[slurm-users] pam_slurm_adopt with pbis-open pam modules

[Prentice Bisbal]

On 2/22/19 12:54 AM, Chris Samuel wrote:
> On Thursday, 21 February 2019 8:20:36 AM PST נדב טולדו wrote:
>
>> Yeah I have, before i installed pbis and introduce lsass.so the slurm module
>> worked well Is there anyway to debug?
>>
>> I am seeing in syslog that the slurm module is adopting into the job context
>> but then i am getting out of context somehow and have access to all
>> resources.
> Yes, check the documentation and review your PAM configuration.  As I
> mentioned it sounds like you've got things in the wrong order there.
>
> https://slurm.schedmd.com/pam_slurm_adopt.html#PAM_CONFIG
>
I second this. PAM is extremely sensitive to the module order by design.

Also, to debug, most PAM modules have a debug option you can use to 
enable the logging of debug messages. If you check the man pages for any 
pam modules, you'll see the debug options. For pam_slurm_adopt, see 
https://slurm.schedmd.com/pam_slurm_adopt.html. It looks like you can 
set a log_level setting:

> *log_level*
>     See SlurmdDebug
>     <https://slurm.schedmd.com/slurm.conf.html#OPT_SlurmdDebug> in
>     slurm.conf for available options. The default log_level is *info*. 
>

So to set the debugging level for pam_slurm_adopt, all the way up, you'd 
do something like this in your PAM file:

account sufficient pam_slurm_adopt.so debug=debug5

If you can't tell what's going on just from that, I would see how to 
enable debugging for all the PAM modules in the rest of the stack, to 
get a better picture of what's going on throughout the whole 
authentication process. When your done, don't forget to turn off logging 
so you don't fill your log files with unnecessary noise.


--

Prentice



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.schedmd.com/pipermail/slurm-users/attachments/20190222/87be24df/attachment.html>