hautreux
commented
8 years ago Have you the aukspriv service started on your nodes ?
Le jeu. 21 janv. 2016 17:47, sreedharmanchu notifications@github.com a écrit :
Hi,
I am trying to make slurm work with auks Right now I am testing it on 3 CentOS 71 VMs I am using first one as a mgmt node that has all 3 auks components (auksd, aukspriv and auksdrenewer) All the 3 boxes are compute and login nodes as well
When as a regular user, when I run srun /bin/hostname, it says it is unable to read credential cache Right now, as shown below, permissions on /var/cache/auks are just 700 I even changed it to 755 and still error is same I'm thinking, some other user, (is it user slurm?) is trying to read these files and rightly permission is denied I think I'm missing something simple here Can you take a look? I really appreciate any help
It does print the hostname But I am not sure whether I'm supposed to see this error I followed your howto article and created configuration Right now, I am not entirely sure whether my auksacl is correct either
It also complained "unable to parse configuration file" and I had to create a symlink to /etc/auks/auksconf in /usr/local/etc I saw another issue and it was stated that this issue was fixed in the latest commit Yesterday I downloaded the zip file and I made rpms out of it
I do have the latest version of slurm root@slurmdev1:/u/sreedhar$ srun -V slurm 15086
My configuration looks like this: ( I replaced real names)
root@slurmdev1:/u/sreedhar$ rpm -qa | grep auks auks-devel-044-1el7centosx86_64 auks-slurm-044-1el7centosx86_64 auks-044-1el7centosx86_64
root@slurmdev1:/u/sreedhar$ cat /etc/auks/auksconf
------------------------------------------------------------------------------
auks client and server configuration file
------------------------------------------------------------------------------
-
Common client/server elements
-
common {
Primary daemon configuration
PrimaryHost = "slurmdev1" ;
PrimaryAddress = "" ;
PrimaryPort = 12345 ; PrimaryPrincipal = "host/slurmdev1realma@REALMA" ;
Secondary daemon configuration
SecondaryHost = "auks2" ;
SecondaryAddress = "" ;
SecondaryPort = "12345" ;
SecondaryPrincipal = "host/auks2myrealmorg@MYREALMORG" ;
Enable/Disable NAT traversal support (yes/no)
this value must be the same on every nodes
NAT = no ;
max connection retries number
Retries = 3 ;
connection timeout
Timeout = 10 ;
delay in seconds between retries
Delay = 3 ;
}
-
API only elements
-
api {
log file and level
LogFile = /tmp/auksapilog ; LogLevel = 3 ;
optional debug file and level
DebugFile = /tmp/auksapilog ; DebugLevel = 3 ;
}
-
Auks daemon only elements
-
auksd {
Primary daemon configuration
PrimaryKeytab = "/etc/krb5keytab" ;
Secondary daemon configuration
SecondaryKeytab = "/etc/krb5keytab" ;
log file and level
LogFile = "/var/log/auksdlog" ; LogLevel = "2" ;
optional debug file and level
DebugFile = "/var/log/auksdlog" ; DebugLevel = "0" ;
directory in which daemons store the creds
CacheDir = "/var/cache/auks" ;
ACL file for cred repo access authorization rules
ACLFile = "/etc/auks/auksacl" ;
default size of incoming requests queue
it grows up dynamically
QueueSize = 500 ;
default repository size (number fo creds)
it grows up dynamicaly
RepoSize = 1000 ;
number of workers for incoming request processing
Workers = 1000 ;
delay in seconds between 2 repository clean stages
CleanDelay = 300 ;
use kerberos replay cache system (slow down)
ReplayCache = no ;
}
-
Auksd renewer only elements
-
renewer {
log file and level
LogFile = "/var/log/auksdrenewerlog" ; LogLevel = "1" ;
optional debug file and level
DebugFile = "/var/log/auksdrenewerlog" ; DebugLevel = "0" ;
delay between two renew loops
Delay = "60" ;
Min Lifetime for credentials to be renewed
This value is also used as the grace trigger to renew creds
MinLifeTime = "600" ;
}
root@slurmdev1:/u/sreedhar$ cat /etc/auks/auksacl
-------------------------------------------------------------------------------
rule { principal = ^host/slurmdev[1-3]realma@REALMA$ ; host = * ; role = admin ; }
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
rule { principal = ^[[:alnum:]]@REALMA https://github.com/REALMA$ ; host = \ ; role = user ; }
-------------------------------------------------------------------------------
root@caslurmdev1:/u/sreedhar$ cat /etc/slurm/plugstackconf include /etc/slurm/plugstackconfd/*conf root@caslurmdev1:/u/sreedhar$ cat /etc/slurm/plugstackconfd/auksconf optional /usr/lib64/slurm/auksso default=enabled spankstackcred=yes minimum_uid=1024
root@caslurmdev1:/u/sreedhar$ auks -p Auks API request succeed root@caslurmdev1:/u/sreedhar$ exit exit
sreedhar@slurmdev1:~$ auks -p Auks API init failed : unable to parse configuration file sreedhar@slurmdev1:~$ auks -vvv -p Thu Jan 21 11:26:22 2016 [INFO2] [euid=564800185,pid=53870] auks_engine: unable to parse configuration file /usr/local/etc/auksconf : No such file or directory Auks API init failed : unable to parse configuration file
sreedhar@slurmdev1:~$ sudo bash root@slurmdev1:/u/sreedhar$ ln -s /etc/auks/auksconf /usr/local/etc/auksconf root@slurmdev1:/u/sreedhar$ exit exit
sreedhar@slurmdev1:~$ auks -p Auks API request succeed
sreedhar@slurmdev1:~$ srun /bin/hostname Auks API request failed : krb5 cred : unable to read credential cache slurmdev1realma
sreedhar@slurmdev1:~$ sudo bash root@slurmdev1:/u/sreedhar$ ls -ld /var/cache/auks drwx------ 2 root root 71 Jan 21 10:01 /var/cache/auks root@slurmdev1:/u/sreedhar$ ls -l /var/cache/auks/* -rw------- 1 root root 13K Jan 19 11:10 /var/cache/auks/aukscc_16180 -rw------- 1 root root 12K Jan 21 10:01 /var/cache/auks/aukscc_564800185 -rw------- 1 root root 12K Jan 20 15:32 /var/cache/auks/aukscc_564800186 root@slurmdev1:/u/sreedhar$ srun /bin/hostname slurmdev1realma root@slurmdev1:/u/sreedhar$
sreedhar@slurmdev1:~$ srun klist Auks API request failed : krb5 cred : unable to read credential cache Ticket cache: FILE:/tmp/krb5cc_564800185_DMViMeYf6S Default principal: sreedhar@realma
Valid starting Expires Service principal 01/20/2016 17:40:11 01/25/2016 17:40:08 krbtgt/REALMA@REALMA renew until 01/27/2016 17:40:08 01/21/2016 11:09:55 01/25/2016 17:40:08 host/slurmdev1realma@REALMA renew until 01/27/2016 17:40:08 sreedhar@slurmdev1:~$
— Reply to this email directly or view it on GitHub https://github.com/hautreux/auks/issues/8.
sreedharmanchu
Hi,
I am trying to make slurm work with auks. Right now I am testing it on 3 CentOS 7.1 VMs. I am using first one as a mgmt node that has all 3 auks components (auksd, aukspriv and auksdrenewer). All the 3 boxes are compute and login nodes as well.
When as a regular user, when I run srun /bin/hostname, it says it is unable to read credential cache. Right now, as shown below, permissions on /var/cache/auks are just 700. I even changed it to 755 and still error is same. I'm thinking, some other user, (is it user slurm?) is trying to read these files and rightly permission is denied. I think I'm missing something simple here. Can you take a look? I really appreciate any help.
It does print the hostname. But I am not sure whether I'm supposed to see this error. I followed your howto article and created configuration. Right now, I am not entirely sure whether my auks.acl is correct either.
It also complained "unable to parse configuration file" and I had to create a symlink to /etc/auks/auks.conf in /usr/local/etc. I saw another issue and it was stated that this issue was fixed in the latest commit. Yesterday I downloaded the zip file and I made rpms out of it.
I do have the latest version of slurm. root@slurmdev1:/u/sreedhar$ srun -V slurm 15.08.6
My configuration looks like this: ( I replaced real names)
root@slurmdev1:/u/sreedhar$ rpm -qa | grep auks auks-devel-0.4.4-1.el7.centos.x86_64 auks-slurm-0.4.4-1.el7.centos.x86_64 auks-0.4.4-1.el7.centos.x86_64
root@slurmdev1:/u/sreedhar$ cat /etc/auks/auks.conf
------------------------------------------------------------------------------
auks client and server configuration file
------------------------------------------------------------------------------
-
Common client/server elements
-
common {
Primary daemon configuration
PrimaryHost = "slurmdev1" ;
PrimaryAddress = "" ;
PrimaryPort = 12345 ; PrimaryPrincipal = "host/slurmdev1.realm.a@REALM.A" ;
Secondary daemon configuration
SecondaryHost = "auks2" ;
SecondaryAddress = "" ;
SecondaryPort = "12345" ;
SecondaryPrincipal = "host/auks2.myrealm.org@MYREALM.ORG" ;
Enable/Disable NAT traversal support (yes/no)
this value must be the same on every nodes
NAT = no ;
max connection retries number
Retries = 3 ;
connection timeout
Timeout = 10 ;
delay in seconds between retries
Delay = 3 ;
}
-
API only elements
-
api {
log file and level
LogFile = /tmp/auksapi.log ; LogLevel = 3 ;
optional debug file and level
DebugFile = /tmp/auksapi.log ; DebugLevel = 3 ;
}
-
Auks daemon only elements
-
auksd {
Primary daemon configuration
PrimaryKeytab = "/etc/krb5.keytab" ;
Secondary daemon configuration
SecondaryKeytab = "/etc/krb5.keytab" ;
log file and level
LogFile = "/var/log/auksd.log" ; LogLevel = "2" ;
optional debug file and level
DebugFile = "/var/log/auksd.log" ; DebugLevel = "0" ;
directory in which daemons store the creds
CacheDir = "/var/cache/auks" ;
ACL file for cred repo access authorization rules
ACLFile = "/etc/auks/auks.acl" ;
default size of incoming requests queue
it grows up dynamically
QueueSize = 500 ;
default repository size (number fo creds)
it grows up dynamicaly
RepoSize = 1000 ;
number of workers for incoming request processing
Workers = 1000 ;
delay in seconds between 2 repository clean stages
CleanDelay = 300 ;
use kerberos replay cache system (slow down)
ReplayCache = no ;
}
-
Auksd renewer only elements
-
renewer {
log file and level
LogFile = "/var/log/auksdrenewer.log" ; LogLevel = "1" ;
optional debug file and level
DebugFile = "/var/log/auksdrenewer.log" ; DebugLevel = "0" ;
delay between two renew loops
Delay = "60" ;
Min Lifetime for credentials to be renewed
This value is also used as the grace trigger to renew creds
MinLifeTime = "600" ;
}
root@slurmdev1:/u/sreedhar$ cat /etc/auks/auks.acl
-------------------------------------------------------------------------------
rule { principal = ^host/slurmdev[1-3].realm.a@REALM.A$ ; host = * ; role = admin ; }
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
rule { principal = ^[[:alnum:]]@REALM.A$ ; host = \ ; role = user ; }
-------------------------------------------------------------------------------
root@caslurmdev1:/u/sreedhar$ cat /etc/slurm/plugstack.conf include /etc/slurm/plugstack.conf.d/*.conf root@caslurmdev1:/u/sreedhar$ cat /etc/slurm/plugstack.conf.d/auks.conf optional /usr/lib64/slurm/auks.so default=enabled spankstackcred=yes minimum_uid=1024
root@caslurmdev1:/u/sreedhar$ auks -p Auks API request succeed root@caslurmdev1:/u/sreedhar$ exit exit
sreedhar@slurmdev1:~$ auks -p Auks API init failed : unable to parse configuration file sreedhar@slurmdev1:~$ auks -vvv -p Thu Jan 21 11:26:22 2016 [INFO2] [euid=564800185,pid=53870] auks_engine: unable to parse configuration file /usr/local/etc/auks.conf : No such file or directory Auks API init failed : unable to parse configuration file
sreedhar@slurmdev1:~$ sudo bash root@slurmdev1:/u/sreedhar$ ln -s /etc/auks/auks.conf /usr/local/etc/auks.conf root@slurmdev1:/u/sreedhar$ exit exit
sreedhar@slurmdev1:~$ auks -p Auks API request succeed
sreedhar@slurmdev1:~$ srun /bin/hostname Auks API request failed : krb5 cred : unable to read credential cache slurmdev1.realm.a
sreedhar@slurmdev1:~$ sudo bash root@slurmdev1:/u/sreedhar$ ls -ld /var/cache/auks drwx------ 2 root root 71 Jan 21 10:01 /var/cache/auks root@slurmdev1:/u/sreedhar$ ls -l /var/cache/auks/* -rw------- 1 root root 1.3K Jan 19 11:10 /var/cache/auks/aukscc_16180 -rw------- 1 root root 1.2K Jan 21 10:01 /var/cache/auks/aukscc_564800185 -rw------- 1 root root 1.2K Jan 20 15:32 /var/cache/auks/aukscc_564800186 root@slurmdev1:/u/sreedhar$ srun /bin/hostname slurmdev1.realm.a root@slurmdev1:/u/sreedhar$
sreedhar@slurmdev1:~$ srun klist Auks API request failed : krb5 cred : unable to read credential cache Ticket cache: FILE:/tmp/krb5cc_564800185_DMViMeYf6S Default principal: sreedhar@realm.a
Valid starting Expires Service principal 01/20/2016 17:40:11 01/25/2016 17:40:08 krbtgt/REALM.A@REALM.A renew until 01/27/2016 17:40:08 01/21/2016 11:09:55 01/25/2016 17:40:08 host/slurmdev1.realm.a@REALM.A renew until 01/27/2016 17:40:08 sreedhar@slurmdev1:~$