Keeping Research Computing (RC) systems secure is one of our highest priorities. Starting Jan. 13, 2027, RC will enhance (secure shell) SSH login with multi-factor authentication (MFA) through Duo. Upon implementation, all RC login methods and systems will be protected with MFA.
What's changing
As of Jan. 13, Duo, UVA’s MFA provider, will be required for all entry points to Research Computing's networks, including SSH access to HPC login nodes.
RC understands that some users rely on automated processes to integrate RC systems with other systems that they are using for their research. When Duo is implemented, manual verification will be required, and alternatives processes can be explored.
Why RC is making this change
Credential theft from increasingly sophisticated attacks by both domestic and foreign actors is a growing risk, and a stolen password or SSH key alone is enough to compromise an account. Requiring a second factor at every entry point to our internal networks and all administrative logins within those networks minimizes the potential impact of stolen credentials.
What users need to do
- Enroll in 2-Step Login (Duo) (if you haven't already)
- If you use tmux, SSH port forwarding, local desktop applications (e.g., MATLAB, VS Code, etc.), lab equipment, or other automated workflows that connect to RC systems via SSH, review the MFA workflow guidance to understand how MFA may affect your setup and what changes may be needed.
- Questions? Contact the RC user support team If you need assistance.
How RC will support users through the change
If users are experiencing issues, they may contact the RC user support team. The team is happy to arrange a consultation to try to find alternative solutions for your specific situation.
Common Automated Workflows
Some workflows may break or behave unexpectedly with MFA enabled. If you have an automated pipeline that uses SSH protocols (such as SCP for file transfers or SSH tunnels) or a custom setup that accesses HPC via SSH, please see the commonly affected workflows below for potential solutions and FAQs.
tmux / screen sessions
- Likely issue: Re-attached long-running terminal sessions or those that lose connectivity mid-session require re-authentication.
- What to do: Scripts will continue executing normally even if your local SSH connection times out or your MFA window expires; however, you’ll need to complete a fresh password and Duo MFA challenge before you can view or re-enter the running session. Keep in mind that long-running and compute-heavy tasks should be submitted as batch jobs.
Local GUIs and commercial software that submit to the cluster
- Likely issue: Local desktop applications (e.g., MATLAB, VS Code, or other job-submission plugins) that connect automatically or non-interactively will not support Duo's interactive push/prompt flow. Any background SSH connections that prompt MFA will silently fail if a Duo push isn't approved quickly enough.
- What to do: When possible, use the provided interactive apps on the Open OnDemand web portal via a browser. The Duo MFA can be completed through the web interface, and a graphical desktop session will run directly on compute nodes.
Lab computers or equipment
- Likely issue: Shared or unattended lab machines that connect to RC systems via SSH may not have a way to receive or respond to an MFA prompt (no dedicated user, no phone/device present).
- What to do: Since the exact purpose of the unattended connections to RC systems is unique and unknown, each workflow will need to be evaluated on a case-by-case basis. Please contact our support team to request a consultation and discuss alternative workflows.
Port forwarding
- Likely issue: SSH port-forwarding sessions (e.g., for Jupyter, or remote visualization) may be interrupted if the underlying connection requires MFA re-authentication.
- What to do: Instead of opening a login session and later trying to forward a port, inject your port mappings directly into the initial command where you complete your MFA. This ensures that you pass the interactive MFA exactly when the network tunnel is constructed.
Frequently Asked Questions
- How will I now log into Afton/Rivanna?
Log in as you normally would, but now after you supply your password, you will be prompted with one or more MFA options:
Password:
Duo two-factor login for <userID>
Enter a passcode or select one of the following options:
1. Duo Push to XXX-XXX-<last-4>
After selecting this option, you’ll receive a Duo push notification to verify your identity and gain access to the RC login nodes.
- Do I need to do anything before Jan. 13, 2027?
You’ll want to ensure that you’re enrolled in 2-Step Login (Duo) if you haven’t already. Other than that, there are no other necessary actions that need to be completed.
- What if I don't have a smartphone or can't use Duo Push?
ITS has a variety of options available for users who can’t use Duo Push: How to Use 2-Step Login (Duo) & FAQs from UVA Information Technology Services
- Who do I contact if I get locked out?
Precautions should be taken to prevent getting locked out. ITS suggests adding a second device or getting Bypass Codes. Details.
If you do get locked out, you should reach out to the ITS Help Desk for support.
- After trying your recommendations, my automation is still broken. What should I do?
Please submit a Support Request or attend our Virtual Office Hours. We are unable to provide exceptions to MFA but may be able to offer suggestions unique to your workflow.
- Will my Ivy VM be affected?
Access to HSZ login nodes (Ivy VMs) already require MFA for access to the project-dedicated node, so you should experience no change.