Skip to content

How to login to the Leonardo cluster

The Leonardo supercomputer is one of the fastest supercomputers in the world. Login to Leonardo follows strict requirements to ensure security, safeguarding sensitive information and ensuring the integrity of its operations.

To access Leonardo one can check the official documentation, none the less we provide here a step-by-step guide to get started.

  • Registration at CINECA UserDB portal
  • Associating your account to an active project
  • Request access to a CINECA HPC cluster
  • Configuration of the 2FA and OTP
  • Install and configuration of the smallstep client
  • Managing password, 2FA and OTP

Step 1: Registration at CINECA UserDB portal

In order to have access on Leonardo, it is necessary to complete the registration procedure on CINECA UserDB portal.

  • Click on the “Create a New User” button and filling in the required fields
  • Uploading an ID card (passport for non-Italian) in the Documents for HPC tab, complete the information about your Institution and check your Personal Data.
  • Your CINECA ID looks like YOUR.NAME_xxxxx [uid: xxxxx], in which xxxxx is a 5-digit string consising of numbers.

Step 2: Association your account with an active project

Send your id account at CINECA to the project leader and ask for an access to an existing project.

Step 3: Request to access CINECA HPC cluster

Once your username has been associated with an active account, you can request access to CINECA HPC clusters. Make sure following info are OK, see the figure below.

  • Personal data
  • Institution
  • HPC DOCs
  • Authorization

Warning

If the Submit button does not appear, it means that one or more of the above steps are still not completed. In the HPC Access page, the portal will indicate you which step is still not OK.

  • Clicking the button Submit on your HPC Access page.
  • Wait for several hours …
  • Once approved your request, you will receive two emails
    1. one email with the username
    2. another with the link to a page showing how to:
      • configure the two-factor authentication (2FA) ONLY VALID FOR 12h.
      • configure the OTP

Note

HPC credentials are different from the UserDB credentials. The former are needed to access CINECA HPC, while the latter are only to be used inside the UserDB portal.

Step 4: Configuration of 2FA and OTP

Two-factor authentication (2FA) refers to an authentication method in which a user is granted access to the CINECA HPC systems only after successfully presenting two pieces of evidence (or factors).

Verifying your identity, using an independent second factor, prevents other users from logging in with your identity, even if they have the password.

The detailed instructions from CINECA's documentation for the configuration of 2FA and OTP are available HERE.

Step 5: Install and configuration of the smallstep client

Once the 2FA will be enabled as the only method to authenticate on CINECA clusters, you will need to install and configure on your PC a program that allows you to authenticate via 2FA and to download locally the temporary certificate. The CINECA recommends the smallstep client.

Detailed instructions for different operating systems are available HERE.

Warning

Users with Ubuntu operating systems (but may happen also for other Linux distributions) should not run the command “sudo apt install step” because this will install a different software that will give errors when following these instructions.

Once the smallstep client is installed one can do:

step ssh login 'USER@EMAIL' --provisioner cineca-hpc

This will lead to a webpage on your default web browser. You should input your cluster credentials (username and password) and then click the button Sign in.


It will ask for the OTP code generated by the FreeOTP/Google Authenticator. Once authenticated, you should see a Success message on your browser.


Now one can run the command:

ssh USERNAME@login.leonardo.cineca.it

If worked well, now one should have access to the Leonardo cluster.

Step 5a: Solving the error message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

Sometimes when re-logging in one can get the following error message:


To solve this, one can follow the suggestion in the message and do: 

ssh-keygen -f '/home/lcasilla/.ssh/known_hosts' -R 'login.leonardo.cineca.it'

and then doing the ssh command again.

Step 6: Managing password, 2FA and OTP

More details about change the password, recover one-time password generator, as well as renew the recovery codes are availalbe HERE.