Re: [HTCondor-users] condor_ssh_to_job

[Rich Pieri <ratinox@xxxxxxx>]

On 8/12/2014 8:11 PM, Keith Brown wrote:
> how can I set restrictions when a user ssh's to a job on a machine? I would
> like to set a shell with has access to very little commands and I want a
> timeout after 5 minutes.

Not really possible. Condor permits users to run pretty much any code
they want. This can be used to bypass any chroot() jails and limited
shells that you create. For example, a custom sshd that ignores a user's
default shell and home directory and uses whatever environment that
Condor provides instead.

If you don't want users running interactively on compute nodes then
don't give them any access to those nodes. Put them behind a firewall
and only allow access via the job submission system.

-- 
Rich Pieri <ratinox@xxxxxxx>
MIT Laboratory for Nuclear Science