Depending on your laptop there are a few clients that can be installed.
Please note that RCIC does not provide Windows OS or macOS support for the campus.
If there is an operating system related issue, RCIC will refer you to you get support
to address your systems issue first before installing CRSP Desktop.
In July 2024, Campus DUO authentication
will be mandatory for all CRSP desktop clients. The push response of DUO can become very tiresome.
On some clients, DUO can make CRSP unusable because every file transfer requires another
DUO push. RCIC cannot βturn off DUO.β
However, ssh keys with strong passwords is a secure method to to provide a different
second factor of authentication. SSH keys managed properly do not require DUO after initial setup but still maintain
strong security. Never copy an ssh private key file!
Quick Start
You should follow the guide to Generate SSH keys for different platforms.
Note
It is highly recommended that your private key file is in
PEM format and has a .pem file extension.
The CRSP desktop client seems to more reliably recognize PEM-formatted keys
Note
If using Windows, it is recommended to use the Powershell method
for generating keys and not use PuTTY.
DO NOT COPYprivate ssh-keys. Every different physical device should have a different ssh key pair
Important
All ssh keys that you generate MUST have a strong password.
Passwordless keys are a security violation.
Learn how to use SSH Agent on your desktop/laptop. If on Windows,
you can also Puttyβs pageant. SSH agents securely store a private
key in memory so that you only have to type the keyβs passphrase once.
CRSP uses ssh for authentication but does not grant shell access. This means that common methods
updating as userβs authorized_keys file cannot be used.
Since there is no shell access to CRSP, you should use the procedure below to copy your
ssh public key to CRSP.
To make ssh key management a bit more tractable, RCIC has built a very simple facility to add a new public
key to your $HOME/.ssh/authorized_keys file on CRSP or to completely replace the contents of the
authorized_keys file.
Note
In the steps below, command-line clients are used. These are available at the Linux terminal, the
Mac Terminal, Windows Command line, and Windows Powershell.
Add an SSH Public Key
Suppose you have new public key in format similar to (single line broken for readability):
Now you need to add this key so that it can be recognized by CRSP. To accomplish this, use
sftp to put the public key into the file $HOME/.ssh/add on CRSP. You will be asked for DUO authentication
to authenticate to CRSP.
In the following example, replacepanteater with your UCINetID and replace the panteater-uci.pub
with the name of the file on your laptop that holds your public key.
What you type is in blue:
cd $HOME/.ssh # 1
sftp panteater@access.crsp.uci.edu:.ssh # 2
Password:
Duo two-factor login for panteater
Enter a passcode or select one of the following options:
1. Duo Push to XXX-XXX-1234
Passcode or option (1-1): 1
Connected to access.crsp.uci.edu.
Changing to: /mmfs1/crsp/home/panteater/.ssh
sftp>put panteter-uci.rsa.pub add # 3
Uploading panteater-uci.rsa.pub to /mmfs1/crsp/home/panteater/.ssh/add
panteater-uci.rsa.pub 100% 742 9.1KB/s 00:00
sftp>ls # 4
add authorized_keys known_hosts
sftp>quit # 5
cd $HOME # 6
The first cd command puts you in a directory where your ssh keys are.
The sftp command makes a secure connection to the CRSP server.
The sftpβs put command copies your public ssh key from your laptop to the CRSP server.
the sftpβs ls command output must have add listed. Additional files
as shown above may be present if you have previously used ssh and added keys.
The sftpβs quit command stops sftp session.
The last cd command puts you in your home area on your laptop.
After approximately 5 minutes, the CRSP server will append the contents of the uploaded file named add
to your $HOME/.ssh/authorized_keys file. You will know that this has been completed when the
file add disappears.
Verifying Access
Once your $HOME/.ssh/authorized_keys file is appended, you should be able to sftp
to CRSP using the private key as the identity as in the following
example. Notice that the passphrase for the key was requested and DUO was not required:
sftp -i panteater-uci panteater@access.crsp.uci.edu
Enter passphrase for key 'panteater-uci':
Connected to access.crsp.uci.edu.
sftp>quit
Starting over: Overwrite authorized_keys
Sometimes your $HOME/.ssh/authorized_keys needs more complex editing than simple addition of new
key. You can completely overwrite the contents of the authorized_keys file with a new version.
Create a new version of the file on your local machine called newkeys. Edit it so that it appears exactly how it
you need it to appear on CRSP.
Danger
You need to understand the format of authorized_keys file
and what to put there. Ad hoc editions can make your CRSP access unusable
if you upload a bad file.
Follow the SFTP ProcedureEXCEPT once
you get to the sftp prompt sftp> put the file as overwrite instead of add:
You should see three items on screen: a .pkg file for Mac clients, a .exe file for Windows,
and older-versions folder. To toggle the between list and icon view click on the Layout
icon outlined in green.
For the Mac, simply click on the file with .pkg ending:
You should then see a screen with a download button on it and the full name of the file that will be downloaded
to your local computer. Click Download:
First time the application is started, it will automatically open a template
window where you can configure your connection. The template bookmark is labeled panteater.
You will edit this bookmark with your specific information.
Configure Step 2
The most common share to access is a lab share, owned by a UCI principal investigator.
Needed information to connect to CRSP:
Your UCNetID
The UCNetID of the CRSP lab owner:
It is our UCNetID if you own CRSP Lab
It is the UCNetID of your adviser, If you are a graduate student or post-doctoral researcher
In this example configuration, we are going to use the following specific
information for user npw to access the ppapadop lab:
UCNetID - npw
UCNetID of the CRSP lab owner - ppapadop
You will edit 5 fields in the default bookmark: Nickname, Username,
SSH Private Key, Path, and Connect Mode:
Nickname - we recommend that you change it to something like: CRSP LAb - <pi> lab
Username - your UCINetID
SSH Private Key - use an SSH key name that you should have generated when following the
Quick Start procedure for working effectively with DUO.
The corresponding public key should have also been copied
to ~/.ssh/authorized_keys on CRSP itself.
Path - only the last part (highlighted) that represents CRSP Lab Ownerβs UCNetID
should be edited. The /mmfs1/crsp/lab must remain unchanged.
Connect Mode - should be changed to Online. This keeps all files on CRSP
and reduces local cache space. If you use CRSP from multiple clients, this the most reliable
mechanism for keeping all data in sync.
The URL is created automatically from the information you type in other fields,
you donβt directly change it. This URL is for using the SFTP protocol to access
CRSP and is an end-to-end encrypted connection.
Configure Step 3
After editing the bookmark with the specific information, your screen should
look similar to the one below (but with your specific information in place):
The snapshots folder is hidden.
To view hidden files/folders in Finder, on the open folder
press Command + Shift + . (period) to make the hidden files appear.
Notice that a local file (ssh private key ~/.ssh/crsp-npw) and a passphrase are requested.
You can optionally save the passphrase.
Assuming that the public key for the private key has been properly installed on CRSP, you should be connected
without a DUO prompt.
2. UCINetID + password + DUO Push
What to expect with a Password + DUO
If you do NOT install an ssh key, you will be prompted for your UCINetID password and a DUO push. Even if you have
the CRSP Desktop remember your password, the DUO Push will be required each and every time the desktop
reconnects to CRSP.
Step 1 Enter your password, similar to the following:
Fig. 6.15 Enter the password associated with YOUR UCINetIDο
Usually, you would enter 1 in the box, click on Continue and you will receive a duo push on your phone.
If your phone isnβt available, then you can enter one of your DUO backup codes that
you set up when you enrolled in DUO through the UCI Office of Information Technology.
You are not limited to just a single, mapped, space. To create a new share,
click Open Connection to create a new template and edit it
following the directions above.
You should see three items on screen: a .pkg file for Mac clients, a .exe file for Windows,
and older-versions folder. To toggle the between list and icon view click on the Layout
icon outlined in green.
For the Windows, simply click on the file with .exe ending.
You should then see a screen with a download button on it and the full name of the file that will be downloaded
to your local computer. Click Download and save the file to your local computer:
By default, the file is downloaded in your Downloads folder. Find the downloaded file,
double-click on it to launch the installation. This installation includes the licensed version of
CRSP Desktop.
Install Step 2
In the opened window click Install to Install the CRSP Desktop on your laptop.
CRSP Desktop shows in the Windows
Notification Area
(also known as system tray). You can left-click or right-click on the CRSP Desktop icon to open it:
Nickname - we recommend that you change it to something like: CRSP LAb - <pi> lab
Username - your UCINetID
SSH Private Key - use an SSH key name that you should have generated when following the
Quick Start procedure for working effectively with DUO.
The corresponding public key should have also been copied
to ~/.ssh/authorized_keys on CRSP itself.
Path - only the last part (highlighted) that represents CRSP Lab Ownerβs UCNetID
should be edited. The /mmfs1/crsp/lab must remain unchanged.
Connect Mode - should be changed to Online. This keeps all files on CRSP
and reduces local cache space. If you use CRSP from multiple clients, this the most reliable
mechanism for keeping all data in sync.
The URL is created automatically from the information you type in other fields,
you donβt directly change it. This URL is for using the SFTP protocol to access
CRSP and is an end-to-end encrypted connection.
Configure Step 3
After editing the bookmark with the specific information, your screen should
look similar to the one below (with your information).
Click OK to save the updated bookmark:
Click connect to open your share.
At this point, your lab share is connected and you can use it just like a folder or network drive.
If you are not running ssh-agent or CRSP desktop has not remembered your password, you should asked for the
passphrase to your ssh private key file that you specified.
Notice that a local file (ssh private key) and a passphrase is requested. You can optionally save the passphrase.
Assuming that the public key for the private key has been properly installed on CRSP, you should be connected
without a DUO prompt.
2. UCINetID + password + DUO Push
What to expect with a Password + DUO
If you do NOT install an ssh key, you will be prompted for your UCINetID password and a DUO push. Even if you have
the CRSP Desktop remember your password, the DUO Push will be required each and every time the desktop
reconnects to CRSP.
Step 1 Enter your password, similar to the following:
Fig. 6.31 Enter the password associated with YOUR UCINetIDο
Usually, you would enter 1 in the box, and you will receive a duo push on your phone. If your phone isnβt
available, then you can enter one of your DUO backup codes that you set up when you enrolled in
DUO through the UCI Office of Information Technology
You are not limited to just a single, mapped, space. To create a new share,
click Open Connection to create a new template and edit it
following the directions above.
Here is an example with multiple connections configured and active:
Once logged in, you will be presented with the CRSP top level screen. You can
follow the tabs to your Lab shared areas in My-labs or HOME
private area in My-Home:
Nothing can be stored in HOME area, it is used for for files associated with the account
and for storing quota info file. It is a completely private area, only you have access.
We recommend that you do most work on CRSP in your lab area.
Lab areas are flexible for sharing. You can be granted access to multiple Lab areas.
To see your labs, Click on My-Labs, then click on CONNECT.
You will see a screen similar to the next one. In this example a user npw
has an access to 4 labs:
The File Browser is fairly easy to navigate, with some very basic sets of functions.
Create folders (directories)
Click on desired folders to navigate to a location where you want to create a
new folder. Click on NEW FOLDER and on a newly opened line type
desired folder name:
Click on desired folders to navigate to a location where you want to create a
file then click on NEW FILE and on a newly opened line type
desired file name:
Then follow your local laptop file finder application that will let you
choose file or multiple files for upload.
Once uploaded the CRSP browser will show a confirmation similar to
the one below showing your uploaded file name:
You must either be on the campus network or connected to the
UCI campus VPN to use sshfs.
In this example there are two variables:
username - Your UCNetID
labname - The UCNetID of the CRSP lab owner:
It is our UCNetID if you own CRSP Lab
It is the UCNetID of your adviser, If you are a graduate student or post-doctoral researcher
From your desktop or laptop, execute the following command
replacing username and labname with the appropriate UCNetIDs:
$ cd ~
$ mkdir crsp_mount
$ sshfs -o ssh_command='ssh -A -X -o StrictHostKeyChecking=no' \
-o idmap=user username@access.crsp.uci.edu:/mmfs1/crsp/lab/labname \
~/crsp_mount
As a result, sshfs mounts CRSP Lab share under ~/crsp_mount
directory. Use any name of your choice in place of crsp_mount.
Sshfs will not automatically map all your remote UID and GID from all of your CRSP groups
into your local Linux system. Note in the command above the use of -o idmap=user option.
This will only present your primary UID/GID from the remote CRSP system to your local system.
As the campus does not have a centralized directory service to manage every systems, options
on how to keep your local system and CRSP accounts synced are very limited.
