pam_sge_authorize(8)

✨ pam_sge_authorize ✨

okay bestie, welcome to pam_sge_authorize — that's section 8 of the System Manager's Manual btw, so you know it's a sysadmin-flavoured situation 💅

🌸 NAME 🌸

pam_sge_authorize — a PAM module that controls access to SGE hosts 🫶

🦋 SYNOPSIS 🦋

pam_sge_authorize [options]

💖 DESCRIPTION 💖

So like. This PAM module limits access via ssh(1) etc. to Grid Engine hosts only to users who currently have a job running on that host. That's the whole vibe. The expectation is that this limits their impact on any other users of the host — i.e. nobody's random side quest is gonna tank your node. 🎀

👑 OPTIONS 👑

• execd_spool_dir=dir — tell the module where the spool directory lives, so it can find the active_jobs directory as dir/hostname/active_jobs. Default: /opt/sge/default/spool. 📂
• bypass_users=user_list — the module straight up ignores access by users whose unames are in the comma-separated user_list. Heads up: there is a limit of 30 users. And root is always allowed access, no questions, no notes, periodt. 👑
• max_sleep=max_sleep — a non-zero max_sleep allows desynchronization of accesses to the spool directory. The module sleeps for a random period t, where 0<=t<=max_sleep microseconds, before accessing the spool directory. Ngl, this probably isn't useful. Default: 0. 😴
• debug — send debugging information to syslog. 🔍

🌈 EXAMPLE 🌈

On a typical GNU/Linux system, add something like the following to /etc/pam.d/sshd, e.g. at the top. ✨

account required /opt/sge/lib/lx-amd64/pam_sge_authorize.so \
  bypass_users=foo,bar,baz,qux spool_dir=/opt/sge/execd_spool

On some systems it might be necessary to copy pam_sge_authorize.so into, say, /lib/security, and instead use it as

auth required pam_sge_authorize.so

🧚 SEE ALSO 🧚

ssh(1), pam(7), pam.conf(4). 💜

🍓 AUTHOR 🍓

TACC. Man page by Dave Love, based on material from Bill Barth, TACC. 🫶

bestie that's the whole page, no cap 🌈

this was the System Manager's Manual edition, dated 2010-11-25 — iconic, vintage, still slaying ✨💅