Hi Lukas,
Thanks for your comments. A few different issues here...
On Fri, 2011-11-18 at 17:12 +0100, Lukas Slebodnik wrote:
Hi all,
In our company, we mainly use Cumin to job monitoring, but Cumin has also
possibility to manage jobs (hold, release, remove). We have installed Cumin
version 0.1.4916. This version communicate with condor through python-qmf.
If I try to remove(release, hold) job, Cumin will report error message:
"Remove: Failed (Forbidden)". This is a reason why we decided to comment out
this features from Cumin, so our users can't see it.
I believe the issue you are running into here is that cumin must
authenticate to the QMF broker as the "cumin" user, otherwise certain
restrictions on actions are enforced by condor.
To do this, a "cumin" user must be created in the SASL database for the
broker, and the cumin.conf file must be updated.
On the machine where the broker is running, do this (this will prompt
for a password and create the cumin user):
$ sudo -u qpidd /usr/sbin/saslpasswd2 -f /var/lib/qpidd/qpidd.sasldb -u QPID cumin
Then, change the "brokers:" setting in /etc/cumin/cumin.conf to include
credentials for the "cumin" user. A broker address with authentication
credentials looks like this (your username will be "cumin")
brokers: username/password@hostname:port
Then, restart cumin. This should take care of it.
Last week I tried the latest version of Cumin from svn (rev. 5117). But job
management also do not work. Is it in qpid or condor configuration problem?
same issue.
I noticed, that latest version of Cumin can communicate with Condor
using
aviary project. I installed latest condor-aviary (from Condor 7.6.4 ).
I configured Cumin to use aviary and then suddenly job management work very
well. But after some testing I noticed that, I was able to remove any user jobs,
although I was only ordinary user (without admin role). I also tried to use
example aviary python scripts and result was the same. I removed any user jobs.
Aviary does not at this point have any checks on user identity. It's
pretty new, this is something we should explore in the future.
Is it also a configuration issue like with qmf?
QMF has ACLs, but I confess I have not explored them deeply, they may be
applicable here.
However, when talking to condor through QMF, you are restricted from
doing certain things unless you connect to the broker as "cumin".
For QMF, if an admin were to keep the "cumin" user password secret, so
that users could not freely connect to the broker as the "cumin" user
then these job operations would be protected (as you saw above!)
But, cumin is missing role enforcement.....
What is a purpose of admin role in cumin? Because I did not noticed
any
differences.
Currently, there is not really any role enforcement in Cumin. Ideally,
admin users will see the "Administrator" view and regular users will
only see the User Grid view.
Jobs in the User Grid view are filtered for the user, so they would not
see the jobs of other users.
Enforcing the roles would provide some protection, so you could not
operate through the GUI on objects you could not see.
However, to protect against hackers constructing their own http requests
for the cumin web-server, cumin would probably also need to enforce some
checks on user activity at the code level.
Regards,
Lukas
_______________________________________________
cumin-users mailing list
cumin-users(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cumin-users