PROOF Authentication problem

Hi all,

I have two computers, both dual core, so I thought I could make use of proof, but I ran into troubles when I tried to make the authentication work …

OK, so here is what I’ve done:

  1. proof.conf containes:

[code]master hefr42

worker hefr42
worker hefr42
worker hebook09
worker hebook09[/code]

and it is the same on both computers

  1. xpd.cf :

[code]###

Example of simple xrootd config file.

The first part enables a simple data server exposing to clients

the root paths /tmp and /data1.

The second part shows how to enable password-based strong

authentication using the ROOT special password in $HOME/.rootdpass

The third part shows how to concurrently enable the PROOF serving

features

To load this configuration file:

~> xrootd -c $ROOTSYS/etc/proof/xpd.cf

See http://www.slac.stanford.edu/xrootd for more details on the

data serving part.

Part one: data serving

xrd.protocol xrootd *
xrootd.fslib libXrdOfs.so

Specify a non-default port here:

- overwritten by -p on the command line

xrd.port 5151

Export path directives, i.e. the root paths which can accessed

by clients (‘xrootd.export /’ exports the whole file system).

An arbitrary number of these can be defined. The default is

to export /tmp.

NB: specifying any of these directives removes the default /tmp

from the internal list; in such a case a directive needs to

be given explicitely if /tmp needs to be exposed.

xrootd.export /tmp
#xrootd.export /pool/data

Part two: security directives:

Example: enable password-based strong authentication checking

also the special ROOT password in $HOME/.rootdpass.

NB: if the application complains about a missing password file in

$HOME/.xrd/ just create an empty one running ‘xrdpwdadmin’ and

replying to the questions

(<ROOT_sys> with the path to the ROOT distribution)

xrootd.seclib /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdSec.so
sec.protocol pwd -d:3 -upwd:1

Part three: enable PROOF serving

Load the XrdProofd protocol:

a) if the ROOT lib paths are known by the linker/loader

#xrd.protocol xproofd:1093 libXrdProofd.so

b) using absolute paths (<ROOT_sys> with the path to the ROOT distribution)

xrd.protocol xproofd:1093 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdProofd.so

NB: envs vars are not expanded here, i.e. $ROOTSYS/lib/libXrdProofd.so will

not work; they are supported for the remaining “xpd.” directives

Directives governing the behaviour of the XrdProofd plug-in.

Except when explicitely indicated, all the following directives support

an optional 'if ’ condition at the end of the line, e.g.

xpd.rootsys /opt/root if lxb*.cern.ch

xpd.rootsys /usr/local if lxp*.cern.ch

Patterns may contain any number of wild cards; the best match is retained

(max number of matching chars; if two are equal, the last specified wins).

Available ROOT versions: the first ‘rootsys’ defines the default one;

specifying a tag is optional: if missing, the ROOT version tag is taken

(however, the tag must be unique, the first occurence is retained).

If no ‘xpd.rootsys’ valid directives are specified, $ROOTSYS is used as

default ROOT version.

xpd.rootsys /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache [tag_for_default_version]

xpd.rootsys /opt/root-dev [tag_for_an_alternative_version]

Location of the temporary directory [/tmp]

xpd.tmp /usr/tmp

Internal wait timeout in secs [5]

xpd.intwait 500

Max number of PROOF sessions [-1, i.e. no limit]

xpd.maxsessions 10

Number of workers for local sessions [number of CPUs]

#xpd.localwrks 2

Multiuser option

Default 1 (==ON) when running as superuser, 0 (==OFF) when running as normal.

user. In the case the daemon has normal privileges, all users run under the

effective user starting the daemon and privacy of sandboxes is not ensured

xpd.multiuser 0

Defines what to do when no client sessions are attached to a client area.

Format:

xpd.shutdown

where:

is the type of action to be taken when a client completly

disconnets; the options are:

0 remain connected

1 terminate when idle

2 terminate no matter the processing state

is the delay after which the action for option 1 or 2

is performed; in seconds; to indicate minutes or hours use

the suffix ‘m’ or ‘h’, respectively; e.g. 5m for 5 minutes.

default:

xpd.shutdown 1 0

xpd.shutdown 1 1m

xpd.shutdown 1 1s

Image name of this server [node name]

xpd.image

Working directory for sessions [<User_Home>/proof]

If this directive is given, the user working directories will be in the

form <work_dir>/<user_name>

xpd.workdir /tmp/proofbox

Dataset root directory [<User_WorkDir>/dataset]

If this directive is given, the user dataset directories will be in the

form <dataset_dir>//, with =“default” if

does not belongs to any of the defined groups.

xpd.datasetdir <dataset_dir>

Max number of old PROOF sessions for which the working directory

is kept with all the relevant files in (logs, env, …); non-positive

values mean no limit [10]

xpd.maxoldlogs 10

Modify priority of sessions belonging to by <delta_priority>

If is missing, apply the change to all sessions.

This directive requires special privileges, so it may be ineffective

if these are missing

xpd.priority <delta_priority> [if ]

xpd.priority 4

xpd.priority 6 if thatuser

Resource finder

NB: 'if ’ not supported for this directive.

“static”, i.e. using a config file

<cfg_file> path alternative config file

[$ROOTSYS/proof/etc/proof.conf]

<user_cfg_opt> if “yes”: enable user private config files at

$HOME/.proof.conf or $HOME/.<usr_cfg>, where

<usr_cfg> is the second argument to

TProof::Open("","<usr_cfg>") [“no”]

<max_workers> Maximum number of workers to be assigned to user

session [-1, i.e. all]

<selection_mode> If <max_workers> != -1, specify the way workers

are chosen:

“roundrobin” round-robin selection in bunches

of n(=<max_workers>) workers.

Example:

N = 10 (available workers), n = 4:

1st (session): 1-4, 2nd: 5-8,

3rd: 9,10,1,2, 4th: 3-6, …

“random” random choice (a worker is not

assigned twice)

xpd.resource static [<cfg_file>] [ucfg:<user_cfg_opt>] [wmx:<max_workers>] [selopt:<selection_mode>]

xpd.resource static ~/.proof.test.conf wmx:2 selopt:random

xpd.resource static /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/proof.conf

Master(s) allowed to connect. Directive active only for Worker or

Submaster session requests. Multiple ‘allow’ directives can

be specified. By default all connections are allowed.

xpd.allow localhost

Server role (master, submaster, worker) [default: any]

Allows to control the cluster structure.

The following (commented) example will set lxb6041 as master, and all

the others lxb* as workers

xpd.role worker if lxb*.cern.ch

xpd.role master if lxb6041.cern.ch

URL and namespace for the local storage if different from defaults.

By the default it is assumed that the pool space on the cluster is

accessed via a redirector running at the top master under the common

namespace /proofpool.

xpd.poolurl lxb0105.cern.ch

xpd.namespace /store

Specifies tracing options. Valid keywords are:

req trace protocol requests [on]*

login trace details about login requests [on]*

act trace internal actions [off]

rsp trace server replies [off]

fork trace proofserv forks [on]*

dbg trace details about actions [off]

hdbg trace more details about actions [off]

err trace errors [on]

inflt trace details about inflate factors [off]

all trace everything

Defaults are shown in brackets; ‘*’ shows the default when the ‘-d’

option is passed on the command line. Each option may be

optionally prefixed by a minus sign to turn off the setting.

Order matters: ‘all’ in last position enables everything; in first

position is corrected by subsequent settings

xpd.trace fork -err rsp

Super-users directive: specify a comma-serarated list of users with

special privileges; the effective user under which the daemon is run

(-R option on the command line) is always privileged.

xpd.superusers usr1,usr2

User access control directive: specifies a comma-separated list

of users allowed to connect to the cluster.

xpd.allowedusers usr1,usr2,usr3

Group information file

Defines the file containing the information about the composition

of the group and their properties. See example in xpd.groups.sample .

xpd.groupfile $ROOTSYS/etc/proof/xpd.groups

xproofd specific security directives, allowing for independent

rules from the ones applying to data serving.

NB: 'if ’ not supported for these directives (protbind can

used for similar purposes).

In the example, GSI authentication is required with no control on CRL.

If this section is missing xproofd falls back to the security setup

defined for data serving.

xpd.seclib libXrdSec.so

xpd.sec.protocol gsi -crl:0 -gmapopt:1 -dlgpxy:1

xpd.sec.protocol pwd -a:1 -d:3 -upwd:1 -keepcreds

This directive may be used to set additional environment variables

for ‘proofserv’. This is useful, for instance, to set client-side

security options. It is possible to set some context depending

keyworks which will be expanded before launching ‘proofserv’; the

syntax is ; keywords currently recognized are:

--> expanded to workdir (see above)

--> expanded to the user’s username

Example:

xpd.putenv MYENV=//.creds

with ‘xpd.workdir /tmp/proof’ will set MYENV to “/tmp/proof/minni/.creds”

for user ‘minni’ and to “/tmp/proof/pippo/.creds” for user ‘pippo’.

There can be as ‘putenv’ directives as needed.

xpd.putenv XrdSecPWDSRVPUK=//.creds/pwdsrvpuk

This directive may be used to set additional rootrc-like variables

for ‘proofserv’. This allows to control everything from this configuration

file. At start-up, ‘proofserv’ will read the additional directives

from the file “session.rootrc” created in the session working dir

by XProofd; “session.rootrc” is actually a symlink to the real file

whose name is in the form

<node_type>--<session_unique_tag>.rootrc

Example:

xpd.putrc AName.AVar: AValue[/code]

the file is the same on both computers, just the paths are slightly different.

on hefr42 (the master + two working nodes) I do:

xrdpwdadmin add -host hefr42 -email asen.christov@gmail.com xrdpwdadmin add christov

and on hebook09 (two work nodes) I do:

on hefr42

output:

080318 17:03:42 001 Scalla is starting. . . Copr. 2007 Stanford University, xrd version 20071116-0000b Config using configuration file /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/xpd.cf ++++++ xrootd anon@hefr42.physik.uni-freiburg.de initialization started. =====> xrd.protocol xrootd * =====> xrd.protocol xproofd:1093 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdProofd.so Config maximum number of connections restricted to 1024 --- Proofd: : GetNumCPUs: # of cores found: 2 Copr. 2007 Stanford University, xrootd version 2.9.0 build 20071116-0000b ++++++ xrootd protocol initialization started. =====> xrootd.fslib libXrdOfs.so =====> xrootd.export /tmp =====> xrootd.seclib /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdSec.so ++++++ Authentication system initialization started. 080318 17:03:42 001 secpwd_Init: using infodir: /afs/physik.uni-freiburg.de/home/christov/.xrd/ 080318 17:03:42 001 secpwd_Init: server ID: hefr42 080318 17:03:42 001 secpwd_Init: contact e-mail: asen.christov@gmail.com 080318 17:03:42 001 crypto_Factory::GetCryptoFactory: loading ssl crypto factory object from libXrdCrypto.so 080318 17:03:42 001 crypto_Factory::GetCryptoFactory: loading ssl crypto factory object from libXrdCryptossl.so 080318 17:03:42 001 secpwd_Init: using FileAdmin: /afs/physik.uni-freiburg.de/home/christov/.xrd/pwdadmin 080318 17:03:42 001 secpwd_Init: server ID: hefr42 080318 17:03:42 001 secpwd_Init: contact e-mail: asen.christov@gmail.com 080318 17:03:42 001 secpwd_Init: auto-registration mode: 0 080318 17:03:42 001 secpwd_Init: verify client mode: 2 080318 17:03:42 001 secpwd_Init: available crypto modules: ssl 080318 17:03:42 001 secpwd_Init: using private pwd files: $(HOME)/.xrd/pwduser =====> sec.protocol pwd -d:3 -upwd:1 Config 1 authentication directives processed in /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/xpd.cf ------ Authentication system initialization completed. Copr. 2007 Stanford University, Ofs Version 20071116-0000b ++++++ File system initialization started. Config effective /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/xpd.cf ofs configuration: ofs.role server ofs.fdscan 9 120 1200 ofs.maxdelay 60 ofs.trace 0 ------ File system server initialization completed. Copr. 2007, Stanford University, oss Version 20071116-0000b ++++++ Storage system initialization started. Config effective /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/xpd.cf oss configuration: oss.alloc 0 0 0 oss.cachescan 600 oss.compdetect * oss.fdlimit 512 1024 oss.maxdbsize 0 oss.trace 0 oss.xfr 1 9437184 30 10800 oss.memfile off max 1061883904 oss.defaults r/w nocheck nodread nomig norcreate nostage ------ Storage system initialization completed. Config warning: 'xrootd.prepare logdir' not specified; prepare tracking disabled. Config exporting /tmp ------ xrootd protocol initialization completed. 080318 17:03:42 001 xpd : XrdROOT::ValidatePrgmSrv: forking test and protocol retrieval 080318 17:03:42 001 xpd : DoDirectiveRootSys: validation OK for: [tag_for_default_version] 5.18/00 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache 16 080318 17:03:42 001 ProofdManager: ParseConfig: configuring 080318 17:03:42 001 ProofdManager: ParseConfig: working directories under: /tmp/proofbox 080318 17:03:42 001 ProofdManager: ParseConfig: PROOF config file: /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/etc/proof/proof.conf 080318 17:03:42 001 XRD seclib not specified; strong authentication disabled 080318 17:03:42 001 ProofdManager : ParseConfig: no priority changes requested 080318 17:03:42 001 ProofdManager : ParseConfig: PROOF pool: root://hefr42.physik.uni-freiburg.de 080318 17:03:42 001 ProofdManager : ParseConfig: PROOF pool namespace: /proofpool 080318 17:03:42 001 xpd : LoadScheduler: scheduler loaded: type: default 080318 17:03:42 001 ProofdManager : ParseConfig: user config files are disabled 080318 17:03:42 001 ProofdManager : ParseConfig: client sessions kept idle for 0 secs after disconnection 080318 17:03:42 001 ProofdManager : ParseConfig: list of superusers: christov 080318 17:03:42 001 ProofdManager : ParseConfig: bare lib path for proofserv: /sge/lib/glinux:/opt/nagc5:/usr/lib 080318 17:03:42 001 xpd : +++ Group: default 080318 17:03:42 001 xpd : +++ Priority: -1, fraction: -1 080318 17:03:42 001 xpd : +++ End of Group: default 080318 17:03:42 001 Proofd : Configure: mgr: 0xb76d64a0 080318 17:03:42 001 Proofd : Configure: listening on port 1093 080318 17:03:42 001 Proofd : Configure: setting internal timeout to (secs): 30 080318 17:03:42 001 Proofd : Configure: using temp dir: /tmp 080318 17:03:42 001 XRD seclib not specified; strong authentication disabled 080318 17:03:42 001 Proofd : Configure: role set to: any 080318 17:03:42 001 Proofd : Configure: cron thread started 080318 17:03:42 001 XProofd protocol version 0.4 build 20071116-0000b successfully loaded. 080318 17:03:42 001 xproofd: protocol V 0.4 successfully loaded ------ xrootd anon@hefr42.physik.uni-freiburg.de:1094 initialization completed.

and on hebook09:

gives me:

Config warning: this hostname, enki, is registered without a domain qualification. 080318 17:07:21 001 Scalla is starting. . . Copr. 2007 Stanford University, xrd version 20071116-0000c Config using configuration file /opt/root/etc/proof/xpd.cf ++++++ xrootd anon@enki initialization started. =====> xrd.protocol xrootd * =====> xrd.protocol xproofd:1093 /opt/root/lib/libXrdProofd.so Config maximum number of connections restricted to 1024 --- Proofd: : GetNumCPUs: # of cores found: 2 Copr. 2007 Stanford University, xrootd version 2.9.0 build 20071116-0000c ++++++ xrootd protocol initialization started. =====> xrootd.fslib libXrdOfs.so =====> xrootd.export /tmp =====> xrootd.seclib /opt/root/lib/libXrdSec.so ++++++ Authentication system initialization started. 080318 17:07:21 001 secpwd_Init: using infodir: /home/christov/.xrd/ 080318 17:07:21 001 secpwd_Init: server ID: hebook09 080318 17:07:21 001 secpwd_Init: contact e-mail: asen.christov@gmail.com 080318 17:07:21 001 crypto_Factory::GetCryptoFactory: loading ssl crypto factory object from libXrdCrypto.so 080318 17:07:21 001 crypto_Factory::GetCryptoFactory: loading ssl crypto factory object from libXrdCryptossl.so 080318 17:07:21 001 secpwd_Init: using FileAdmin: /home/christov/.xrd/pwdadmin 080318 17:07:21 001 secpwd_Init: server ID: hebook09 080318 17:07:21 001 secpwd_Init: contact e-mail: asen.christov@gmail.com 080318 17:07:21 001 secpwd_Init: auto-registration mode: 0 080318 17:07:21 001 secpwd_Init: verify client mode: 2 080318 17:07:21 001 secpwd_Init: available crypto modules: ssl 080318 17:07:21 001 secpwd_Init: using private pwd files: $(HOME)/.xrd/pwduser =====> sec.protocol pwd -d:3 -upwd:1 Config 1 authentication directives processed in /opt/root/etc/proof/xpd.cf ------ Authentication system initialization completed. Copr. 2007 Stanford University, Ofs Version 20071116-0000c ++++++ File system initialization started. Config effective /opt/root/etc/proof/xpd.cf ofs configuration: ofs.role server ofs.fdscan 9 120 1200 ofs.maxdelay 60 ofs.trace 0 ------ File system server initialization completed. Copr. 2007, Stanford University, oss Version 20071116-0000c ++++++ Storage system initialization started. Config effective /opt/root/etc/proof/xpd.cf oss configuration: oss.alloc 0 0 0 oss.cachescan 600 oss.compdetect * oss.fdlimit 512 1024 oss.maxdbsize 0 oss.trace 0 oss.xfr 1 9437184 30 10800 oss.memfile off max 1058590720 oss.defaults r/w nocheck nodread nomig norcreate nostage ------ Storage system initialization completed. Config warning: 'xrootd.prepare logdir' not specified; prepare tracking disabled. Config exporting /tmp ------ xrootd protocol initialization completed. 080318 17:07:21 001 xpd : XrdROOT::ValidatePrgmSrv: forking test and protocol retrieval 080318 17:07:21 001 xpd : DoDirectiveRootSys: validation OK for: [tag_for_default_version] 5.19/02 /opt/root 16 080318 17:07:21 001 ProofdManager: ParseConfig: configuring 080318 17:07:21 001 ProofdManager: ParseConfig: working directories under: /tmp/proofbox 080318 17:07:21 001 ProofdManager: ParseConfig: PROOF config file: /opt/root/etc/proof/proof.conf 080318 17:07:21 001 XRD seclib not specified; strong authentication disabled 080318 17:07:21 001 ProofdManager : ParseConfig: no priority changes requested 080318 17:07:21 001 ProofdManager : ParseConfig: PROOF pool: root://enki 080318 17:07:21 001 ProofdManager : ParseConfig: PROOF pool namespace: /proofpool 080318 17:07:21 001 xpd : LoadScheduler: scheduler loaded: type: default 080318 17:07:21 001 ProofdManager : ParseConfig: user config files are disabled 080318 17:07:21 001 ProofdManager : ParseConfig: client sessions kept idle for 0 secs after disconnection 080318 17:07:21 001 ProofdManager : ParseConfig: list of superusers: christov 080318 17:07:21 001 ProofdManager : ParseConfig: bare lib path for proofserv: 080318 17:07:21 001 xpd : +++ Group: default 080318 17:07:21 001 xpd : +++ Priority: -1, fraction: -1 080318 17:07:21 001 xpd : +++ End of Group: default 080318 17:07:21 001 Proofd : Configure: mgr: 0xb76df1e0 080318 17:07:21 001 Proofd : Configure: listening on port 1093 080318 17:07:21 001 Proofd : Configure: setting internal timeout to (secs): 30 080318 17:07:21 001 Proofd : Configure: using temp dir: /tmp 080318 17:07:21 001 XRD seclib not specified; strong authentication disabled 080318 17:07:21 001 Proofd : Configure: role set to: any 080318 17:07:21 001 Proofd : Configure: cron thread started 080318 17:07:21 001 XProofd protocol version 0.4 build 20071116-0000c successfully loaded. 080318 17:07:21 001 xproofd: protocol V 0.4 successfully loaded ------ xrootd anon@enki:1094 initialization completed.

in both logs there is :

Does it mean that:

xrootd.seclib /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdSec.so
is not enough ?

anyway …, next thing I do I start root on hebook09 and call:

[color=red][size=150]but it doesn’t ask me for any password ?!?![/size][/color]

it just says:

Starting master: opening connection ... Starting master: OK Opening connections to workers: OK (4 workers) Setting up worker servers: OK (4 workers) PROOF set to parallel mode (4 workers) (class TProof*)0x8342898

gProof->Print()

gives me:

Connected to: hefr42.physik.uni-freiburg.de (valid) Port number: 1093 User: christov ROOT version|rev: 5.19/02|r22600 Architecture-Compiler: linux-gcc413 Proofd protocol version: 16 Client protocol version: 16 Remote protocol version: 16 Log level: 0 Session unique tag: hefr42-1205856873-17136 Default data pool: root://hefr42.physik.uni-freiburg.de//proofpool *** Master server 0 (parallel mode, 4 workers): Master host name: hefr42 Port number: 1093 User/Group: christov/default ROOT version|rev|tag: 5.18/00|r21744|[tag_for_default_version] Architecture-Compiler: linux-gcc412 Protocol version: 16 Image name: hefr42.physik.uni-freiburg.de:/tmp/proofbox/christov Working directory: /tmp/proofbox/christov/session-hefr42-1205856873-17136/master-0-hefr42-1205856873-17136 Config directory: Config file: proof.conf Log level: 0 Number of workers: 4 Number of active workers: 4 Number of unique workers: 1 Number of inactive workers: 0 Number of bad workers: 0 Total MB's processed: 0.00 Total real time used (s): 0.008 Total CPU time used (s): -0.000

the log of the xrootd on hebook09:

080318 17:14:57 13190 xpd:MapClient: christov.17136:29@hefr42.physik.uni-freiburg.de login 080318 17:14:57 13190 xpd : Create: using ROOT version: [tag_for_default_version] 5.19/02 /opt/root 16 xpd:child: : SetUserEnvironment: set HOME=/tmp/proofbox/christov 080318 17:14:57 13190 xpd:MapClient: christov.13260:34@localhost login 080318 17:14:57 13190 xpd : Create: using ROOT version: [tag_for_default_version] 5.19/02 /opt/root 16 xpd:child: : SetUserEnvironment: set HOME=/tmp/proofbox/christov 080318 17:14:57 13190 xpd:MapClient: christov.13263:35@localhost login

the log of the xrootd on hefr42:

080318 17:14:33 14741 xpd:MapClient: christov.13242:30@hebook09 login 080318 17:14:33 14741 xpd : Create: using ROOT version: [tag_for_default_version] 5.18/00 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache 16 xpd:child: : SetUserEnvironment: set HOME=/tmp/proofbox/christov 080318 17:14:33 14741 xpd:MapClient: christov.17136:34@localhost login 080318 17:14:33 14741 xpd : GetActiveWorkers: returning list with 5 entries 080318 17:14:33 14741 xpd : GetActiveWorkers: returning list with 5 entries 080318 17:14:33 14741 xpd:MapClient: christov.17136:32@hefr42 login 080318 17:14:33 14741 xpd : Create: using ROOT version: [tag_for_default_version] 5.18/00 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache 16 xpd:child: : SetUserEnvironment: set HOME=/tmp/proofbox/christov 080318 17:14:33 14741 xpd:MapClient: christov.17146:36@localhost login 080318 17:14:33 14741 xpd : Create: using ROOT version: [tag_for_default_version] 5.18/00 /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache 16 xpd:child: : SetUserEnvironment: set HOME=/tmp/proofbox/christov 080318 17:14:34 14741 xpd:MapClient: christov.17148:37@localhost login

How can I make it work, so that it asks for the password ? When and how many times it should ask for the password ?

thanks, Asen.

Dear Asen,

Due to a bug introduced while re-factoring the way the configuration directives are parsed, the ‘xrootd.seclib’ directive is ignored by the XrdProofd plug-in.
This will be fixed asap.
For the time being, using ‘xpd.seclib’ should solve the problem.

Please try and let me know.

Gerri

Thanks for the answer …

So I tried this:

in my xpd.cf: I have now

xpd.seclib libXrdSec.so xrootd.seclib /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdSec.so sec.protocol pwd -d:3 -keepcreds xpd.sec.protocol pwd -d:3 -keepcreds

then I do:

xrdpwdadmin add -host hefr42 -email asen.christov@gmail.com xrdpwdadmin add christov

and I get the temporary password for the user christov from .xrd/genpwd/christov

next step: I start xrootd (xrootd -c /xpd.cf)

it asks for the password for the user christov, I type in the temporary passwd. Then I have to type a new passwd.

So far, so good.

First question: Do I need both,

xpd.seclib libXrdSec.so xpd.sec.protocol pwd -d:3 -keepcreds

and

xrootd.seclib /afs/physik.uni-freiburg.de/opt/root_v5.18_slc4_py2.4_dcache/lib/libXrdSec.so sec.protocol pwd -d:3 -keepcreds

Second question:
It creates a new file (.xrd/pwdnetrc) and it never asks for the password again. If I remove .xrd/pwdnetrc I have to type in the passwd, the file is recreated and again next time i try to “log in” it doesn’t ask for the password. Is that the correct behavior ?

thanks, Asen.

Dear Asen,

One (xpd.seclib) is to protect PROOF usage, the other to control access to the files on the cluster. If the files are just for PROOF usage my guess is that you just need ‘xpd.seclib’.

By default, autologin is switched on for pass-based authentication. This means that the client par of the plug-in will check the file ‘.xrd/pwdnetrc’ for the credentials and use them if found. By default the file is updated after any succesfull login to a given sever, which is uniquely identified. You can check for which {user,server} you have credentials by issuing

$ xrdpwdadmin -m netrc

You can switch-off autologin (and therefore ignore ‘.xrd/pwdnetrc’) by setting

XSec.Pwd.AutoLogin 0

in your ‘$HOME/.roorc’ or inside the session before starting PROOF

root [] genv->SetValue("XSec.Pwd.AutoLogin",0)

or by setting the env variable XrdSecPWDAUTOLOG to “0”

export XrdSecPWDAUTOLOG=0

Gerri

Hi Gerry,

[quote]You can switch-off autologin (and therefore ignore ‘.xrd/pwdnetrc’) by setting

XSec.Pwd.AutoLogin 0

in your ‘$HOME/.roorc’[/quote]

You probably mean $HOME/.roo[color=red]t[/color]rc …
I tried to put there the line you suggested … Didn’t work. (the rest of the options in my ~/.rootrc work …)

[quote]or inside the session before starting PROOF

root [] gEnv->SetValue(“XSec.Pwd.AutoLogin”,0)[/quote]

this worked.

The last option:

export XrdSecPWDAUTOLOG=0

Where should I put this?
execute in the shell where I run xrootd -c xpd.cf ?
in the shell where I run root ?
put it in xpd.cf ? (before or after xpd.sec.protocol pwd -d:3 -keepcreds ?)

thanks, Asen.

Hi Asen,

Bizarre … was it pick-up by gEnv? You can check this by doing

root [] gEnv->Print()

and checking if there is any line like

XSec.Pwd.AutoLogin:       0                              [User]

In the shell before starting ROOT or inside ROOT with

root [] gSystem->Setenv("XrdSecPWDAUTOLOG","0")

Gerri

mea culpa …

I forgot a new line at the end of ~/.rootrc