diff --git a/pages/merlin6/02 accessing-merlin6/transfer-data.md b/pages/merlin6/02 accessing-merlin6/transfer-data.md index 60db5cf..7d5de11 100644 --- a/pages/merlin6/02 accessing-merlin6/transfer-data.md +++ b/pages/merlin6/02 accessing-merlin6/transfer-data.md @@ -41,12 +41,24 @@ local computer and merlin. Two servers are enabled for exporting data from Merlin to outside PSI. These Remote Access Merlin servers are the following: -* **'ra-merlin-01.psi.ch'** -* **'ra-merlin-02.psi.ch'** +* **'ra-merlin-01.psi.ch'**: normal password authentication with PSI password + * `/data/user` mounted in RO (read-only) + * `/export` directory in RW (read-write). `/export` is also visible from login nodes. +* **'ra-merlin-02.psi.ch'**: ***Two factor authentication*** (2FA), required **RSA SecurID** token (same as VPN) + * `/data/project` directories mounted in RW on demand. Project responsibles must request it. + * `/data/user` mounted in RO (read-only) + * `/export` directory in RW (read-write). `/export` is also visible from login nodes. -Due to security reasons, currently only ``/data/user`` directories are exported in Read-Only mode. -This policy will change in the future but in the meantime we allow users to export their files -in an easy way. +In the future, **'ra-merlin-01.psi.ch'** will be also configured with 2FA and will mount the same +as **'ra-merlin-02.psi.ch'**. In the meantime, we keep **'ra-merlin-01.psi.ch'** with standard authentication +until we can ensure that most of the Merlin users have a RSA SecurID token or until PSI security policy makes +its use mandatory. + +### Directories + +#### /data/user + +User data directories are mounted in RO on both servers. Mounting it in RW is under evaluation. {{site.data.alerts.warning}}Please, ensure proper secured permissions in your '/data/user' directory. By default, when directory is created, the system applies the most restrictive @@ -54,9 +66,36 @@ permissions. However, this does not prevent users for changing permissions if th point, users become responsible of those changes. {{site.data.alerts.end}} -Transferring big amounts of data from outside PSI to Merlin is not possible yet, unless -this is done from PSI (i.e. transferring files from CSCS to Merlin is possible by using -`scp` / `rsync` commands from the Merlin6 login nodes). +#### /export + +Transferring big amounts of data from outside PSI to Merlin is always possible through `/export`. + +{{site.data.alerts.tip}}The '/export' directory can be used by any Merlin user. +This is configured in Read/Write mode. If you need access, please, contact the Merlin administrators. +{{site.data.alerts.end}} + +##### Exporting data from Merlin + +For exporting data from Merlin to outside PSI by using `/export`, one has to: + * From a Merlin login node, copy your data from any directory (i.e. `/data/project`, `/data/user`, `/scratch`) to +`/export`. Ensure to properly secure your directories and files with proper permissions. + * Once data is copied, from **ra-merlin-01.psi.ch** or **ra-merlin-02.psi.ch**, copy the data from `/export` to outside PSI. + +##### Importing data to Merlin + +For importing data from outside PSI to Merlin by using `/export`, one has to: + * From **ra-merlin-01.psi.ch** or **ra-merlin-02.psi.ch**, copy the data from outside PSI to `/export`. +Ensure to properly secure your directories and files with proper permissions. + * Once data is copied, from a Merlin login node, copy your data from `/export` to any directory (i.e. `/data/project`, `/data/user`, `/scratch`). + +#### /data/project + +Optionally, instead of using `/export`, experiments with a Merlin project can request Read/Write or Read/Only access to their project directory. + +{{site.data.alerts.tip}}Merlin projects can request direct access on 'ra-merlin-02.psi.ch' +This can be configured in Read/Write or Read/Only modes. If your project needs access, please, +contact the Merlin administrators. +{{site.data.alerts.end}} ### Accepted protocols @@ -65,13 +104,15 @@ Accepted protocols for Remote Access Merlin servers are the following: * **ssh**: **`scp`** command (as well as **WinSCP** and similar programs) or **`rsync`** command * **~~Globus Online~~**: ***not available yet.*** -### About Remote Access Servers +### Remote Access Servers Policies SSH is one of the allowed protocols. * Please, **absolutely never** use this servers as a login node. * Please avoid copying files to the *home* directories. +* Please **never use SSH Keys** for accessing these servers. Accessing through SSH keys will be denied in the upcomig months. -Only ``/data/user`` should be used on these nodes, and exclusively for transferring data to outside PSI. +Only ``/data/user`, `/data/project` and `/export` directories should be used on these nodes, +and exclusively for transferring data from/to PSI to/from outside PSI. ## Connecting to Merlin6 from outside PSI