## Kerberized Grid Engine Release Notes

Kerberized Grid Engine provides for the authentication of Grid Engine users and Grid Engine daemons to ensure a secure queueing environment. Kerberized Grid Engine also supports automatic forwarding and renewal of Kerberos ticket granting tickets (TGTs) on behalf of the user to the execution hosts to ensure that users' jobs will have the proper Kerberos credentials to execute other kerberized applications (e.g. PVM).

#### Installation Instructions for Kerberized Grid Engine

Kerberized Grid Engine requires Kerberos 5, release 1.0pl1 or later to be installed on all Grid Engine qmaster, shadow, execution, and submit hosts.
You must also define some kerberos principals and add them to the Kerberos database and add some keys to the default keytabs of the qmaster and execution hosts. Detailed instructions for setting up your Kerberos database to execute Kerberized Grid Engine are included below. The instructions below include examples.
In the examples, the Kerberos domain is HPC-TX.COM. The qmaster host is fritz.hpc-tx.com and the execution host is constitution.hpc-tx.com.

1. Add a principal for the Grid Engine service for each qmaster and shadow host. Specify the qmaster or shadow host as the host portion of the principal.

$ kinit admin/admin
Password for admin/admin@HPC-TX.COM:
$ /usr/krb5/sbin/kadmin
Enter password:
kadmin: addprinc -randkey sge/fritz.hpc-tx.com@HPC-TX.COM
Principal "sge/fritz.hpc-tx.com@HPC-TX.COM" created.
kadmin: quit
$

2. Add a principal for the sge_qmaster and sge_schedd daemons for the qmaster host and any shadow hosts. Specify the qmaster or shadow host as the host portion of the principal.

$ /usr/krb5/sbin/kadmin
Enter password:
kadmin: addprinc -randkey sge_qmaster/fritz.hpc-tx.com@HPC-TX.COM
Principal "sge_qmaster/fritz.hpc-tx.com@HPC-TX.COM" created.
kadmin: addprinc -randkey sge_schedd/fritz.hpc-tx.com@HPC-TX.COM
Principal "sge_schedd/fritz.hpc-tx.com@HPC-TX.COM" created.
kadmin: quit
$

3. For each execution host, add a sge_execd principal for the sge_execd daemon which will be executing on the host. Specify the execution host as the host portion of the principal.

$ /usr/krb5/sbin/kadmin
Enter password:
kadmin: addprinc -randkey sge_execd/constitution.hpc-tx.com@HPC-TX.COM
Principal "sge_execd/constitution.hpc-tx.com@HPC-TX.COM" created.
kadmin: quit
$

4. Add the Grid Engine, sge_qmaster, and sge_schedd principals to the default keytab on the qmaster host and any shadow hosts. (You need to be root to write to the default keytab.)

On each qmaster or shadow host:

$ su
Password:
# /usr/krb5/bin/kinit admin/admin
Password for admin/admin@HPC-TX.COM:
# /usr/krb5/sbin/kadmin
Enter password:
kadmin: ktadd sge/fritz.hpc-tx.com sge_qmaster/fritz.hpc-tx.com sge_schedd/fritz.hpc-tx.com
Entry for principal sge/fritz.hpc-tx.com with kvno 5, encryption type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal sge_qmaster/fritz.hpc-tx.com with kvno 5, encryption type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal sge_schedd/fritz.hpc-tx.com with kvno 4, encryption type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
kadmin: quit
#

5. For each execution host, add the sge_execd principal to the default keytab on the execution host. (You need to be root to write to the default keytab.)

On each execution host:

$ su
Password:
# /usr/krb5/bin/kinit admin/admin
Password for admin/admin@HPC-TX.COM:
# /usr/krb5/sbin/kadmin
Enter password:
kadmin: ktadd sge_execd/constitution.hpc-tx.com
Entry for principal sge_execd/constitution.hpc-tx.com with kvno 3, encryption type DES-CBC-CRC added to keytab WRFILE:/etc/krb5.keytab.
kadmin: quit
#

6. Follow the usual instructions for installing Grid Engine.

- Kerberos Error Logging
Kerberos errors are logged in the usual Grid Engine messages files as well as the Kerberos library log file. Each kerberos error includes a descriptive Kerberos error message as well as the Grid Engine context in which the error occurred. Authentication failures are logged as errors.
- TGT Forwarding and TGT Renewal
In order for Kerberized Grid Engine to automatically forward and renew TGTs for a job submitted by a user, the user must have obtained a forwardable and renewable TGT. This can be done by using the -f and -r switches when the kinit command is issued. To request a forwardable TGT which can be renewed for 14 days, the user should issue the command:

$ kinit -f -r 14d

Copyright 2001 Sun Microsystems, Inc. All rights reserved.