Re: [HTCondor-users] Securing HTCondor

[John M Knoeller <johnkn@xxxxxxxxxxx>]

There is no table,  many of the tools can query or send commands to either.  Most of the tools will query the collector some of the time if not all of the time, since the collector acts as a database of daemon addresses.

for example

"condor_q -name"  will query the collector to get the address of the schedd, then query the schedd to get jobs. 

"condor_status -direct -schedd" will query the collector to get the address of the schedd, then query the schedd to get the schedd's daemon ad.

"condor_q -analyze"  will query both the schedd and collector to get job ads and machine ads and then analyze the collections to see which jobs and machine match each other.

A lot of the functionality of the various condor tools will not be available unless you have a setup where all tools can query the collector for READ access.

As a general rule, commands about jobs will go to the schedd, and will not need to use the collector if the command is run on the machine where the schedd is running. Pretty much anything else will need to at least query the collector. 

The exception is condor_who, which is specifically designed to work without access to the collector. 

-tj

---

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of ella.henry.lee via HTCondor-users <htcondor-users@xxxxxxxxxxx>
Sent: Sunday, May 17, 2026 9:30 AM
To: htcondor-users@xxxxxxxxxxx <htcondor-users@xxxxxxxxxxx>
Cc: ella.henry.lee <ella.henry.lee@xxxxxxxxxxxxxx>
Subject: [HTCondor-users] Securing HTCondor

I am running HTCondor on Alma Linux 10 for my lab. I also have few Ubuntu hosts which are used for some researchers to submit jobs. I have been following https://indico.cern.ch/event/611296/contributions/2604403/attachments/1473508/2281086/EUCW17-Security_Basics.pdf but not sure if this is relevant.

My goal is this:

• Use SSL certificates to communicate with condor_status 
• Use FS for condor_q 

Is there a mapping of what client commands affect the deamons? for example condor_q affects condor_schedd. condor_status affects condor_collector. It would be nice to have this in a table somewhere.

Sent with Proton Mail secure email.