As of 20 June 2026, the Lengau login procedure has been made much more secure. There are three layers of security:

1. Multi-factor authentication on the user portal
2. Virtual Private Network into the CHPC network
3. SSH login using keys only

This is the process for logging into Lengau for the first time once services have been restored:

1. Login to the CHPC User Portal using your username and password.
2. Complete MFA verification using the 6-digit code sent to your email (valid for 2 hours).
3. Configure and download your unique VPN profile, then connect to the CHPC VPN.
4. Create your SSH keys (if none exist) and copy the contents of public key to a text file.
5. Load the contents of the public key file onto the cluster through the ssh-keys management page on the user portal.
6. SSH to Lengau using your CHPC username. If you have not loaded the keys at the previous step, you will be prompted to do so now at the login prompt.

The process is demonstrated in this video.

Before asking for help, please take a look at our Login FAQ

Users manage their profile data on the CHPC user portal. To protect the integrity of the cluster login credentials as well as private information, logging into this web-based user portal will require the user to enter a 6-digit code which will be sent automatically to their registered email address. Contact the CHPC helpdesk immediately if you notice such any such email not triggered by yourself.

A VPN is used to restrict access to the CHPC network to registered CHPC users. In addition, each registered user may have only one open VPN connection at any given time. Get your WireGuard configuration file on the CHPC user portal. Additional client software install instructions are available on the WireGuard web page.

For more information see the CHPC VPN guide.

If you are experiencing difficulties, work through this checklist:

1. Check basic network connectivity
2. Check for presence of other VPN connections
3. Confirm no other open WireGuard connections on the same configuration file
4. Check nature of error message - is this a VPN or ssh failure?
5. Check local firewalling on workstation
6. Check with IT department that UDP port 51820 is open to vpn.chpc.ac.za
7. Check if same workstation and config work on alternative network, such as with cellphone hotspot
8. Does nslookup lengau.chpc.ac.za return an IP address? It should be 10.128.15.127
9. Try to do an ssh login on 10.128.15.127
10. Reboot workstation
11. Submit a helpdesk request for assistance

To increase security without incurring too much unnecessary effort, cluster login is by means of ssh-keys only. Passwords are inherently insecure and easy to get wrong. Ssh-keys are easy to set up and make subsequent logins much easier. The process is explained on this page.

Access to the DTN node for large file transfers, including large pip and git builds, is by application only. Send your request to be added to the DTN node access group to our Helpdesk.

The DTN node dtn.chpc.ac.za is protected by additional two-factor authentication using the Google Authenticator app. Once your DTN access request is granted please follow the instructions below to set up the authentication.

Open the appropriate application install app for your phone:

• Android devices use the Google Play Store link
• Apple devices use the Apple App Store link

ssh into the login node lengau.chpc.ac.za as usual.

Configure google authenticator for your account by running the command

google-authenticator -s ~/.google_authenticator_ssh 

This will ask you several questions. The first question is

Do you want authentication tokens to be time-based (y/n) 

Answer y for yes and press ENTER.

A QR code will then be displayed. Before going any further, you need to scan this QR code using the Authenticator app on your phone:

• Open Authenticator on your phone
• Tap on the multi-colour + button to add a new key
• Tap on Scan a QR code
• Point your phone's camera at the screen making sure the QR code is in the box

Note that the QR code may scroll off the top of the screen. Enlarge your ssh terminal window or reduce the font size so that the code is fully visible.

Once the code is accepted and a new key, named login2: folowed by your cluster user name, will appear in the Autheticator app list of codes.

Now continue to answer the google-authenticator questions on the cluster.

Important: Answer y (and press Enter) to all the questions to set up strong security.

Now you can ssh to the DTN node at dtn.chpc.ac.za. This connection will use your ssh key (like for lengau) to connect and then you will be prompted for the Authenticator code. Ensure that you distinguish between the passphrase for your key and the request for the Authenticator code:

Verification code:

Open the Authenticator app on your phone and look for the 6 digits below the login2: label. Type those in and press ENTER.