The secure front ends (SFEs) are the bastion hosts protecting the NAS secure computing enclave. The enclave includes all of the major HECC systems, including: Aitken, Electra, Endeavour, Lou, and the hyperwall.

To access resources inside the enclave from your local system, you must first use Secure Shell (SSH) to connect to one of the SFEs (sfe[6-8]) and log in using one of the following two-factor authentication methods:

• RSA SecurID + NAS password
• RSA SecurID + NASA personal identity verification (PIV)
• RSA SecurID + public key

Once authenticated, you can then use SSH to access any of the NAS systems from the SFE.

You can avoid having to log in twice (first to an SFE and then to a system inside the enclave) by setting up SSH Passthrough.

Note: Using SSH to connect from the SFEs to hosts outside of the enclave is not allowed.

New SFE Features and Changes

The SFEs (sfe[6-8]), which replaced some old SFEs in 2021, have some new features as well as some changed functionality:

• The new SFEs are built on a different and more restrictive architecture than the old ones. You can no longer directly read or write any file on the SFEs. You can only execute the commands ssh, ssh-balance, and a new command called ssh-key-init.
• SSH public keys used for SSH passthrough are managed using the new ssh-key-init command. For instructions on using this command to initialize public keys, see: Setting Up Public Key Authentication
• Transfers to and from the SFEs themselves are no longer allowed. Existing mechanisms using SSH passthrough and SUP/Shift are still supported as previously. For transfer instructions, see: Inbound File Transfer Through SFEs: Examples
• When you log into an SFE using the RSA SecurID passcode + NAS password method, the password will now be prompted before the RSA SecurID passcode (instead of after).
• A new authentication method, RSA SecurID passcode + NASA PIV, is now available for users who hold NASA personal identity verification (PIV) badges. When your NASA badge is attached to your workstation via a card reader, this method enables you to log in using your PIV personal identification number (PIN) and RSA SecurID passcode.