diff --git a/schedmd/slurm/25.05/rockylinux9/Dockerfile b/schedmd/slurm/25.05/rockylinux9/Dockerfile index 0c07267..15a8aec 100644 --- a/schedmd/slurm/25.05/rockylinux9/Dockerfile +++ b/schedmd/slurm/25.05/rockylinux9/Dockerfile @@ -185,6 +185,7 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked </dev/null; then + # Insert after common-account include + sed -i '/^account[[:space:]]*include[[:space:]]*password-auth/a -account required pam_slurm_adopt.so action_no_jobs=deny action_unknown=newest action_adopt_failure=deny action_generic_failure=deny disable_x11=0' /etc/pam.d/sshd + fi +} + function main() { mkdir -p /run/slurm/ mkdir -p /var/spool/slurmd/ + mkdir -p /run/sshd/ + chmod 0755 /run/sshd/ + ssh-keygen -A + configure_pam local coreSpecCount=0 if ((POD_CPUS > 0)); then diff --git a/schedmd/slurm/25.05/ubuntu24.04/Dockerfile b/schedmd/slurm/25.05/ubuntu24.04/Dockerfile index a930f73..89b8781 100644 --- a/schedmd/slurm/25.05/ubuntu24.04/Dockerfile +++ b/schedmd/slurm/25.05/ubuntu24.04/Dockerfile @@ -182,6 +182,7 @@ set -xeuo pipefail apt-get -qq update apt-get -qq -y install --no-install-recommends --fix-broken \ gawk socat \ + openssh-server \ ./slurm-smd-client_[0-9]*.deb \ ./slurm-smd-client-dbgsym_[0-9]*.ddeb \ ./slurm-smd-dev_[0-9]*.deb \ @@ -200,17 +201,21 @@ mkdir -p /var/spool/slurmd/ cp -v /etc/nsswitch.conf{,.bak} sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf +# Configure SSH +rm -f /etc/ssh/ssh_host_* EOR COPY files/etc/supervisor/supervisord.conf /etc/supervisor/ COPY \ files/etc/supervisor/conf.d/slurmd.conf \ + files/etc/supervisor/conf.d/sshd.conf \ files/etc/supervisor/conf.d/fakesystemd.conf \ /etc/supervisor/conf.d/ COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/ COPY files/usr/local/bin/slurmd-entrypoint.sh /usr/local/bin/entrypoint.sh EXPOSE 6818/tcp +EXPOSE 22/tcp ENTRYPOINT ["entrypoint.sh"] ################################################################################ diff --git a/schedmd/slurm/25.05/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh b/schedmd/slurm/25.05/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh index 14d8cb8..ab8dd44 100755 --- a/schedmd/slurm/25.05/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh +++ b/schedmd/slurm/25.05/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh @@ -6,6 +6,7 @@ set -euo pipefail # Additional arguments to pass to slurmd. export SLURMD_OPTIONS="${SLURMD_OPTIONS:-} $*" +export SSHD_OPTIONS="${SSHD_OPTIONS:-""}" # The asserted CPU resource limit of the pod. export POD_CPUS="${POD_CPUS:-0}" @@ -94,9 +95,22 @@ function addConfItem() { export SLURMD_OPTIONS="${slurmdOptions[*]}" } +# Configure PAM for pam_slurm_adopt (following login's dynamic pattern) +function configure_pam() { + # Add pam_slurm_adopt to SSH PAM configuration if not already present + if ! grep -q "pam_slurm_adopt.so" /etc/pam.d/sshd 2>/dev/null; then + # Insert after common-account include + sed -i '/^@include common-account/a -account required pam_slurm_adopt.so action_no_jobs=deny action_unknown=newest action_adopt_failure=deny action_generic_failure=deny disable_x11=0' /etc/pam.d/sshd + fi +} + function main() { mkdir -p /run/slurm/ mkdir -p /var/spool/slurmd/ + mkdir -p /run/sshd/ + chmod 0755 /run/sshd/ + ssh-keygen -A + configure_pam local coreSpecCount=0 if ((POD_CPUS > 0)); then diff --git a/schedmd/slurm/master/rockylinux9/Dockerfile b/schedmd/slurm/master/rockylinux9/Dockerfile index e4c2095..7c4465a 100644 --- a/schedmd/slurm/master/rockylinux9/Dockerfile +++ b/schedmd/slurm/master/rockylinux9/Dockerfile @@ -182,6 +182,7 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked </dev/null; then + # Insert after common-account include + sed -i '/^account[[:space:]]*include[[:space:]]*password-auth/a -account required pam_slurm_adopt.so action_no_jobs=deny action_unknown=newest action_adopt_failure=deny action_generic_failure=deny disable_x11=0' /etc/pam.d/sshd + fi +} + function main() { mkdir -p /run/slurm/ mkdir -p /var/spool/slurmd/ + mkdir -p /run/sshd/ + chmod 0755 /run/sshd/ + ssh-keygen -A + configure_pam local coreSpecCount=0 if ((POD_CPUS > 0)); then diff --git a/schedmd/slurm/master/ubuntu24.04/Dockerfile b/schedmd/slurm/master/ubuntu24.04/Dockerfile index d166708..1ad77db 100644 --- a/schedmd/slurm/master/ubuntu24.04/Dockerfile +++ b/schedmd/slurm/master/ubuntu24.04/Dockerfile @@ -176,6 +176,7 @@ set -xeuo pipefail apt-get -qq update apt-get -qq -y install --no-install-recommends --fix-broken \ gawk socat \ + openssh-server \ ./slurm-smd-client_[0-9]*.deb \ ./slurm-smd-dev_[0-9]*.deb \ ./slurm-smd-doc_[0-9]*.deb \ @@ -190,17 +191,21 @@ mkdir -p /var/spool/slurmd/ cp -v /etc/nsswitch.conf{,.bak} sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf +# Configure SSH +rm -f /etc/ssh/ssh_host_* EOR COPY files/etc/supervisor/supervisord.conf /etc/supervisor/ COPY \ files/etc/supervisor/conf.d/slurmd.conf \ + files/etc/supervisor/conf.d/sshd.conf \ files/etc/supervisor/conf.d/fakesystemd.conf \ /etc/supervisor/conf.d/ COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/ COPY files/usr/local/bin/slurmd-entrypoint.sh /usr/local/bin/entrypoint.sh EXPOSE 6818/tcp +EXPOSE 22/tcp ENTRYPOINT ["entrypoint.sh"] ################################################################################ diff --git a/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh b/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh index 14d8cb8..ab8dd44 100755 --- a/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh +++ b/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmd-entrypoint.sh @@ -6,6 +6,7 @@ set -euo pipefail # Additional arguments to pass to slurmd. export SLURMD_OPTIONS="${SLURMD_OPTIONS:-} $*" +export SSHD_OPTIONS="${SSHD_OPTIONS:-""}" # The asserted CPU resource limit of the pod. export POD_CPUS="${POD_CPUS:-0}" @@ -94,9 +95,22 @@ function addConfItem() { export SLURMD_OPTIONS="${slurmdOptions[*]}" } +# Configure PAM for pam_slurm_adopt (following login's dynamic pattern) +function configure_pam() { + # Add pam_slurm_adopt to SSH PAM configuration if not already present + if ! grep -q "pam_slurm_adopt.so" /etc/pam.d/sshd 2>/dev/null; then + # Insert after common-account include + sed -i '/^@include common-account/a -account required pam_slurm_adopt.so action_no_jobs=deny action_unknown=newest action_adopt_failure=deny action_generic_failure=deny disable_x11=0' /etc/pam.d/sshd + fi +} + function main() { mkdir -p /run/slurm/ mkdir -p /var/spool/slurmd/ + mkdir -p /run/sshd/ + chmod 0755 /run/sshd/ + ssh-keygen -A + configure_pam local coreSpecCount=0 if ((POD_CPUS > 0)); then