<div dir="ltr">From our /etc/pam.d/sshd on our compute nodes<div><br></div><div><br>account required pam_nologin.so<br>account sufficient pam_access.so<br>account include password-auth<br>-account required pam_slurm_adopt.so<br></div><div><br></div><div><br></div><div>....and /pam.d/password-auth: </div><div><br></div><div>#-session optional pam_systemd.so<br></div><div><br></div><div>Note that disabling pam_systemd is necessary to have the ssh login properly fenced by cgroups.<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 27, 2022 at 1:35 PM byron <<a href="mailto:lbgpublic@gmail.com">lbgpublic@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>This happens on all our compute nodes.</div><div><br></div><div>I can't find any mention of slurm_pam_adopt in /etc/pamd.d. All I have is in sshd, account required pam_slurm.so.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 27, 2022 at 5:52 PM Brian Andrus <<a href="mailto:toomuchit@gmail.com" target="_blank">toomuchit@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Lloyd,</p>
<p>You could check out the order of entries in your pam.d/ssh (and
related/included) files</p>
<p>See where the slurm_pam_adopt is, how it is being called and if
there are settings that are interferring.</p>
<p>Does this occur only on a single node, or all of them?</p>
<p>Brian Andrus<br>
</p>
<div>On 7/27/2022 9:29 AM, Lloyd Goodman
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">I don't think that's the source of the problem.
All our user accounts are centrally managed using sssd.
<div><br>
</div>
<div>And just to be sure I run "getent passwd <username>"
on the management, head and compute nodes and they all
returned the same values</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, 27 Jul 2022 at 17:22,
Brian Andrus <<a href="mailto:toomuchit@gmail.com" target="_blank">toomuchit@gmail.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Verify
that their uid on the node is the same as the uid your master
sees<br>
<br>
Brian Andrus<br>
<br>
<br>
On 7/27/2022 8:53 AM, byron wrote:<br>
> Hi<br>
><br>
> When a user tries to login into a compute node on which
they have a <br>
> running job they get the error<br>
><br>
> Access denied: user blahblah (uid=3333) has no active
jobs on this node.<br>
> Authentication failed.<br>
><br>
> I recently upgraded slurm to 20.11.9 and was under the
impression that <br>
> prior to the upgrade they were able to ssh into nodes
where they had <br>
> running jobs, but its entirely possible that I'm
mistaken.<br>
><br>
> Either way, can some explain how to enable that behaviour
please.<br>
><br>
> Thanks<br>
><br>
><br>
><br>
><br>
<br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div style="color:rgb(34,34,34);background-color:rgb(255,255,255)"><b style="font-family:Arial;font-size:small">Lloyd<span style="color:rgb(81,80,88)"> </span>Goodman</b><span style="font-family:Arial;font-size:small;color:rgb(0,174,255)"> // </span><font style="font-family:Arial" size="2">HPC Systems Administrator</font></div>
<div style="color:rgb(34,34,34);background-color:rgb(255,255,255)"><br>
<font size="1" face="Arial"><strong><span style="color:rgb(0,174,255)">e: </span></strong><a href="mailto:lloyd.goodman@cfms.org.uk" style="color:rgb(81,80,88)" target="_blank">lloyd.goodman@cfms.org.uk</a> <span style="color:rgb(0,174,255)"> </span> <font color="#222222"> </font><span style="color:rgb(0,174,255)"> <strong>w: </strong></span><a href="http://www.cfms.org.uk/" rel="noreferrer" style="color:rgb(81,80,88)" target="_blank">www.cfms.org.uk</a> <span style="color:rgb(0,174,255)"> </span></font></div>
<div style="color:rgb(34,34,34);background-color:rgb(255,255,255)"><font size="1" face="Arial"><span style="color:rgb(81,80,88)">CFMS
Services Ltd</span><span style="color:rgb(0,174,255)"> // </span><span style="color:rgb(81,80,88)">Bristol & Bath Science
Park</span> <span style="color:rgb(0,174,255)">//</span> <span style="color:rgb(81,80,88)">Dirac Crescent</span> <span style="color:rgb(0,174,255)">//</span> <span style="color:rgb(81,80,88)">Emersons Green</span> <span style="color:rgb(0,174,255)">//</span> <span style="color:rgb(81,80,88)">Bristol</span> <span style="color:rgb(0,174,255)">//</span> <span style="color:rgb(81,80,88)">BS16 7FR</span> </font></div>
<div style="color:rgb(34,34,34);background-color:rgb(255,255,255)"><font style="font-size:small" face="Verdana"> </font><a href="https://cfms.org.uk/media/384108/email-footer-darren-swift.png?width=500&height=115&mode=crop" target="_blank"><img></a><a href="https://cfms.org.uk/media/384108/email-footer-darren-swift.png?width=500&height=115&mode=crop" target="_blank"><img></a></div>
</div>
</blockquote>
</div>
</blockquote></div>
</blockquote></div>