norment / tsd_issues

Repo to track issues with TSD as tickets
2 stars 0 forks source link

Setup robust kerberos authentication on rhel7 thinlink node #41

Closed ofrei closed 3 years ago

ofrei commented 4 years ago

In our preliminary testing we've noticed intermittent issues with /cluster access on p33-rhel7-login.tsd.usit.no machine (i.e. the thinlink login machine that most of p33 users use to access linux environment). In means that from time to time you may see an empty /cluster/projects/p33 folder and/or can't use "module" environment with software. TSD team is actively looking into this. If you experience such issues, the suggestion is to use p33-submit node, which is free of such issues. If you need to run software with graphical user interface, consider "ssh -X p33-submit" (a feature know as X11 forwarding). As a hint, to test if you can run graphical user interface in your remote SSH session, try to execute "xclock" command, which should start a lightweight app with graphical interface.

Here is further info on kerberos authentication on Colossus.

The mounts are now kerberized meaning you’ll need a valid ticket to be able to access them (/cluster/software and /cluster/projects/p33). You get a ticket when you login and provide your password. The ticket is valid for 10h. Please verify using:

$ klist

You can renew the ticket while its valid and up 7 days ("renew until” in the output above). Please verify using:

$ kinit -R $ kist

The “valid starting” should have changed, but not the “renew until”.

Check if the paths are correct, accessible and working as expected: $ cd /cluster/software $ module avail $ module load R $ R $ > q() $ cd /cluster/projects/p33

In some instances you may get a warning when you log in for the first time: “/cluster/software/lmod/lmod/init/profile: No such device”. Just logout and back in.

ofrei commented 3 years ago

I'm not sure if there is ongoing work to get rid of "kinit" ? Or is this by design?