pam_oar_adopt(8)

📦
version 2.6.1 · 3 versions
, in debian trixie, ubuntu questing

💖 pam_oar_adopt(8) — the OAR commands era 💖

okay bestie, sit down, grab a boba 🧋, because we're talking about pam_oar_adopt — it's a <rainbow>pam_exec</rainbow> script from the OAR commands fam, and its whole job is managing ssh connections to OAR nodes. lowkey iconic. no cap. 🫶

✨ NAME ✨

pam_oar_adopt — OAR's <cyan>pam_exec</cyan> script that manages ssh connections to OAR nodes 💅

🌸 SYNOPSIS 🌸

pam_oar_adopt -a for PAM account

pam_oar_adopt -s for PAM session

like, that's it. two modes. <hotpink>-a</hotpink> for the PAM account era, <hotpink>-s</hotpink> for the PAM session era. pick your fighter. 🎀

🦋 DESCRIPTION 🦋

so this script? it's part of the OAR resources and jobs manager software. it's not out here doing its own thing, it's on the team. 💜

PAM can be configured to let users <cyan>ssh</cyan> — and we mean basic ssh, not via <cyan>oarsh</cyan> — onto OAR nodes, and then it takes the processes that get created and plops them right into the job's cgroup. 🪄 it will also prevent any ssh connection to nodes that aren't properly reserved. gatekeeping, but make it infrastructure.

this whole situation uses the <hotpink>pam_exec</hotpink> module together with the <hotpink>pam_oar_adopt</hotpink> script, plus the <hotpink>pam_env</hotpink> module. a little trio. a little squad. 🫶

once it's enabled, here's the vibe: if a user has reserved a node and then connects to it using ssh, PAM will find out the job's cgroup and place the ssh remote process in it. yes ma'am, correct cgroup, first try. ✨ it will also load the job's environment variables. so the environment? immaculate. 💅

now the part where the connection just fails 😭 — if a user tries to ssh to a node that is:

  • not reserved, or
  • not reserved in full (like, all compute resources of the node must be reserved — no crumbs left over), or
  • reserved multiple times (e.g. 2 different jobs reserving each a subset of the node's compute resources, or using the <purple>timesharing</purple> job type)

…then bestie, the connection will fail. it's giving "you shall not pass". 💀

please note that while using ssh is very convenient, <cyan>oarsh</cyan> provides extra features to connect to jobs. so like, ssh is the easy route, but oarsh is the main character. 👑

🎀 CONFIGURATION 🎀

to enable this feature, one must configure <pink>pam_oar_adopt</pink> in PAM and activate it in its configuration file (/etc/oar/pam_oar_adopt.conf). both. not one. both. 🙈

🌈 PAM CONFIGURATION

make sure the ssh service — and we mean the one on port 22, not OAR's dedicated ssh service on port 6667 — enables PAM. /etc/ssh/sshd_config must contain:

UsePAM yes

periodt. 💅

follows an example of configuration of PAM with <pink>pam_oar_adopt</pink> on Debian-like systems:

  • /etc/pam.d/common-account — the following can be set as the first PAM directive in common-account:
account required      pam_exec.so quiet stdout /usr/sbin/pam_oar_adopt -a
  • /etc/pam.d/common-session and /etc/pam.d/common-session-noninteractive — the following can be set as the last PAM directives in common-session and common-session-noninteractive:
session required   pam_exec.so quiet stdout /usr/sbin/pam_oar_adopt -s
session optional   pam_env.so readenv=1 envfile=/var/lib/oar/pam.env

on Debian-like systems, one can also use the <cyan>pam-auth-update</cyan> command to configure PAM and, by default, this PAM profile is installed with the <purple>oar-node</purple> package. convenient? yes. slay? also yes. ✨

💜 PAM_OAR_ADOPT CONFIGURATION 💜

the /etc/oar/pam_oar_adopt.conf file contains the following configuration options:

  • MODE — whether pam_oar_adopt is enabled or not. possible values are:
    • enforced: pam_oar_adopt is enabled and will prevent any ssh connection to nodes that are not properly reserved.
    • disabled: pam_oar_adopt is disabled.

by default, pam_oar_adopt is disabled. 😴

[DEPRECATED] for compatibility reasons, if the /etc/oar/pam_oar_adopt_enabled file exists, regardless of /etc/oar/pam_oar_adopt.conf, then pam_oar_adopt is enabled. so yeah, that file overrides everything. deprecated but still out here acting up. 🙈
  • WARN — in disabled mode, pam_oar_adopt will warn users about what would have been done if it was enabled. possible values are:
    • yes: warn users (default).
    • no: do not warn users about pam_oar_adopt doing nothing.
  • USER_UID_MIN — in enforced mode, pam_oar_adopt will ignore (not prevent) ssh connections from users with a UID lower than USER_UID_MIN. this is useful to allow system users to connect to nodes without being part of a job. the default value is 1000.

🔥 NOTES 🔥

it is a good practice to prevent users to connect to OAR nodes outside of jobs (except system users: at least root and the oar user). like, boundaries, bestie. 🫶

configuring pam_oar_adopt does it, but it can also be enforced using <cyan>pam_access</cyan> or the AllowedUsers directive in /etc/ssh/sshd_config. multiple ways to secure the vibes. 💅

conversely — flip it — in an installation where either of OAR's <purple>deploy</purple> or <purple>cosystem</purple> job types is used, which requires the oar-node package to also be installed on the deploy or cosystem frontend, it is usually normal to let any user ssh to that frontend regardless of jobs. so like, everyone's welcome there. 🎉 as a result on such a frontend, pam_oar_adopt should not be installed (on Debian-like systems, one may use pam-auth-update to deactivate the oar-node PAM profile). don't install it there, fr fr. 🚫

👑 SEE ALSO 👑

go read the whole friend group, they're all linked. iykyk. 🌈

💖 COPYRIGHTS 💖

Copyright 2003-2025 Laboratoire d'Informatique de Grenoble (http://www.liglab.fr). This software is licensed under the GNU General Public License Version 2 or above. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

okay so real talk: NO warranty — not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read it, internalize it, respect it. 💀

and that's the whole page, bestie! 🎀 this was pam_oar_adopt from OAR commands, dated 2025-03-24. now go configure your PAM and be the main character of your cluster. mwah. 💅✨🦋

📦 where this page comes from