RE: MPI/PBS enforcing restrictions..

Use PAM and enable access.conf support for all services (e.g. rsh, ssh, ftp,
telnet, etc...)

Then use the PBS epilogue/prologue support to add and remove users from the
access.conf file before and after the job.  I have been doing this for 3
years with no security issues.

Tip:  Don't forget to put root in access.conf and leave it there.  Make a
backup of the root only access.conf, then create a script restore the root
only access.conf on reboot to avoid any holes.

> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On 
> Behalf Of Szabolcs Vrbos
> Sent: Sunday, April 06, 2003 11:05 AM
> To: [email protected]
> Subject: [Myrinet] MPI/PBS enforcing restrictions..
> 
> 
> hello everyone. I would have a question about PBS on myrinet 
> clusters, 
> regarding the enforcement of restrictions (such as reserving 
> nodes for a 
> given job when PBS is used for submitting that job). I read 
> thru the PBS 
> documentation, I could see they have security implemented, 
> but somehow 
> failed to understand an important thing:
> It appears to me that even though I queue the job with PBS, 
> in the end, the 
> process is started with an 'mpirun' command. mpirun requires 
> the ability to 
> be able to rsh/ssh to the nodes without a password.
> So what will than prevent a user from running a basic 
> 'mpirun' command from 
> his login on the master-node (bypassing PBS, while a PBS 
> queued job is also 
> in progress)?
> Or more importantly, how will PBS' mom process on the client 
> node disable 
> user logins to that node while a PBS job is running on that 
> node (another 
> user might log in and run his own processes, right?)?
> thank you kindly for clarifying that to a beginner in the world of 
> clustering,
> -Szabolcs Vrbos
> 
> 
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
> http://join.msn.com/?page=features/junkmail
> 
> _______________________________________________
> Myrinet mailing list
> [email protected]
> http://email.osc.edu/mailman/listinfo/myrinet
>