Cluster Offsite Access

Instructions for off-site HTTPS and SSH access

As of late 2026, the majority of DAQ and PSD experimental hosts will be moved fully behind the TRIUMF firewall. After hosts are moved behind the firewall it will no longer be possibly to directly access these hosts with HTTPS or SSH.

Access will be possible via VPN. If you have TRIUMF VPN client running you will be able to access the hosts via HTTPS or SSH as normal.

There are also a couple other options for accessing TRIUMF hosts from offsite.

HTTPS proxy

The https proxy is provided by Ivanti, who also provide the VPN client.

To use the proxy you first go to

https://vpn.triumf.ca/

You will be asked to login using your two-factor TRIDENT authentication. There is a window in your browser that shows that you are logged in.

Once you login you will get a page with some bookmarked hosts. This will include the daq00 DAQ webpage. If you click on it you will be redirected to the DAQ main page. It will take a little while to get used to the proxy URL mangling.

Here's some examples of the URL mangling

1) https://mpmt-daq03.triumf.ca/

becomes

https://vpn.triumf.ca/,DanaInfo=mpmt-daq03.triumf.ca,SSL+

2) https://ucnelog.triumf.ca/elog/

becomes

https://vpn.triumf.ca/elog/,DanaInfo=ucnelog.triumf.ca,SSL+

3) https://daq00.triumf.ca/DaqWiki/index.php/Main_Page

becomes

https://vpn.triumf.ca/DaqWiki/index.php/,DanaInfo=daq00.triumf.ca,SSL+Main_Page

ssh jump host

TRIUMF has a temporary jump host called hoop.triumf.ca. Once you have it setup you can from outside TRIUMF do the following to login to an internal TRIUMF host like tucan01.ucn.triumf.ca. For instance you can do

ssh -J hoop.triumf.ca ucn@tucan01.ucn.triumf.ca

You are not allowed to actually ssh to just hoop; you can only access hoop to jump somewhere else.

Contact a DAQ group member if you need access to the jump host.

This jump host is just a temporary solution. In the longer term a different solution will be provided.