<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Ivano,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am running SSSD on the CES nodes (we need it for file authorization for NFS and SMB, but rely on AD for authentication). IBM set this up for us, had no issues doing it, and there were no library conflicts.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Mike Jarsulic<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Associate Director, Scientific Computing<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Center for Research Informatics | Biological Sciences Division<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">University of Chicago<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">5454 South Shore Drive, Chicago, IL 60615 | (773) 702-2066</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="color:black">From:
</span></b><span style="color:black">gpfsug-discuss <gpfsug-discuss-bounces@gpfsug.org> on behalf of Talamo Ivano Giuseppe <ivano.talamo@psi.ch><br>
<b>Date: </b>Monday, July 22, 2024 at 8:55</span><span style="font-family:"Arial",sans-serif;color:black"> </span><span style="color:black">AM<br>
<b>To: </b>gpfsug-discuss@spectrumscale.org <gpfsug-discuss@spectrumscale.org><br>
<b>Subject: </b>[EXTERNAL] [gpfsug-discuss] ssh authentication on CES nodes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">Dear all, I have a question regarding the CES service, aka protocol nodes. Our CES cluster is configured with the AD authentication and, accordingly to the documentation
[1], SSSD should not be running on the CES nodes. For us that's quite annoying,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart<o:p></o:p></span></p>
</div>
<div style="border:none;border-top:solid #E5BB00 3.0pt;padding:0in 0in 0in 0in;display:block!important;text-align:left!important;margin:0px!important;padding:16px!important;border-radius:4px!important;min-width:200px!important;background-color:#FADF9B!important;border-top:#e5bb00!important" id="pfptBannereatz7si">
<div id="pfptBannereatz7si">
<div id="pfptBannereatz7si">
<p class="MsoNormal" style="line-height:13.5pt;background:#FADF9B"><b><span lang="EN" style="font-family:"Arial",sans-serif;color:black">External: Use caution with links, attachments, and providing information.
<o:p></o:p></span></b></p>
</div>
</div>
<div id="pfptBannereatz7si">
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN" style="color:black"><a href="https://us-phishalarm-ewt.proofpoint.com/EWT/v1/MyIu0v6UfBA57LoN!4d_ODmlK7vdRO65GX_WTdZ3OfENAmlISr9BG6gKN6oPi384swmgkx0NzN8m6yWO08nZU-czK_NGKaSRNTtX3uO27nXLYetWX-fcXozmjTFNW7krLzXtpZD2eFFMkVMHiRpIuzzofs4dqbkJPXQ$"><span lang="EN-US" style="text-decoration:none"><o:p></o:p></span></a></span></p>
<div style="border:solid #666666 1.0pt;padding:0in 0in 0in 0in;display:inline-block!important;display:inline-block;visibility:visible!important;opacity:1!important;color:#000000!important;font-size:14px!important;font-weight:normal!important;text-decoration:none!important;border-radius:2px!important;padding:16px!important;margin:16px!important;white-space:nowrap!important;width:fit-content!important">
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN" style="font-family:"Arial",sans-serif;color:black"><a href="https://us-phishalarm-ewt.proofpoint.com/EWT/v1/MyIu0v6UfBA57LoN!4d_ODmlK7vdRO65GX_WTdZ3OfENAmlISr9BG6gKN6oPi384swmgkx0NzN8m6yWO08nZU-czK_NGKaSRNTtX3uO27nXLYetWX-fcXozmjTFNW7krLzXtpZD2eFFMkVMHiRpIuzzofs4dqbkJPXQ$"><span style="color:black;text-decoration:none">Report Suspicious
</span><span lang="EN-US" style="color:black;text-decoration:none"><o:p></o:p></span></a></span></p>
</div>
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN" style="color:black"> </span><span lang="EN"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Dear all,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">I have a question regarding the CES service, aka protocol nodes.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Our CES cluster is configured with the AD authentication and, accordingly to the documentation [1], SSSD should not be running on the CES nodes. For us that's quite annoying, since we can't login with our personal/central
accounts and then sudo.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Neither we can use winbind, since samba-winbind-modules package (that provides the necessary PAM module) conflicts with the gpfs.smb package.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">We will probably end up creating one or more local accounts and using ssh keys for access.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">But I wonder if someone with a similar problem found a better workaround.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Ivano<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">[1] <a href="https://urldefense.com/v3/__https:/www.ibm.com/docs/en/storage-scale/5.2.0?topic=authentication-limitations__;!!MyIu0v6UfBA57LoN!81qFjI1_Bd1tQ1ey7YDQHcce_OlEdsQ90dPVDgCbIFzKNw9JJPDKJ4BtVVdy1qE2Xiq3aE1-6-yht4mLhMrH-RUVMbma6g$">
https://www.ibm.com/docs/en/storage-scale/5.2.0?topic=authentication-limitations</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">__________________________________________<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Paul Scherrer Institut<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Ivano Talamo<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">OBBA/230</span><span style="font-family:"Calibri",sans-serif;color:black"><br>
</span><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Forschungsstrasse 111</span><span style="font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">5232 Villigen PSI<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Schweiz<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Phone: +41 56 310 47 11<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">E-Mail: ivano.talamo@psi.ch<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#404040;background:white">Available: Monday - Wednesday</span></i><span style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#404040"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="0" width="100%" align="center">
</div>
<p class="MsoNormal">“This message was received from outside of the organization. Please pay special attention and practice care when clicking on any links, or providing any information to the sender. Cyber attacks commonly attempt to trick you in to thinking
the sender is a reputable individual who you can trust.”<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>