Skip to content

Getting Started

How to get access to PRESCIENT: request an account, set up your credentials, and connect to the network. Once you can log in, see Slurm Cluster for running work.

Prerequisites

You will need:

  • An identity (id: name.# for OSU) or a sponsored guest account.
  • A laptop or workstation you can install a VPN client on (macOS, Linux, Windows, or iOS/Android).

Step 1 — Request an account

TODO: describe the actual request mechanism once it is in place.

Step 2 — Set your password

Accounts are managed through Authentik, the testbed's single sign-on (SSO) portal. Once your account exists:

  1. Visit the account portal at https://auth.resnull.party.
  2. Log in with your one-time password. You'll be prompted to set up a TOTP authenticator for multi-factor authentication (MFA) — Duo or any TOTP app works.
  3. The one-time password is marked expired on first use, so go to your account settings and set a new password. You'll be required to change it before you can reach any testbed services anyway.

Your Authentik password and MFA are what you'll use for the VPN and for SSH.

TODO: paste the final account portal URL and a screenshot of the password and MFA settings.

Step 3 — Enroll your device in the VPN

You join the PRESCIENT VPN (a private WireGuard mesh) using your id and MFA.

  1. Install the Tailscale client for your OS: https://tailscale.com/download
  2. Point it at the PRESCIENT control server: 
    tailscale up --login-server=https://vpn.resnull.party --accept-routes

If you are switching from another Tailscale account:

tailscale up --login-server=https://vpn.resnull.party --force-reauth --reset --accept-routes
  1. Your browser opens to the SSO login. Sign in with your id and complete MFA. This may be automatic if you recently authenticated through the SSO portal.
  2. Approve the device. Once enrolled, you can reach *.prescient.internal hostnames directly.

TODO: confirm the final --login-server URL and document the iOS/Android flow (which uses a ?key= URL instead of the command above).

Verify VPN connectivity

ping slurm-head.prescient.internal

If this fails, see Help & FAQ.

Step 4 — First SSH

With the VPN connected, log in to the submission node:

ssh <name.#>@slurm-head.prescient.internal

Use your SSO password. You should see the cluster welcome banner (MOTD) after logging in. If you cannot SSH:

  • Confirm you are connected to the VPN (tailscale status).
  • Confirm your account has been granted access — without it, SSH is rejected at the PAM layer.

slurm-head is the submission node for the GPU clusters; you don't run jobs on it directly. From here you allocate GPUs and dispatch work — continue to Slurm Cluster.

Step 5 — Enable key-based SSH (optional)

Password + MFA is all you need to log in, so this step is optional. If you'd rather not type your password on every connection, you can use key-based SSH: e-mail your SSH public key to the testbed operator and they will add it to your account for you. Self-service key upload is not enabled.

# Print your public key (create one first with `ssh-keygen -t ed25519` if you
# don't have one), then paste the output into your e-mail to the operator:
cat ~/.ssh/id_ed25519.pub

Once the operator has added it, ssh <name.#>@slurm-head.prescient.internal authenticates with your key instead of prompting for a password.

Next steps