Cluster Offsite Access

Instructions for off-site HTTPS and SSH access

As of late 2026, the majority of DAQ and PSD experimental hosts will be moved fully behind the TRIUMF firewall. After this change it will no longer be possibly to directly access these hosts with HTTPS or SSH.

Access will be possible via VPN. If you have TRIUMF VPN client running you will be able to access the hosts via HTTPS or SSH as normal.

There are also a couple other options for accessing TRIUMF hosts from offsite.

HTTPS proxy

The https proxy is provided by Ivanti, who also provide the VPN client.

To use the proxy you first go to

https://vpn.triumf.ca/

You will be asked to login using your two-factor TRIDENT authentication. There is a window in your browser that shows that you are logged in.

Once you login you will get a page with some bookmarked hosts. This will include the daq00 DAQ webpage. If you click on it you will be redirected to the DAQ main page. It will take a little while to get used to the proxy URL mangling.

Here's some examples of the

1) https://mpmt-daq03.triumf.ca/

becomes

https://vpn.triumf.ca/,DanaInfo=mpmt-daq03.triumf.ca,SSL+

2) https://daq00.triumf.ca/DaqWiki/index.php/Main_Page

becomes

https://vpn.triumf.ca/DaqWiki/index.php/,DanaInfo=daq00.triumf.ca,SSL+Main_Page

I think that so far I find that ELOG pages work okay through this proxy. So I find I can also login to this same elog through this link

https://daq00.triumf.ca/elog-daq/DAS/

I will go ahead and also post this elog through the proxy; I think that works too.

But it would be good if others confirm that more complicated webpages work through the proxy. ______________

ssh jump host

Kelvin has a jump host called hoop.triumf.ca. Once you have it setup you can from outside TRIUMF do the following to login to an internal TRIUMF host like tucan01.ucn.triumf.ca

lindner@polybius 2026 % ssh -J hoop.triumf.ca ucn@tucan01.ucn.triumf.ca Last login: Mon Sep 14 16:34:42 2026 from 142.90.98.252 ucn@tucan01:~$

Couple notes:

1) You are not allowed to actually ssh to just hoop; you can only access it to jump somewhere else.