<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi, <div><br></div><div>Please have a look at </div><div> <a href="https://github.com/jupyter/jupyterhub">https://github.com/jupyter/jupyterhub</a></div><div>and</div><div> <a href="https://github.com/jupyter/configurable-http-proxy">https://github.com/jupyter/configurable-http-proxy</a></div><div><br></div><div><br></div><div>This is what will be used for IPython multi-user.</div><div><br><div><div>Le 28 août 2014 à 09:05, Sébastien Hinderer <<a href="mailto:Sebastien.Hinderer@inria.fr">Sebastien.Hinderer@inria.fr</a>> a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite">Dear all,<br><br>First of all, let me thank all those who have provided so useful<br>responses to the question about setting up a multi-user notebook server.<br><br>Basically, we will do it as all of you seem to have done it: creating a<br>Unix account for each user so that security relies on Unix permissions.<br>Technically, we will write our own scripts but they will definitely<br>devrive from existing work, so thanks again for having provided<br>valuable resources.<br><br>One issue I'm curious about and that did not seem to be addressed in the<br>resources I explored is the termination of webserver and<br>kernel processes. Since we develop the solution in the context of a<br>MOOC, there is the possibility of having plenty of users. So, letting<br>all the processes run forever does not seem an option. There is<br>indeed a limit in how many processes can run simultaneously on a system<br>and, perhaps even more importantly, the number of available TCP ports is<br>even smaller than that. Of course, the transpor beween web servers and<br>kernels can be set-up to use Unix local sockets, but the webservs will<br>all need a different port so if they are kept alive that means a limit<br>on the number of users.<br><br>Perhaps one possibility here would be to have a web server running in<br>front and redirecting connections to the notebook severs, based on a URL<br>prefix or a similar solution. Not sure whether/ how this can be<br>implemented, though.<br></blockquote><div><br></div>This is what above link do. <br><div><br></div><br><blockquote type="cite">Another suggestion, regarding IPython 3.0, would be to provide<br>configuration parameters to let a kernel and a web server stop after<br>some given idle time, or something like that.<br></blockquote><div><br></div><div><br></div><div>Probably not. </div><div>as you are in control of the server/proxy, you can have a </div><div>deamon that monitor the connexion and send the rest command</div><div> to shutdown with the logic you like. </div><div><br></div><div>It will be much more reliable and flexible than baking in all the imaginable logic in IPython.</div><br><blockquote type="cite">Any comment on this aspect will of course be welcome!<br></blockquote><div><br></div><div><br></div><div>We will be happy to get help on the developpement of this, </div><div>The current funding of IPython is (as far as I know) coming to </div><div>an end at the end of this year, so we cannot promise that things </div><div>will continue to move fast in the future. </div><div><br></div><div>If your MOOC as a lot of audience and you use IPython/Python a lot, </div><div>please consider proposing your hierarchy to give something to Python community. </div><div><br></div><div>Be aware that isolating user on the server-side using container or alike is </div><div>not the hard part of the security issue in using IPython.</div><div>The hard part is on the browser side. </div><div><br></div><div>To anyone that say that container are used on server-side for security, </div><div>be aware that what you say is equivalent to say :</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>« The server of your bank is in a vault with 5 ton door, of course you can </div><div><span class="Apple-tab-span" style="white-space:pre"> </span> send plain text email with your credit card number to any people that claim </div><div> to be the server, no one can access this server »</div><div><br></div><div>The risk is js injection in the browser, if it is a MOOC, steeling credential, replaying cookie auth,</div><div>CORS on web socket, and so on and so forth. </div><div>— </div><div>M</div><div><br></div><br><blockquote type="cite"><br>Bes wishes,<br>Sébastien.<br><br><br>_______________________________________________<br>IPython-dev mailing list<br><a href="mailto:IPython-dev@scipy.org">IPython-dev@scipy.org</a><br>http://mail.scipy.org/mailman/listinfo/ipython-dev<br></blockquote></div><br></div></body></html>