Accessing Jupyterhub Machines

Since the jupyterhub machines do not have conduits, they are only visible from the sdcc.bnl.gov network. Accessing the machines requires either a direct ssh tunnel to the desired machine or an ssh tunnel to a squid HTTP proxy on the SDCC network. The former is simpler, but requires an explicit tunnel to the jupyterhub machine. The latter is a bit more complicated to setup, but will handle any of the jupyterhub machines.

The direct tunnel is created with an ssh connection similar to the following:

ssh -L 8000:jupyter01.sdcc.bnl.gov:8000 <user>@rssh.rhic.bnl.gov

Once this tunnel is opened, you can access the jupyter01 hub from your browser by entering the URL https://localhost:8000. Since the SSL certificate for the machine is not associated with "localhost" you will have to accept the security exception. To get to the other jupyter hub machines, change the address in the -L argument accordingly.

Using a squid proxy to access a jupyterhub instance requires a few setup steps. The following will assume that you are using a browser capable of using a pac file to select proxies.

Assuming that you are already using a tunnel to get to internal BNL websites, the modifications here are essentially adding another branch to the proxy tree.

The pac file should look something like:

function FindProxyForURL(url, host)
{
    /* If going to a BNL address, go throgh the tunnel, else go direct
    */

    if (shExpMatch(host, "*.sdcc.bnl.gov"))
        return "PROXY localhost:3129";

    if (shExpMatch(host, "*.bnl.gov") ||
        shExpMatch(host, "*.bnl.local") ||
        shExpMatch(host, "130.199.*"))
        return "PROXY localhost:3128"
    else
        return "DIRECT";
}

Note that the two ports used for the proxy tunnels are different. With this pac file in place and your browser configured to use it, start the tunnel to the squid HTTP proxy with:

ssh -L 3129:cl1.sdcc.bnl.gov:3128 <user>@rssh.rhic.bnl.gov

where cl1.sdcc.bnl.gov is the machine where the HTTP proxy was setup.

(The general campus squid tunnel would be:
ssh -L 3128:130.199.23.54:3128 <user>@cssh.rhic.bnl.gov)

You should now be able to access the jupyter hub machines from your browser with their real addresses:

https://jupyter01.sdcc.bnl.gov:8000
https://jupyter02.sdcc.bnl.gov:8000
https://jupyter03.sdcc.bnl.gov:8000

You will not get prompted for an SSL exception in this case.