Re: [HTCondor-users] dirty AFS hook stuff?

[Rich Pieri <ratinox@xxxxxxx>]

Bach, Richard A wrote:
> Yes I admit it's a hack. It does not however open all of your users
> up to being compromised if one account gets hacked.

Not if that account is root. Just fire up a Live CD of your favorite
Linux distribution and you have root. Anyone with UID 0 who has access
to your AFS cell has access to those files. This is the same security
flaw that plagues every kind of UID-based security across a network:
root on any node is still UID 0. This is why NFS maps the root user to
the nobody user.

I suggest a different procedure: Create an AFS volume on one of your
file server machines. Set the ownership and ACLs on the volume to permit
HTCondor users access to the volume without tokens. Have your users copy
their work data to this scratch space and run their jobs against that.
You still get your AFS-backed shared storage and you don't have
unauthenticated access to users' private storage. The copy process makes
it less likely that users will mistakenly reveal something that should
be private or confidential.

-- 
Rich Pieri <ratinox@xxxxxxx>
MIT Laboratory for Nuclear Science