<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 11/13/2012 05:10 PM, george he wrote:
<blockquote
cite="mid:1352844644.45947.YahooMailNeo@web163102.mail.bf1.yahoo.com"
type="cite">
<div style="color:#000; background-color:#fff; font-family:times
new roman, new york, times, serif;font-size:12pt">
<div>Hi all,</div>
<div>I have a cronjob run daily by an ipa user, which accesses
nfs mounted data on the nfs server (another machine in the
realm).</div>
<div>The problem is when the user was away for a few days, his
credential expired and the cronjob did not run until he came
back and logged on to the system again. Then all halted
cronjob from the past days started to run, which is not
desired because all of them were doing the same thing.</div>
<div>My question is: Can we keep the cronjob running when the
user's credential is expired? If we cannot, then can we skip
or kill all of the old cronjobs but not the most recent one?</div>
<div>Thanks,</div>
<div>George</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
Which cron jobs to keep and which ones to kill is really something
you have to decide for yourself and script in your environment.<br>
<br>
There are several ways to overcome the issue though.<br>
Does the job really have to run as user?<br>
If so you might want to consider allowing SSSD to automatically
renew the ticket on user behalf. See sssd-krb5 man page for details
about the renewable tickets. Once the original authentication is
conducted there is a period of the validity of the ticket but there
is also a much longer period (by default a week or so) when the
ticket can be renewed on behalf of the user. If the usual absence of
users is less than say 10 days you can set a policy in IPA to allow
renewable tickets for 10 days from the original authentication. Then
the cron jobs would be able to run for at least 10 day until the
tickets completely expire and can't be renewed. Keep in mind that by
allowing the ticket to be longer lived you reduce the security of
your environment as you increase the time the potential attacker can
use to crack the ticket. However this kind of attack is unlikely but
worth mentioning.<br>
<br>
If the job can be run under different identity then you have several
options.<br>
You can create an account for the cron jobs to run and assign a
keytab to it and provision it.<br>
Then the cron job can use this account and keytab to acquire
tickets. One would have to periodically do kinit with this keytab as
another cron job or use k5start which is not supported in RHEL but
available upstream. Keep in mind that in future GSS proxy daemon
would be able to automatically renew the tickets for such accounts
on as needed basis. This functionality is planned for Fedora 19 and
is waiting for MIT 1.11 to land in Fedora later this year or early
next year.<br>
<br>
HTH<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>