Automation in the context of multifactor authentication/fr

Les flux de travail qui établissent sans intervention humaine des connexions à nos grappes ne peuvent pas utiliser un deuxième facteur. Avec l'authentification multifacteur obligatoire, vous devez demander l'accès à un des nœuds spéciaux qui sont réservés pour les flux automatisés. Un deuxième facteur ne sera pas requis, mais les fonctionnalités de ces nœuds sont limitées par rapport à celles des nœuds de connexion ordinaires en termes de type d'authentification requise et aussi des types d'actions à exécuter.

Mesures de sécurité accrues

Accès sur demande seulement

Pour avoir accès aux nœuds spéciaux, écrivez au soutien technique. Décrivez le type d'automatisation, listez les commandes qui seront exécutées ainsi que les outils ou les bibliothèques pour gérer l'automatisation.

Accès via certaines clés SSH

L'accès aux nœuds spéciaux se fera uniquement via les clés SSH téléversées dans CCDB. Les clés inscrites dans un fichier .ssh/authorized_keys ne seront pas acceptées. De plus, lkes clés SSH dopivent respecter les contraintes suivantes.

restrict

This constraint disables port forwarding, agent forwarding, and X11 forwarding. It also disables the pseudo teletype (PTY), blocking most interactive workloads. This is required because these automation nodes are not intended to be used to start long-running or interactive processes. Regular login nodes must be used instead.

from="pattern-list"

This constraint specifies that the key can only be used from IP addresses that match the patterns. This is to ensure that this key is not used from computers other than the ones intended. The patterns list must include only IP addresses that fully specify at least the network class, the network, and the subnet, which are the first 3 sections of an IP address. For example, 192.168.*.* would not be accepted, but 192.168.1.* would be accepted.

command="COMMAND"

This constraint forces the command COMMAND to be executed when the connection is established. This is so that you may restrict which commands can be used with this key.

Convenience wrapper scripts to use for command=

command constraints can specify any command, but they are most useful when using a wrapper script which will accept or reject commands based on which command is being called. You can write your own script, but for convenience, we provide a number of such scripts which will allow common actions. These scripts are defined in this git repository.

• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh permet uniquement les commandes de transfert de fichiers, comme scp, sftp ou rsync.
• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/archiving_commands.sh permet les commmandes d'archivage de fichiers, comme gzip, tar ou dar.
• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/file_commands.sh permet la commande de manipulation de fichiers, comme mv, cp ou rm.
• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/git_commands.sh permet la commande git.
• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/slurm_commands.sh permet certaines commandes Slurm, comme squeue, sbatch.
• /cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/allowed_commands.sh permet toutes les commandes ci-dessus.

Examples of accepted SSH keys

Accepted SSH keys must include all 3 of the above constraints to be accepted. Here are examples of SSH keys that would be accepted: For example, the following key would be accepted, and could only be used for transferring files (through scp, sftp or rsync for example):

restrict,from="216.18.209.*",command="/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE6AACAIExK9iTTDGsyqKKzduA46DvIJ9oFKZ/WN5memqG9Invw

while this one would only allow Slurm commands (squeue, scancel, sbatch, scontrol, sq):

restrict,from="216.18.209.*",command="/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/slurm_commands.sh" ssh-ed25519 AAAAC3NzaC1lZDI1NTE6AACAIExK9iTTDGsyqKKzduA46DvIJ9oFKZ/WN5memqG9Invw

Using the right key

If you have multiple keys on your computer, you need to be careful to use the correct key. This is typically done by passing parameters to the command you are using. Below are a few examples.

Avec ssh ou scp,

[name@server ~]$ ssh -i .ssh/private_key_to_use ...

[name@server ~]$ scp -i .ssh/private_key_to_use ...

Avec rsync,

[name@server ~]$ rsync -e "ssh -i .ssh/private_key_to_use" ...