Accelerator Controls File Transfer Guide

Since the computers on the Control Network are protected by the controls firewall, it can be difficult to transfer files between a controls node and a PC or Mac outside the Controls Network. Here are some things that work.

Outland mounted Linux disks

The gateway nodes outland.fnal.gov and outback.fnal.gov have the clxsrv and daesrv shared disks mounted via NFS. You can use an SCP, or SFTP client to transfer files to/from outland and have them show up on a Linux shared disk.

==================================================
 
 outland disk		  Linux disk
  /cbs_files		clxsrv:/usr/local/cbs_files
  /mecca_head		clxsrv:/usr/local/mecca_head
  /export/home1		clxsrv:/export/home1
  /export/userb		clxsrv:/usr/local/userb
  /export/scratch	clxsrv:/export/scratch
  /export/engines	daesrv:/export/engines
  /export/users		daesrv:/export/users
  /usr/local/dae	daesrv:/export/dae

==================================================

Windows File Transfer Clients

The following file transfer clients are available on Windows PC's and can transfer files between a PC outside the Controls Network and the outland or outback gateway nodes.

• Command line pscp. An SCP client. Part of PuTTY package. Distributed with Accelerator Controls Customizations. Similar to scp on Linux or Mac.
• Command line psftp. An SFTP client. Part of PuTTY package. Distributed with Accelerator Controls Customizations. Similar to sftp on Linux or Mac.
• WinSCP. A GUI SFTP and SCP client with many features.

Using WinSCP (Windows SFTP and SCP client)

WinSCP is installed on all Accelerator Division managed PC's. For a home PC, you can download the installer from WinSCP.net. The Accelerator Controls Customizations have pre-configured WinSCP to work with Fermilab Kerberos authentication and the outland and outback gateways. Start WinSCP. A Login dialog to connect to a host will appear. There will be several example WinSCP saved configurations for different use cases which you can use as is or clone and modify as needed.

• username@outland connect to outland to access controls system shared disks.
• username@outback connect to outback to access controls system shared disks.
• username@chablis connect to chablis, the control system web server. The connection is forwarded through a gateway node.
• New Site Use this to connect to nodes outside of the Control Network, such as fnalu.fnal.gov or the cartoon or heimdal nodes. The outland and outback gateways are not involved. Enter a Host name and a User name. Click the "Login" button to login immediately, or the "Save" button to save the configuration for later use.
• via NC Proxy For connecting to nodes on the Controls Network. It uses an ssh nc proxy to get through the controls firewall. username@chablis has been cloned from this configuration. Right click and select "Clone to New Site". Click on "New Site". Enter a Host name and a User name. Click the "Login" button to login immediately, or the "Save" button to save the configuration for later use.
• via Controls Proxy For connecting to nodes on the Controls Network. This is similar to via NC Proxy, but uses the Controls Web Proxy to get through the controls firewall. The Controls Web Proxy needs to be running for this to work.

Two step Transfer

Outland or outback can be used as the midpoint of a two step transfer. They support sftp and scp transfers from outside the Controls Network. They have various client commands installed, such as sftp, scp, ftp, rsh, rcp, tftp, and telnet, which may be useful for transfers to or from controls nodes.

Web Access

Some Control System files can be accessed (read-only) over the web. If you are not at Fermilab, you may need to use the lab VPN or the Controls Web Proxy. For example: clxsrv:/usr/local/userb/pic/ can be accessed at https://www-bd.fnal.gov/userb/pic/

Windows File Sharing

You can access the clxsrv and daesrv shared disks on a Windows PC by mounting \\ad-c-samba\. You need to be at Fermilab for this to work. It will not work at home, even if you are using the VPN. If it doesn't work at Fermilab, you may need to enable the SMB V1.0/CIFS Client on your PC.

Controls VPN

When using the Controls VPN, your PC uses an IP address on the Controls Network and is not subject to the restrictions of the controls firewall. This can be useful for testing protocols which are blocked by the controls firewall. A downside of using the Controls VPN is that, while the VPN is active, your PC is not allowed to access anything on the Internet outside of Fermilab. You can request a Controls VPN account at Controls Account Request.