ECCE 8.18.9

Bug fix and security fix, backported from 9.0.

• Compute machine password sent to the data server; jobs not monitored (#204, #138): when ECCE logged in to a compute machine with a password (ssh, password or keyboard-interactive login without a key), the job monitor (eccejobstore) looked up the data server's credentials in ECCE's in-memory password cache and took the most recently cached entry of any kind. That entry was the compute machine's password. ECCE then sent it to the data server in an HTTP Basic Authorization header. Two effects:
  • The cluster password was disclosed to the data server (the Apache instance ECCE talks to, local or central) in every request made with it. It went to the data server you were connected to, not to a third party; on a central server that is the server machine.
  • The data server rejected it, eccejobstore exited with "EDSIFactory::getResource failed" before starting the monitor, and the job stayed "submitted" in the Organizer although it ran on the machine.
    The fallback now takes only a credential of the same kind (a data server lookup gets a data server password, never an ssh password). Logins with an ssh key were not affected. Affected: 8.x releases up to and including 8.18.8 when launching jobs to a machine that logs in by password.
    If you use password login to a cluster and your data server is not on a machine you trust with that password (for example a shared central server), change the cluster password.

Packages, each built on the system it is for:

File	Built on	Install with
ecce_8.18.9_amd64.deb	Debian 13 (trixie)	sudo apt install ./ecce_8.18.9_amd64.deb
ecce_8.18.9_ubuntu24.04_amd64.deb	Ubuntu 24.04	sudo apt install ./ecce_8.18.9_ubuntu24.04_amd64.deb
ecce-8.18.9-1.x86_64.rpm	Rocky Linux 9	sudo dnf install epel-release && sudo dnf install ./ecce-8.18.9-1.x86_64.rpm

Debian 13 tested: a regression test (authcache_last_url) fails without the fix and passes with it, and the teaching calculation set passes on this release. The Ubuntu and RPM packages were built on their systems but not tested for this release. RHEL has no ActiveMQ package; see GETTING_STARTED: ActiveMQ on RHEL, Rocky and Fedora.