Skip to content

Commit 023688a

Browse files
CinnamalsCinnamals
committed
Initial commit
0 parents  commit 023688a

15 files changed

Lines changed: 685 additions & 0 deletions

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*~
2+
**/*.o
3+
**/*.so

‎README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# ThinLinc for Open OnDemand (Beta Version)
2+
Welcome to the beta release of ThinLinc for Open OnDemand (OOD).
3+
4+
This repository contains everything you need to get started with using ThinLinc through Open OndDemand in a Slurm cluster. This repository is targeted at system administrators as it requires elevated privileges to install ThinLinc and the OOD ThinLinc application. If you are a user of an OOD system, please contact the administrator and ask for installation of this app.
5+
6+
## Requirements
7+
- Open OnDemand version 4.1
8+
- It is possible to run this application on earlier Open OnDemand versions, though it will require manual patching of the Open OnDemand `mod_ood_proxy` module. If this is preferred, see the [pre-4.1-ood](https://github.com/cendio/ood-thinlinc/tree/pre-4.1-ood) branch.
9+
- ThinLinc version 4.20
10+
- Slurm as the batch system
11+
- We have tested with Slurm version `22.05`, but it should work with older versions as well.
12+
- X86 compute nodes with Linux
13+
14+
## What is ThinLinc for Open OnDemand
15+
This beta version provides functionality that is similar to what the build-in "interactive desktop" function of OOD provides, but implemented using ThinLinc. ThinLinc is easier to install and configure than going through the OOD Interactive Desktop process. Using ThinLinc also enables connecting to the desktop from the ThinLinc native clients rather than just through the web browser.
16+
17+
In a future version, we plan to expand the functionality to also run ThinLinc on servers outside the batch system, to enable truly persistent desktops that users can log-in for days and weeks. This will make it possible to build an HPC Desktop through OOD.
18+
19+
## Why a beta release / What are we looking for
20+
The primary goal of publishing a beta version is to get feedback from the community. Please submit a feedback form if you have installed the beta version and let us know how it went. We are looking for feedback, even if everything went well and you didn't encounter any issues during setup or usage.
21+
22+
[Link to the feedback form](https://docs.google.com/forms/d/e/1FAIpQLSc29FNqfOW0E0d84nUfwJY_Qh0nWHOBSKOVxskCmp6Sa8Sg1w/viewform?usp=header)
23+
24+
## Getting Started
25+
Please read the [Installation guide](installation.md).
26+
27+
## Note on the ThinLinc End User License Agreement
28+
The ThinLinc End User License Agreement restricts ThinLinc the free usage of ThinLinc to 10 concurrent users. If your organization doesn't already have a ThinLinc license and you expect more than 10 users, please [contact](mailto:contact@cendio.com) us. We are happy to provide evaluation licenses for testing out this beta version.
29+
30+
## Submitting Feedback / Bugs / Issues
31+
Please use the issue tracker in this repository to submit feedback and open issues.
32+
33+
If you already have a ThinLinc license and an active support agreement, and you have site specific issues, you can also open a support ticket through the usual [ThinLinc support](https://www.cendio.com/support/) channel.

‎form.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
attributes:
3+
cluster:
4+
widget: select
5+
label: "Cluster"
6+
options:
7+
- ["lab-210", "test"]
8+
help: "Choose the cluster you want to run this session on"
9+
required: true
10+
bc_num_hours:
11+
widget: "number_field"
12+
label: "Number of hours"
13+
value: "1"
14+
min: 1
15+
step: 1
16+
help: "Select the number hours for the session to run"
17+
required: true
18+
bc_num_slots:
19+
widget: "number_field"
20+
label: "Number of Cores"
21+
value: "1"
22+
min: 1
23+
max: 4
24+
step: 1
25+
help: "Select the number of CPU cores for the session"
26+
required: true
27+
num_mem:
28+
widget: "number_field"
29+
label: "Memory (GB)"
30+
value: "2"
31+
min: 1
32+
max: 3
33+
help: "Select amount of memory for the session"
34+
required: true
35+
node_type: null
36+
37+
form:
38+
- cluster
39+
- bc_num_hours
40+
- bc_num_slots
41+
- num_mem

‎installation.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Installation overview
2+
1. Configure SSL redirection for OOD
3+
2. Install the application on OOD
4+
3. Install and configure the ThinLinc server on the compute node
5+
4. Set up PAM module pam_tlpasswd for automatic login
6+
7+
Chapter 1-2 are for the Open OnDemand **login node** and chapter 3-4 are for
8+
the **compute nodes**.
9+
10+
# 1. Configure SSL redirection for OOD
11+
You need to set the SSL redirection sub-uri and the additional SSL settings for
12+
the OOD reverse proxy in `/etc/ood/config/ood_portal.yml`:
13+
```
14+
secure_rnode_uri: '/secure-rnode'
15+
ssl_proxy:
16+
- 'SSLProxyCheckPeerCN Off'
17+
- 'SSLProxyCheckPeerName Off'
18+
```
19+
20+
Should you want to enable Native client support, this custom virtual host
21+
directive will be needed to set the correct MIME-type for the ThinLinc
22+
profile. The native client will only work if users are able to establish a
23+
direct SSH connection to the compute node/ThinLinc server.
24+
```
25+
custom_vhost_directives:
26+
- '<LocationMatch ".*\.tlclient$">'
27+
- ' Header set Content-Type "application/thinlinc.client"'
28+
- ' Header set Content-Disposition "attachment"'
29+
- '</LocationMatch>'
30+
```
31+
32+
When you have added these configurations to your `ood_portal.yml` config,
33+
generate the new Apache config as such:
34+
```
35+
sudo /opt/ood/ood-portal-generator/sbin/update_ood_portal
36+
```
37+
38+
To apply the new configurations made with `update_ood_portal`, you need to
39+
restart the web server running the OOD instance.
40+
41+
# 2. Install the application on OOD
42+
1. Clone this repository into your applications folder for OOD.
43+
44+
2. Configure the `form.yml`
45+
- You need to *at least* configure the clusters available to start the job on. These
46+
clusters names are the ones specified in `/etc/ood/config/clusters.d/<clustername>.yml`.
47+
48+
3. Configure the `submit.yml.erb`
49+
- This may or may not need configurations for resources such as GPU (sharing or no
50+
sharing) or other devices/configuration changes made in `form.yml`.
51+
52+
4. Configure the `view.html.erb`
53+
- To enable the native client functionality, set the `enabled_client`
54+
variable to either `native` for native client-only support, or `both` to
55+
enable the native client and the web client.
56+
- If you configured the `secure_rnode_uri` to something other than
57+
`/secure-rnode`, change the `webaccess_url` variable to your value.
58+
59+
# 3. Install and configure the ThinLinc server on the compute node
60+
[Download](https://www.cendio.com/thinlinc/download/) and
61+
[install](https://www.cendio.com/thinlinc/docs/install/) the latest ThinLinc
62+
server on the **compute node**.
63+
64+
# 4. Set up PAM module pam_tlpasswd for automatic login
65+
This chapter contains two steps. Installing the PAM module, then installing a
66+
Slurm Epilog script to clean up the temporary password files created by the Open
67+
OnDemand job. Both of these steps are done on the **Compute nodes**.
68+
69+
## Install the PAM module pam_tlpasswd
70+
1. Install the PAM module `pam_tlpasswd`, you need to reconfigure the path to
71+
your PAM modules directory.
72+
```
73+
sudo install ./prequisites/pam_tlpasswd/pam_tlpasswd.so /lib64/security/pam_tlpasswd.so
74+
```
75+
76+
2. Configure `/etc/pam.d/sshd` to add this in the top of the file:
77+
```
78+
auth [success=done ignore=ignore default=die] pam_tlpasswd.so
79+
```
80+
81+
## Install the Slurm Epilog clean up script
82+
1. Install the clean up script
83+
```
84+
sudo cp ./prequisites/ood_thinlinc_cleanup.sh /etc/slurm/ood_thinlinc_cleanup.sh
85+
```
86+
87+
2. Edit `/etc/slurm/slurm.conf` to add the following line:
88+
```
89+
Epilog=/etc/slurm/ood_thinlinc_cleanup.sh
90+
```
91+
92+
Debugging The Epilog clean up script:
93+
```
94+
sudo journalctl -t tlCleanupEpilog
95+
```

‎manifest.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
name: ThinLinc
3+
icon: fa://desktop
4+
category: Interactive Apps
5+
subcategory: Desktops
6+
role: batch_connect
7+
description: |
8+
This app launch an interactive desktop environment as a ThinLinc session.

‎prequisites/ood_thinlinc_cleanup.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/usr/bin/env bash
2+
3+
TAG="tlCleanupEpilog"
4+
5+
if [ -z "$SLURM_JOB_ID" ]; then
6+
logger -t $TAG "$TAG: Error - SLURM_JOB_ID is not set. Cannot check job name. Exiting."
7+
exit 1
8+
fi
9+
10+
if [ -z "$SLURM_JOB_USER" ]; then
11+
logger -t $TAG "$TAG: Error - SLURM_SLURM_JOB_USER not set. Exiting."
12+
exit 1
13+
fi
14+
15+
USER_HOME=$(getent passwd "$SLURM_JOB_USER" | cut -d: -f6)
16+
if [ -z "$USER_HOME" ]; then
17+
logger -t $TAG "$TAG: Error - Could not find home directory for user $SLURM_JOB_USER. Exiting."
18+
exit 1
19+
fi
20+
21+
SECRET_FILE_TO_DELETE="$USER_HOME/.thinlinc/.ood-secrets/job-$SLURM_JOB_ID"
22+
23+
if [ -f "$SECRET_FILE_TO_DELETE" ]; then
24+
logger -t $TAG "$TAG: Found ThinLinc secret for Job $SLURM_JOB_ID. Proceeding with cleanup."
25+
26+
rm -f "$SECRET_FILE_TO_DELETE"
27+
logger -t $TAG "$TAG: Removed secret hash: $SECRET_FILE_TO_DELETE Status: $?"
28+
29+
JOB_CONFIG_TO_DELETE="$USER_HOME/.thinlinc/.ood-secrets/session_config.$(hostname)"
30+
if [ -f "$JOB_CONFIG_TO_DELETE" ]; then
31+
rm -f "$JOB_CONFIG_TO_DELETE"
32+
logger -t $TAG "$TAG: Removed session config: $JOB_CONFIG_TO_DELETE. Status: $?"
33+
fi
34+
35+
else
36+
logger -t $TAG "$TAG: Job $SLURM_JOB_ID does not appear to be a ThinLinc job (no secret file found). Skipping."
37+
exit 0
38+
fi

‎prequisites/pam_tlpasswd/Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
SRC = pam_tlpasswd.c
2+
TARGET = pam_tlpasswd.so
3+
4+
CC = gcc
5+
CFLAGS = -fPIC -fno-stack-protector -shared
6+
LDLIBS = -lcrypt
7+
8+
.PHONY: all clean
9+
10+
all: $(TARGET)
11+
12+
$(TARGET): $(SRC)
13+
$(CC) $(CFLAGS) -o $(TARGET) $(SRC) $(LDLIBS)
14+
15+
clean:
16+
rm -f $(TARGET)

‎prequisites/pam_tlpasswd/pam_modutil.h‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#ifndef PAM_MODUTIL_H
2+
# define PAM_MODUTIL_H
3+
4+
#include <security/pam_modules.h>
5+
#include <security/_pam_macros.h>
6+
#include <security/_pam_types.h>
7+
# ifdef HAVE_SECURITY_PAM_MODUTIL_H
8+
# include <security/pam_modutil.h>
9+
# else
10+
11+
# ifdef HAVE_SECURITY_PAM_MODULES_H
12+
# include <security/pam_modules.h>
13+
# endif
14+
15+
# include <pwd.h>
16+
17+
struct passwd *pam_modutil_getpwnam (pam_handle_t * pamh, const char *user);
18+
extern void send_user_msg(pam_handle_t *pamh, const char *msg);
19+
20+
# endif
21+
#endif

0 commit comments

Comments
 (0)