Logging into Explorer (HPC) with Claude

Logging into Explorer (HPC) with Claude

How to make a key, unlock it once, and let Claude Code log into Northeastern's Explorer HPC cluster for you, without ever handing it your password, your passphrase or your key. Also how Explorer's login differs from AICR's. Part of the series Research Computing on Explorer and AICR, built from a real login session. Liam, in for Bear, narrates.

Chapters 0:00 Opening 0:12 The idea 0:24 Terms in this lecture 0:42 I · What Explorer Asks For 1:24 II · Make And Install A Key 2:03 III · Unlock It Once 2:56 IV · Let Claude Do It 3:48 V · How It Differs From AICR 4:36 Recap 4:58 Your turn

Your turn. Paste this into Claude: Log into the Explorer cluster with ssh explorer and run read-only commands only. Run: whoami, hostname, pwd, squeue -u $USER. Tell me the user name, the host, and which folder I land in. Do not submit, cancel or change anything, and do not run computation on the login node. Then check two things yourself: did Claude run only read-only commands, nothing that submits or changes? Did Claude ever ask for, or print, your passphrase or key? It should not.

Agent rule files for clusters (free): https://github.com/nikbearbrown/hpc-aicr/tree/main/skills

Sources

• A real Explorer login session recorded on 2026-10-11; every terminal line on screen is read from that record, long lines cut at a word boundary. The web-portal and Duo statements are narration, and the web-portal part is marked as documented, not tested.
• The HPC.md and AICR.md rule files in the repository above. Questions about the clusters: rchelp@northeastern.edu.

Made with the brutalist.art toolkit: Manim, Remotion and Kokoro, free and local. Narration is synthetic (Liam, in for Bear). This is an independent educational film, not an official Northeastern publication.

What this video covers

• 0:00 — Opening
• 0:12 — The idea
• 0:24 — Terms in this lecture
• 0:42 — I · What Explorer Asks For
• 1:24 — II · Make And Install A Key
• 2:03 — III · Unlock It Once
• 2:56 — IV · Let Claude Do It
• 3:48 — V · How It Differs From AICR
• 4:36 — Recap
• 4:58 — Your turn

Transcript

A lightly formatted transcript of the video, with timestamps so you can jump to any section on YouTube.

Opening

[0:00] Research computing on Explorer and AICR. Logging into Explorer HPC with Claude. How to make a key, unlock it once, and let Claude code log into the Explorer cluster for you without ever handing it a password.

The idea

[0:13] Hello, this is Liam in for Bear. First, a correction. To let Claude log into Explorer, you do not hand it your password. You make a key, you unlock it once yourself, and Claude never sees either.

Terms in this lecture

[0:24] Six terms: a private key, a secret file that proves who you are. A public key, its matching half, safe to share. An SSH agent, a helper that holds your unlocked key. Batch mode, a setting that makes SSH refuse to ask any question. A host alias, a short name for the cluster in your SSH config. And a login node, the shared computer you land on when you

I · What Explorer Asks For

[0:42] Connect. Explorer lets you in with your Northeastern password. You connect to the login host, answer the first host key question with yes, type the password, and you land on a login node. On our account, there was no Duo prompt for SSH. The web portal is different. The documentation says it asks. That works for you at a keyboard. It does not work for Claude. Claude code runs commands with no keyboard attached, and a password is the one thing you must never hand it. So, we replace the password with something the agent can use without ever seeing it. A key. One detail on the login name. The one that worked was the name from the access form, the user ID, not the first part of an email address. If your first guess is refused, try the other and wait a little after any password change.

II · Make And Install A Key

[1:25] A key comes in two halves. The private half stays on your computer and proves who you are. The public half is safe to hand out, and Explorer will keep a copy. When you connect, your computer proves it holds the private half that matches. Make it with SSH keygen. The type is ED25519, a modern default. You choose a passphrase, which locks the private file and which Claude never sees. The command prints where both halves went and a fingerprint, a short name for this key. To install the public half, one command, SSH copy ID. It asks for your Northeastern password this one time typed by you and it reports that one key was added. After this, Explorer knows

III · Unlock It Once

[2:03] Your key. Now the old problem, Claude cannot type a passphrase. So, you unlock the key yourself once into a helper called the SSH agent. The agent holds the unlocked key. SSH asks the agent and the key never passes through Claude. On a Mac, one command SSH add with the Apple keychain flag, you type the passphrase here in your own terminal. It answers that the identity was added. With the keychain, the key can reload itself when the agent is emptied. Then give the cluster a short name, one block in your SSH config, host explorer, the real host name, your username, the key file and identities only so SSH offers just this key. Add keys to agent, use keychain and a keep alive. Here is a real mistake from this setup so you do not repeat it. Before that block existed, the test failed, could not resolve host name explorer. SSH treated explorer as a computer name because nothing told it otherwise. The fix is the block you just saw.

IV · Let Claude Do It

[2:58] Test it the way Claude will connect. Batch mode makes SSH fail at once instead of asking a question. It printed the username and the login node explorer-01. No password, no passphrase, no duo. Then Claude code ran the same login itself with four read only commands, who am I, which host, which folder and my own jobs. The job list printed only its header because there were none. From here, Claude follows the rules in the HPC.md file. Read only first, ask before it submits, cancels or deletes, never compute on the login node and if any command ever prompts, it stops and tells you. Then the hardest test which is a deliberate one, empty the agent. It reports no identities. Login anyway and it still works because the keychain reloaded the key and the list shows it back. This command empties every key so our rules say only you run it on purpose

V · How It Differs From AICR

[3:48] As a test. How is this different from AICR? On explorer, you start with your password and you make your own key. On AICR, there's no password at all. You download a key and a certificate that the AICR certificate authority signed. Your Explorer username is your university login. Your AICR name is built from it with an underscore in the institution on the end. And access comes from a project sponsor on Explorer and from a proposal on AICR. What is the same matters more. Both are SSH. Both need you to unlock a key once into the agent. Both are tested with batch mode and on both Claude never holds your password, your passphrase, or your key. And what we did not test, logging in from off campus or another network, the web portal, and whether research computing permits automated agent access. The policy pages mentioned none of them, so ask once by email to rc-help@northeastern.edu.

Recap

[4:38] Let's recap with Claude. Explorer starts with your password, which Claude must never hold. Make a key, install its public half, and keep the private half yours. Unlock the key once into the SSH agent and give the cluster a host alias. Test with batch mode, then let Claude run read-only commands. AICR differs. No password and a key and certificate you download. And on both, Claude never holds your password, passphrase, or key.

Your turn

[4:59] Your turn. Paste this into Claude. Log into the Explorer cluster with SSH Explorer and run read-only commands only. Run who am I, hostname, pwd, and sq for my own user. Tell me the username, the host, and which folder I land in. Do not submit, cancel, or change anything, and do not run computation on the login node. Then check two things yourself. Did Claude run only read-only commands, and did it ever ask for or print your passphrase or your key? Logging into Explorer HPC with Claude at Nick Bear Brown.