Connecting to Marlowe

After your project has been approved, connecting is simple! This page covers logging in over SSH, authenticating once and reusing that connection, and mounting your Marlowe files on your laptop so you can edit them locally.

SSH

The login server you will need to ssh into is login.marlowe.stanford.edu. That name covers three login nodes, login-01, login-02 and login-03, and it can send you to any of the three, so you will not always land on the same one. Each node is also reachable directly as login-0N.marlowe.stanford.edu, so you can name one when you want a particular node. Log in with your SUNet ID.

So, if your SUNet ID was bob, your login command would look like:

ssh bob@login.marlowe.stanford.edu

You will be prompted to provide both your password and Duo two-factor authentication credentials before it logs you in.

If you receive a message "Connection closed by 171.67.99.202 port 22" when trying to login, it usually indicates that your account is not fully active yet. A confirmation email is usually sent to inform you of full activation.

Reusing a connection

Every new SSH connection to Marlowe prompts for your password and Duo. If you have several open at once, such as a shell, a file transfer and an editor mount, you can authenticate once and let the rest reuse that connection. Add the following to your ~/.ssh/config, replacing bob with your own SUNet ID:

Host login-01 login-02 login-03
    HostName %h.marlowe.stanford.edu
    User bob
    ControlMaster auto
    ControlPath ~/.ssh/controlmaster/%r@%h:%p
    ControlPersist 10m
    ServerAliveInterval 60
    ServerAliveCountMax 3

Create the socket directory once:

mkdir -p ~/.ssh/controlmaster

Now ssh login-01 authenticates as usual the first time. Every connection after that reuses the open one with no password or Duo prompt, until you close the last one and ControlPersist expires.

Use the short name from now on. ssh bob@login.marlowe.stanford.edu does not match the Host line above, so it will keep authenticating from scratch. scp and rsync pick up the same config, so scp data.csv login-01: reuses the connection too.

To check whether a connection is currently open, or to close it:

ssh -O check login-01
ssh -O exit login-01

The connection stays open for ten minutes after your last session closes, and during that time it can be reused without a password or Duo prompt. If you are working on a shared or unattended machine, run ssh -O exit login-01 when you finish, or lower ControlPersist.

If you have an sshfs mount on that connection, unmount it before running ssh -O exit. Closing the master underneath a live mount leaves it unusable until you unmount.

Naming the node explicitly rather than using login.marlowe.stanford.edu is deliberate. A reused connection never looks the hostname up again, so it always lands on the node the first one reached. Pinning the name means that when you reconnect later you come back to the same node, where anything you left running still is. It also means that if a node is down or under maintenance, you can simply use another one.

Pick one name per node and stay with it. login.marlowe.stanford.edu and login-02.marlowe.stanford.edu are different names as far as ssh is concerned, even when they point at the same machine, so configuring both would give you two separate connections and two authentications.

Editing files from your laptop

The VS Code and Cursor “Remote - SSH” extensions are not supported on Marlowe. There are two supported ways to work on your Marlowe files:

• Code Server through Open OnDemand, which runs VS Code in your browser on a Marlowe compute node.
• sshfs, which mounts a Marlowe filesystem onto your laptop so you can open it in whatever local editor you prefer.

To use sshfs, first install it.

On Linux, install the sshfs package from your distribution’s package manager.

On macOS, sshfs needs a FUSE implementation, which you install separately. FUSE-T runs a local NFS server and does not use a kernel extension. The older macFUSE does, and on Apple Silicon that also means enabling reduced security. Whichever you install, the sshfs build you use has to match it.

Then set up connection reuse as described above, and:

mkdir -p ~/mnt/marlowe

# Mount your Marlowe home directory locally at ~/mnt/marlowe
sshfs login-01: ~/mnt/marlowe -o idmap=user

login-01: with nothing after the colon mounts your home directory.

sshfs returns before the mount is actually live. If you are scripting this, wait for the mount to appear rather than trusting the exit code, because a copy that starts immediately can see an empty directory.

Unmount when you are done:

umount ~/mnt/marlowe              # Linux
diskutil unmount ~/mnt/marlowe    # macOS

Any other path works the same way, so you can mount whichever filesystem your code actually lives on:

# Mount /projects/m123456/code locally at ~/mnt/marlowe-project
sshfs login-01:/projects/m123456/code ~/mnt/marlowe-project -o idmap=user

# Mount /scratch/m123456 locally at ~/mnt/marlowe-scratch
sshfs login-01:/scratch/m123456 ~/mnt/marlowe-scratch -o idmap=user

m123456 stands in for your own project ID.

Directories under /projects/ are automounted, but naming one directly works, so you do not need to log in and cd to it first. Mount the subdirectory you actually want rather than the top of your project directory. On macOS, mounting /projects/m123456 itself succeeds and then refuses to list.

Your home directory is limited to 32GB, so if your code does not fit there, /projects/ is usually the filesystem you want: it is sized to your allocation, and it is backed up and snapshotted. Keep in mind that /scratch/ is neither backed up nor replicated, so it is a poor place to keep source you are actively editing.

Because sshfs reads your ~/.ssh/config, the mount reuses the connection you already authenticated and will not prompt you again. idmap=user makes your own files show up under your username rather than a raw numeric ID, and it is already the default on macOS. Files belonging to other people show numeric owners either way.

If a mount succeeds but listing it gives Operation not permitted, grant the application access to Network Volumes under System Settings → Privacy & Security → Files and Folders.