Users may have one of several permissions in a project (or a
subgroup):
-
User: - Users with this permission are not allowed
to start new experiments, nor do they have root access on
nodes. Typically this permission is used in classes, where
students need to log into nodes, but not be able to alter
any state or view anything except what standard unix
permissions allow. See the note below for additional
information.
-
Root: - The most common permission granted, users
with this permission are allowed to start new experiments,
and have root access (via sudo) on all nodes
belonging to experiments in the project (or subgroup). In
a class setting, this means that users can log into the
nodes of other students and view any files they want.
-
Manager: - In addition to the privileges granted with
root, managers are allowed to approve new users to
the project or subgroup, as well as set the privileges for
other members of the project or subgroup. Typically class
TAs would be given this permission so that they can help
the instructor manage the class.
A note about teaching classes and using user privileges:
a common practice in classes is to place different sets of
students in different subgroups and give them root
privileges so that they can create experiments in those
subgroups. On the nodes, accounts are built only for those
members of the subgroup, and those members have root
access. Students in other subgroups will not be able to log
into the nodes. This isolates the groups of students (or
even one student per subgroup) from each other.
However in order
for this to be completely secure, you must assign
user permissions to students in the project main
(default) group. This will prevent students from
creating experiments in the main group, which would give
them root access on nodes that include the accounts of all
students in the project. And with root access, they can
access all the files of all the members of the project.