<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.34">
<TITLE>RE: [Beowulf] SSH without login in nodes</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Here's a very simple suggestion.</FONT>
</P>
<P><FONT SIZE=2>This disallows interactive logins to a non-login node. It does not stop something like "ssh nodename /home/username/longrunningjob", but it adequately prevents accidental logins; and it's easy to maintain.</FONT></P>
<P><FONT SIZE=2>As coded it allows the root user and users in the "clustadm" group to access the nodes interactively but kicks out any users who "accidentally" attempt to interactively login to a node (after sending instructions on where they should login).</FONT></P>
<P><FONT SIZE=2>Put the following text in a file called "/etc/profile.d/nologin.sh"</FONT>
</P>
<P><FONT SIZE=2>#</FONT>
<BR><FONT SIZE=2># Prevents interactive logins on cluster nodes</FONT>
<BR><FONT SIZE=2>#</FONT>
<BR><FONT SIZE=2># Allow root and members of the "clustadm" group</FONT>
<BR><FONT SIZE=2># set the "master" variable to the name of the login node</FONT>
<BR><FONT SIZE=2>#</FONT>
</P>
<P><FONT SIZE=2>master="headnode"</FONT>
</P>
<P><FONT SIZE=2>if [ "$LOGNAME" = "root" ]</FONT>
<BR><FONT SIZE=2>then</FONT>
<BR> <FONT SIZE=2>:</FONT>
<BR><FONT SIZE=2>else</FONT>
<BR><FONT SIZE=2> groups=`groups | grep clustadm`</FONT>
<BR> <FONT SIZE=2>if [ "$groups" = "" ]</FONT>
<BR><FONT SIZE=2> then</FONT>
<BR> <FONT SIZE=2>echo "Please log into the master node, $master, for access to the cluster."</FONT>
<BR><FONT SIZE=2> echo "Logging you out now."</FONT>
<BR><FONT SIZE=2> echo</FONT>
<BR><FONT SIZE=2> exit</FONT>
<BR><FONT SIZE=2> fi</FONT>
<BR><FONT SIZE=2>fi</FONT>
</P>
<br><br><table bgcolor=white style="color:black"><tr><td><br>CONFIDENTIAL AND PRIVILEGED INFORMATION NOTICE<br>
<br>
This e-mail, and any attachments, may contain information that<br>
is confidential, subject to copyright, or exempt from disclosure.<br>
Any unauthorized review, disclosure, retransmission, <br>
dissemination or other use of or reliance on this information <br>
may be unlawful and is strictly prohibited. <br>
<br>
AVIS D'INFORMATION CONFIDENTIELLE ET PRIVILÉGIÉE<br>
<br>
Le présent courriel, et toute pièce jointe, peut contenir de <br>
l'information qui est confidentielle, régie par les droits <br>
d'auteur, ou interdite de divulgation. Tout examen, <br>
divulgation, retransmission, diffusion ou autres utilisations <br>
non autorisées de l'information ou dépendance non autorisée <br>
envers celle-ci peut être illégale et est strictement interdite.</td></tr></table></BODY>
</HTML>