| Index | Recent Threads | Unanswered Threads | Who's Active | Guidelines | Search |
 |
World Community Grid Forums
Category: Support
Forum: BOINC Agent Support
Thread: BOINC installed as a service |
| No member browsing this thread |
|
Thread Status: Active Total posts in this thread: 3
|
|
| Author |
|
|
schepers
Advanced Cruncher Canada Joined: Oct 11, 2006 Post Count: 85 Status: Offline Project Badges: 
|
I've tried mailing Rom Walton on this question, but can't see how to post on his BOINC forum.
Is there a particular reason the BOINC installer, when installing as a service, requires having account credentials to run the service under? I'm testing a BOINC install where I've converted the service to "Local System" which requires no credentials and it appears to work OK for the 5 days it's been up. I know UD works this way fine as I ran it for over a month. I don't run BOINC under c:\program files, instead it is installed on a separate drive letter (d:\boinc). Is running this kind of service without credentials a potential security concern, could there be file access issues, or might there be work unit corruption? |
||
|
|
Former Member
Cruncher Joined: May 22, 2018 Post Count: 0 Status: Offline |
There are potential security issues. While all WCG projects are audited and as safe as possible, anyone can set up a BOINC project. In theory, someone could set up a malicious BOINC project, or hack a less secure BOINC project.
Current thinking is to set up a "sandbox" for BOINC. That way, the only application that needs full trust is the BOINC client. The science applications can be severely restricted, and the Manager will run (as always) under the login account. |
||
|
|
schepers
Advanced Cruncher Canada Joined: Oct 11, 2006 Post Count: 85 Status: Offline Project Badges:
|
So security concerns are the only known issue, not corruption? Interesting because the first machine I tried BOINC on as a "local system" service generated an error on its first work unit so I thought there was some other concerns. My second attempt has been good.
Since I am only connected to the WCG project on BOINC, then in theory I should be OK (minimal risk) to run as a pure system service, yes? One of the interesting things about the BOINC install is it requires admin rights to install, and defaults to using those admin credentials to run the service. Kind-a defeats the purpose for security, doesn't it? I would think that UD, running as a service, would suffer the same security issues, except that you can only connect to WCG. |
||
|
|
|