The new secure front-end (SFE) systems have been deployed, and the old SFEs are being turned off  today, April 5. The secure front end (SFE) systems sfe[1-3] will be turned off today and will no longer be accessible.

Previous Reminder - March 29, 2021

The current SFEs, sfe[1-3], have reached end-of-life and will be turned off on April 5. New SFEs, sfe[6-9], have been deployed and are available now.

To ensure a smooth transition from the old SFEs to the new ones, please complete the steps below:

Steps for Transitioning from sfe[1-3] to sfe[6-9]

1. Download the new SSH configuration file template.

   Change the configuration file in the ~/.ssh/config directory on all hosts that you use to access the current SFEs. Old configurations are no longer valid due to changes in host names and changes to the SSH ciphers and algorithms supported. You should also transition any unrelated configuration settings that you may have in your existing ~/.ssh/config file.

   Tip: Before downloading the new file, rename your old ~/.ssh/config file to a different name (such as config.pre_sfe6), in case you need to transfer any settings from your old file to the new file.

   Note: Public keys that were previously set up for SSH passthrough on the old SFEs have been copied over to the new SFEs, so you do not need to re-upload them.

2. Copy any files on sfe[1-3] that you want to keep.

   You must copy any files on sfe[1-3] you want to save to a different system before sfe[1-3] are turned off on April 5, 2021.

New SFE Features and Changes

The new SFEs have some new features, as well as some changed functionality:

• The new SFEs are built on a different and more restrictive architecture than the old ones. You can no longer directly read or write any file on the SFEs. You can only execute the commands ssh, ssh-balance, and a new command called ssh-key-init.
• SSH public keys used for SSH passthrough are managed using the new ssh-key-init command. For instructions on using this command to initialize public keys, see Setting Up Public Key Authentication.
• Transfers to and from the SFEs themselves are no longer allowed. Existing mechanisms using SSH passthrough and SUP/Shift are still supported as previously. For transfer instructions, see Inbound File Transfer Through SFEs: Examples.
• When you log into an SFE using the RSA SecurID passcode + NAS password method, the password will now be prompted before the RSA SecurID passcode (instead of after).
• A new authentication method, RSA SecurID passcode + NASA PIV, is now available for users who hold NASA personal identity verification (PIV) badges. This method enables you to log in using your RSA SecurID passcode and the PIV PIN associated with your attached NASA badge.

If you have questions or need more information, please contact the Control Room at (800) 331-8737, (650) 604-4444, support@nas.nasa.gov.