True passwordless SSH login to IHEP cluster

Karuboniru · 2026-08-24

Strange design of IHEP cluster

IHEP’s computing service is organized in a somewhat unusual way. Although it supports SSH key-based login, users who log in to the cluster must authenticate with a password again to obtain write access to their home directories. ¹

After a recent update, the system even blocks read access to users’ home directories by default until they authenticate.

The reason is simple: the cluster uses AFS ²

https://en.wikipedia.org/wiki/Andrew_File_System

, a distributed file system that requires a keytab for authentication. The keytab is generated by the cluster’s authentication server, which is designed to authenticate users with a password. SSH key-based login gives you access to the shell, but not to AFS.

The solution

The solution is that you can get a Kerberos ticket from your local machine and use it to authenticate to both the login node and AFS ³

Initially learned from https://doc.cc.in2p3.fr/en/Daily-usage/kerberos.html, pretty suprising that this also works for IHEP cluster without much modification.

^Listing 1Kerberos realm configuration in /etc/krb5.conf.d/IHEP_AC_CN. This can also be ~/.krb5.conf or any user-defined path; in that case, set KRB5_CONFIG to point to the file.

[realms]
 IHEPKRB5 = {
  kdc = krb5-02.ihep.ac.cn
  admin_server = krb5-02.ihep.ac.cn
  default_domain = IHEPKRB5
 }


[domain_realm]
 .ihep.ac.cn = IHEPKRB5
 ihep.ac.cn = IHEPKRB5

^Listing 2SSH host configuration in ~/.ssh/config; replace <username> with your IHEP username

Host lx
   HostName                   lxlogin.ihep.ac.cn
   User                       <username>
   GSSAPIClientIdentity       <username>@IHEPKRB5
   GSSAPIAuthentication       yes
   GSSAPIDelegateCredentials  yes
   GSSAPITrustDns             yes

Run kinit <username>@IHEPKRB5 to obtain a Kerberos ticket. You will be prompted for your password.
Now you can log in to the cluster (ssh lx) without entering your password again, until the Kerberos ticket expires.

The bonus is that, GNOME Online Accounts have a nice integration with Kerberos, so by adding <username>@IHEPKRB5 to the Enterprise Login section, it will save the password for you and automatically renew the Kerberos ticket whenever required.