Tunneling to remote kernel on a server with two-factor authentication

[suyashbire1]

I'm following the guide in https://github.com/ipython/ipython/wiki/Cookbook:-Connecting-to-a-remote-kernel-via-ssh to connect to a remote jupyter kernel.

However, my server has two-factor authentication. So I get stuck at the step: jupyter console --existing ./kernel-1234.json --ssh server. I can set up the tunnels manually and proceed from there without the --ssh server flag.

So, I was wondering if it would be possible to make provisions for two-factor authentication while tunneling with the --ssh flag? It would involve prompting users for tokens when ssh connections are made.

[Carreau]

Thanks for question,

this part of the codebase is not used a lot, so we would need to dig-in to figure out where to add such mechanism. It's probably no easy to find, and we'll likely need someone do volonteer some time.

We'll try to give some hints on where to look .

[dmanikowski-reef]

I would like to try to do this. Any hints where to look in the first place?

[takluyver]

The code to set up the ssh connection is in the package jupyter_client - see here:

https://github.com/jupyter/jupyter_client/blob/78951c37b7b7f99069cab1a7350ad341d9869a98/jupyter_client/consoleapp.py#L198

[dmanikowski-reef]

Thanks for the tip! As I am looking into the code... Shouldn't this change be implemented in pyzmq codebase? I mean like here - https://github.com/zeromq/pyzmq/blob/master/zmq/ssh/tunnel.py?

[takluyver]

Quite possibly. I haven't looked at the code in enough detail to know where the 2FA code belongs. @minrk can advise on what's in scope for pyzmq.

[dmanikowski-reef]

@minrk suggests that the tunneling should be moved to jupyter_client as this feature is mostly used in IPython: https://github.com/zeromq/pyzmq/issues/1127#issuecomment-356014678

I am willing to do it. Any objections? Any advices?

[takluyver]

No objections from me. Min's a maintainer on both projects, so I trust his judgement about where the code belongs.

Maybe make one PR copying the existing tunnelling functionality into j_c, and then a separate PR with the changes, so it's easy to see what you're changing.

[minrk]

It was made largely for use here, so this is probably the most logical place for it, to me. pyzmq's a pretty slow-moving project, so it will probably be easier to get the update to folks here.

[caenrigen]

Hi all,

Many years later... better later than never? 😂

For anyone that might be interested, I built a python package that integrates with Jupyter (via a custom Kernel Provisioner) for launching and connecting to Jupyter kernels on remote systems via SSH. Kernels can be spawn directly from the JupyterLab UI or from the command line. It allows for configurability including SSH host jumps.

Python package: https://pypi.org/project/sshpyk/ Docs and GitHub: https://github.com/casangi/sshpyk/ (I donated my work to Common Astronomy Software Applications)

Hope this can help someone, cheers

[Carreau]

Feel free to advertise it on discourse, zulip and to add the corresponsing Jupyter Trove classifiers https://pypi.org/classifiers/ and look for https://pypi.org/project/remote_ikernel/ users to convert them to your project.