XSEDE GSI OpenSSH Installation Guide

Last revised: 2020-12-18


The Globus Project has turned support for the Globus Toolkit over to the community. The Grid Community Forum took over Globus Toolkit support and renamed it as the Grid Community Toolkit (GCT), which it now distributes via Extra Packages for Enterprise Linux (EPEL) repositories.

On December 31, 2020, XSEDE will no longer support the Globus Toolkit, and instead support the GCT.

Installation Instructions

Use these instructions to install the latest GCT GSI OpenSSH from EPEL on XSEDE resource.


As of OpenSSH versions 7.4p1-6 for EPEL 7 and 8.0pl1-5 for EPEL 8, GCT includes the HPN patch, but it does not include the iSSHD logging patch. If you need iSSHD, install old unsupported XSEDE binaries, or patch newer GCT source and build your own binaries.

Supported Distributions

These instructions apply to all RPM based GCT distributions, including the CentOS and RedHat used on XSEDE resources.


If you are installing the GSI OpenSSH server on a system with the XSEDE Globus Client (globus-client-xsede) already installed, you will first need to update the client to the same release as the server to get the latest compatible patches using the command(s):

    # yum clean expire-cache
    # yum update globus-client-xsede

Trusting the XSEDE Repo

XSEDE RPM repositories provides source and binary RPM meta-packages for XSEDE platforms (RHEL, CentOS, and SLES).

XSEDE GSI OpenSSH packages depend on GCT packages distributed via EPEL.

Install the XSEDE Repository

Install the appropriate XSEDE platform repository using these instructions:

Install the GCT Repository

Install the appropriate EPEL platform repository using these instructions:

Installing GSI OpenSSH RPMs

On RedHat based platforms, install from the above configured repositories using the commands(s):

    # yum install gsi-openssh-server-xsede

Updating GSI OpenSSH RPMs

To update an existing installation to the most recent release, use the same install command; yum will prompt you with a list of packages that will be updated, and ask you whether or not you wish to install them. Select "y" at the prompt.

Install Host Certificate

Obtain an IGTF Server Certificate using these instructions:

and install them to the default locations:


Install Trusted CA certificates

CA certificates trusted by XSEDE are available in XSEDE RPM repositories. Install them into the default /etc/grid-security/certificates location using the commands(s):

    # yum install xsede-ca-certificates

Configuration Instructions

The following suggested configuration options are provided in /etc/gsissh/sshd_config.xsede which may be copied to /etc/gsissh/sshd_config with any additional site-specific customization:

For more configuration instructions, see: http://grid.ncsa.illinois.edu/ssh/.


For information about iSSHD (NERSCmod), see Instrumented SSH.

Also consult the change logs for the OpenSSH Portable, HPN, and GSI versions at the respective sites for the versions of these incorporated into this release.

The specific versions of these components can be obtained by running:

gsissh -V

To support other SSH authentication methods see: FAQ.

Operating Instructions

Follow operating instructions at:

Testing Instructions

To check that your GSI OpenSSH server is operating normally:

Login to login.xsede.org.

Then 'gsissh' to your server. You will need to configure your GSI OpenSSH server to accept your XSEDE certificate used when you ssh from login.xsede.org, i.e., make sure you have an entry for your certificate in /etc/grid-security/grid-mapfile.

XSEDE Service Publishing

XSEDE service providers (SPs) must publish information about GSI OpenSSH servers so that users can discover and use them. Published information is entered by SPs into text files in the format shown below and published using IPF to XSEDE central information services.

Steps for creating and updating a GSI OpenSSH service published information file:

  1. Create a file for each unique GSI OpenSSH endpoint with the contents of the example below, by copying a previous similar file. Each unique hostname plus port is a unique GSI OpenSSH endpoint.

    All XSEDE service publishing files live in a single directory. We recommend /etc/ipf/services/ (or $IPF/etc/services if your IPF was a non-RPM install), though you could place them anywhere. This directory must match the SERVICEPATH configured during the IPF installation.

    The file can have any unique name, though we recommend this name format: org.globus.openssh-[-].conf

    Each non-comment line should have the format "keyword = value", where value is double quoted if it contains special characters.

    Example of a GSI OpenSSH published information file:
    ## $SERVICEPATH/org.globus.openssh-6.0.1.conf
    Name = org.globus.openssh
    Version = 7.3p1c
    Endpoint = your_hostname.site.xsede.org:2222
    Capability = login.remoteshell
    Capability = login.remoteshell.gsi
    SupportStatus = testing

  2. Update the file with the following base fields:
    • Name must be "org.globus.openssh" which is the GLUE2 Primary protocol name.
    • Version should be your GSI OpenSSH server version.
    • Endpoint must include the public hostname and optional port in the example format.
    Explicitly specifying the default port of 22 is recommended. Alternate or testing servers may run on alternate ports.

    One or more Capability lines containing one of the values in this table: Table of Valid Name, Version, and Capability values for GSI OpenSSH services:
        Name                Version       Capability
        org.globus.openssh 	{5,6}.y.z     login.remoteshell
    A SupportStatus of development, testing, or production. If SupportStatus is not supplied your service status in the your resource's RDR status.

  3. Once your IPF software provider has run, confirm that your GSI OpenSSH service is listed at: https://info.xsede.org/wh1/glue2-views-api/v1/services/InterfaceName/org.globus.openssh