Configuration for Using the Mesogip of Télécom Paris by ENSTA Users (Translated from French to English)

Introduction

The Mesogip is a GPU-equipped computing center located at Télécom Paris. You will only have access to the machines belonging to ENSTA, which are part of this center.

This documentation is intended for students and other members of ENSTA authorized to access the Mesogip.

To connect to the Mesogip via the command line from a Linux machine, you must go through an ENSTA relay machine connected to Télécom Paris.

The configuration to access the Mesogip is divided into two steps:

Generate your SSH authentication key files using the online tool provided by Télécom Paris.
Configure your SSH tool on your machine to simplify the connection procedure.

Configuring Your Linux Ubuntu Machine

Installing the SSH Client

You need to install the openssh tool for SSH connection.

sudo apt update 
sudo apt install openssh-client

The Telecom Paris Web Tool

An online tool is available to generate the credentials needed to connect to the Mesogip. We will now detail the steps to use this tool, proceeding slightly differently from what is indicated on the tool’s web interface, as this tool is normally intended for Télécom Paris students.

To access the tool, go to the following link: https://mesogip.r2.enst.fr. You must log in using your ENSTA credentials.

There are 4 sections on this webpage:

The “Welcome to the Mesogip cluster” section: this section explains how to use the tool, but we will not follow this procedure.
The “SSH Keys” section: this section is intended to generate SSH keys, which will be necessary later in this guide.
The “WG Keys” section: this section concerns the configuration of a WireGuard VPN, but it is not necessary for our use.
The “Admin” section: this section allows managing Mesogip users.

Thus, the only useful section for us is the “SSH Keys” section.

Once you are logged into the site, you will receive a Mesogip identifier in the following format: ensta-xxxxxx. It is written at the top of the page: “Your login is…”. It is important to note this identifier, as it will be used later under the term login-mesogip.

Validation by an ENSTA Administrator

Access to the web tool with ENSTA credentials does not automatically grant access to the Mesogip. Access to the ENSTA Mesogip is restricted, and validation by an administrator is required to be authorized.

After logging into the tool’s web interface for the first time, you can leave the page. You will then need to contact Emmanuel Battesti (emmanuel.battesti@ensta.fr) or Gianni Franchi (gianni.franchi@ensta.fr) to have them validate you as an authorized user, in other words, to “trust” you.

Once this step is completed, returning to the tool’s web interface, you will see the mention “You are trusted” at the top of the page! As long as you are not “trusted”, you can suspend the configuration described on this page.

Configuring the SSH Connection

To perform this configuration step, ensure that the mention “You are trusted” appears at the top of the tool’s webpage https://mesogip.r2.enst.fr. If not, read the paragraph above.

Creating SSH Keys

We will now create an SSH key on your machine to connect to the Mesogip, then provide this key to the web interface. We will use the ssh-keygen tool to generate a private and public key in the files id_rsa_mesogip and id_rsa_mesogip.pub, respectively.

Open a terminal and execute the following commands:

cd ~/.ssh
ssh-keygen -t rsa -f id_rsa_mesogip # Generates a private and public key of type rsa with the name id_rsa_mesogip
cat id_rsa_mesogip.pub # Displays the public key

Copy the public key displayed on the screen, contained in the file id_rsa_mesogip.pub, and paste it into the “Add ssh key” field of the web interface in the “SSH Keys” section.
Then click the “Add” button. (Note: the page scrolls back to the top after each click, you will need to scroll down manually to return to the same place.)
You should now see a field “Your key” containing your public key.
Below, another field with a dark red border will appear, still empty.
Under this red-bordered field, click the “Enable/Extend” button.
The red-bordered field will turn green and contain a new key.
Then, create the file id_rsa_mesogip-cert.pub

cd ~/.ssh
touch id_rsa_mesogip-cert.pub  # Creates an empty file named id_rsa_mesogip-cert.pub

Copy the content of this field containing the new key and paste it into the file ~/.ssh/id_rsa_mesogip-cert.pub.
Save the file and close it. Your SSH key is now configured to connect to the Mesogip.

Be careful not to share your private keys.

Adding the Key to ssh-agent for Use

If needed, in case of an error, it may be necessary to add the key to ssh-agent for use:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa_mesogip

Configuring the SSH config File

To simplify the connection to the Mesogip, you can configure a direct connection in the ~/.ssh/config directory. Here are the steps to follow:

Check if the ~/.ssh/config file already exists. If it does not exist, you can create it using the following command in a terminal:
```
touch ~/.ssh/config # Creates an empty file named config in the ~/.ssh directory
```
Open the ~/.ssh/config file in a text editor of your choice.
Copy the following content into the file:

Host istanbul_mesogip_internal
    # Replace login-ensta with your ENSTA Cascad login
    User login-ensta 
    # istanbul.ensta.fr = 147.250.35.180
    HostName istanbul.ensta.fr
    PubkeyAuthentication no
    PreferredAuthentications password

Host mesogip_internal
    # Replace login-mesogip with your Mesogip login: ensta-xxx
    User login-mesogip
    HostName 10.10.0.1
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_mesogip
    ForwardAgent yes
    ProxyJump istanbul_mesogip_internal

Host istanbul_mesogip_external
    # Replace login-ensta with your ENSTA Cascad login
    User login-ensta 
    # istanbul.ensta.fr = 147.250.35.180
    HostName istanbul.ensta.fr
    ProxyCommand ssh -W %h:%p %r@relais.ensta.fr
    PubkeyAuthentication no
    PreferredAuthentications password

Host mesogip_external
    # Replace login-mesogip with your Mesogip login: ensta-xxx
    User login-mesogip
    HostName 10.10.0.1
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_mesogip
    ForwardAgent yes
    ProxyJump istanbul_mesogip_external

Replace all occurrences of login-ensta with your ENSTA Cascad identifier.
Replace all occurrences of login-mesogip with your Mesogip identifier obtained earlier (in the format ensta-xxxx).
Save the file and close it.

How to Connect?

At ENSTA, on the Wired Network

If you are inside the ENSTA wired network, you can connect to the Mesogip using the following command in a terminal:

ssh mesogip_internal

Make sure you have replaced the login-ensta and login-mesogip values in the ~/.ssh/config file with your respective identifiers before executing this command.

The system first connects to the istanbul.ensta.fr machine. You will need to enter your ENSTA Cascad password. Once connected to istanbul, the connection to the Mesogip at Télécom Paris will be automatic and instantaneous.

Outside ENSTA or on Eduroam, Visitor, or Eduspot Wi-Fi

If you are outside the ENSTA network or on an ENSTA Wi-Fi network, you can connect to the Mesogip using the following command in a terminal:

ssh mesogip_external