perfSONAR User Q&A and Other Discussion

[Andrew Lake <>]

Hi Casey,

Having an esmond agent is an interesting idea.  In the forthcoming 4.1 we actually add some new options for managing authentication to an archive defined in the central file, but it is not quite what you describe. 

Right now for a central server defined in a mesh file people use IP authentication because we don't want to throw an API key in the public file (for obvious reasons). 4.1 will replace MeshConfig with a new component called pSConfig. All the old ways to define archives still work, but one new feature pSConfig has is that you can apply local transformations to the JSON the agent downloads. This includes adding things like API keys to measurement archives defined in the downloaded JSON. You can add these transformations by dropping a file in an include directory. The downside of course is that if you have 40 hosts, that could mean dropping a script defining the transformation into a directory on each host. This is painful to do by hand, but the thought is config management software like Ansible, etc is really good at this sort of thing. If all 40 of those hosts are at 40 different institutions you may still have an issue as you’ll need each administrator to setup the transform, hence something for the case you describe is still valid. No perfect for every case, but still more than we could do before though, so thought it was worth mentioning.

Thanks,

Andy

On May 10, 2018 at 1:47:11 PM, Casey Russell () wrote:

There might be a better place to make feature requests, but I'm sitting here adding 40+ individual "authenticate by IP" entries to esmond (again) because I reinstalled a host that participates in a large mesh.  

It occurs to me, it would dramatically simplify these authentication setups if I could say (perhaps in the meshconfig-agent.conf file?) something along the lines of esmond_authenticate=yes  So that any hosts that are a part of the "mesh configured" testing could be automatically authenticated by IP (and IPv6).  

I realize you'd have to do lookups for both A and AAAA records and somehow feed that to esmond.  But this would reduce the complexity of configuring these meshes (and making them green up) by a massive amount.  

I'd recommend of course that the default setting be esmond_authenticate=no so the default behavior is the (presumably safer) option where you have to manage authentication manually.

thoughts?

Sincerely,

Casey Russell

Network Engineer

785-856-9809

2029 Becker Drive, Suite 282
Lawrence, Kansas 66047