Configuring a PAM file

About this task

When USE_PAM_CREDS is set to y or limits in the lsb.queues or lsb.applications file, LSF can apply PAM limits to an application when its job is dispatched to a Linux host using PAM LSF. The LSF job does not run within the PAM session. For these parameter settings, LSF assumes that the Linux PAM service "lsf" is created.

When USE_PAM_CREDS is set to session in the lsb.queues or lsb.applications file, LSF opens a PAM session for the user and executes a RES process into that session. The RES process executes the job task, then LSF disowns the process. This means that other LSF integrations are automatically handled in the PAM session. For this parameter setting, LSF assumes that the Linux PAM service "lsf-<clustername>" is created.

You can also specify limits and sessions together (USE_PAM_CREDS=limits session). For this parameter setting, LSF assumes that the Linux PAM services "lsf" and "lsf-<clustername>" are created.

If LSF limits are more restrictive than PAM limits, LSF limits are used, otherwise PAM limits are used. PAM limits are system resource limits defined in the limits.conf file.

The job sbatchd daemon checks the lsf service, and the job or task RES daemon checks the lsf-<clustername> service. The job will fail if the execution host does not have PAM configured.

Procedure

  1. Create a PAM configuration file on each execution host you want.

    /etc/pam.d/lsf

  2. In the first two lines, specify the authentication and authorization you need to successfully run PAM limits. For example:

    auth required pam_localuser.so

    account required pam_unix.so

  3. Specify any resource limits. For example:

    session required pam_limits.so

Results

For more information about configuring a PAM file, check Linux documentation.