Connecting to the NIH HPC systems with SSH

You may connect to NIH HPC systems via multiple secure methods, including both textual and graphical interfaces with SSH access and Open OnDemand.

To connect to one of the HPC systems listed above your computer will need one of the following:

  1. physically connected to the wired NIH network or the NIH-Staff wireless (authentication required)
  2. connected to the NIH VPN (requires VPN client installed)
  3. (for NCI users): accessing the NIH network via NCI RemoteApps

To connect with SSH, you will additionally need an SSH client installed on your local machine. Your computer likely already includes an installation of OpenSSH.

Host key fingerprints

A host key is a cryptographic key used for authenticating computers in the SSH protocol. Host keys are key pairs, typically using the RSA, DSA, or ECDSA algorithms. Public host keys are stored on and/or distributed to SSH clients, and private keys are stored on SSH servers.

When connecting to a new server for the first time ssh clients usually report the fingerprint of a host key and ask if the user would like to store the public host key to verify future connections. Below are the fingerprints of the current biowulf and helix public host keys. If the fingerprint presented to you matches the fingerprint below it is safe to accept the key and store it. Some clients will present an md5 fingerprint, others a sha256 fingerprint.

md5 key fingerprints

helix
1024 MD5:e9:87:ba:5b:4b:fd:ca:82:04:79:c1:60:b3:99:95:75 helix (RSA)
256 MD5:6c:15:e2:92:f0:fe:2e:f0:ab:d8:ce:ee:e0:0c:8c:64 helix (ECDSA)
256 MD5:87:37:87:fe:4c:8d:6d:b2:36:b2:74:e2:ed:5a:66:e4 helix (ED25519)

biowulf
2048 MD5:92:77:3e:50:9a:69:9d:3e:5b:7f:d1:76:dc:2b:5c:b5 biowulf (RSA)
256 MD5:6c:15:e2:92:f0:fe:2e:f0:ab:d8:ce:ee:e0:0c:8c:64 biowulf (ECDSA)
256 MD5:87:37:87:fe:4c:8d:6d:b2:36:b2:74:e2:ed:5a:66:e4 biowulf (ED25519)

sha256 key fingerprints

helix
1024 SHA256:6fz4LcdAE71brp857n29I3+6whMCjAKXPVeZJPCkL7c helix (RSA)
256 SHA256:BoP/KLS17g+gUuQ7mrCHa9oPPO+MHi/h8WML44iA1dw helix (ECDSA)
256 SHA256:MBuANYkwgnJAlovbS1Kp1/S2hviPwkc/VOxCuFfW/lo helix (ED25519)

biowulf
2048 SHA256:rQ6vBSjlXGE56I0nwQfvvDduOwx+C1aRuT6cZnVpS8k biowulf (RSA)
256 SHA256:BoP/KLS17g+gUuQ7mrCHa9oPPO+MHi/h8WML44iA1dw biowulf (ECDSA)
256 SHA256:MBuANYkwgnJAlovbS1Kp1/S2hviPwkc/VOxCuFfW/lo biowulf (ED25519)
Connecting from Windows
back to top

There are several SSH clients available on Windows. Many, but not all installations of Windows 10 or 11 include OpenSSH, the same software you might use to SSH from macOS or Linux. PuTTY is another popular option amongst our users. PuTTY is an SSH and telnet client, developed originally by Simon Tatham. PuTTY is open source software and is developed and supported by a group of volunteers. Recent versions of Windows include an SSH client with PowerShell so you can connect to the NIH HPC systems without downloading or installing anything.

OpenSSH

Current builds of Windows 10 include OpenSSH by default, although it may be disabled. The general form of the ssh command to connect to any host is: ssh [username@]host.

You can open a PowerShell window from the Windows Start Menu. In the PowerShell window, type:
ssh $env:username@biowulf.nih.gov or ssh $env:username@helix.nih.gov to start an ssh session to Biowulf or Helix respectively.

Note: The general form of the ssh command does not require a username; instead, OpenSSH will automatically fill in your system username. However, on Windows Machine, your system username includes a domain name which is prepended to your NIH username. The system username used by OpenSSH will not match your Biowulf and Helix username. To avoid this problem, specify your NIH username or use $env:username when connecting to Biowulf or Helix using PowerShell.

When first connecting to a new server, ssh will report that the server's host key is not known. It will present the fingerprint of the host key. If the fingerprint matches one of the fingerprints shown above it is safe to answer "yes" and store the key. Some clients are configured to reject unknown keys outright. In that case you can include -o StrictHostKeyChecking=ask.

In the following example, you may specify your NIH login username explicitly.
PS C:\Users\myuser> ssh $env:username@biowulf.nih.gov
The authenticity of host 'biowulf.nih.gov (128.231.2.9)' can't be established.
ECDSA key fingerprint is SHA256:BoP/KLS17g+gUuQ7mrCHa9oPPO+MHi/h8WML44iA1dw.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'biowulf.nih.gov,128.231.2.9' (RSA) to the
list of known hosts.
                                ***WARNING***

You are accessing a U.S. Government information system, which includes
(1) this computer, (2) this computer network, (3) all computers
connected to this network, and (4) all devices and storage media
attached to this network or to a computer on this network. This
information system is provided for U.S.  Government-authorized use only.

Unauthorized or improper use of this system may result in disciplinary
action, as well as civil and criminal penalties.

By using this information system, you understand and consent to the
following:

* You have no reasonable expectation of privacy regarding any
communications or data transiting or stored on this information system.
At any time, and for any lawful Government purpose, the government may
monitor, intercept, record, and search and seize any communication or
data transiting or stored on this information system.

* Any communication or data transiting or stored on this information
system may be disclosed or used for any lawful Government purpose.

--

NOTE: This system is rebooted for patches and maintenance on the first
Monday of every month at 7:00 AM unless Monday is a holiday, in which
case it is rebooted the following Tuesday.  A detailed schedule is
available at    http://helix.nih.gov/Documentation/reboots.html

Last login: Thu Apr 17 07:46:21 2025 from hostname
[username@biowulf ~]$ 
        

PuTTY

Installation of PuTTY may require administrative privileges. Please consult with your local system administrators regarding installation policies.

Because PuTTY is continuously updated, you should download the latest version from http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html. The download page includes a self contained executable (putty.exe) available under the "Alternative binary files" heading, and an installer (putty-<version>-installer.msi) available under the "Package files" heading. The installer will require administrative privileges. For most Windows users, the 64-bit x86: putty.exe under the "Alternative binary files" will probably suffice.

Once PuTTY is installed or downloaded, start PuTTY by double-clicking the icon created on your desktop or use your search bar to locate the executable

Setting up sessions with PuTTY

When starting PuTTY, you will see a dialog box. This dialog box allows you to control everything PuTTY can do. In the 'Host Name' box, enter helix.nih.gov or biowulf.nih.gov.

Enter host name

Quick Start

For a quick start, simply type "biowulf.nih.gov" or "helix.nih.gov" into the Host Name field and press the "Open" button.
When prompted for your username, enter your NIH username.

Helpful Suggestions

You don't need to change most of the configuration options, but here are a few suggestions below.

Specify your username in the Host Name field

Specifying a username in the host name field will mean you do not need to type your username when clicking "Open". Instead, use your_username@biowulf.nih.gov or your_username@helix.nih.gov in the Host Name field. Replace "your_username" with your NIH username.

The Backspace Key

Set backspace key to Control H

The Window Title

Set Window Title

Enable X11 Forwarding

PuTTY can forward the X11 protocol which can be used together with an X11 server on your computer to run graphical applictions. However, we recommend using Open OnDemand for this purpose

Enable X11 Forwarding

After making your configuration changes, be sure to save the session so you will not have to reconfigure PuTTY each time.

Save session

When first connecting to a new server, PuTTY will report that the server's host key is not cached in the registry yet. It will present the fingerprint of the host key. If the fingerprint matches one of the fingerprints shown above it is safe to answer "yes" and store the key in PuTTY's cache

Creating icons on your Windows desktop

Right-click the PuTTY icon on your desktop, then left-click "Properties".

Change PuTTY Properties

In the "Target" box under the Shortcut tab, type -load "helix" or -load "helix.nih.gov" after putty.exe:

Edit properties

Click on the 'General' tab and change the name from PuTTY to helix, then click the OK button.

Changing icon name

Double-click on the helix icon to login to helix

To create an icon for any of the other systems, be sure to make a copy of the helix or PuTTY icon, then change the properties of the copy.

Documentation

For more in-depth knowledge of PuTTY, see the PuTTY Documentation Page

If you wish to use X11 Forwarding with PuTTY on Windows, you will also need an X11 server running. Xming is an X11 Server available on Windows. Download the installer and install XMing into your Documents or other personal folder. XMing must be started before connecting with PuTTY for X11 Forwarding to function.

Graphical connection

Direct access to graphical applications on Biowulf over an SSH connection from Windows is possible, although not supported by HPC staff. Software like MobaXterm can provide this kind of access if desired.

Connecting from Macs
back to top

Mac OS X includes an ssh client. In a terminal window, type ssh hostname to start an ssh session to a host. If your username on your local system is different from your NIH domain username, you will need to type ssh username@biowulf.nih.gov, for example, where 'username' is your NIH domain username.

When first connecting to a new server, ssh will report that the server's host key is not known. It will present the fingerprint of the host key. If the fingerprint matches one of the fingerprints shown above it is safe to answer "yes" and store the key. Some clients are configured to reject unknown keys outright. In that case you can include -o StrictHostKeyChecking=ask.

In the following example, replace 'yourusername' with your NIH login username.
[mymac:~] macuser% ssh yourusername@biowulf.nih.gov
The authenticity of host 'biowulf.nih.gov (128.231.2.9)' can't be established.
ECDSA key fingerprint is SHA256:BoP/KLS17g+gUuQ7mrCHa9oPPO+MHi/h8WML44iA1dw.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'biowulf.nih.gov,128.231.2.9' (RSA) to the
list of known hosts.
                             ***WARNING***

You are accessing a U.S. Government information system, which includes
(1) this computer, (2) this computer network, (3) all computers
connected to this network, and (4) all devices and storage media
attached to this network or to a computer on this network. This
information system is provided for U.S.  Government-authorized use only.

Unauthorized or improper use of this system may result in disciplinary
action, as well as civil and criminal penalties.

By using this information system, you understand and consent to the
following:

* You have no reasonable expectation of privacy regarding any
communications or data transiting or stored on this information system.
At any time, and for any lawful Government purpose, the government may
monitor, intercept, record, and search and seize any communication or
data transiting or stored on this information system.

* Any communication or data transiting or stored on this information
system may be disclosed or used for any lawful Government purpose.

--

NOTE: This system is rebooted for patches and maintenance on the first
Monday of every month at 7:00 AM unless Monday is a holiday, in which
case it is rebooted the following Tuesday.  A detailed schedule is
available at    http://helix.nih.gov/Documentation/reboots.html

Last login: Wed Jul  8 11:34:37 2015 from hostname
[username@biowulf ~]$ 

Graphical connection

Direct access to graphical applications with X11 forwarding is no longer supported as the required XQuartz software is no longer maintained.

Connecting from Linux
back to top

Linux automatically includes SSH software. In a terminal window, type ssh username@hostname to start an ssh session to a host, where username is your NIH domain username. A sample session will be exactly like the Mac session displayed above.

When first connecting to a new server, ssh will report that the server's host key is not known. It will present the fingerprint of the host key. If the fingerprint matches one of the fingerprints shown above it is safe to answer "yes" and store the key. Some clients are configured to reject unknown keys outright. In that case you can include -o StrictHostKeyChecking=ask.

Graphical connection

Your Linux distribution typically includes X11. It is possible to directly access graphical applications over an SSH connection without additional software, though we recommend dedicated tools like Open OnDemand for accessing graphical software in general. In a terminal window, type ssh -Y username@hostname to start an ssh session to a host, where username is your NIH domain username.

Sample session:

[mylocaluser@mylinux:~ ] ssh -Y username@biowulf.nih.gov

[..govt warning...]

Last login: Wed Jul  8 11:34:37 2015 from hostname
[username@biowulf ~]$ xclock

At this point you are logged on to Helix and can run Xwindows programs. To test, type xclock at the prompt. You should see a clock window appear on your desktop.

Browser tunnel connection
back to top

Several useful tools like Jupyter or RStudio Server can be run on compute nodes in an interactive session and accessed in your browser.

Although we recommend accessing these tools through Open OnDemand, these tools may also be accessed through an SSH "tunnel" between your computer and the cluster. You can find details on how to connect to such applications via tunnels on our tunneling page and a short hands-on video specifically for windows..

Additional Authentication Information
back to top

GSSAPI (Kerberos) Access

Connecting with ssh keys