Show More
@@ -4,11 +4,6 b'' | |||||
4 | Using MPI with IPython |
|
4 | Using MPI with IPython | |
5 | ======================= |
|
5 | ======================= | |
6 |
|
6 | |||
7 | .. note:: |
|
|||
8 |
|
||||
9 | Not adapted to zmq yet |
|
|||
10 | This is out of date wrt ipcluster in general as well |
|
|||
11 |
|
||||
12 | Often, a parallel algorithm will require moving data between the engines. One |
|
7 | Often, a parallel algorithm will require moving data between the engines. One | |
13 | way of accomplishing this is by doing a pull and then a push using the |
|
8 | way of accomplishing this is by doing a pull and then a push using the | |
14 | multiengine client. However, this will be slow as all the data has to go |
|
9 | multiengine client. However, this will be slow as all the data has to go |
@@ -248,75 +248,6 b' capabilities based authentication model, in conjunction with SSH tunneled' | |||||
248 | TCP/IP channels, address the core potential vulnerabilities in the system, |
|
248 | TCP/IP channels, address the core potential vulnerabilities in the system, | |
249 | while still enabling user's to use the system in open networks. |
|
249 | while still enabling user's to use the system in open networks. | |
250 |
|
250 | |||
251 | Other questions |
|
|||
252 | =============== |
|
|||
253 |
|
||||
254 | .. note:: |
|
|||
255 |
|
||||
256 | this does not apply to ZMQ, but I am sure there will be questions. |
|
|||
257 |
|
||||
258 | About keys |
|
|||
259 | ---------- |
|
|||
260 |
|
||||
261 | Can you clarify the roles of the certificate and its keys versus the FURL, |
|
|||
262 | which is also called a key? |
|
|||
263 |
|
||||
264 | The certificate created by IPython processes is a standard public key x509 |
|
|||
265 | certificate, that is used by the SSL handshake protocol to setup encrypted |
|
|||
266 | channel between the controller and the IPython engine or client. This public |
|
|||
267 | and private key associated with this certificate are used only by the SSL |
|
|||
268 | handshake protocol in setting up this encrypted channel. |
|
|||
269 |
|
||||
270 | The FURL serves a completely different and independent purpose from the |
|
|||
271 | key pair associated with the certificate. When we refer to a FURL as a |
|
|||
272 | key, we are using the word "key" in the capabilities based security model |
|
|||
273 | sense. This has nothing to do with "key" in the public/private key sense used |
|
|||
274 | in the SSL protocol. |
|
|||
275 |
|
||||
276 | With that said the FURL is used as an cryptographic key, to grant |
|
|||
277 | IPython engines and clients access to particular capabilities that the |
|
|||
278 | controller offers. |
|
|||
279 |
|
||||
280 | Self signed certificates |
|
|||
281 | ------------------------ |
|
|||
282 |
|
||||
283 | Is the controller creating a self-signed certificate? Is this created for per |
|
|||
284 | instance/session, one-time-setup or each-time the controller is started? |
|
|||
285 |
|
||||
286 | The Foolscap network protocol, which handles the SSL protocol details, creates |
|
|||
287 | a self-signed x509 certificate using OpenSSL for each IPython process. The |
|
|||
288 | lifetime of the certificate is handled differently for the IPython controller |
|
|||
289 | and the engines/client. |
|
|||
290 |
|
||||
291 | For the IPython engines and client, the certificate is only held in memory for |
|
|||
292 | the lifetime of its process. It is never written to disk. |
|
|||
293 |
|
||||
294 | For the controller, the certificate can be created anew each time the |
|
|||
295 | controller starts or it can be created once and reused each time the |
|
|||
296 | controller starts. If at any point, the certificate is deleted, a new one is |
|
|||
297 | created the next time the controller starts. |
|
|||
298 |
|
||||
299 | SSL private key |
|
|||
300 | --------------- |
|
|||
301 |
|
||||
302 | How the private key (associated with the certificate) is distributed? |
|
|||
303 |
|
||||
304 | In the usual implementation of the SSL protocol, the private key is never |
|
|||
305 | distributed. We follow this standard always. |
|
|||
306 |
|
||||
307 | SSL versus Foolscap authentication |
|
|||
308 | ---------------------------------- |
|
|||
309 |
|
||||
310 | Many SSL connections only perform one sided authentication (the server to the |
|
|||
311 | client). How is the client authentication in IPython's system related to SSL |
|
|||
312 | authentication? |
|
|||
313 |
|
||||
314 | We perform a two way SSL handshake in which both parties request and verify |
|
|||
315 | the certificate of their peer. This mutual authentication is handled by the |
|
|||
316 | SSL handshake and is separate and independent from the additional |
|
|||
317 | authentication steps that the CLIENT and SERVER perform after an encrypted |
|
|||
318 | channel is established. |
|
|||
319 |
|
||||
320 | .. [RFC5246] <http://tools.ietf.org/html/rfc5246> |
|
251 | .. [RFC5246] <http://tools.ietf.org/html/rfc5246> | |
321 |
|
252 | |||
322 | .. [OpenSSH] <http://www.openssh.com/> |
|
253 | .. [OpenSSH] <http://www.openssh.com/> |
General Comments 0
You need to be logged in to leave comments.
Login now