Follow these steps to configure authentication for PAM and default clients by using an
authentication plug-in.
Before you begin
- Stop the cluster:
# egoshutdown.sh
- On all management hosts, create a plug-in configuration file (pamauth.conf)
under the $EGO_CONFDIR directory. For an example of a
pamauth.conf file, refer to the following steps. If you have used the PAM
plug-in previously, this file might exist.
Note: If $EGO_CONFDIR is on a shared
directory, you need to perform this step only once.
- Optional: Complete one of the following steps:
- Ensure a PAM service file (the default PAM service is sshd) exists under the /etc/pam.d/ directory. As root, assign 644 permissions to the PAM service file.
- Configure the EGO plug-in to use another (existing) PAM policy file (for example,
sshd). The PAM configuration file controls the authentication policy and can be
modified by the system administrator.
Procedure
-
Edit the PAM configuration file ($EGO_CONFDIR/pamauth.conf) to set the
values of mandatory and optional parameters:
Table 1. PAM configuration parameters
Parameter |
Mandatory or optional |
Description |
PAM_SERVICE |
Mandatory |
Specifies the PAM policy file that is located under the
/etc/pam.d/ directory. |
KEYFILE |
Optional |
Specifies the path to the key file. You can also specify a custom key in
the key file, which is used to create credentials. Specify a value for the KEY
parameter within the KEYFILE parameter. Specify up to 64 ASCII alphanumeric
characters and special characters. For example, KEY="myKey12345@#$%^*ABC" .
|
PAM_CACHEEXPIRYTIME
|
Optional |
Specifies the interval at which the user cache is updated, enabling new users
and user groups to be imported from PAM and registered to the system. By default, the user cache is
updated every day. In environments where adding and removing users are frequent operations, set this
parameter at an interval that suits your requirements.
|
SEC_PAM_BYPASS |
Optional |
Specifies whether to bypass PAM authentication. If you enable this parameter,
all user authentication requests from PAM clients succeed. |
For example, the
pamauth.conf file can include the following parameters:
# Optional parameters
# PAM_CACHEEXPIRYTIME=<a-positive-integer-followed-by-d-or-D-or-h-or-H-or-m-or-M>
# The interval at which the user cache is updated.
PAM_CACHEEXPIRYTIME=2h
# KEYFILE=<keyfile-location>
# Absolute path to the location of the key file.
KEYFILE=/tmp/seckey.conf
# SEC_PAM_BYPASS=<y-or-n>
# Bypass PAM authentication: Y or N.
SEC_PAM_BYPASS=N
# Mandatory parameters
# PAM_SERVICE=<pam-service-name>
# PAM service file (at /etc/pam.d) which defines the
# PAM policy to be used for EGO.
# Default is "sshd"
PAM_SERVICE=sshd
- Optional:
If you configured the KEYFILE parameter in
pamauth.conf, configure a custom key by using the KEY
parameter within KEYFILE.
For example, the
pamauth.conf file contains the
KEYFILE
parameter set to a value of
/tmp/seckey.conf:
KEYFILE=/tmp/seckey.conf
For example, you can set the
KEY parameter with a value of
myKey12345@#$%^*ABC,
defined within the
KEYFILE value:
KEY="myKey12345@#$%^*ABC"
- On all management hosts, edit ego.conf to modify the value of the EGO_SEC_PLUGIN and EGO_SEC_CONF parameters as follows:
Table 2. Management host configuration parameters
Parameter |
Value |
Description |
EGO_SEC_PLUGIN |
sec_ego_pam_default |
Specifies PAM+default authentication on management hosts. |
EGO_SEC_CONF |
$EGO_CONFDIR,0,INFO,$EGO_TOP/kernel/log |
Specifies if log messages are required from the server-side plug-in. All
server-side messages are logged to ego_ext_plugin_server.log in the plug-in
log-directory. Use this format: <plugin-configurationdirectory, created-ttl,
plugin-log-level, pluginlog-directory>
|
-
On all compute hosts, edit
ego.conf to modify the value of the EGO_SEC_PLUGIN and
(optionally) the EGO_SEC_CONF parameter:
Table 3. Compute host configuration parameters
Parameter |
Value |
Description |
EGO_SEC_PLUGIN |
sec_ego_pam_default |
Specifies PAM+default authentication. |
EGO_SEC_CONF (optional) |
$EGO_TOP/kernel/conf,0,DEBUG,$EGO_TOP/kernel/log |
Specifies whether log messages are required from the client-side plug-in. All
client-side messages are logged to ego_ext_plugin_client.log in the plug-in
log-directory. Use this format: <plugin-configurationdirectory, created-ttl,
plugin-log-level, pluginlog-directory>
|
-
Start the IBM® Spectrum
Conductor
cluster:
-
Log on to the primary host as
the cluster administrator.
-
Run the following commands to start the cluster:
-
Complete this step only if the authentication server is required to authenticate a PAM
client by using the default authentication method or the PAM authentication method.
Log on to EGO as the cluster administrator called Admin
, then run the
egosh user add command to map the PAM user to the EGO account.
-
From the cluster management console, edit the Spark instance group configuration to enable the
Spark drivers and executors to run as the OS user.
-
From the cluster management console, click
.
- Select the Spark instance group to modify and click
Configure.
If the Spark instance group is
running workload, stop the Spark instance group and all associated
notebooks before you change its configuration.
-
In the Basic Settings tab, select Enable authentication and
authorization for the submission user.
-
Click Modify Instance Group.