<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Hi Ivano,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">I am curious about this line of your message:<br>
“</span><span lang="EN-US" style="color:black">For us that's quite annoying, since we can't login with our personal/central accounts and then sudo.”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:black">We only allow administrator access to the GPFS cluster via the EMS nodes. We will be restricting them to MFA based access.<br>
We then navigate to all other nodes from one of them.<br>
<br>
End users can access an area shared to the HPC cluster via ssh, and we have an internal FTP server mounting various areas via NFS, but no direct ssh access to the whole GPFS cluster.</span><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Kindest regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Paul<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Paul Ward<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">TS Infrastructure Architect<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Natural History Museum<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">T: 02079426450<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">E: <a href="mailto:p.ward@nhm.ac.uk">
<span style="color:#0563C1">p.ward@nhm.ac.uk</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:black"><img border="0" width="137" height="74" style="width:1.425in;height:.775in" id="Picture_x0020_2" src="cid:image001.png@01DADCF1.0446AA60"></span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> gpfsug-discuss <gpfsug-discuss-bounces@gpfsug.org>
<b>On Behalf Of </b>Jarsulic, Michael [BSD]<br>
<b>Sent:</b> Monday, July 22, 2024 3:17 PM<br>
<b>To:</b> gpfsug main discussion list <gpfsug-discuss@gpfsug.org>; gpfsug-discuss@spectrumscale.org<br>
<b>Subject:</b> Re: [gpfsug-discuss] ssh authentication on CES nodes<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Ivano,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I am running SSSD on the CES nodes (we need it for file authorization for NFS and SMB, but rely on AD for authentication). IBM set this up for us, had no issues doing it, and there were no library
conflicts.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Mike Jarsulic<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Associate Director, Scientific Computing<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Center for Research Informatics | Biological Sciences Division<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">University of Chicago<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">5454 South Shore Drive, Chicago, IL 60615 | (773) 702-2066</span><span lang="EN-US" style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-US" style="color:black">From:
</span></b><span lang="EN-US" style="color:black">gpfsug-discuss <<a href="mailto:gpfsug-discuss-bounces@gpfsug.org">gpfsug-discuss-bounces@gpfsug.org</a>> on behalf of Talamo Ivano Giuseppe <<a href="mailto:ivano.talamo@psi.ch">ivano.talamo@psi.ch</a>><br>
<b>Date: </b>Monday, July 22, 2024 at 8:55</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"> </span><span lang="EN-US" style="color:black">AM<br>
<b>To: </b><a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a> <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
<b>Subject: </b>[EXTERNAL] [gpfsug-discuss] ssh authentication on CES nodes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span lang="EN-US" style="font-size:1.0pt;color:white">Dear all, I have a question regarding the CES service, aka protocol nodes. Our CES cluster is configured with the AD authentication and, accordingly
to the documentation [1], SSSD should not be running on the CES nodes. For us that's quite annoying,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span lang="EN-US" style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerStart<o:p></o:p></span></p>
</div>
<div style="border:none;border-top:solid #E5BB00 3.0pt;padding:0cm 0cm 0cm 0cm;display:block!important;text-align:left!important;margin:0px!important;padding:16px!important;border-radius:4px!important;min-width:200px!important;background-color:#FADF9B!important;border-top:#e5bb00!important" id="pfptBannereatz7si">
<div id="pfptBannereatz7si">
<div id="pfptBannereatz7si">
<p class="MsoNormal" style="line-height:13.5pt;background:#FADF9B"><b><span lang="EN" style="font-family:"Arial",sans-serif;color:black">External: Use caution with links, attachments, and providing information.
<o:p></o:p></span></b></p>
</div>
</div>
<div id="pfptBannereatz7si">
<div style="border:solid #666666 1.0pt;padding:0cm 0cm 0cm 0cm;display:inline-block!important;display:inline-block;visibility:visible!important;opacity:1!important;color:#000000!important;font-size:14px!important;font-weight:normal!important;text-decoration:none!important;border-radius:2px!important;padding:16px!important;margin:16px!important;white-space:nowrap!important;width:fit-content!important">
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN" style="font-family:"Arial",sans-serif;color:black"><a href="https://us-phishalarm-ewt.proofpoint.com/EWT/v1/MyIu0v6UfBA57LoN!4d_ODmlK7vdRO65GX_WTdZ3OfENAmlISr9BG6gKN6oPi384swmgkx0NzN8m6yWO08nZU-czK_NGKaSRNTtX3uO27nXLYetWX-fcXozmjTFNW7krLzXtpZD2eFFMkVMHiRpIuzzofs4dqbkJPXQ$"><span style="color:black;text-decoration:none">Report Suspicious
</span></a></span><span class="MsoHyperlink"><span lang="EN-US" style="text-decoration:none"><o:p></o:p></span></span></p>
</div>
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:#FADF9B"><span lang="EN" style="color:black"> </span><span lang="EN"><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span lang="EN-US" style="font-size:1.0pt;color:white">ZjQcmQRYFpfptBannerEnd<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Dear all,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">I have a question regarding the CES service, aka protocol nodes.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Our CES cluster is configured with the AD authentication and, accordingly to the documentation [1], SSSD should not be running on the CES nodes. For us that's quite annoying, since we can't login with
our personal/central accounts and then sudo.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Neither we can use winbind, since samba-winbind-modules package (that provides the necessary PAM module) conflicts with the gpfs.smb package.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">We will probably end up creating one or more local accounts and using ssh keys for access.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">But I wonder if someone with a similar problem found a better workaround.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">Ivano<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black">[1] <a href="https://urldefense.com/v3/__https:/www.ibm.com/docs/en/storage-scale/5.2.0?topic=authentication-limitations__;!!MyIu0v6UfBA57LoN!81qFjI1_Bd1tQ1ey7YDQHcce_OlEdsQ90dPVDgCbIFzKNw9JJPDKJ4BtVVdy1qE2Xiq3aE1-6-yht4mLhMrH-RUVMbma6g$">
https://www.ibm.com/docs/en/storage-scale/5.2.0?topic=authentication-limitations</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black">__________________________________________<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Paul Scherrer Institut<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Ivano Talamo<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">OBBA/230</span><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black"><br>
</span><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Forschungsstrasse 111</span><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">5232 Villigen PSI<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Schweiz<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">Phone: +41 56 310 47 11<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:black">E-Mail:
<a href="mailto:ivano.talamo@psi.ch">ivano.talamo@psi.ch</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#404040;background:white">Available: Monday - Wednesday</span></i><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#404040"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span lang="EN-US">
<hr size="1" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span lang="EN-US">“This message was received from outside of the organization. Please pay special attention and practice care when clicking on any links, or providing any information to the sender. Cyber attacks commonly attempt to trick
you in to thinking the sender is a reputable individual who you can trust.”<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>