Re: [HTCondor-users] dirty AFS hook stuff?

[Rich Pieri <ratinox@xxxxxxx>]

The general solution is to create a dedicated service user and grant
this user access to users' directories via AFS ACLs. The Globus example
is a specific case of this. The problem with doing this for all of your
users' entire home directories is that a single AFS user -- the one that
all of your users are effectively running as -- has access to everything
without any authentication at all. What's the worst that could happen?
An ignorant user could run "rm -rf /" and wipe out the entire AFS
storage space. A malicious user could steal or corrupt or destroy a
rival's data or results.

You /really/ don't want to go there. You'll be much better off using NFS
automounts or a central NFS server for staging submissions.

-- 
Rich Pieri <ratinox@xxxxxxx>
MIT Laboratory for Nuclear Science