[torqueusers] pbs_iff cannot authenticate user

[Philipp Cain]

Garrick Staples wrote:

> On Tue, Oct 25, 2005 at 01:44:00PM +0200, Philipp Cain alleged:
>  
>
>> Hello,
>>
>> while adding a HP-UX node to a working Torque/Maui-Linux environment 
>> I ran into the following problem:
>> On the HP node qstat,qmgr,pbsnodes etc. is working only sporadically. 
>> Usually the commands results in the error message (with PBSDEBUG=yes)
>>   
>>
>>> qstat
>>>     
>>
>> pbs_iff:  MSG=cannot authenticate user
>> ALERT:  cannot read pipe, rc=0, errno=0 (Error 0)
>> ERROR:  cannot authenticate connection, errno=0 (Error 0)
>> No Permission.
>> qstat: cannot connect to server warp31.physik.tu-chemnitz.de 
>> (errno=15007)
>>   
>
>
> Does it work as root?  Is pbs_iff setuid root?

No, and setuid root is already set
-rwsr-xr-x   1 root       sys          61440 Oct 24 15:51 /usr/sbin/pbs_iff

> Can you run pbs_iff in test mode?   It should go something like this:
>   $ pbs_iff -t warp31.physik.tu-chemnitz.de 15001
>   $ echo $?
>   0

I get exactly the same output. No error code. So pbs_iff seems to work 
properly !?

>> At the same time the server log says:
>> 10/24/2005 17:28:12;0100;PBS_Server;Req;;Type AuthenticateUser 
>> request received from cain at nischel1.physik.tu-chemnitz.de, sock=12
>> 10/24/2005 17:28:12;0080;PBS_Server;Req;req_reject;Reject reply 
>> code=15019( MSG=cannot authenticate user), aux=0, 
>> type=AuthenticateUser, from cain at nischel1.physik.tu-chemnitz.de
>>
>> Nevertheless I can send jobs to the HP node when submitting from a 
>> Linux PBS client or from the PBS Server.
>>   
>
>
> That's good.  MOM<->Server connections don't require a AuthenticateUser
> req first, so we know the problem isn't very deep.

Hope you are right :)

>> First I thought of a timeout problem. So I increased  tcp_timeout, 
>> which didn't change anything.
>>
>> Here is the server setup:
>>      acl_host_enable = True
>>      acl_hosts = *.physik.tu-chemnitz.de
>>   
>
>
> Can the server get proper DNS forward and reverse resolution of
> nischel1?

Works fine.

> If the pbs_iff stuff above is all true, does acl_host_enable=F allow the
> client to connect?

Setting "acl_host_enable = False" doesn't help. I checked that I can 
connect from machines outside of *.physik.tu-chemnitz.de with "qstat 
@warp31.physik.tu-chemnitz.de" . For nischel1 I still get the 
authentication error.


Philipp.