hautreux
commented
8 years ago A generic logic to deal with credential renewal is using the pam_afs_session as you suggested. pam_afs_session implements the pam_setcred logic and can thus provides automatic renewal when combined with a calling program (like sshd) that supports that (like sshd with GSSAPIStoreCredentialsOnRekey=yes when available).
Concerning auks/slurm, the auks spank plugin is forking an helper process ("auks -R loop") that is responsible for renewing the credential during the job execution. It only deals with kerberos credential renewal and has no support for PAM or other things like that. It could be done, but it is not currently done, as I never have to deal with AFS (I am using NFSv4.x+kerberos).
You have multiple options if you want that :
- the easier : fork a process using a slurm prolog on the compute nodes, the process will have to monitor the user credential cache and use aklog to refresh the token every time the credential is renewed.
- the fastest 'integrated' solution : hack auks_api_renew_cred() in auks_api.c to launch an helper script every time the credential is renewed. The script will deal with the aklog logic or anything else.
- the better/harder solution : implements PAM logic in auks to call a PAM stack every time a credential is renewed.
The second approach could be done easily. I can give you some hints if you want to go this way and propose a patch.
dietrichliko
feltstykket
belfhi
Hi!
Thanks for your effort. This is less an issue, more a question. I am setting up SLURM and AUKS on an OpenAFS system on a small site in Vienna. Evidently auks is keeping the Kerberos token alive, but in case of AFS one has to convert the Kerberos token into an AFS token using aklog on a regular basis.
I succeed setting up the initial AFS token, using the pam_afs_session module, which solves this problem also during a login with SSH. But now it is required to renew the AFS token on a regular basis ... which requires detaching another process.
I see that you have a solution for that problem with the auks spank plugin, so I could write my own plugin to solve that. But I have the impression that I am trying the reinvent the wheel. Is there a standard solution on how to solve this issue for AFS ?
Cheers, Dietrich