You are getting some good insights here. To add to them, there is a VERY good chance that your pam.d setup needs tweaked. If a user authenticates by something else before pam_slurm_adopt, then that is the access they get, which means, no adoption into the job constraints.

Hi, 

 We have blocked ssh to nodes where users do not have a running job. However, when there is a running job, a user can ssh to that node and use more than the slurm resources allocated on that node. Am I missing something?
I usually request an interactive session of 2GB. I then open another terminal and ssh to the node where the interactive session runs. I allocated a 4GB R variable on the node where I just ssh but this does not error out. 
Additionally, if I end my interactive session, the ssh connection still lives which I believe should not happen. 
Best,

Fritz Ratnasamy
Data Scientist
Information Technology