View source for Admin Guide SSH to Compute Nodes

Admin Guide SSH to Compute Nodes / ← SSH to Compute Nodes (Admin Guide)

You do not have permission to edit this page, for the following reason:

---

You can view and copy the source of this page.

[[Category:HPC-Admin|SSH to Compute Nodes]]<nowiki /> [[Category:HPC.NRW-Best-Practices|SSH to Compute Nodes]]<nowiki /> [[Category:ssh]]<nowiki /> {{DISPLAYTITLE:SSH to Compute Nodes (Admin Guide)}}<nowiki /> = User Access on Compute Nodes = Compute nodes and are somewhat fragile if the user has full access on them. Consider the case that a user has unlimited access to a compute node via ssh. At the same time a workload manager, such as slurm, is running on the cluster. If the user starts a job directly on the nodes via command line, slurm will not know that the job is running hence the ressource will still be marked as idle. Another user who wants to start a job via slurm might now get the same ressources which puts the node in a undefined state. To avoid this kind of behaviour some methods have been collected on the ap3 mailing List. === slurm === The user has login access via ssh to a login node from which jobs can be started using sbatch or srun etc. From here the slurm module '''pam_slurm_adopt''' is used. The modules purpose is to prevent the user from sshing onto any (non-login) nodes as long as the ressources are not owned. Owning the ressources requires either to have a running job or job allocation. This or a similar system is used in Paderborn and Aachen. Bielefeld plans to do it in the near future. === HTCondor === The user has login access via LDAP/Kerberos (using sssd) onto a Desktop Computer. In order to obtain ressources a job has to be started using the HTCondor system. Jobs are implemented with a NAT-Gateway solution for which a tunneled ssh-connection is established (out-of-the-box functionality using the HTCondor <code>CCB</code> service). The authentication for this also applies Kerberos. Furthermore, this solution allows X-Forwarding locked into a container. If combined with <code>SINGULARITY_JOB = true</code>, this will containerize all jobs and interactive jobs and allows users to connect to a running job’s container via SSH. This uses off-the-shelf functionality of HTCondor. An integration with slurm is not yet feasible due to the containerization. This system is used in Bonn (BAF2). == Resources == * [https://slurm.schedmd.com/pam_slurm_adopt.html pam_slurm_adopt] * [https://agenda.hep.wisc.edu/event/1440/session/3/contribution/6 Example setup with HTCondor]

Return to SSH to Compute Nodes (Admin Guide).