Automation in the context of multifactor authentication: Difference between revisions

<code>command</code> constraints can specify any command, but they are most useful when using a wrapper script which will accept or reject commands based on which command is being called. You can write your own script, but for convenience, we provide a number of such scripts which will allow common actions. These scripts are defined in [https://github.com/ComputeCanada/software-stack-custom/tree/main/bin/computecanada/allowed_commands this git repository].

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh</code> will allow only file transfers, such as <code>scp</code>, <code>sftp</code> or <code>rsync</code>.

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/archiving_commands.sh</code> will allow commands to archive files, such as <code>gzip</code>, <code>tar</code> or <code>dar</code>.

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/file_commands.sh</code> will allow commands to manipulate files, such as <code>mv</code>, <code>cp</code> or <code>rm</code>.

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/git_commands.sh</code> will allow the <code>git</code> command.

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/slurm_commands.sh</code> will allow some Slurm commands, such as <code>squeue</code>, <code>sbatch</code>.

* <code>/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/allowed_commands.sh</code> will allow all of the above.

The restrictions must be added directly as text in front of your key, before uploading the complete string in [https://ccdb.alliancecan.ca/ssh_authorized_keys your account].