View source for Automation in the context of multifactor authentication

<languages />
<translate>

<!--T:1-->
Automated workflows which connect to the clusters without human intervention cannot make use of a second authentication factor. In order to execute such workflows after MFA becomes a requirement, you must request access to one of our special nodes. These nodes will not require the use of a second factor, but will be otherwise much more limited than regular login nodes in terms of the type of authentication they accept and the type of action that they can be used to perform.

= Increased security constraints = <!--T:2-->
== Available only by request ==
Users who need to make use of automated workflows for their research must first contact our [[technical support]] to be allowed to use these nodes. When contacting us, please explain in detail the type of automation you intend to use as part of your workflow. Tell us what commands will be executed and what tools or libraries you will be using to manage the automation.

== Available only through constrained SSH keys == <!--T:3-->
The only accepted means of authentication for the automation nodes will be through [[SSH_Keys#Using_CCDB|SSH keys uploaded to the CCDB]]. SSH keys written in your <i>.ssh/authorized_keys</i> file are not accepted. In addition, the SSH keys <b>must</b> obey the following constraints.  

=== <code>restrict</code> === <!--T:4-->
This constraint disables port forwarding, agent forwarding, and X11 forwarding. It also disables the pseudo teletype (PTY), blocking most interactive workloads. This is required because these automation nodes are not intended to be used to start long-running or interactive processes. Regular login nodes must be used instead. 

=== <code>from="pattern-list"</code> === <!--T:5-->
This constraint specifies that the key can only be used from IP addresses that match the patterns. This is to ensure that this key is not used from computers other than the ones intended. The patterns list must include only IP addresses that fully specify at least the network class, the network, and the subnet, which are the first 3 sections of an IP address. For example, <code>192.168.*.*</code> would not be accepted, but <code>192.168.1.*</code> would be accepted. 

=== <code>command="COMMAND"</code> === <!--T:6-->
This constraint forces the command <code>COMMAND</code> to be executed when the connection is established. This is so that you may restrict which commands can be used with this key. 

== Convenience wrapper scripts to use for <code>command=</code> == <!--T:7-->
<code>command</code> constraints can specify any command, but they are most useful when using a wrapper script which will accept or reject commands based on which command is being called. You can write your own script, but for convenience, we provide a number of such scripts which will allow common actions. These scripts are defined in [https://github.com/ComputeCanada/software-stack-custom/tree/main/bin/computecanada/allowed_commands this git repository].

<!--T:8-->
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh</code> will allow only file transfers, such as <code>scp</code>, <code>sftp</code> or <code>rsync</code>.
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/archiving_commands.sh</code> will allow commands to archive files, such as <code>gzip</code>, <code>tar</code> or <code>dar</code>.
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/file_commands.sh</code> will allow commands to manipulate files, such as <code>mv</code>, <code>cp</code> or <code>rm</code>.
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/git_commands.sh</code> will allow the <code>git</code> command.
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/slurm_commands.sh</code> will allow some Slurm commands, such as <code>squeue</code>, <code>sbatch</code>.
* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/allowed_commands.sh</code> will allow all of the above.

== Examples of accepted SSH keys == <!--T:9-->
Accepted SSH keys must include all 3 of the above constraints to be accepted. Here are examples of SSH keys that would be accepted: 
For example, the following key would be accepted, and could only be used for transferring files (through <code>scp</code>, <code>sftp</code> or <code>rsync</code> for example): 
<pre>
restrict,from="216.18.209.*",command="/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE6AACAIExK9iTTDGsyqKKzduA46DvIJ9oFKZ/WN5memqG9Invw
</pre>
while this one would only allow Slurm commands (squeue, scancel, sbatch, scontrol, sq):  
<pre>
restrict,from="216.18.209.*",command="/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/slurm_commands.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE6AACAIExK9iTTDGsyqKKzduA46DvIJ9oFKZ/WN5memqG9Invw
</pre>

<!--T:16-->
{{Warning|title=Warning|content=
The restrictions must be added directly as text in front of your key, before uploading the complete string in [https://ccdb.alliancecan.ca/ssh_authorized_keys your account]. 
}}

= Automation nodes for each cluster = <!--T:13-->
Here is the hostname of the node to be used for unattended connections on each cluster: 
* Cedar: robot.cedar.alliancecan.ca
* Graham: robot.graham.alliancecan.ca
* Béluga: robot.beluga.alliancecan.ca
* Narval: robot.narval.alliancecan.ca
* Niagara: robot.niagara.alliancecan.ca

= Using the right key = <!--T:10-->
If you have multiple keys on your computer, you need to be careful to use the correct key. This is typically done by passing parameters to the command you are using. Below are a few examples. 

<!--T:11-->
With <code>ssh</code> or <code>scp</code>:
{{Command|ssh -i .ssh/private_key_to_use ...}}
{{Command|scp -i .ssh/private_key_to_use ...}}

<!--T:12-->
With <code>rsync</code>: 
{{Command|rsync -e "ssh -i .ssh/private_key_to_use" ...}}

<!--T:14-->
It's often much more convenient to put these parameters into your ~/.ssh/config file, so it gets picked up by any ssh client invocation.  For instance:
 host robot
  hostname robot.cluster.alliancecan.ca
  user myrobot
  identityfile ~/.ssh/my-robot-key
  identitiesonly yes
  requesttty no

<!--T:15-->
this means that the following kinds of commands will do what you want:
{{Command|ssh robot /usr/bin/ls}}
{{Command|rsync -a datadir/a robot:scratch/testdata}}
</translate>