[Beowulf] Newbie

[Dan Stromberg]

On Thu, 2006-01-05 at 09:30 -0500, Robert G. Brown wrote:

> 
> SSH per se greatly increases security and (IMHO) should be used in all
> cases where an analysis of its expected overhead shows that it is in the
> irrelevant (<1%) range, which is in nearly all cases -- a fraction of a
> second per transaction (for just one or two transactions) to start up a
> job against thousands to millions of seconds of runtime, per node, for
> example.

Actually, on gigabit networks (and I assume on 10 gigabit nets too), ssh
overhead is often significant.


> However, if any account is compromised by any means whatsoever, you're
> equally screwed regardless of how you authenticate at the shell level.
> I personally don't use ssh passwords EXCEPT for root accounts and on
> servers and on relatively untrusted hosts, and in the latter case it is
> more to give me a small chance of detecting an intrusion before it
> spreads between networks.
> 
> It is an exercise for the studio office to contemplate methodologies for
> getting passwords, ssh keys, and pretty much anything else you want from
> most users' accounts once you have access to them without their
> knowledge.

Yes, but at least it's an extra step, particularly if there's some
decent cryptography going on in the filesystem.  Yes, once you have
root, all bets are off to an extent, but few users have the
sophistication to grab a private key out of core until someone writes a
program to do it for them.