Use these instructions to connect to both classified and unclassified HPC machines at LANL. Any connection or account issues should be reported to LANL HPC Support at consult@lanl.gov.

Classified Machine Access

Complete instructions are available at https://hpc.lanl.gov/networks/red-network/red-network-tri-lab-user-acce… (requires LANL authentication). Abbreviated instructions are provided below for convenience.

  1. Login to a classified (SCF) LC machine.
  2. Make sure you have a valid kerberos credential - use the klist -l command. If in doubt, get a forwardable kerberos credential by authenticating with the kinit -f command.
  3. SSH to a front-end login machine of your choice. Current front-end login machines are listed on the LANL webpage at https://hpc.lanl.gov/networks/red-network/red-network-tri-lab-user-acce…. For convenience (as of October 2025):
    • Tycho: ty-fe
    • Crossroads: xr-fe

    For example, connecting to a Tycho front-end machine:

    ssh -l lanl_userid xr-fe.lanl.gov

    You should then be logged into the front end machine without the need for a password.

Copying Files between LLNL and LANL Classified Machines

After logging in to a classified machine at either site, and authenticating with kinit -f, you can use optimized Tri-lab file transfer scripts, including file transfer to storage systems. These scripts use hsi, htar, and pftp protocols. For details see Tri-lab high bandwidth file transfers over SecureNet.

Unclassified Machine Access

LANL's unclassified machines reside on either the turquoise or the yellow network, and login procedures are different for each network.

Accessing the LANL Turquoise (Collaborative Enclave) Network

Complete instructions are available at https://hpc.lanl.gov/networks/turquoise-network/turquoise-network-hpc-a… (requires LANL authentication). Abbreviated instructions are provided below for convenience.

  1. From any location, use your LANL user name and LANL CRYPTOcard to SSH to the LANL gateway, wtrw.lanl.gov. For example:

    ssh -l lanlmoniker wtrw.lanl.gov

    password: from LANL CRYPTOcard
  2. Successfully logging in to wtrw.lanl.gov provides you with credentials that allow you to SSH to a LANL HPC front-end node. Example Turquoise network front-end nodes are:
    • Chicoma: ch-fe (institutional resource)

Accessing Rocinante on the LANL Turquoise (Restricted Enclave) Network

The use of ihpc-gate to get to LANL RE resources is deprecated. LLNL users can now go direct from LLNL RZ resources to LANL RE resources. For example LLNL users can go from rzslic or rzvernal direct to Rocinate (ro-rfe.lanl.gov) with their LANL moniker and a LLNL kerberos ticket.

From LLNL:

  1. Log into an LLNL unclassified RZ machine such as rzvernal.llnl.gov or rzslic.llnl.gov and get a forwardable Kerberos credential using:

    kinit -f 

    2. Connect to LANL Rocinante (or other LANL RE cluster) front end.

    ssh -l <lanl_userid> ro-rfe.lanl.gov

Unclassified Web Access

LANL's unclassified documentation requires a LANL-provided YubiKey for authentication. The following steps can be used to access the hpc.lanl.gov website. 

  1. Navigate to hpc.lanl.gov
  2. Click "Accept and Log In". You will be prompted for an authentication method, either PIV / zToken or YubiKey / CRYPTOCard.
  3. Select "Use YubiKey or CRYPTOCard". Enter your LANL Z Number, and your YubiKey PIN. Touch the copper contact on the YubiKey.
  4. You are now authenticated and should be able to browse LANL unclassified web pages.