<div dir="ltr">This is just a quick follow up building upon Gus's solution. <div><br></div><div>The ssh trick as described is not a 100% GUI access but it goes quote long to alleviate the need for GUI. To have CLI access to Git repository you will need the following small blurb in your ~/.ssh/config</div><div><br></div><div>Host gogs <br> HostName <a href="http://git.int.autonsys.com">git.int.autonsys.com</a> <br> User git <br> Port 2224 <br> IdentityFile ~/.ssh/gogs <br> ProxyCommand ssh springdale1 exec nc %h %p <br></div><div><br></div><div><br></div><div>Note that the user is always git. That is not a mistake. Gogs automatically maps singe uid git to your ssh-keys (you need the GUI access to upload them) and in turn to your repos. That is what I personally use working from home. </div><div><br></div><div>For example, instead of login into the shell gateway and then moving to one of your favorite computing nodes, you can do something like this with your ~/.ssh/config file</div><div><br></div><div>Host foxconn<br> HostName <a href="http://foxconn.int.autonlab.org" target="_blank">foxconn.int.autonlab.org</a> <br> Port 22<br> User predragp<br> ProxyCommand ssh -W %h:%p <a href="mailto:predragp@lop2.autonlab.org" target="_blank">predragp@lop2.autonlab.org</a><br></div><div><br></div><div>I will conclude this email by saying that with the exception of MATLAB GUI or genuine web browsing you really don't need the X2Go client and GUI access to servers. </div><div><br></div><div>In my experience, most members actually use Jupiter notebook, RStudio or just some programming language (I use Julia as many of you know) and need access only to Gogs web services. Does anybody need help to convert the following trick? </div><div><br></div><div><a href="https://fizzylogic.nl/2017/11/06/edit-jupyter-notebooks-over-ssh/">https://fizzylogic.nl/2017/11/06/edit-jupyter-notebooks-over-ssh/</a><br></div><div><br></div><div>into the appropriate ~/.ssh/config entry? </div><div><br></div><div>If people need help with RStudio or if you guys insist on me running RStudio-server that would be OK. That kind of suggestions followed with some nice little hacks are much more useful to all of us in my opinion than asking for some fundamental changes </div><div>requiring complex technologies.</div><div><br></div><div>If there is an interest I would be happy to give a ZOOM overview of the Lab capabilities or even to have regular or irregular Q&A sessions.</div><div><br></div><div>Best,</div><div>Predrag</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 3, 2020 at 11:45 AM Predrag Punosevac <<a href="mailto:predragp@andrew.cmu.edu" target="_blank">predragp@andrew.cmu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">Dear Autonians,<div><br></div><div>I know that many of you were annoyed by the fact that in order to use our internal instance of Gogs you had to use X2Go for GUI access to one of the shell gateways first. </div><div><br></div><div><a href="https://gogs.io" target="_blank">https://gogs.io</a></div><div><br></div><div>After a bit of consideration the following solution proposed by Gus Welter seems to be the easiest. Locate on your machine the following file or create a new one</div><div><br></div><div>~/.ssh/config</div><div><br></div><div>use your favorite editor and create an entry as follows:</div><div><br></div><div>Host gogs</div><div> Hostname <a href="http://lop2.autonlab.org" target="_blank">lop2.autonlab.org</a> (you could do any other shell gateway)</div><div> User $yourusername</div><div> IdentityFile ~/.ssh/$your_private_key (could be left out if you insist on using LDAP password)</div><div> Port 22</div><div> LocalForward 2222 <a href="http://git.int.autonlab.org:80" target="_blank">git.int.autonlab.org:80</a></div><div><br></div><div><br></div><div>Then just ssh to gogs. Open the web browser on your own computer and type in the search bar</div><div><br></div><div><a href="http://localhost:2222" target="_blank">http://localhost:2222</a></div><div><br></div><div>Magic will happen. I will update documentation shortly.</div><div><br></div><div><br></div><div>After further consideration, evaluation of various VPN technologies: OpenSSH, IKEv2, OpenVPN, tinc, WireGuard, AnyConnect (CISCO proprietary version as well as open source <b>ocserv </b>clone) the following decision was made:</div><div><br></div><div>We will continue to provide world wide access to the Auton Lab infrastructure via shell gateways OpenSSH for people who don't have the Auton Lab provided/supported desktops. However, I will add the additional 4th shell gateways. FYI (will be updated in the documenation as well) There is a minor difference between </div><div><br></div><div><a href="http://lop2.autonlab.org" target="_blank">lop2.autonlab.org</a></div><div><a href="http://lop1.autonlab.org" target="_blank">lop1.autonlab.org</a> (I will replace dead gateway with the new one)</div><div><br></div><div>and</div><div><br></div><div><a href="http://bash.autonlab.org" target="_blank">bash.autonlab.org</a></div><div><a href="http://lion.auton.cs.cmu.edu" target="_blank">lion.auton.cs.cmu.edu</a></div><div><br></div><div>The first two shell gateways have no VPN overhead. The second two shell gateways are just the desktops which are connected via OpenVPN to the computing nodes. As a matter of fact any Auton Lab desktop is potentially shell gateway but the login is restricted only to the desktop owner. The desktops use OpenVPN to connect to the Auton Lab LAN zone. Unless your ISP is blocking UDP port 1194 (not uncommon) and you have a very complicated NAT (network address translation) set up at home there is no reason that a desktop which you take home will stop having VPN access to the lan zone.</div><div><br></div><div>Upon the insistence of Robert Edman I agreed to create and distribute certificates/keys and configuration files to any Auton Lab member who would like to set up OpenVPN access from her/his home computer to our VPN gateway. However, I am not willing to give any support beyond that and furthermore I am not willing to answer any emails regarding your personal machines and home networks. </div><div><br></div><div><br></div><div>Most Kind Regards,</div><div>Predrag Punosevac</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div>
</blockquote></div>