Logging into CCAST

> winget install PuTTY

Duo Authentication: Tips & Troubleshooting

NDSU IT requires Duo multi-factor authentication for all Bison login attempts, including those for CCAST. If you are logging into CCAST, you must also authenticate using 2FA with your phone. It is your responsibility as a user to authenticate every time you attempt to log in. 

However, certain SSH and file transfer clients can interfere with that process, leading to repeated Duo prompts, failed logins, or account lockouts. These issues are generally related to one of three things:

• The behavior of the SSH or file transfer client being used
• Automatic reconnect attempts made by that client in the background
• Duo device configuration on the user's Duo account

In this section, we show you how to avoid repeated Duo prompts, failed logins, automatic reconnects in commonly used clients, and account lockouts when connecting to CCAST HPC clusters

How Duo Works With CCAST Login

For a full explanation of Duo multi-factor authentication at NDSU, see the Duo Authentication KB article. In short: when you log into a CCAST cluster, Duo attempts to authenticate using the default device on your Duo account. If that device is inactive, or Duo isn’t fully set up on it, the login can hang, time out, or generate repeated prompts—see Managing Your Devices to update your default device.

Recommendations

Many SSH and file transfer clients automatically retry dropped or failed connections in the background. Because each reconnect attempt triggers a new Duo authentication request, unapproved prompts can quickly result in an automatic Bison account lockout.

Authenticating with Duo once per new session is normal. To prevent repeated prompt loops and lockouts, follow these guidelines:

• Disable automatic reconnection: Turn off auto-reconnect features in your SSH, SFTP, and SCP clients. See "Disabling Automatic Reconnect" below for step-by-step instructions.
• Close background clients during prompt storms: If you receive unexpected or continuous Duo pushes, immediately close all active SSH and file transfer applications to stop background retry attempts. Retrying clients is the most common cause of prompt storms and lockouts.
• Wait before retrying: Allow a few seconds for the Duo push notification to reach your device before attempting to log in again or opening a new session.
• Fall back to native terminals: If third-party SSH wrappers or graphical tools conflict with Duo MFA, connect directly using your operating system's built-in terminal (PowerShell on Windows; Terminal on Mac and Linux):
• Use Open OnDemand: Alternatively, access clusters via Open OnDemand shell session, which handles authentication through the browser as shown earlier in this article.

Quick Guide: Disabling Automatic Reconnect

The settings below turn off the automatic retry behavior that most often causes repeated Duo prompts. Menu names may differ slightly between versions.

PuTTY (Windows)

PuTTY itself does not automatically re-attempt a login after a session drops, but its keepalive packets can generate repeated connection activity, and PuTTY-based wrapper tools do reconnect on their own.

1. Open PuTTY and load your saved session, or select Default Settings to change the defaults for all new sessions.
2. In the Category pane on the left, select Connection.
3. Under Sending of null packets to keep session active, set Seconds between keepalives (0 to turn off) to 0.
4. Under Low-level TCP connection options, clear the Enable TCP keepalives (SO_KEEPALIVE option) checkbox.
5. Return to the Session category and click Save.

If you use a PuTTY-based wrapper such as SuperPuTTY, MobaXterm, or KiTTY, check that tool's own settings as well. Auto-reconnect is a feature of the wrapper, not of PuTTY itself, and it must be disabled there.

WinSCP (Windows)

1. Open WinSCP. From the Login dialog or the main window, go to Options → Preferences.
2. In the left pane, select the Endurance page (listed under Transfer).
3. Clear all three reconnect checkboxes:
   • Automatically reconnect session, if it breaks during transfer
   • Automatically reconnect session, if it breaks while idle
   • Automatically reconnect session, if it stalls
4. Click OK.
5. Optionally, in the Login dialog, click Advanced → Connection and set Keepalives to Off.

The breaks while idle option is the one most often responsible for a WinSCP window that quietly re-authenticates in the background after you step away from your computer.

VS Code Remote-SSH

By default, the Remote-SSH extension retries a dropped connection many times without asking, and each attempt triggers a Duo push. This is a frequent cause of lockouts.

1. Open Settings (Ctrl+, on Windows/Linux, Cmd+, on Mac).
2. Search for Remote.SSH: Max Reconnection Attempts and set it to 0. VS Code will then prompt you before reconnecting instead of retrying silently. A value of 1 is also acceptable if you want a single automatic retry.
3. Search for Remote.SSH: Connect Timeout and increase it to 15 seconds. This gives you more time to approve the Duo push before the extension gives up and tries again.
4. When you finish working, use File → Close Remote Connection. VS Code reopens your last remote session on startup, which will trigger a Duo prompt the next time you launch it.
5. Search for window.restoreWindows and set it to none or folders (so it does not automatically reopen remote SSH sessions immediately upon launch without your action).

You may also need to run the following command to completely delete the corrupted server cache after logging in to the cluster via:

• For VS Code:

  rm -rf ~/.vscode-server

Getting Help

If you continue to experience Duo authentication issues after following the recommendations above, send an e-mail to ndsu.ccast.support@ndsu.edu. In your e-mail, please include:

• The cluster you are connecting to (Thunder or Thunder Prime)
• The client or application you are using (e.g., PowerShell, Terminal, PuTTY, WinSCP, FileZilla, VS Code Remote-SSH)
• Your operating system
• The approximate date and time of the failed login attempts
• A description of the behavior you observed, including any error messages

Please do not contact individual CCAST staff directly for technical support, as this bypasses our tracking system.

Thank you for your patience while we help you get reconnected.

Related resources

• CCAST FAQ
• CCAST Usage Policies
• Duo Authentication
• Managing Your Devices
• Activating or Reactivating the Duo Mobile App

Keywords: CCAST Duo MFA multi-factor two-factor authentication SSH SFTP SCP file transfer login push notification lockout reconnect PuTTY WinSCP VS Code Remote-SSH troubleshooting help