25.06.2015 Views

Administering Platform LSF - SAS

Administering Platform LSF - SAS

Administering Platform LSF - SAS

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Chapter 38<br />

Authentication<br />

How <strong>LSF</strong> determines the user authentication method<br />

<strong>LSF</strong> uses the <strong>LSF</strong>_AUTH parameter in the lsf.conf file to determine which<br />

type of authentication to use:<br />

If <strong>LSF</strong>_AUTH is ... <strong>LSF</strong> uses ...<br />

eauth<br />

External authentication (eauth)<br />

Not defined<br />

Privileged ports (setuid)<br />

ident<br />

Identification daemon (identd)<br />

<strong>LSF</strong>_AUTH=eauth<br />

<strong>LSF</strong>_AUTH=ident<br />

or undefined<br />

<strong>LSF</strong>_AUTH=eauth is set automatically during installation with lsfinstall.<br />

<strong>LSF</strong> runs the external executable eauth in the <strong>LSF</strong>_SERVERDIR directory to<br />

perform the authentication.<br />

If a load-sharing application is not setuid to root, library functions use a nonprivileged<br />

port. If the <strong>LSF</strong>_AUTH parameter is not set in lsf.conf, the<br />

connection is rejected.<br />

If <strong>LSF</strong>_AUTH is defined to be ident, RES on the remote host, or mbatchd in<br />

the case of a bsub command, contacts the identification daemon on the local<br />

host to verify the user ID. The identification daemon looks directly into the<br />

kernel to make sure the network port number being used is attached to a<br />

program being run by the specified user.<br />

<strong>LSF</strong> allows both the setuid and identification daemon methods to be in effect<br />

simultaneously. If the effective user ID of a load-sharing application is root,<br />

then a privileged port number is used in contacting RES. RES always accepts<br />

requests from a privileged port on a known host even if <strong>LSF</strong>_AUTH is defined<br />

to be ident. If the effective user ID of the application is not root, and the<br />

<strong>LSF</strong>_AUTH parameter is defined to be ident, then a normal port number is<br />

used and RES tries to contact the identification daemon to verify the user’s<br />

identity.<br />

setuid permission on <strong>LSF</strong> administration commands<br />

The <strong>LSF</strong> administration commands (lsadmin and badmin, etc.) are installed<br />

setuid by default. All other <strong>LSF</strong> commands except the administration<br />

commands can be run without setuid permission if an identification daemon<br />

is used.<br />

If your file server does not permit setuid permission, you should install<br />

<strong>LSF</strong>_BINDIR on a file system that does allow setuid.<br />

<strong>Administering</strong> <strong>Platform</strong> <strong>LSF</strong> 497

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!