search

scarlehoff / pyHepGrid

Tool for distributed computing management geared towards HEP applications.
GNU General Public License v3.0
6 stars 4 forks source link

Issues with ProxyRenewal #82

Closed adamboutcher closed 3 years ago

adamboutcher commented 3 years ago

Hi All,

Your proxy renewal shouldn't be automated as it should ask for a password, it's part of the AUP for a grid certificate. This is what the MyProxy service is for, this could have your certificate revoked if there was a security audit.

However if you wanted to be clever, you could also add a check the validity left so you don't call a new proxy every time it's run if there's say 6 hours left but really this should be user interaction.

    SECPROX=$(arcproxy -i validityEnd)
    SECNOW=$(date +%s --date "6 hours")
    if [ $SECPROX -le $SECNOW ]; then
        arcproxy >/dev/null 2>&1
    fi
scarlehoff commented 3 years ago

I am not sure who is still running with this in Durham, but I guess you mean these scripts: https://github.com/scarlehoff/pyHepGrid/tree/master/proxy_renewal ?

adamboutcher commented 3 years ago

Yes that's what I mean, specifically the proxy renewal part for this issue. We still find people use pyHepGrid to submit.

scarlehoff commented 3 years ago

I'll comment out the script so that it prints a warning instead.

adamboutcher commented 3 years ago

An initial arcproxy should be manual, and then just use the myproxy delegation for any renewal.

scarlehoff commented 3 years ago

I added a link to this issue. If @jcwhitehead or someone else want to add a wrapper it would be appreciated (since I don't have access anymore). In any case, I'll leave the IPPP link to MyProxy here.