PBS Works Administrator's Guide

Transcription

1 PBS Works 12.0 Administrator's Guide

2 Table of Contents 1 Introduction to PBS Works Copyright, Trademarks, and Third Party Licenses... 3 System Requirements... 4 Supported Platforms... 8 PBS Works Service Commands Starting PBS Works Stopping PBS Works Restarting PBS Works Determining the status of the PBS Works service PBS Works Database 15 4 Authentication and Authorization 16 5 Managing Users and Groups using AMS 17 6 Location of PBS Works Files 20 7 Database Field Lengths Configuring Authentication through AMS Changing Authentication to SSH Changing Authentication to Windows Changing Authentication to use the AMS Datastore Changing Authentication to NIS Changing Authentication to PAM Configuring Administrative Users Configuring File Operations Performance ii Configuring JVM Performance Configuring SSL... 37

3 Configuring a Secure Open Port Configuring a Secure Open Port with Redirection Configuring the Postgres Database Changing the database password Configuring logging Configuring Session Timeout Configuring the License Server Configuring Language/Localization iii

4 Chapter 1 Introduction to PBS Works Chapter 1 Introduction to PBS Works PBS Works is a modern Service Oriented Architecture coupled with the market leading HPC workload management and job scheduling solution - PBS Professional, constituting the foundation of Altair's HPC offering. PBS Works increases high-performance computing productivity, providing users with a reliable and affordable enterprise simulation platform. Benefits: Users First PBS Works is the most natural way to organize, automate and manage the contents used throughout the simulation life cycle, working in an extremely intuitive and user-friendly Web-based interface. Data Freshness With PBS Works, users can immediately begin managing their personal data or collaborating in small teams, without the overhead typical of enterprise data management and PLM systems, maintaining the content pedigree and synchronizing data in nearly real time. Human Centric PBS Works provide users with an enjoyable data and process management experience, employing software and hardware resources to streamline complex analysis with a few mouse clicks. Components available through the installation of PBS Works: Compute Manager Display Manager Access Management Services Results Visualization Service Please refer to the respective administration guides for more information on how to configure these products postinstallation. 1

5 Introduction to PBS Works Chapter 1 Compute Manager Compute Manage (CM) is a job submission and monitoring portal which enables users to run, monitor and manage workloads on distributed resources remotely. Compute Manager uses the High Performance Computing workload management capability of Altair s PBS Application Services and PBS Professional for efficient resource utilization, access to the cloud for job submission, and subsequent accounting. Display Manager Display Manager (DM) enables users to run graphics-intensive applications on their cluster while visualizing those applications on their desktop. Because applications run directly from the data center, users can take advantage of shared, powerful, GPU-enabled hardware in the data center and use their Web browser to view, edit, interact with and control the graphical apps remotely. As a result, the enterprise can buy fewer high-end graphics systems, and avoid purchasing a costly high-end graphics desktop for each engineer. Display Manager enables sharing of HPC-class systems housed in the datacenter (or in an HPC cluster) among all the engineers in the enterprise. Please see the Display Manager Installation and Administration Guide for more information. Results Visualization Service Results Visualization (RVS) provides necessary features and functionalities to access, process and visualize CAE results information through an easy and intuitive graphical user interface, embedded directly into the web browser. This allows users to access these features anytime and from anywhere without the need for installing any post processing applications on their desktop. In the current release, these features are accessible through the Compute Manager web interface. Access Management Service Access Management Service (AMS) provides a centralized configuration system for authentication and authorization. With AMS administrators can manage users and groups, as well as as access control policies. For more information about using AMS to manage users and groups see Managing Users and Groups using AMS. Compute Manager and Results Visualization Service must be installed separately. For more information about Compute Manager see the Compute Manager Administrator's Guide. For more information about Results Visualization Service see the Results Visualization Service Installation and Administration Guide. Both documents can be downloaded from the PBS Works documentation user area. 2

6 Chapter Introduction to PBS Works Copyright, Trademarks, and Third Party Licenses Altair updated 6/11/13 Copyright Altair Engineering, Inc. All Rights Reserved Compute Manager, PBS Works, PBS, PBS Professional, PBS Application Services, PBS Analytics, Display Manager, PBS Desktop, PBS Portal, e-biochem, e-compute and e-render are trademarks of Altair Engineering, Inc. and are protected under U.S. and international laws and treaties. All other marks are the property of their respective owners ALTAIR ENGINEERING INC. Proprietary and Confidential. Contains Trade Secret Information. Not for use or disclosure outside of ALTAIR and its licensed clients. Information contained herein shall not be decompiled, disassembled, duplicated, or disclosed in whole or in part for any purpose. Usage of the software is only as explicitly permitted in the end user software license agreement. Copyright notice does not imply publication. 3

7 Introduction to PBS Works 1.2 Chapter 1 System Requirements Hardware Requirements for Compute Manager Hardware Requirements for CM Hardware Minimum Requirement Recommended CPU 1 CPU 2 CPU Memory (Physical) 4 GB 8 GB Disk Space 4 GB 8 GB Hardware requirements for Display Manager Portal Host Requirements CPU Intel(R) Xeon(R) CPU 3.07GHz or faster Physical Memory 8GB or higher 4

8 Introduction to PBS Works Chapter 1 Execution Host Requirements Operating System Any Linux distribution in the Red Hat Enterprise or SuSE Enterprise families which contains GLIBC or later Graphics Only nvidia and ATI cards are known to work with this technology. If the manufacturer of your 3D adapter provides proprietary drivers for Linux, then it is recommended that you install these. Many of the drivers that ship with Linux do not provide full 3D acceleration or Pbuffer support, which is required for the technology to work. GPU cores and GPU memory Specific to the application of use. CPU cores and Physical memory Specific to the application of use. Others X Server configured to export True Color (24 bit or 32 bit) visuals. Client Requirements Recommended CPU Pentium 4/Xeon, 2.0 GHz or faster Recommended Physical Memory 2GB or higher Java plug-in Java plug-in must be enabled in the web browser. 5

9 Introduction to PBS Works Chapter 1 Hardware Requirements for Results Visualization Service Hardware Requirements for RVS Hardware Minimum Requirement Recommended CPU 2 CPU 4 CPU Memory (Physical) 4 GB 8 GB Resources are specific to the machine that Results Visualization Service is running on. Prerequisites for Compute Manager In order to register a user session of Compute Manager to an Enterprise PBS Professional complex, the complex head node must be running PBS Professional 12.0 or later, and PBS Application Services 12.0 or later. Please contact your site administrator for further information. Google Chrome Frame plug-in Compute Manager Internet Explorer versions 8 and 9 do not natively support the multi-file upload mechanisms for local files nor the file upload progress meter in Compute Manager. It has been observed that many times installing the Chromium projects Google Chrome Frame plug-in on Windows XP, Vista and Windows 7 has provided indirect support for this. However, this configuration has not formally been tested, so it is not fully supported by Altair. Please use the Chromium projects at your own discretion. Results Visualization Service It is observed that installing Google Chrome Frame on IE 8 and 9 significantly improves the performance of Results Visualization, especially plotting use cases. However, the plug-in appears to have some random issues with the Hyperview Player plug-in, which sometimes leads to unexpected behavior during animation data viewing. In these instances, the generated animation file (h3d) can be downloaded and viewed locally using the standalone version of HyperView player. This configuration (Google Chrome Frame + IE 8/9) has not been formally tested, so it is not fully supported by Altair. If issues arise, it may be recommended to uninstall the plug-in. To install and configure Google Chrome Frame see Installing Google Chrome Frame and Configuring Google Chrome Frame in the Compute Manager Administrator s Guide. 6

10 Chapter 1 Introduction to PBS Works Prerequisites for Display Manager The PBS Professional Server should have been configured using either the PBS Works 12.0 installer, or the PBS Works 12.0 DM installer so that ngpus are configured as a custom resource. Further configuration must be performed on the execution hosts to configure the custom resource ngpus. Please see the Display Manager Installation and Administration Guide for more information. 7

11 Introduction to PBS Works 1.3 Chapter 1 Supported Platforms PBS Works is supported on the following platforms: Windows 64bit Windows Server 2008 Windows Server 2008 R2 Linux 64bit Suse Linux Enterprise Server 10 & 11 Red Hat Enterprise Linux 5 & 6 Cent OS 5.5 Supported Browsers Windows Firefox 17 ESR (Firefox 17 ESR (Only Extended Support Release is supported. Please refer to Google Chrome 18+ Internet Explorer v8 - v9 Linux Firefox 17 ESR (Firefox 17 ESR (Only Extended Support Release is supported. Please refer to Google Chrome 18+ OSX Safari 5.1 (not heavily tested) 8

12 Chapter 2 PBS Works Service Commands Chapter 2 PBS Works Service Commands Use the information in this chapter to start, stop, and restart the PBS Works service. Typically, the PBS Works service is installed and configured to use port If this port is not available during installation, then the PBS Works installer will increment the port number and try again. This will continue until a free port is found, or until 100 consecutive ports are refused at which point the installer will ask for a port. If PBS Works is installed on a Windows platform, then a separate service is registered specifically for the PBS Works database. This service will automatically be started when the PBS Works service is started. Starting the PBS Works service Stopping the PBS Works service Restarting the PBS Works service 9

13 PBS Works Service Commands 2.1 Chapter 2 Starting PBS Works Linux At the Linux command line prompt enter: /etc/init.d/pbsworks start The following messages will be displayed: Starting PBSWorks **************************************************************** Starting PBSWorks Database... PBSWorks Database successfully started Done Starting PBSWorks Database Starting PBSWorks... PBSWorks started, pid: 29727, port:8086 [OK] **************************************************************** Windows Navigate to Control Panel->Administrative Tools->Services. Right-click PBSWorks Service and select Start. 10

14 PBS Works Service Commands Chapter Stopping PBS Works Linux At the Linux command line prompt enter: /etc/init.d/pbsworks stop The following messages will be displayed: Stopping PBSWorks Database... pg_ctl: server does not shut down PBSWorks Database successfully stopped Done Stopping PBSWorks Database Stopping PBSWorks PID 28376: PBSWorks stopped, was pid: [OK] Windows Navigate to Control Panel->Administrative Tools->Services. Right-click PBSWorks Service and select Stop. 11

15 PBS Works Service Commands 2.3 Chapter 2 Restarting PBS Works Linux At the Linux command line prompt enter: /etc/init.d/pbsworks restart The following messages will be displayed: Restarting PBSWorks **************************************************************** Stopping PBSWorks Database... pg_ctl: server does not shut down PBSWorks Database successfully stopped Done Stopping PBSWorks Database Stopping PBSWorks PID 29727: PBSWorks stopped, was pid: [OK] Starting PBSWorks **************************************************************** Starting PBSWorks Database... PBSWorks Database successfully started Done Starting PBSWorks Database

16 PBS Works Service Commands Chapter 2 Starting PBSWorks... PBSWorks started, pid: 29928, port:8086 [OK] Windows Navigate to Control Panel->Administrative Tools->Services. Right-click PBSWorks Service and select Restart. 13

17 PBS Works Service Commands 2.4 Chapter 2 Determining the status of the PBS Works service Linux At the Linux command line prompt enter: /etc/init.d/pbsworks status The following messages will be displayed: PPBSWorks (pid 28376) is running You can access the portal using link altair.com:8086/pbsworks Windows Navigate to Control Panel->Administrative Tools->Services. View the Status column of the PBSWorks Service to determine the status of the service. 14

18 Chapter 3 PBS Works Database Chapter 3 PBS Works Database Postgres (version _64) will be installed by the PBS Works installer. The installer will create a default user, if one is not supplied during installation, as the database super user - pbsworksuser having a password of pbsworks@123. The PBS Works database is installed and configured to use port If this port is not available during installation, then the PBS Works installer will increment the port number and try again. This will continue until a free port is found, or until 100 consecutive ports are refused at which point the installer will ask for a port. 15

19 Authentication and Authorization Chapter 4 Chapter 4 Authentication and Authorization AMS provides a centralized configuration system for authentication and authorization. During installation, PBS Works can be configured to use either Windows based or SSH based authentication, or it can be configured to use the AMS datastore for authentication. The AMS datastore can be populated with users and groups via a connection to a Windows Active Directory (AD), or any Lightweight Directory Access Protocol (LDAP) compatible server. Or it can be populated by using the AMS console to add users and groups. For more information about using AMS to manage users and groups see Managing Users and Groups using AMS. If authentication is done against the AMS datastore, and a connection to an LDAP/AD is not specified during installation, then the AMS console must be used to add users to the datastore prior to users logging into the CM and DM web applications. Authorization is performed against the AMS datastore. The AMS console can be used to add authorization policies. For more information see Configuring Access to CM in the Compute Manager Administrator s Guide. 16

20 Chapter 5 Managing Users and Groups using AMS Chapter 5 Managing Users and Groups using AMS Accessing the AMS Administration Console To access the AMS Administration Console, enter the following in the address bar of any supported web browser: <PBS_WORKS_HOSTNAME:PORT>/AccessManagementService/ The AMS Administration Console login page will open in the browser as shown below: Use the PBS Works portal administrator credentials to login to the AMS Administration console. These credentials are set during the installation of PBS Works. Please note: If during installation of PBS Works, a LDAP/AD was provided for authorization, then those users stored in the directory will be displayed. In addition, adding and deleting users via the AMS console is restricted when an LDAP/AD is being used. If authorization is being done through the AMS datastore, then users and groups will need to be added using the AMS console. 17

21 Managing Users and Groups using AMS Chapter 5 Managing User Accounts Click on the Users tab in the AMS Administration console to manage user accounts. The list of user accounts is displayed. The Status Messages area provides information on the latest actions performed. The total number of users is displayed in the area next to the status messages area. Click on a user account name in the list to view details of the user account.\ You can filter the information displayed by entering criteria in the Filter Records box above a column s title. To edit the user account details, click on the Edit tab. You can change the user account password from the Edit tab. You can also freeze an account by selecting Freeze Account option in the Edit tab. After updating the user account details, click on the Save button to update the information. To add a new user, click on the Add New button. Enter the details of the user account. The required fieldsare marked with a (*) symbol. Click on the Save button to create the new user account. To delete a user account, click on the Delete button ( ) located in the same row. Confirm your choice to delete the user account in the dialog box that appears. 18

22 Chapter 5 Managing Users and Groups using AMS Managing User Groups Click on the User Groups tab in the AMS Administration Console to manage user groups. The list of groups is displayed. Click on the View tab to view the list of users in the group. A group can have several sub-groups. This is also displayed in the View tab. Click on the Delete button ( ) in the row of a group to delete it. Confirm your choice in the dialog box that appears. To Add a new group, click on the Add New button. Enter a GroupName, a GroupID and click on the Save button. The new group will be added to the list of groups. Click on the Edit tab to edit the members of the group. All the available users will be listed. Choose the members you want to add or remove and click on the Add or Remove buttons. You can create a group and assign it as a sub-group to any other group from this section. You can set Administrator privileges by selecting the Set Admin Privilege option in the Edit group form. By doing so, all the members of the group will be able to access the AMS Administration Console. 19

23 Location of PBS Works Files Chapter 6 Chapter 6 Location of PBS Works Files The installation directory, which will be referred to as <PBS_WORKS_INSTALL_DIR>, for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0 on Linux : /opt/altair/pbsworks/12.0 Tomcat Web Server Files The Tomcat web server configuration files can be found at <PBS_WORKS_INSTALL_DIR>/thirdparty/ apache/tomcat/conf. Files located in this directory can be used to enable SSL. Apache Log4j Properties File The Apache Log4j properties file can be found at <PBS_WORKS_INSTALL_DIR>/config/log4j. properties. This file can be used to configure PBS Works logging. PBS Works Platform Configuration File The PBS Works platform configuration file can be found at <PBS_WORKS_INSTALL_DIR>/config/ platform.xml. This file can be used to configure PBS Works session timeout and language settings. Postgres Configuration File The Postgres configuration file can be found at <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/ tomcat/conf/context.xml. This file can be used to configure the Postgres database. PBS Works License Server Configuration File The PBS Works license server configuration file can be found at <PBS_WORKS_INSTALL_DIR>/binaries/ framework/data/adminsettings.xml. This file can be used to configure the PBS Works license server. 20

24 Chapter 6 Location of PBS Works Files PBS Works Authentication Configuration Files The PBS Works Access Management Service files can be found at <PBS_WORKS_INSTALL_DIR>/config/ AAServiceHome/config. Files located in this directory can be used to configure Access Management Service. PBS Works Script Files The PBS Works script files can be found at <PBS_WORKS_INSTALL_DIR>/scripts. Script files located in this directory can be used to configure file operations performance and JVM performance. Log Files PBS Works Log Files The PBS Works log files can be found at <PBS_WORKS_INSTALL_DIR>/logs/cmlog.log Apache Tomcat Logs The Apache Tomcat log file can be found at <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/ tomcat/logs/catalina.out Postgres Server Log The Postgres server log file can be found at <PBS_WORKS_INSTALL_DIR>/thirdparty/postgres/ pbsworksdata/postgres_server.log 21

25 Database Field Lengths Chapter 7 Chapter 7 Database Field Lengths Database field lengths: account_name Character varying(500) application Character varying(500) architecture Character varying(500) check_point Character varying(500) error_path Character varying(500) execution_host Character varying(500) hold_types Character varying(500) jobid Character varying(500) job_name Character varying(500) job_state Character varying(500) join_path Character varying(500) keep_files Character varying(500) mailstatus Character varying(1) mail_points Character varying(500) output_path Character varying(500) pbs_job_directory Character varying(500) queuename Character varying(500) re_runnable Character varying(500) sandbox Character varying(500) servername Character varying(500) session_id Character varying(500) user_name Character varying(500) 22

26 The following topics are considered advanced configuration of PBS Works. Changes to any of these configurable items will effect both Compute Manager and Display Manager. These configuration tasks are NOT necessary to gain access to the either of these web applications. Please refer to the respective administration guides for more information on how to configure those products. 23

27 8.1 Configuring Authentication through AMS During installation, PBS Works can be configured to use either Windows based or SSH based authentication, or it can be configured to use the AMS datastore for authentication. Authentication information is stored in the file AA_jaas.config. The location of the file for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0\config\AAServiceHome\config on Linux : /opt/altair/pbsworks/12.0/config/aaservicehome/config PBS Works supports the following methods for authentication: Using SSH Using Windows Using the AMS datastore Using NIS Using PAM Please note that PAM and NIS have not been fully tested, therefore use of these authentication methods should be used with caution. Sample configuration files for all authentication methods are stored in the AAServiceHome directory. Administrators can use these configuration files for: Changing the authentication from one method to another Changing the SSH server Connecting to an LDAP/AD datastore Changing the NIS server 24

28 8.1.1 Changing Authentication to SSH To change authentication to SSH follow the instructions below. If SSH is currently being used for authentication, and you only need to change the SSH server, then see Changing the SSH Server. 1. Back up the existing AA_jaas.config. 2. Copy the sample configuration file AA_jaas.config.ssh to AA_jaas.config. 3. Update the SSH server by following the instructions for Changing the SSH Server. 4. Restart the PBS Works service. Changing the SSH server 1. Edit the AA_jaas.config file to change the SSH server that will be used to authenticate PBS Works users. Replace <SSH_SERVER> with the new SSH server IP address or hostname. AA_jaas.config.ssh file LoginModule { com.altair.jaas.module.sshunixloginmodule Required host="<ssh_server>" cache_ttl="60"; }; Super_User_Login { com.altair.jaas.module.datastoreloginmodule Required; }; 25

29 8.1.2 Changing Authentication to Windows To change authentication to Windows follow the instructions below: 1. Back up the existing AA_jaas.config. 2. Copy the sample configuration file AA_jaas.config.win to AA_jaas.config. 3. Restart the PBS Works service. AA_jaas.config.windows file LoginModule { com.altair.jaas.module.processrunnerwindowsloginmodule Required; }; Super_User_Login { com.altair.jaas.module.datastoreloginmodule Required; }; 26

30 8.1.3 Changing Authentication to use the AMS Datastore To change authentication to use the AMS datastore follow the instructions below: 1. Back up the existing AA_jaas.config. 2. Copy the sample configuration file AA_jaas.config.ds to AA_jaas.config. 3. If you wish to populate the AMS datastore with information stored in a Windows Active Directory (AD), or a Lightweight Directory Access Protocol (LDAP) compatible server, then provide the necessary information to connect to the LDAP/AD by following the instructions for Connecting to a LDAP/AD. Otherwise, users and groups will have to added to the AMS datastore using the AMS console - see Authentication and Authorization for more information. 4. Restart the PBS Works service. AA_jaas.config.ds file LoginModule { com.altair.jaas.module.datastoreloginmodule Required java.naming.security.authentication="simple" debug="true"; }; Super_User_Login { com.altair.jaas.module.datastoreloginmodule Required; }; Connecting to a LDAP/AD 1. Edit the Datastore.properties file to provide the necessary LDAP/AD information. The location of the file for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0\config\AAServiceHome\config\Datastore on Linux : /opt/altair/pbsworks/12.0/config/aaservicehome/config/datastore Replace all LDAP attributes with the appropriate values of the LDAP/AD. Note: Please check with Altair support for valid values of the below attributes. LDAP attribute 27 Description Example com.altair.aaservice.ldap.departmentid Id for Department attribute in AD Example value can be department com.altair.aaservice.ldap.domain Domain Name of AD Example value can be example. organization.com com.altair.aaservice.ldap.titleid ID for Title attribute in AD Example value can be title com.altair.aaservice.ldap.domaincomponent Domain Component of AD Example value can be DC=example, DC=organization,

31 LDAP attribute Description Example DC=com com.altair.aaservice.ldap.firstnameid ID for First Name attribute in AD> Example value can be givenname com.altair.aaservice.ldap.countryid ID for Country attribute in Example value can be c AD com.altair.aaservice.ldap.domainuser. password Encrypted password of Example value can be the existing user in AD x0leophma1kn+xd5ov0qfq== to query information from AD com.altair.aaservice.ldap.domainuser.id Existing User ID in AD to Example value can be testuser Query User details and Group Membership from AD com.altair.aaservice.ldap.url Valid LDAP/AD URL to connect Example value can be ldap:// :389/ com.altair.aaservice.ldap.locationid ID for Location Attribute in AD Example value can be l com.altair.aaservice.ldap.managerid ID for Manager Attribute in AD Example value can be manager java.naming.factory.initial=com.sun.jndi.ldap. Java naming factory LdapCtxFactory Do not change this attribute com.altair.aaservice.ldap. commannameattributeid Example value can be CN com.altair.aaservice.ldap.telephonenoid ID for Common Name in AD ID for Telephone Number Example value can be in AD telephonenumber com.altair.aaservice.ldap.roleattributeid ID for Role attribute in AD Example value can be memberof com.altair.aaservice.ldap.lastnameid ID for Last Name attribute in AD Example value can be sn com.altair.aaservice.ldap.emaiid <ID for attribute in Example value can be mail AD com.altair.aaservice.ldap.uidattrname ID for User Id attribute in Example value can be AD samaccountname 28

32 LDAP attribute com.altair.aaservice.ldap.groupcontainer Description Group Container in AD Example Can have multiple values separated by a semicolon (;) Example value can be OU=Distribution Groups, OU=Groups,DC=example, DC=Organization, DC=com ; OU=Distribution Groups2,OU=Groups, DC=example,DC=Organization, DC=com com.altair.aaservice.ldap.groupobjectclass Object class for Group in Example value can be group AD com.altair.aaservice.ldap.usercontainer User Container in AD Can have multiple values separated by a semicolon (;) Example value can be CN=Users, DC=example,DC=Organization, DC=com ; OU=NoScrSvr, OU=MKTG,,DC=example, DC=Organization,DC=com com.altair.aaservice.ldap.userobjectclass Object Class for User in AD Example value can be user com.altair.aaservice.ldap.memberattributeid ID for Member attribute in Example value can be member AD com.altair.aaservice.ldap. reconnecttimeinseconds 29 Reconnect time in seconds in case of network issues Example value can be 10

33 Datastore.properties com.altair.aaservice.ldap.departmentid=<id for Department Attribute in AD> com.altair.aaservice.ldap.domain=<domain Name of AD> com.altair.aaservice.ldap.titleid=<id for Title attribute in AD> com.altair.aaservice.ldap.domaincomponent=<domain Component of AD> com.altair.aaservice.ldap.firstnameid=<id for First Name attribute in AD> com.altair.aaservice.ldap.countryid=<id for Country attribute in AD> com.altair.aaservice.ldap.domainuser.password=<encrypted password of the existing user in AD to query information from AD> com.altair.aaservice.ldap.domainuser.id=<existing user id in AD to Query User details and Group Membership from AD> com.altair.aaservice.ldap.url=<valid LDAP/AD URL to connect> com.altair.aaservice.ldap.locationid=<id for Location Attribute in AD> com.altair.aaservice.ldap.managerid=<id for Manager Attribute in AD> java.naming.factory.initial=com.sun.jndi.ldap.ldapctxfactory com.altair.aaservice.ldap.commannameattributeid=<id for Common Name in AD> com.altair.aaservice.ldap.telephonenoid=<id for Telephone Number in AD> com.altair.aaservice.ldap.roleattributeid=<id for role attribute in AD> com.altair.aaservice.ldap.lastnameid=<id for Last name attribute in AD> com.altair.aaservice.ldap.emaiid=<id for attribute in AD> com.altair.aaservice.ldap.uidattrname=<id for User Id attribute in AD> com.altair.aaservice.ldap.groupcontainer=<group Container in AD> com.altair.aaservice.ldap.groupobjectclass=<object Class for Group in AD> com.altair.aaservice.ldap.usercontainer=<user Container in AD> com.altair.aaservice.ldap.userobjectclass=<object Class for User in AD> com.altair.aaservice.ldap.memberattributeid=<id for Member attribute in AD> com.altair.aaservice.ldap.reconnecttimeinseconds= <Reconnect time in seconds in case of network issues> 30

34 8.1.4 Changing Authentication to NIS To change authentication to NIS follow the instructions below. If NIS is currently being used for authentication, and you only need to change the NIS server, then see Changing the NIS Server. 1. Back up the existing AA_jaas.config. 2. Copy the sample configuration file AA_jaas.config.nis to AA_jaas.config. 3. Download nis-1_2_1.zip from 4. Extract the file nis-1_2_1.zip. 5. Copy the jar files nis.jar and providerutil.jar from <EXTRACTED_LOC>/lib to <PBSWORKS_INSTALL_DIR>/binaries/common where <EXTRACTED_LOC> is the location where the nis-1_2_1.zip file was extracted and <PBSWORKS_INSTALL_DIR> is the location where PBS Works was installed. 6. Update the NIS server by following the instructions for Changing the NIS Server. 7. Restart the PBS Works service. Changing the NIS server 1. Edit the AA_jaas.config file to change the NIS user and group URL by replacing <NIS_USER_URL> and <NIS_GROUP_URL> with the appropriate values. For example: user.provider.url="nis://nisserverhostname/nisdomain/user" group.provider.url="nis://nisserverhostname/nisdomain/system/group" LoginModule { com.sun.security.auth.module.jndiloginmodule Required strongdebug="false" user.provider.url="<nis_user_url>" group.provider.url="<nis_group_url>" tryfirstpass="false" usefirstpass="false" storepass="true" clearpass="true" debug="true" java.naming.factory.initial=com.sun.jndi.nis.nisctxfactory; }; Super_User_Login { com.altair.jaas.module.datastoreloginmodule Required; }; 31

35 8.1.5 Changing Authentication to PAM To change authentication to PAM follow the instructions below: 1. Back up the existing AA_jaas.config. 2. Copy the sample configuration file AA_jaas.config.pam to AA_jaas.config. 3. Download jaas-pam-0.2-src.tar.gz from 4. Extract the contents of the compressed file. This will create a directory called jaas-pam Set the environment variable JAVA_HOME, where <PBS_WORKS_INSTALL_DIR> is the installation directory of PBS Works. export JAVA_HOME=<PBS_WORKS_INSTALL_DIR>/thirdparty/java 6. Navigate to the following directory <PAM_EXTRACT_DIR>/jaas-pam-0.2/src/java, where <PAM_EXTRACT_DIR> is where the jaas-pam files were extracted. 7. Compile the jaas-pam java classes by issuing the following commands: $JAVA_HOME/bin/javac -encoding ISO ch/odi/jaaspam/*.java $JAVA_HOME/bin/javac -encoding ISO ch/odi/pam/*.java 8. Create a jar file from the compiled java classes by issuing the following command: jar cvf <jar_file_name> ch/odi/jaaspam/*.class ch/odi/pam/*.class 9. Copy the generated jar file to <PBS_WORKS_INSTALL_DIR>/binaries/common. 10. Restart the PBS Works service. AA_jaas.config.pam file LoginModule { ch.odi.jaaspam.pamloginmodule Required service=login; }; Super_User_Login { com.altair.jaas.module.datastoreloginmodule Required; }; 32

36 8.2 Configuring Administrative Users During the installation of PBS Works, the installation process prompts for a userid that will be used to administer the PBS Works portal. This user will be responsible for administering the CM web application, for example adding PAS servers to CM. The installation process adds this administrator to a group called "altairadmin". To add or remove PBS Works portal administrators, simply add or remove users from this group using AMS. 33

37 8.3 Configuring File Operations Performance When a job is running and a user wants to view or download a file from the execution directory of the job, PBS Works asks PBS Application Services (PAS) for the contents of the file in chunks. By default, PBS Works asks for 8 MB of content at a time, therefore a 100 MB file results in 100/8 number of calls to PAS. To improve the performance this default can be set to a higher value (16, 32, 64, etc.). For instance, increasing the default from 8 MB to 16 MB, halves the number of calls to PAS. This default is stored in a script file called server-start.sh on Linux and PBSWorksService.bat on Windows. The location of this file for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0\scripts on Linux : /opt/altair/pbsworks/12.0/scripts The argument that needs to be modified is the JVM argument -DAIF_FILECHUNK_SIZE_MB. server-start.sh file This is the area of the file that will need to be modified (this file is too large to show in its entirety): #--- CM Specific Pararmeters echo "Setting CM Paramters" if [ "$HWE_CM" == "INSTALLED" ] ; then JAVA_OPTS="$JAVA_OPTS -DAIF_WSDL_LOCATION=file:///$HWE_INSTALLATION_DIRECTORY/services/cm/ config/wsdl/" JAVA_OPTS="$JAVA_OPTS -DAIF_FILECHUNK_SIZE_MB=8" fi PBSWorksService.bat file This is the area of the file that will need to be modified (this file is too large to show in its entirety): rem Set base parameters "%EXECUTABLE%" //US//%SERVICE_NAME% --Environment "HWE_INSTALLATION_DIRECTORY=% HWE_INSTALLATION_DIRECTORY%#PATH='%PATH%'" --JvmOptions "-Xmx1024m;-Djava.security.auth. login.config=%hwe_installation_directory%/config/login.config;-dhwe_installation_directory=% HWE_INSTALLATION_DIRECTORY%;-DAIF_WSDL_LOCATION="file:///"%HWE_INSTALLATION_DIRECTORY%"/ services/cm/config/wsdl/";-dderby.system.home=%hwe_installation_directory%/binaries/ framework/data/datastore;-dderby.infolog.append=true;-djava.protocol.handler.pkgs=com.altair. common.filetransfer;-dcatalina.base=%catalina_base%;-dcatalina.home=%catalina_home%;-djava. endorsed.dirs=%catalina_home%/endorsed;-daif_filechunk_size_mb=8" --StartMode jvm --StopMode jvm 34

38 Increasing the value of the JVM argument -DAIF_FILECHUNK_SIZE_MB improves performance, however, this has an adverse affect on memory (RAM required). If this value is set to 32 MB and 10 users are simultaneously downloading the file, potentially 32*10 MB of RAM could be required just for downloads. This can result in an OutOfMemory exception, therefore take careful consideration when determining the optimal value for this argument. The PBS Works service will need to be restarted for the changes to be reflected after updating the JVM argument -DAIF_FILECHUNK_SIZE_MB: 35

39 8.4 Configuring JVM Performance To sustain a large number of concurrent users (over 30), the Java Virtual Machine (JVM) heap size may need to be adjusted. Currently, the default JVM heap size is 1024 MB. If OutOfMemory errors or warnings are reported in the PBS Works log files, this value should be increased. It can be increased in multiples of 256 MB. Thie Java heap size default is stored in a script file called server-start.sh on Linux and hweportal.bat on Windows. The location of this file for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0\scripts on Linux : /opt/altair/pbsworks/12.0/scripts The JVM argument that needs to be modified is the -Xmx1024m argument. Increase the "1024" value. server-start.sh file This is the area of the file that will need to be modified (this file is too large to show in its entirety): CATALINA_OPTS="-Xmx1024m -D${prodid}" CATALINA_OPTS="$CATALINA_OPTS -Djava.security.auth.login.config=$HWE_INSTALLATION_DIRECTORY/ config/login.config" CATALINA_OPTS="$CATALINA_OPTS -Djava.protocol.handler.pkgs=com.altair.common.filetransfer" export CATALINA_OPTS hweportal.bat file This is the area of the file that will need to be modified (this file is too large to show in its entirety): set CATALINA_OPTS= "-Xmx1024m" set CATALINA_OPTS="-Djava.security.auth.login.config=%HWE_INSTALLATION_DIRECTORY%/config/ login.config" set CATALINA_HOME=%TOMCAT_HOME% The PBS Works service will need to be restarted for the changes to be reflected after updating the JVM argument -Xmx1024m 36

40 8.5 Configuring SSL Enabling SSL for PBS Works on Linux requires root privileges. Typically, the PBS Works service is installed and configured to use port If this port is not available during installation, then the PBS Works installer will increment the port number and try again. This will continue until a free port is found, or until 100 consecutive ports are refused at which point the installer will ask for a port. The following instructions assume that PBS Works is configured to use port If your installation of PBS Works is using a different port, then these instructions will need to be modified accordingly (i.e., references to port 8086 must be changed to the correct port). The PBS Works installation directory will be denoted by <PBS_WORKS_INSTALL_DIR>. The installation directory for a typical installation of PBS Works is: on Linux : /opt/altair/pbsworks/ Determine if the environment variable JAVA_HOME is set properly by entering the following at the Linux command line prompt: echo $JAVA_HOME JAVA_HOME should be set to <PBS_WORKS_INSTALL_DIR>/thirdparty/java. If it is not then enter the following command: export JAVA_HOME=<PBS_WORKS_INSTALL_DIR>/thirdparty/java 2. Create a Tomcat Certificate Keystore File by running the following command: $JAVA_HOME/bin/keytool -keystore <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/tomcat/conf/ keystore -genkey -alias PBSWorks -keyalg RSA After executing this command, you will first be prompted for the keystore password. The default password used by Tomcat is "changeit" (all lower case), although you can specify a custom password if you like. You will also need to specify the custom password in the server.xml configuration file, as described in step 3. Next, you will be prompted for general information about this Certificate, such as company, contact name, and so on. This information will be displayed to users who attempt to access a secure page in your application, so make sure that the information provided here matches what they will expect. Finally, you will be prompted for the key password, which is the password specifically for this Certificate (as opposed to any other Certificates stored in the same keystore file). You MUST use the same password here as was used for the keystore password itself. This is a restriction of the Tomcat implementation. (Currently, the keytool prompt will tell you that pressing the ENTER key does this for you automatically.) If everything was successful, you now have a keystore file in the <PBS_WORKS_INSTALL_DIR>/ thirdparty/apache/tomcat/conf directory with a Certificate that can be used by your server. 37

41 There are two options for configuring SSL: Option 1 - enable secure access to PBS Works over port 8443 Option 2 - enable secure access to PBS Works over port 8443 with redirection through http port

42 8.5.1 Configuring a Secure Open Port This option enables secure access to PBS Works over port With this option, access to PBS Works is only available through port 8443, with no redirection from the default http port of PBS Works runs as a normal user (pbsworksuser). The pbsworksuser does not have permission to use privileged ports (443), therefore a non-privileged port (8443) is used. If you have enabled SSL using the Configuring a Secure Open Port with Redirection option, then please back out those changes prior to completing the following steps: 1. Configure the secure public port (8443) by editing the Tomcat server configuration file <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/tomcat/conf/server.xml. Comment out the following http connector: <Connector connectiontimeout="20000" port="8086" protocol="http/1.1" redirectport="8443"/> so that it looks like this: <!-<Connector connectiontimeout="20000" port="8086" protocol="http/1.1" redirectport="8443"/> --> Paste the following block of code: <Connector port="8443" maxthreads="200" scheme="https" secure="true" SSLEnabled="true" keystorefile=" <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/tomcat/conf/keystore" keystorepass="changeit" clientauth="false" sslprotocol="tls"/> After the following block of code: <!-- Define a SSL HTTP/1.1 Connector on port 8443 This connector uses the JSSE configuration, when using APR, the connector should be using the OpenSSL style configuration described in the APR documentation --> The keystorepass= should be the password used during step 2. Replace <PBS_WORKS_INSTALL_DIR> with the pathname to the PBS Works installation directory. 39

43 2. To configure AMS to communicate with PBS Works over https, edit the Access Management Service client properties file <PBS_WORKS_INSTALL_DIR>/config/AA/AA_Client.properties. Replace the following block of code: java.authwsdl= java.authendpoint= java.adminwsdl= java.adminendpoint= java.authnwsdl= java.authnendpoint= with this block of code: java.authwsdl= java.authendpoint= java.adminwsdl= java.adminendpoint= java.authnwsdl= java.authnendpoint= 3. The PBS Works service will need to be restarted for the changes to be reflected. Please note the restart command will return this message.. PBSWorks started, pid: <PID>, port:8086 [OK] Disregard the reference to port this is a known issue. PBS Works will now be configured to use the secure https port Accept the Certificate: From a supported web browser, navigate to certificate when you are prompted by the browser. Login to the PBS Works portal. Accept the 40

44 8.5.2 Configuring a Secure Open Port with Redirection This option enables secure access to PBS Works over port 8443, while keeping the http port 8086 open. With this option, users are redirected to the secure connection from the http port. PBS Works runs as a normal user (pbsworksuser). The pbsworksuser does not have permission to use privileged ports (443), therefore a non-privileged port (8443) is used. If you have enabled SSL using the Configuring a Secure Open Port option, then please back out those changes prior to completing the following steps: 1. Configure the secure public port (8443) by editing the Tomcat server configuration file <PBS_WORKS_INSTALL_DIR>/thirdparty/apache/tomcat/conf/server.xml. Paste the following block of code: <Connector port="8443" protocol="http/1.1" SSLEnabled="true" maxthreads="150" scheme="https" secure="true" clientauth="false" sslprotocol="tls" keystorefile="<pbs_works_install_dir>/thirdparty/apache/tomcat/conf/keystore" keyalias="pbsworks" keystorepass="changeit" /> After the following line of code which configures the http port: <Connector connectiontimeout="20000" port="8086" protocol="http/1.1" redirectport="8443"/> The keystorepass= should be the password used during step 2. Replace <PBS_WORKS_INSTALL_DIR> with the pathname to the PBS Works installation directory. 2. Edit the PBS Works framework web application configuration file <PBS_WORKS_INSTALL_DIR>/binaries/ framework/webapps/pbsworks/web-inf/web.xml to set up redirection from HOSTNAME:8086/pbsworks to Paste the following block of code: <security-constraint> <web-resource-collection> <web-resource-name>altair PBSWorks</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <user-data-constraint> <transport-guarantee>confidential</transport-guarantee> </user-data-constraint> </security-constraint> 41

45 After the following block of code: <session-config> <session-timeout>120</session-timeout> </session-config> 3. The PBS Works service will need to be restarted for the changes to be reflected. Please note the restart command will return this message.. PBSWorks started, pid: <PID>, port:8086 [OK] Disregard the reference to port this is a known issue. PBS Works will now be configured to use the secure https port Accept the Certificate: From a supported web browser, navigate to Accept the certificate when you are prompted by the browser. Login to the PBS Works portal through the URL or through the URL which will redirect the user to the secure connection. 42

46 8.6 Configuring the Postgres Database PBS Works uses Postgres 8.3 which is bundled with the PBS Works installer. PBS Works can be changed to point to a different Postgres database by updating the spring-config.xml file. The location of the file for a typical installation of PBS Works is: on Windows : C:\altair\pbsworks\12.0\services\cm\config on Linux : /opt/altair/pbsworks/12.0/services/cm/config Configuring the Postgres database The default entry in spring-config.xml that points to the PBS Works database is shown below: <bean id="cmdatasource" destroy-method="close" class="com.altair.custom.datasource. EncryptBasicDataSource"> <property name="driverclassname" value="org.postgresql.driver" /> <property name="url" value="jdbc:postgresql://localhost:6767/pbsworksdb"/> <property name="username" value="pbsworksuser" /> <property name="password" value="nnhocotwysvbm8gg74e3kw==" /> <property name="maxactive" value="8" /> <property name="maxidle" value="1" /> <property name="maxwait" value="-1" /> </bean> To configure PBS Works to point to a different Postgres database: 1. Edit the spring-config.xml file and change the resource definitions for the datastore where: POSTGRES_SERVER_HOST is the hostname or IP address of the server where Postgres is installed. POSTGRES_SERVER_PORT is the port configured for Postgres. POSTGRES_DB_NAME is the Postgres database name. POSTGRES_DB_USER is the Postgres user name which PBS Works will use to connect to the database. POSTGRES_DB_PASSWORD is the password for the Postgres user name. <bean id="cmdatasource" destroy-method="close" class="com.altair.custom.datasource. EncryptBasicDataSource"> <property name="driverclassname" value="org.postgresql.driver" /> <property name="url" value="jdbc:postgresql://postgres_server_host: POSTGRES_SERVER_PORT/POSTGRES_DB_NAME"/> <property name="username" value="postgres_db_user" /> <property name="password" value="encrypted_postgres_db_password" /> <property name="maxactive" value="8" /> <property name="maxidle" value="1" /> <property name="maxwait" value="-1" /> </bean> 43

47 2. To encrypt the database password see Changing the database password. 3. The PBS Works service will need to be restarted for the changes to be reflected after updating the Postgres database information. 44