<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Jonathan,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Yes, we have dedicated personal admins accounts. But they're also centrally configured on AD. The problem stays the same.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We don't have an EMS for those nodes. Our CES nodes are in a storage-less cluster (the storage is accessed via remote-cluster mount) and we install them via our puppet-based infrastructure.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for the suggestion of using pam_krb5. I'm not a big fan since RHEL discontinued it in favour of SSSD, but I'll check it out.</div>
<div class="elementToProof" style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div class="elementToProof" style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ivano</div>
<div class="elementToProof" style="margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
<br>
<br>
</div>
<div id="Signature">
<div style="font-size:12pt;font-family:Calibri, Helvetica, sans-serif;color:rgb(0, 0, 0)" dir="ltr" id="divtagdefaultwrapper">
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
__________________________________________</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
Paul Scherrer Institut</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
Ivano Talamo</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 9pt;">OBBA/230</span><span style="font-size: 12pt;"><br>
</span><span style="font-size: 9pt;">Forschungsstrasse 111</span></div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
5232 Villigen PSI</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
Schweiz</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<span style="font-size: 12pt;"><br>
</span><span style="font-size: 9pt;"></span></div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
Phone: +41 56 310 47 11</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 9pt; color: rgb(0, 0, 0);">
E-Mail: ivano.talamo@psi.ch</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 9pt; color: rgb(64, 64, 64);">
<span style="background-color: rgb(255, 255, 255);"><i>Available: Monday - Wednesday</i></span></div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> gpfsug-discuss <gpfsug-discuss-bounces@gpfsug.org> on behalf of Jonathan Buzzard <jonathan.buzzard@strath.ac.uk><br>
<b>Sent:</b> 23 July 2024 13:29<br>
<b>To:</b> gpfsug-discuss@gpfsug.org <gpfsug-discuss@gpfsug.org>; gpfsug-discuss@spectrumscale.org <gpfsug-discuss@spectrumscale.org><br>
<b>Subject:</b> Re: [gpfsug-discuss] ssh authentication on CES nodes</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Tue, 2024-07-23 at 10:11 +0000, Paul Ward wrote:<br>
> Hi Ivano,<br>
> <br>
> I am curious about this line of your message:<br>
> “For us that's quite annoying, since we can't login with our<br>
> personal/central accounts and then sudo.”<br>
> <br>
> We only allow administrator access to the GPFS cluster via the EMS<br>
> nodes. We will be restricting them to MFA based access.<br>
> We then navigate to all other nodes from one of them.<br>
> <br>
> <br>
<br>
My guess would be that administrators log onto the cluster using their <br>
personal/central accounts and then use sudo to issue administrative<br>
commands. This creates a log of who issued what commands at what time.<br>
Useful when you have more than one administrator and provides a level<br>
of tracking.<br>
<br>
Though personally I think using your "personal" everyday account for<br>
this is suboptimal. Best practice would suggest have a separate<br>
personal administrator account. So for example in a previous life my<br>
normal everyday account was njab14 no different than anyone else's<br>
account, but my I had a separate account administrator account was<br>
sjab14. That could do things like sudo had rights in the AD etc. etc.<br>
<br>
You can also do things like create groups of users that can log onto<br>
things that normal users cant.<br>
<br>
<br>
JAB.<br>
<br>
-- <br>
Jonathan A. Buzzard Tel: +44141-5483420<br>
HPC System Administrator, ARCHIE-WeSt.<br>
University of Strathclyde, John Anderson Building, Glasgow. G4 0NG<br>
_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at gpfsug.org<br>
<a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss_gpfsug.org">http://gpfsug.org/mailman/listinfo/gpfsug-discuss_gpfsug.org</a><br>
</div>
</span></font></div>
</body>
</html>