This shows you the differences between two versions of the page.
Next revision | Previous revision Next revision Both sides next revision | ||
cluster:157 [2017/03/27 19:11] hmeij07 created |
cluster:157 [2017/03/29 13:52] hmeij07 |
||
---|---|---|---|
Line 2: | Line 2: | ||
**[[cluster: | **[[cluster: | ||
- | ==== Centralize Key Management ==== | + | ==== Centralize |
+ | |||
+ | Lest assume we have 3 colleges (CollegeA, CollegeB, CollegeC) and we write a grant proposal and each institution will do something unique science wise. Grant gets funded and specialized hardware or software gets deployed at each college (for maybe brain scan analyses, deep learning, and engineering). | ||
+ | |||
+ | The grant mentioned that all members of participating colleges can request access at any college. How would one do that without a mess developing? Nobody, not even admins, should have access to any user level passwords. Accounts should be able to be revoked. CPU usage should be accountable. In short, some sort of " | ||
+ | |||
+ | * https:// | ||
+ | * http:// | ||
+ | |||
+ | I asked the OpenHPC community and got some great suggestions back. One involved using Kerberos without tickets and tying into Active Directory. I quickly realized not all AD installations are publicly exposed. I'm providing Alan Sill's comments below for future reference. Another suggestion was to centrally manage SSH keys for password less login functionality, | ||
+ | |||
+ | ** SSH public key authentication** | ||
+ | |||
+ | [need a way to collect key files, push them out, and manage passwd/ | ||
+ | |||
+ | In the ''/ | ||
+ | |||
+ | * '' | ||
+ | |||
+ | For this example, the /etc, /etc/ssh, and / | ||
+ | |||
+ | < | ||
+ | |||
+ | # ls -ld /etc /etc/ssh / | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | </ | ||
+ | |||
+ | The sshd service interprets '' | ||
+ | |||
+ | Use a secure, automated method to distribute the public key files to each login host's ''/ | ||
+ | |||
+ | |||
+ | **Kerberos & AD** | ||
+ | |||
+ | < | ||
+ | |||
+ | 1. install pam by run commands "yum install pam", "yum install pam_krb5", | ||
+ | The last package is needed on a log-in node, it's not required on compute nodes. | ||
+ | |||
+ | 2. Modify / | ||
+ | |||
+ | (Note for historical reasons we use both upper case and lower case for our kerberos domains. | ||
+ | Both resolve to the same thing. You may not need this - try it and see.) | ||
+ | |||
+ | |||
+ | | ||
+ | default = FILE:/ | ||
+ | kdc = FILE:/ | ||
+ | admin_server = FILE:/ | ||
+ | |||
+ | | ||
+ | default_realm = YOUR-UNIV-KERB-DOMAIN (e.g., MYUNIVERSITY.EDU) | ||
+ | dns_lookup_realm = true | ||
+ | dns_lookup_kdc = true | ||
+ | ticket_lifetime = 24h | ||
+ | renew_lifetime = 7d | ||
+ | forwardable = true | ||
+ | |||
+ | | ||
+ | | ||
+ | kdc = your-univ-domain (e.g., my university.edu): | ||
+ | admin_server = your-univ-domain (e.g., my university.edu): | ||
+ | } | ||
+ | your-univ-kerb-domain (e.g., ttu.edu) = { | ||
+ | kdc = your-univ-domain (e.g., my university.edu): | ||
+ | admin_server = your-univ-domain (e.g., my university.edu): | ||
+ | } | ||
+ | |||
+ | | ||
+ | profile = / | ||
+ | |||
+ | | ||
+ | pam = { | ||
+ | debug = false | ||
+ | ticket_lifetime = 36000 | ||
+ | renew_lifetime = 36000 | ||
+ | forwardable = true | ||
+ | krb4_convert = false | ||
+ | } | ||
+ | |||
+ | 3. Replace / | ||
+ | |||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | 4. Replace / | ||
+ | |||
+ | |||
+ | | ||
+ | |||
+ | |||
+ | 5. Setup banner announcement in /etc/banner (optional, depending on yoru organizational policies) | ||
+ | |||
+ | |||
+ | 6. Replace / | ||
+ | Host * | ||
+ | CheckHostIP | ||
+ | ForwardX11 | ||
+ | ForwardAgent | ||
+ | StrictHostKeyChecking | ||
+ | UsePrivilegedPort | ||
+ | Protocol | ||
+ | |||
+ | 7. Modify / | ||
+ | |||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | 8. Modify / | ||
+ | making any changes needed to fit this into your setup. | ||
+ | |||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | or as the following: | ||
+ | |||
+ | # User changes will be destroyed the next time authconfig is run. | ||
+ | |||
+ | auth required | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | |||
+ | 9. Reload and restart sshd and ntpd | ||
+ | |||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | (optional, if the difference of the system time to the ntp server time is too long, | ||
+ | this command can synchronize the system time to the ntp server) | ||
+ | |||
+ | 10. If all the above steps are done but it still doesn' | ||
+ | or all of the following | ||
+ | |||
+ | |||
+ | | ||
+ | run " | ||
+ | " | ||
+ | modify / | ||
+ | and run " | ||
+ | |||
+ | </ | ||
\\ | \\ | ||
**[[cluster: | **[[cluster: |