[torqueusers] Remote submit hosts?

[Kjeldgaard Morten]

Is it possible to establish remote submit hosts in PBS/Torque, to
submit jobs via the PBS server?

We have a small CPU cluster, and job submission is carried out from a
single PBS server host on the external network. It works great, but
of course it requires that people log on to the PBS server host and
submit their jobs from there.

Now the question: is it possible to arrange for other computers/
workstations to submit jobs remotely, via the PBS server? In our
setup, people have their preferred workstations, and it would be
convienient if you could submit via a "qsub" command no matter which
machine you are logged on to in the network.

I have googled for answers to this question, and I have seen
indications that it may be possible, I have just not found any
specific instructions on how to set it up. I imagine perhaps that a
routing queue on the "submit hosts" is required. I still want the PBS
server to be the only machine that interacts with the nodes directly.


Cheers,
Morten

[Justin Bronder]

This is quite easy to achieve; we have a number of submission hosts
on side. The documentation you are looking for is located here:
http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts

-Justin.

Post by Kjeldgaard Morten
Is it possible to establish remote submit hosts in PBS/Torque, to
submit jobs via the PBS server?
We have a small CPU cluster, and job submission is carried out from a
single PBS server host on the external network. It works great, but
of course it requires that people log on to the PBS server host and
submit their jobs from there.
Now the question: is it possible to arrange for other computers/
workstations to submit jobs remotely, via the PBS server? In our
setup, people have their preferred workstations, and it would be
convienient if you could submit via a "qsub" command no matter which
machine you are logged on to in the network.
I have googled for answers to this question, and I have seen
indications that it may be possible, I have just not found any
specific instructions on how to set it up. I imagine perhaps that a
routing queue on the "submit hosts" is required. I still want the PBS
server to be the only machine that interacts with the nodes directly.
Cheers,
Morten
--
Morten Kjeldgaard, asc. professor, MSc, PhD
Department of Molecular Biology, Aarhus University
Gustav Wieds Vej 10 C, DK-8000 Aarhus C, Denmark.
Lab [phone] * Mobile [phone] * Fax [phone]
Home [phone] * http://www.bioxray.dk/~mok
_______________________________________________
torqueusers mailing list
http://www.supercluster.org/mailman/listinfo/torqueusers

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.supercluster.org/pipermail/torqueusers/attachments/20061211/66eb41d6/attachment.html

[Justin Bronder]

Post by Justin Bronder

Post by Justin Bronder
This is quite easy to achieve; we have a number of submission hosts

http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts
Have you got it to work *without* specifying the hostname in
/etc/hosts.equiv - and only use the submit_hosts parameter (as the
documentation above states should be possible)?

No, I haven't even tried. The r* utilities are either firewalled, turned
off,
not installed or most likely all of the above. Hence I went the hosts.equiv
route due only to the fact it was the first solution I read. I was not
aware
that there were problems with submit_hosts.

-Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.supercluster.org/pipermail/torqueusers/attachments/20061211/5c5b40ba/attachment-0001.html

[Morten Kjeldgaard]

Post by Justin Bronder
This is quite easy to achieve; we have a number of submission hosts
http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts

Great, thanks! The link explains how to set it up on the pbs server.

Post by Justin Bronder

qmgr -c 'set server submit_hosts = login1'

(... I assume "login1" is the name of a submit host, right?)

But don't I have to set up a dummy queue or something on the submit hosts?

Cheers,
Morten

[Justin Bronder]

Post by Justin Bronder

Post by Justin Bronder
This is quite easy to achieve; we have a number of submission hosts

http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts
Great, thanks! The link explains how to set it up on the pbs server.

Post by Justin Bronder

qmgr -c 'set server submit_hosts = login1'

(... I assume "login1" is the name of a submit host, right?)

Correct. Although, taking into account Eirik's earlier email, this may not
work. On site we
use hosts.equiv.

But don't I have to set up a dummy queue or something on the submit hosts?


No, provided you setup <pbs spool dir>/server_name to point to your server,
everything contact
that address for queue information.

-Justin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.supercluster.org/pipermail/torqueusers/attachments/20061212/47c09e50/attachment.html

[Åke Sandgren]

Post by Morten Kjeldgaard

Post by Justin Bronder
This is quite easy to achieve; we have a number of submission hosts
http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts

Great, thanks! The link explains how to set it up on the pbs server.

Post by Justin Bronder

qmgr -c 'set server submit_hosts = login1'

(... I assume "login1" is the name of a submit host, right?)
But don't I have to set up a dummy queue or something on the submit hosts?

No. The only thing the submit hosts need is access to the client tools
(qsub, qdel and a few more) and for ease of use a server_name file in
the torque spool area with the right contents.

[Eirik Thorsnes]

Post by Justin Bronder
This is quite easy to achieve; we have a number of submission hosts
http://www.clusterresources.com/wiki/doku.php?id=torque:1.3_advanced_configuration#hosts

Have you got it to work *without* specifying the hostname in
/etc/hosts.equiv - and only use the submit_hosts parameter (as the
documentation above states should be possible)?

[Kjeldgaard Morten]

Thanks to Justin and Erik for your answers to my questions! I've now
got remote submission working!

Have you got it to work *without* specifying the hostname in /etc/
hosts.equiv - and only use the submit_hosts parameter (as the
documentation above states should be possible)?

I think the general consensus is that the rsh utilities and /etc/
hosts.equiv are security holes that should be avoided at all cost.

We use passwordless login with ssh, it works perfectly, and is not a
security risk, because it is based on public key encryption.

Cheers,
Morten

[Bas van der Vlies]

Thanks to Justin and Erik for your answers to my questions! I've now got
remote submission working!

Post by Justin Bronder
Have you got it to work *without* specifying the hostname in
/etc/hosts.equiv - and only use the submit_hosts parameter (as the
documentation above states should be possible)?

My submit hosts are also nodes for torque, but they do not run pbs_mon
and i allow compute nodes to submit jobs, no need for /etc/hosts.equiv
with this setup.

nodes:
login_ng1
login_ng2

pbs_server:
set server submit_hosts = login-ng1
set server submit_hosts += login-ng2
set server allow_node_submit = True


Regards

Cheers,
Morten
_______________________________________________
torqueusers mailing list
http://www.supercluster.org/mailman/listinfo/torqueusers

[Chris Samuel]

Post by Kjeldgaard Morten
I think the general consensus is that the rsh utilities and /etc/
hosts.equiv are security holes that should be avoided at all cost.

Torque doesn't actually use the r* applications themselves, what happens is
that there is an example authentication function defined in the file:

src/lib/Libsite/site_check_u.c

which has a comment that says:

/*
* site_check_u - site_check_user_map()
*
* This routine determines if a user is privileged to execute a job
* on this host under the login name specified (in user-list attribute)
*
* As provided, this routine uses ruserok(3N). If this is a problem,
* It's replacement is "left as an exercise for the reader."
*
* Return -1 for access denied, otherwise 0 for ok.
*/

It actually looks like it does some extra checks now, with comments like:

/* submitting from server host, access allowed */
/* job submitted from compute host, access allowed */
/* job submitted from host found in trusted submit host list, access allowed
*/

So if you want to add/debug things then this looks like the place to do it!

cheers,
Chris
--
Christopher Samuel - [phone] - VPAC Deputy Systems Manager
Victorian Partnership for Advanced Computing http://www.vpac.org/
Bldg 91, 110 Victoria Street, Carlton South, VIC 3053, Australia

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.supercluster.org/pipermail/torqueusers/attachments/20061222/2d7e8c05/attachment.bin

[Chris Samuel]

Post by Kjeldgaard Morten
Now the question: is it possible to arrange for other computers/
workstations to submit jobs remotely, via the PBS server? In our ?
setup, people have their preferred workstations, and it would be ?
convienient if you could submit via a "qsub" command no matter which ?
machine you are logged on to in the network.

Unless you've modified the source the pbs_server calls ruserok(3) (as used by
rlogin, rsh) to confirm a user is authorised to use the server.

So this gives you the option of doing things like configuring /etc/hosts.equiv
or users .rhosts file.

However, PBS can often rely on rcp/scp to stage output and error files back to
the node that submitted the job from the mother superior compute node, so you
would have to have the cluster configured so that (a) the nodes can route
back to the submit node and (b) the necessary config is done on the submit
node to allow that to happen automatically. Alternatively, if you have the
same shared filesystem for home directories on the cluster and the submit
node then you could just set the $usecp directive in the pbs_mom config file
for the filesystems that are shared.

How does that sound ?

Chris
--
Christopher Samuel - [phone] - VPAC Deputy Systems Manager
Victorian Partnership for Advanced Computing http://www.vpac.org/
Bldg 91, 110 Victoria Street, Carlton South, VIC 3053, Australia

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.supercluster.org/pipermail/torqueusers/attachments/20061222/4704eb17/attachment.bin