Authentication via ftp...

Hi,

I have a question about the ftp authentication that the sever uses.

Does the ftp have to be bi-directional or can the master scheduler be the initiator of the ftp and the agent does not have ftp connectivity back to the master scheduler?

I hope that makes sense...

Master can ftp to the agent.
Agent has ftp enabled but cannot ftp back to the master.

Thanks.

Hi,

It is neither bi-directional or single directional. The scheduler doesn't take direct part in the user authentication process.

Here is how it works. The scheduler connects to the agent and asks the agent to authenticate the job user. If FTP is chosen as an authentication method, the agent talks to the local FTP daemon and ask it to verify the user. If the local FTP daemon returns Ok, the agent reports to the scheduler that the user is valid and then it creates the process on behave of that user and runs it.

The difference between PAM and FTP authentication method, is in the first case, the agent asks the OS, not FTP daemon, to authenticate the user. Based on the currently chosen PAM plug-in, the OS can use different methods for the user authentication, for example Kerberos authentication or something else, but that occurs outside of the agent control.

And lastly, on Windows systems, the agent talks to OS directly using native interface, by default, neither PAM or FTP is used on Windows.

Thanks I get it now!