[slurm-users] pam_slurm_adopt

[Ratnasamy, Fritz via slurm-users]

Hi, 

 We have blocked ssh to nodes where users do not have a running job. However, when there is a running job, a user can ssh to that node and use more than the slurm resources allocated on that node. Am I missing something?
I usually request an interactive session of 2GB. I then open another terminal and ssh to the node where the interactive session runs. I allocated a 4GB R variable on the node where I just ssh but this does not error out. 
Additionally, if I end my interactive session, the ssh connection still lives which I believe should not happen. 
Best,

Fritz Ratnasamy
Data Scientist
Information Technology

[Christopher Samuel via slurm-users]

On 4/8/26 8:44 pm, Ratnasamy, Fritz via slurm-users wrote:

>  We have blocked ssh to nodes where users do not have a running job.
> However, when there is a running job, a user can ssh to that node and
> use more than the slurm resources allocated on that node. Am I missing
> something?

Are you using pam_slurm_adopt? Is your Slurm configured to use cgroups?

[...]

> Additionally, if I end my interactive session, the ssh connection still
> lives which I believe should not happen.

We don't see this problem with pam_slurm_adopt, the ssh session is
killed when the job ends.

All the best,
Chris
--
Chris Samuel : http://www.csamuel.org/ : Philadelphia, PA, USA

--
slurm-users mailing list -- slurm...@lists.schedmd.com
To unsubscribe send an email to slurm-us...@lists.schedmd.com

[Lambers, Martin via slurm-users]

Hi Fritz,

On 4/9/26 05:44, Ratnasamy, Fritz via slurm-users wrote:
>  We have blocked ssh to nodes where users do not have a running job.
> However, when there is a running job, a user can ssh to that node and
> use more than the slurm resources allocated on that node. Am I missing
> something?

Did you disable pam_systemd in your PAM configuration? It is
incompatible with pam_slurm_adopt.

Best,
Martin
--
Dr. habil. Martin Lambers
Forschung und Wissenschaftliche Informationsversorgung
IT.SERVICES
Ruhr-Universität Bochum | 44780 Bochum | Germany
https://www.it-services.rub.de/

[Ole Holm Nielsen via slurm-users]

Hi Fritz,

This Wiki page gives a discussion of how to configure pam_slurm_adopt
correctly:
https://wiki.fysik.dtu.dk/Niflheim_system/Slurm_configuration/#pam-module-restrictions

IHTH,
Ole

On 4/9/26 05:44, Ratnasamy, Fritz via slurm-users wrote:

> Hi,
>
>  We have blocked ssh to nodes where users do not have a running job.
> However, when there is a running job, a user can ssh to that node and use
> more than the slurm resources allocated on that node. Am I missing something?
> I usually request an interactive session of 2GB. I then open another
> terminal and ssh to the node where the interactive session runs. I
> allocated a 4GB R variable on the node where I just ssh but this does not
> error out.
> Additionally, if I end my interactive session, the ssh connection still
> lives which I believe should not happen.

--
Ole Holm Nielsen
PhD, Senior HPC Officer
Department of Physics, Technical University of Denmark

[Keith Lyle Ballou via slurm-users]

To add on to this, the way we handle "disabled pam_systemd in your PAM configuration" on our cluster is to disable/mask the systemd-logind service on the compute nodes. Not sure if there's a more elegant way to handle that.

Keith

[Feng Zhang via slurm-users]

Also check this on how to compile and install pam_slurm_adopt.

https://github.com/prod-feng/compile-and-setup-pam_slurm_adopt.so-module

Stop pam_systemd is also important(or stop system-login) in pam model files on the compute nodes:

###### -session     optional      pam_systemd.so

Best,

Feng

[Brian Andrus via slurm-users]

You are getting some good insights here. To add to them, there is a VERY good chance that your pam.d setup needs tweaked. If a user authenticates by something else before pam_slurm_adopt, then that is the access they get, which means, no adoption into the job constraints.

Brian Andrus