1

I'm playing around with a cluster (with torque+open-mpi). I have a master node and compute nodes. Master submit jobs to computes nodes. To do it I use NIS+NFS in order to unify UID's and home directory. In order to execute remote commands I use ssh and keychain to get passwordless login.

Everything seems OK, doesn't it? Well not really.

For example let's say master is master node and node1 and node2 are compute nodes. So when Issue a job, node1 and node2 ask for the passphrase. Ensuing remote commands does not ask for passphrase anymore. Are you thinking all is OK? Not really :)

Let's say that I add 30 new nodes. I will have to enter the passphrase for the first time for every node, which is somewhat insane. Or let's say that I have to reboot some of the nodes, the same problem...

I've tried with openssh certificates (ssh-keygen -s ...) but it's the same issue, I depend on ssh-agent. Perhaps what I'm looking for it's somewhat insecure, but I'd want that every compute node use the socket of master node. but I have no idea how to do it.

It seems that is not possible ssh via public key authentication for users administered with NIS , doesn't it?

Any idea? Thanks in advance

1 Answer 1

1

ssh-agent and some method of distributing the public key (authorized_keys in the users home directory, mounted over NFS works) is the standard answer to your request.

For bonus points you can consider using agent forwarding to pass your credentials along if you need to pass through more than one node for some reason..

As you've given no reason why this wouldn't work in your situation, I recommend that you implement this solution.

2
  • File authorized_keys it's the same file because it's the same directory over NFS. keychain uses ssh-agent. Regarding to agent forwarding, I don't understand how that could help in this case, agent forwarding AFAIK is useful when you have Client A > Intermediate Host B > Server C and you want to forward agent from A to C with no need to copy public key to intermediate host B. If I am wrong correct me please. The main problem here is that I MUST to enter the passphrase for the first time . If you have a lot of nodes is really a problem...
    – sebelk
    Jul 21, 2012 at 14:09
  • I've found an option of keychain interesting: --inherit any Inherit when a sock (e.g. SSH_AUTH_SOCK) is set in the environment. This allows inheriting a forwarded agent. I'll test it ASAP
    – sebelk
    Jul 21, 2012 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .