Have a look at the official wiki page of The Alliance:
Automation in the context of multifactor authentication
And here are some tips from me:
First you need to contact The Alliance (support@tech.alliancecan.ca) and tell them what commands you want to execute (for example 'rsync') and what tools or libraries you will be using to manage the automation. They should get back to you with more information - or questions.
Once you have the okay from The Alliance to proceed you need to manage your SSH keys.
For this you can either use an SSH key you already have or create a new one.
The specific process to generate an SSH key pair depends on the operating system you use. For the Windows PuTTY or MobaXterm clients, see Generating SSH keys in Windows. For a Unix-like environment (Linux, Mac, WSL or Cygwin), see Using SSH keys in Linux.
On any of our internal UQAM servers go into your ~/.ssh directory:
| cd ~/.ssh |
There you can generate it with the ssh-keygen command:
| ssh-keygen -t ed25519 |
When prompted with the question "Enter file in which to save the key (/home/username/.ssh/id_ed25519):" you can either just press enter or change the name to, for example:
/home/username/.ssh/id_ed25519_transfer)
When asked for a passphrase and to repeat it you can just press enter. After this you should have the following two new files:
| id_ed25519_transfer # private key - never share!!! id_ed25519_transfer.pub # public key |
Log in on the following CCDB web site:
https://ccdb.alliancecan.ca/ssh_authorized_keys
Paste your public SSH key (the content of the file ending on *.pub) in the field indicated. Then precede what you just pasted by:
| restrict,from="IP_address",command="command" |
Where "IP_address" is the IP address from which you want to connect and "command" is the command you would like to execute. The Alliance already provides a number of wrapper scripts which allow common actions. Have a look at their wiki: Automation in the context of multifactor authentication under "Convenience wrapper scripts to use for command=".
For example, if you want to do automated transfers from Narval to UQAM or vice versa, you should put something like:
restrict,from="132.208.147.*",command="/cvmfs/soft.computecanada.ca/custom/bin/computecanada/allowed_commands/transfer_commands.sh" full_content_of_public_SSH_key |
Then give or change the "Description" (optional but recommended) and click on "Add Key".
Once you did all the above correctly you can issue the commands you specified in the SSH key above without being asked for authentication. For example, you can now copy data from Narval to UQAM (issued from an internal UQAM server) with:
| rsync -e "ssh -i ~/.ssh/id_ed25519_transfer" username@robot.narval.alliancecan.ca:source destination |
Again, for more information have a look at their wiki: Automation in the context of multifactor authentication under "Using the right key".