FWIW, though the "--x11" flag is available to srun in 17.11.0, neither the man page nor the built-in --help mention its presence or how to use it.
Also FWIW, in setting-up the 17.11 on CentOS 7, I encountered these minor gotchas: - Your head/login node's sshd MUST be configured with "X11UseLocalhost no" so the X11 TCP port isn't bound to the loopback interface alone - Add the "X11" flag to your slurm.conf PrologFlags to enable X11 forwarding in slurmctld et al. (implicitly enables Alloc and Contain) > On Nov 29, 2017, at 4:37 PM, Matthieu Hautreux <matthieu.hautr...@gmail.com> > wrote: > > Hi Kevin, > > Based on my understanding and a discussion with the SLURM dev team on that > subject, here are some information about the new support of X11 in > slurm-17.11 : > > - slurm's native support of X11 forwarding is based on libssh2 > - slurm's native support of X11 can be disabled at configure/compilation time > using the --disable-x11 configure pragma > - slurm-spank-x11 can be used only if you disable slurm's native support of > X11 at configure/compilation time > > The simplest case with --pty available since 1.3 only works if you do not > really want to secure your X11 forwarding (using xhost +...). > > libssh2 yet offers a subset of the capabilities of openssh (less encryption > methods, less authentication methods, ...). If you need options only > available in openssh, you should use slurm-spank-x11 instead of slurm's > native support of X11. That is what we are doing with 17.11 as we need GSSAPI > support for kerberos authentication, a support that is not provided by > libssh2 right now. > > Take a look at https://www.libssh2.org/ to figure out if the provided > features is sufficient for you. If it is the case, I guess that using slurm's > native support of X11 will be easier than having to compile, install and > configure slurm-spank-x11. > > Looking at the code in current slurm-17.11 > (src/slurmd/slurmstepd/x11_forwarding.c), the logic behind slurm's native > support of X11 differs from slurm-spank-x11 when it comes to establish the > ssh connections required to secure the X11 forwarding. If my understandings > are correct, native logic is to redirect a local port on the compute node to > the X11 port on the submission/login node using libssh2 direct-tcpip channels > (equivalent to -L %port:%host:%port in openssh) and set that local port as > the X11_DISPLAY to use locally by the applications. Hostbased authentication > and pubkey authentication are the two authentication logics that are tried. > So you need to have either hostbased authentication configured on your > cluster or pubkey/private keys available and configured for all of your users > in their home directories, readable on the compute nodes after > seteuid/setegid. > > > HTH. > > Matthieu > > Le 29 nov. 2017 21:20, "Kevin Manalo" <kman...@jhu.edu> a écrit : > Hello SLURM users, > > I was reviewing the X11 documentation > > > https://slurm.schedmd.com/faq.html#terminal > > https://slurm.schedmd.com/faq.html#x11 > > > > 15. Can tasks be launched with a remote terminal? > In Slurm version 1.3 or higher, use srun's --pty option. Until then, you can > accomplish this by starting an appropriate program or script. In the simplest > case (X11 over TCP with the DISPLAY environment already set), executing srun > xterm may suffice. > > > At our site, indeed this is sufficient. We are using the > https://github.com/hautreux/slurm-spank-x11 plugin currently. > > > I see that in the 17.11.0 announcement > > > -- X11 support is now fully integrated with the main Slurm code. > Remove any > X11 plugin configured in your plugstack.conf file to avoid errors being > logged about conflicting options. > > > Questions > > > • If ‘srun —x11’ is not needed to X11 forward (the simplest case > works), do we encourage users to use it? I’m more in need of understanding > how it works because some users use it, some do not, and more education on > this would be great. > • Is the SLURM spank x11 plugin now unnecessary once we build 17.11.0 > with the updated configuration? > > Thanks, > > Kevin > > :::::::::::::::::::::::::::::::::::::::::::::::::::::: Jeffrey T. Frey, Ph.D. Systems Programmer V / HPC Management Network & Systems Services / College of Engineering University of Delaware, Newark DE 19716 Office: (302) 831-6034 Mobile: (302) 419-4976 ::::::::::::::::::::::::::::::::::::::::::::::::::::::
