search

perfsonar / pscheduler

The perfSONAR Scheduler
Apache License 2.0
53 stars 32 forks source link

U22: pscheduler pause needs pscheduler user #1431

Open laeti-tia opened 1 month ago

laeti-tia commented 1 month ago

When running pscheduler pause on an U22 machine, I get an authorisation error:

# pscheduler pause
Unable to connect to the database: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: FATAL:  Peer authentication failed for user "pscheduler"

Running it as pscheduler is fine:

# sudo -u pscheduler pscheduler pause
Pausing indefinitely.
# sudo -u pscheduler pscheduler resume

This is probably coming from a change we did on 5.0.x to change a security setup.

mfeit-internet2 commented 1 month ago

The client authentication file (/etc/postgresql/14/main/pg_hba.conf) is missing the lines required to allow authentication by anyone with the DSN.

This is how it's done in the RPM; this should work fine almost verbatim (change %{name} to pscheduler-server) on Debuntu:

https://github.com/perfsonar/pscheduler/blob/184c5749d7b0c32dd4d0faef78f2a8f2392e626b/pscheduler-server/pscheduler-server/unibuild-packaging/rpm/pscheduler-server.spec#L396

I'll leave fixing this to you since you're our resident Debian maven.

laeti-tia commented 3 weeks ago

I thought it was a new issue, but apparently on 4.4.6 it behaves the same for U18. At this stage I'd suggest we just adapt the documentation at https://docs.perfsonar.net/pscheduler_server_running.html#pausing-and-resuming to say that for RPM based distros it should be run with sudo and with Deb based ones it should be sudo -u pscheduler

mfeit-internet2 commented 3 weeks ago

I'm going to leave this open as a bug for 5.1.1. I doubt this feature gets used much, but it should work.