Administering Platform LSF - SAS

About Host Authentication
About Host Authentication
Trust LSF host
/etc/hosts.equiv (UNIX)
For more information
When a batch job or a remote execution request is received, LSF first
determines the user’s identity. Once the user’s identity is known, LSF decides
whether it can trust the host from which the request comes from.
LSF normally allows remote execution by all users except root, from all hosts
in the LSF cluster; LSF trusts all hosts that are configured into your cluster. The
reason behind this is that by configuring an LSF cluster you are turning a
network of machines into a single computer. Users must have valid accounts
on all hosts. This allows any user to run a job with their own permission on
any host in the cluster. Remote execution requests and batch job submissions
are rejected if they come from a host not in the LSF cluster.
A site can configure an external executable to perform additional user or host
authorization. By defining LSF_AUTH to be eauth in lsf.conf, the LSF
daemon will invoke eauth -s when it receives a request that needs
authentication and authorization. For example, eauth can check if the client
user is on a list of authorized users or if a host has the necessary privilege to
be trusted.
If the LSF_USE_HOSTEQUIV parameter is set in the lsf.conf file, LSF uses
the same remote execution access control mechanism as the rsh command.
When a job is run on a remote host, the user name and originating host are
checked using the ruserok(3) function on the remote host.
The ruserok(3) function checks in the /etc/hosts.equiv file and the user’s
$HOME/.rhosts file to decide if the user has permission to execute jobs.
The name of the local host should be included in this list. RES calls ruserok()
for connections from the local host. mbatchd calls ruserok() on the master
host, so every LSF user must have a valid account and remote execution
permission on the master host.
The disadvantage of using the /etc/hosts.equiv and $HOME/.rhosts files
is that these files also grant permission to use the rlogin and rsh commands
without giving a password. Such access is restricted by security policies at
some sites.
See the hosts.equiv(5) and ruserok(3) man pages for details on the format
of the files and the access checks performed.
500
Administering Platform LSF