Re: [PATCH] Input wanted on changes.

On Mon, Jan 24, 2005 at 11:56:18AM +0000, Toby Dickenson wrote:
> On Friday 21 January 2005 12:22, Bj|rn Augustsson wrote:
> 
> > a) I can't set the PYTHONPATH in the zope users' login files, since 
> >    there are several versions of zope, and I don't know which one is
> >    correct for the instance I'm replicating.
> 
> I address this problem (and others) by having different uids for each 
> instance.

Well, that's certainly a clean and nice solution. My app people won't 
neccessarily be thrilled about having to deal with it, but I like it.
I'll consider it. 

> > b) I _could_ do the .ssh/environment trick, sort of, but it would mean
> 
> A better variant of this trick is to have different ssh keys for each 
> instance. In ~/.ssh/authorized_keys on the master you need one line per key.
> 
> Theres lots of good stuff you can add in that file..... per-key environment 
> variables will solve your main problem.

Perhaps I just haven't had enough coffee yet (though that seems unlikely,
the way my hands move), but I don't really see how that solves it, at 
least not without another patch. 

From my reading of the ssh man page, I control that via the 
-i <identity-file> switch, but I have no direct control over the args
replica.py calls ssh with. Is there some environment variable that I
don't know about?

Ie, I can get this info over the first ssh step, but not the one replica.py 
does itself, and then things go south on the other side.

> no-X11-forwarding etc will solve the timeout problem you mentioned. 

Right.

> We have some off-site replicas, so replica-to-master security is interesting 
> to us. For extra security on the master you can restrict this 
> replication-login-key to specific IP addresses, and limit its command line so 
> that the key can only be used for replication, not accessing a full shell.

Yeah, that's in the works here as well. Just have to get it to work at 
all (and with a minimum of local patches that I have to maintain) first.

> I hope this helps.

Thanks,

/August.
-- 
Bj|rn Augustsson      Sysadmin     IT Systems & Services
Chalmers tekniska h|gskola     Chalmers University of Technology
         "Damn spooky analog crap." -- John Carmack.


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl