Setting Up The VPN on Windows

Before following these instructions, please ensure that you have filled out an account request form and completed all the training and requirements as detailed here:

Requirement_for_users_to_get_GI_VPN_access

After completing those requirements, you should have received a welcome email from us explaining that your account is ready. Once you have received that email, continue following these instructions.

We will be installing OpenVPN Connect client for Windows. This VPN client currently supports Windows 10 and Windows 11. Do not install this software on public or shared computers!

Before installing our VPN profile, you must have enrolled your cell phone for Duo MFA using your CruzID account with UCSC. Most folks already have this from when they first started at UCSC. If you don't yet have a CruzID, please contact your sponsor/PI and ask them to help you acquire a CruzID. If you have a CruzID but haven't yet enrolled your cell phone, please follow the instructions here to enroll your phone:

https://its.ucsc.edu/mfa/enroll.html

After confirming your cell phone MFA enrollment, or if you have already done this a while ago, continue to install our VPN profile. You will need to download our OpenVPN client configuration file from this link:

https://giwiki.gi.ucsc.edu/downloads/

The username and password to access that web link will be sent to you in your account creation welcome email. Download that prism.ovpn file by right-clicking on the link on website above and selecting "Save Link As...", and save it to your Desktop or some other area you will remember.

After downloading the OpenVPN configuration file, you will need to download the OpenVPN Connect client from here:

https://openvpn.net/client/

Download the Windows Installer. Double click on the Installer to begin installation, and follow the on-screen prompts to complete installation.

Once the installation is complete, launch the OpenVPN Connect application. Review and agree to the Data Usage Policy.

After opening the app, we will need to import the prism-duo.ovpn file you downloaded earlier. Click File and browse to the location of your prism-duo.ovpn file. Import the file.

You should now be able to select the new profile and click connect. It should ask you for a username and password, which we will have sent you in our welcome email. After entering the username and password, you will receive a Duo Push on your phone in order to complete authentication. The OpenVPN status icon will appear in your system tray on the bottom right of your desktop. If it is yellow or red, that indicates you are not connected. If it is green, that indicates you are connected.

Once you authenticate to the VPN (username/password/MFA), then login via SSH to 'mustard.prism' for example, and you will be asked to change your password.

You can access SSH via several common Windows SSH client such as PuTTY. You can also use SSH right from a Command Prompt or Power Shell window (do a Windows search for "command" or "power shell" to find them). Once you have launched one of those applications, do:

ssh username@mustard.prism

Where "username" is the username we sent you in the welcome email (incidentally it is also your CruzID username). It will ask you for a password, just type in the password we sent you in your account creation welcome email. When you type the password, the characters will not echo to the screen, so it will not show you what you are typing. Once logging in successfully to mustard, it will as you to change your password. It will ask for you current password one more time, then it will ask you to choose a new password, which you will need to enter two times. Again, whatever password you choose will not echo to the screen. You new password must be:

1: At least 10 characters long
2: At least 3 character classes (lowercase, uppercase, number and/or special character)

Once you change your password, it will log you out of mustard. Then, log out of the VPN (select "Disconnect" from the OpenVPN Connect application). This step is very important! Then, log back into the VPN using your new password. It will send another Duo MFA push to your phone, then you should be logged in!

Then feel free to ssh to any of our firewalled servers (using your new password). Note the following page for available resources:

https://giwiki.gi.ucsc.edu/index.php?title=Firewalled_Computing_Resources_Overview

As always, if you have any questions, please email cluster-admin@soe.ucsc.edu for help.