Re: [HTCondor-users] htcondor interactions with software firewalls

[Todd L Miller <tlmiller@xxxxxxxxxxx>]

> * Which port does ssh_to_job use to make a remote connection to the
>   execution point where the job is running? Is it 9618 or the default
>   ssh 22?

	It's port 9618.

> * Is there any extra configuration necessary to make sure ssh_to_job
>   works beyond the default setup? Particularly if I limit traffic to
>   just a few open ports.

	If you allow inbound port 9618 on your execution points (that is, 
the EPs are _not_ using CCB), then no; HTCondor tunnels the traffic over 
its own connection.

> In order for the various file transfer plugins to work, can I just have the 
> relevant ports open on the access point or do I need to make sure the 
> execution points also have firewalld rules configured for https, ftp, or 
> what-have-you as well?

	The file-transfer plug-ins should (generally) only ever want to 
make outbound connections, but they will be made from the EPs.

> For an single htcondor pool, should one be able to directly ssh to the
> central manager or should it be only accessible through an AP?

	Submitters should not (generally) need to ssh to the central 
manager.

-- ToddM