MPI/PBS enforcing restrictions..

hello everyone. I would have a question about PBS on myrinet clusters, 
regarding the enforcement of restrictions (such as reserving nodes for a 
given job when PBS is used for submitting that job). I read thru the PBS 
documentation, I could see they have security implemented, but somehow 
failed to understand an important thing:
It appears to me that even though I queue the job with PBS, in the end, the 
process is started with an 'mpirun' command. mpirun requires the ability to 
be able to rsh/ssh to the nodes without a password.
So what will than prevent a user from running a basic 'mpirun' command from 
his login on the master-node (bypassing PBS, while a PBS queued job is also 
in progress)?
Or more importantly, how will PBS' mom process on the client node disable 
user logins to that node while a PBS job is running on that node (another 
user might log in and run his own processes, right?)?
thank you kindly for clarifying that to a beginner in the world of 
clustering,
-Szabolcs Vrbos


_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail