Troubleshoot O2 two-factor authentication sign in issues

This article is written for HMS Researchers who are having trouble signing in to the O2 cluster. This article specifically covers troubleshooting steps during the 2-factor authentication stage of sign in. 

Note - These instructions only apply to the Duo interface. Instructions will be updated to incorporate Okta shortly.

ssh

There is an additional step to connect via ssh to the O2 cluster at o2.hms.harvard.edu, any O2 login hosts (for example, login01.o2.rc.hms.harvard.edu), or the transfer cluster at transfer.rc.hms.harvard.edu from outside of the HMS network. 

1. Connect via ssh as you normally would.
   
   
2. Enter your HMS ID and password.
   
   
3. The "Duo two-factor login" screen will appear. Select an authentication method such as Duo Push in the mobile app, a phone call, or an SMS passcode.
   
   
4. After successful authentication, you will see "Welcome to O2 (Orchestra 2)!". You are now signed in to the O2 cluster.

DESKTOP:~$ ssh abc123@o2.hms.harvard.edu
Password: [input your account password]
Duo two-factor login for abc123

Enter a passcode or select one of the following options:

 1. Duo Push to XXX-XXX-1234
 2. Phone call to XXX-XXX-1234
 3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
Welcome to O2 (Orchestra 2)!

scp/sftp/rsync

Commands like scp, sftp, or rsync will still work as expected when using the transfer cluster transfer.rc.hms.harvard.edu. Once you submit the scp/sftp/rsync command to transfer data, you will receive a notification via your default Duo method (e.g. push, phone, sms) to authenticate if you are connecting from outside the HMS network. If you don't have a default DUO Method setup, then all scp/sftp/rsync or similar non-interactive commands will just hang. 

Refer to the Identify authentication on O2 article for instructions on how to set up a default DUO Method. For more information on transferring data to/from O2, please reference the File Transfer page. 

DESKTOP:~$ sftp abc123@transfer.rc.hms.harvard.edu
Password: [input your account password]
# now Duo will contact you via your preferred method 
# once you've successfully authenticated, you will be connected:
Connected to abc123@transfer.rc.hms.harvard.edu.
sftp>

Additionally, when using scp or sftp from the command line, you can also configure ssh parameters as well. This is useful if you need to set up keep-alive to hold the process open, for example (see below for graphical options):

Refer to the tcp-keepalives page for more keep-alive options (use them with -o in the above command).

SFTP/SCP applications like Filezilla, WinSCP, and Transmit

Transferring data to or from O2 using the transfer cluster (transfer.rc.hms.harvard.edu) via an SFTP/SCP application like Filezilla will require two-factor authentication from outside of the HMS network. For information on transferring data to/from O2, please reference this page.

When you connect to transfer.rc.hms.harvard.edu with Filezilla or an equivalent program, your default Duo method will be used to authenticate. Once you have confirmed via Duo, you will be able to transfer files using your SFTP/SCP application.

In order to reduce the number of times you need to authenticate via Duo, you can enable the keep-alive option in your SFTP/SCP application.

FileZilla

1. In FileZilla, navigate to Settings > Connection > FTP.
   
   
2. Select the Send FTP keep-alive commands checkbox to enable sending keep-alive commands to retain your Filezilla connection for longer periods of time (and prevent needing to authenticate with Duo for your next transfer).
   
   

WinSCP

The equivalent option for enabling keep-alive commands in WinSCP:

1. In WinSCP, navigate to Advanced Site Settings menu > Connection.
   
   
   
   
2. Transmit requires modification of several settings to reduce the number of authentication requests via Duo. 
   1. Under Preferences > Advanced, select "Try to keep idle connections alive".
      
      
      
      
   2. Under Preferences > Advanced > Advanced Server Settings, select "Tickle server during long transfers". You can also increase the number of seconds specified in "Connect Timeout" under Advanced Server Settings.
      
      

Additionally, Transmit takes advantage of Mac's App Nap, which can extend your battery life by putting inactive applications into a suspended state where they aren't able to use system resources. If App Nap is enabled for Transmit and the application is put into the background, you will get a Duo two-factor authentication request once you move Transmit to the foreground and try to transfer files to or from O2. You can prevent Transmit from using App Nap by running in your local terminal:

Additional information

It's worth noting that all of these tools (and probably more) will behave as expected only if you are doing typical drag-and-drop activities inside the open session. If you are a user that uses a file manager to make edits to files in order to circumvent having to use a terminal-based text editor, if you perform some action such as right-click → edit, then save your edits afterward to re-upload to O2, you WILL be prompted to authenticate every single time you do this. This is because these programs typically open brand new connections to deal with such operations, which the cluster interprets to be brand new log-ins. The workaround to this is obviously to only perform drag-and-drop operations, as these use the existing open connection.

Of particular note, MobaXterm will prompt you for re-authentication every time even though you are performing a drag-and-drop activity.

We are looking into potential configuration settings or alternate offerings that may change the above behavior, and will modify this page accordingly if anything is found.

If your workflow is impacted by this (e.g. a local edit/re-upload workflow), it is strongly recommended that you find an alternate means of file editing that you are comfortable with. nano is a solid entry-level terminal-based text editor, but is much less feature-rich than other programs such as vim or emacs, which have non-trivial learning curves. If you absolutely must use the mouse in your editing, you can download certain text editors with Linux support directly to O2 (such as Sublime Text), and use them over an active X11 connection. You will experience some latency, especially as the file you are looking at increases in size, but you will be able to edit your file and have full mouse capabilities.

If you have questions about this option, please contact rchelp@hms.harvard.edu and we can assist you in setting this up in your local cluster environment.