Thanks guys. I am looking into it Thomas ________________________________________ From: Dave Love <[email protected]> Sent: Wednesday, September 28, 2016 12:24 PM To: William Hay Cc: Thomas Beaudry; [email protected] Subject: Re: [SGE-discuss] SGE + kerberos
William Hay <[email protected]> writes: > On Fri, Sep 23, 2016 at 07:23:00PM +0000, Thomas Beaudry wrote: >> Hi, >> >> I am running into problems when cluster users submit a job to execution >> hosts that don't have the users kerberos ticket to access NFS shares. I >> tried copying the users's ticket to the excution host but that didn't fix >> the problem. The only thing that is working is if I have the user login >> to the execution host first before launching the job. >> >> What is the best solution to this problem? There's no good one, since the Kerberos model is fundamentally at odds with batch systems (which would be better off with capabilities). You can't do this in general without privileges, or at least influence, in the Kerberos realm, since you either have to delegate obtaining tickets or make them arbitrarily renewable. Anyhow, as far as I know, AUKS is what to look at, as William said, but I don't know of any SGE integration; it isn't relevant for filesystems here, so I haven't investigated. (It's mentioned under <http://arc.liv.ac.uk/SGE/tools>, and see the discussion in the old workshop paper, though DESY subsequently suggested AUKS rather than their system.) >> Thanks! >> >> Thomas Beaudry > You may be able to use the various features built into grid engine for > integration with > AFS (set_token_cmd,pag_cmd,token_extend_time). See bootstrap(5) about the security of that. If you're not careful, tickets can be stolen. > Alternatvely there is > the AUKS project > that is specifically designed for integrating batch schedulers (like > SGE) with Kerberos. > > Last heard of at http://sourceforge.net/projects/auks/ but someone > seems to be tweaking it a > little more recently here: https://github.com/hautreux/auks although > it looks like they are more > slurm focussed. > > Also general questions are probably better directed at > [email protected] keeping this list > for things you know are specific to the SoGE fork. Well, has anyone else has looked at this seriously recently, specifically separating ticket management from authentication? I don't remember to what extent that's actually safe with the AFS "security" method, though, or whether it's feasible to fix the GSS methods. (It would probably be better just to use SASL for GSS.) _______________________________________________ SGE-discuss mailing list [email protected] https://arc.liv.ac.uk/mailman/listinfo/sge-discuss
