if the Windows OpenSSH Client is installed. If PowerShell reports that ssh-keygen is not recognized, install and use MobaXterm to follow these steps.
Step 1: Generate a Key Pair
Run the following on your local machine, not on the DCC:
You will be prompted for a file to save the key in. The default is fine, so press Enter. You will then be prompted for a passphrase.
Important!
Do not leave the passphrase blank. A key passphrase is optional to ssh-keygen but essential here: once your key is in place it replaces both your Duke password and your Duo prompt, so an unprotected key file gives anyone who copies it your access to the cluster with nothing left to stop them.
Apply Duke's credential standard to your passphrase. Per the Secure Access Guide, credentials must be at least 12 characters and pass a basic complexity check. Several unrelated words strung together are both stronger and easier to remember than a short, complicated string.
Your key passphrase must not be your NetID password, and must never be shared. Duke provides 1Password at no cost to generate and store it, and it is covered under the Duke Acceptable Use Policy along with your other Duke credentials.
This creates two files that work as a pair. ~/.ssh/id_ed25519.pub is your public key, which is the half you hand out. ~/.ssh/id_ed25519 is your private key, which stays on your machine.
Step 2: View and Copy Your Public Key
The output should look something like this, on a single line:
ssh-ed25519 AAUAC3NzaC1lZDI1NTE5AAAAIDhkOqqB+kRDIDp86EGo0hNvogOxwJmM5kxx/aYCzOrG kk338@CDSS-CPP0H34NX2
Copy the entire line.
Important!
When copying a key to share, always use the .pub file. The matching file without the extension, ~/.ssh/id_ed25519, is your private key, which you should NEVER share with ANYONE.
Later steps refer to that private key path, without .pub, and that is expected. Commands that share your key use the .pub file, while commands that load your key on your own computer, such as ssh-add in Avoid Retyping Your Passphrase, use the private key.
Step 3: Add the Public Key to Your Duke Profile
Go to Advanced User Options at idms-web.oit.duke.edu/portal and find the section titled Manage Your Public SSH Keys.
In that section there should be clickable text that says + See More about SSH keys. Click that to expand the section, and you should see a textbox for New Public Key where you can paste the public key you copied in the previous step.
Step 4: Test Your Connection
Connect again as you did above. You should now see Enter passphrase for key instead of Password, and you should not be prompted for Duo.
Sample ssh login using a key
kk338@CDSS-5630 ~ % ssh kk338@dcc-login.oit.duke.edu
Enter passphrase for key '/Users/kk338/.ssh/id_ed25519':
Last login: Tue Dec 21 11:13:41 2021 from xxx
################################################################################
# MOTD #
# My patch window is wednesday 03:00 #
################################################################################
kk338@dcc-login-03 ~ $
Avoid Retyping Your Passphrase
Because your key is protected by a passphrase, SSH will ask for it on every connection, including each scp or rsync transfer and each time VS Code reconnects. An authentication agent removes that friction: it holds your unlocked private key in memory so you enter the passphrase once per session rather than once per command. Setting one up is what keeps a strong passphrase practical, so you are never tempted to fall back to an unprotected key.
1Password's SSH feature is itself an authentication agent. Choose one agent, either your operating system's ssh-agent or 1Password, rather than configuring both to serve the same key.
Add the key to the agent and store the passphrase in your keychain:
Enter the passphrase you created in Step 1 when prompted.
Then edit ~/.ssh/config so the key is loaded automatically from then on:
Most modern Linux desktop environments will automatically prompt for and manage your private key passphrase. If yours does not, run:
To load the key automatically, edit ~/.ssh/config and add:
Run:
See Microsoft's Windows ssh-agent documentation for details on starting the agent as a service so your key persists across reboots.
1Password is provided to Duke users at no cost and can serve your key as an SSH agent, so each connection is approved with Touch ID or your account password instead of a typed passphrase.
The 1Password agent serves only keys saved in 1Password, not keys sitting in ~/.ssh. You must import your key, and ssh-add cannot load one into it.
- Enable the agent in the 1Password desktop app under Settings > Developer.
- Import your key with New Item > SSH Key > Add Private Key > Import a Key File, select
~/.ssh/id_ed25519, and enter its passphrase when prompted to decrypt it. - Point SSH at the 1Password agent by adding the block below to
~/.ssh/config.
That socket path is for macOS; see the setup guide below for Linux and Windows. Host * is appropriate here because IdentityAgent selects only which agent answers, not which key is offered.
Test with ssh YOUR_NETID@dcc-login.oit.duke.edu rather than ssh-add -l. The ssh-add command reads the SSH_AUTH_SOCK environment variable instead of ~/.ssh/config, so it reports on your system agent and will show no identities even when 1Password is working correctly.
- To get started: 1Password at Duke
- Setup guide: 1Password SSH agent
- Key management: 1Password Manage Keys
Scoping these settings to dcc-login.oit.duke.edu rather than Host * means your DCC key is offered only to the DCC, not to every server you connect to. It also applies to the Access via VS Code and Access via AI Agents profiles, since those connect through the same login host.
View more general information about SSH public key authentication at ssh.com.
Login Troubleshooting
| What you see | What to try |
|---|---|
| Nothing appears while typing your password | This is expected. Passwords are not echoed to the screen, not even as asterisks. |
Permission denied, please try again. |
Check that your NetID and password are correct. Retype the password rather than pasting it. |
| No Duo prompt appears, or it times out | Confirm your devices are enrolled and working at Duke MFA help. |
ssh-keygen: command not found (Windows) |
The Windows OpenSSH Client is not installed. Use MobaXterm's local terminal instead. |
You set up a key but are still asked for Password |
Confirm you pasted the contents of id_ed25519.pub, not the private key, and that it was saved to your Duke profile. |
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! |
The login node's host key changed. Do not bypass this blindly. Contact rescomputing@duke.edu to confirm before continuing. |
If you are still stuck, email rescomputing@duke.edu and include the command you ran and the full output you are seeing.
VS Code
Users may connect to the DCC login nodes using VS Code for light debugging tasks and managing scripts. However, VS Code SHOULD NOT BE USED for computationally intense tasks on login nodes. If you would like to execute code using VS Code, connect to Open OnDemand and run your code interactively using the Code Server option or follow the Access via VS Code guide to connect directly to a compute node.
AI Agents
AI agents running on your local machine, such as Claude Code, OpenCode, and Codex CLI, attempt to execute remote commands over SSH. If they connect directly to dcc-login.oit.duke.edu, those commands run on a shared login node, which may cause heavy load on the node affecting all users. Please follow the Access via AI Agents guide to learn how to configure your AI agents to run tasks on compute nodes instead. You may find additional details regarding AI policy on the DCC at AI Use on the Duke Compute Cluster.