Name

       condor_ssh_to_job create - an ssh session to a running job

Synopsis

       condor_ssh_to_job [-help]

       condor_ssh_to_job[-debug]  [-name schedd-name] [-pool pool-name] [-ssh ssh-command] [-keygen-options ssh-
       keygen-options]   [-shells   shell1,shell2,...]   [-auto-retry]    [-remove-on-interrupt]    cluster    |
       cluster.process | cluster.process.node [remote-command]

Description

       condor_ssh_to_jobcreates  an sshsession to a running job. The job is specified with the argument. If only
       the job clusterid is given, then the job processid defaults to the value 0.

       It is available in Unix HTCondor distributions, and it works for vanilla, vm, java, local,  and  parallel
       universe  jobs.  The  user  must  be  the  owner  of  the job or must be a queue super user, and both the
       condor_scheddand  condor_starterdaemons  must  allow  condor_ssh_to_jobaccess.  If  no   remote-commandis
       specified,  an  interactive shell is created. An alternate sshprogram such as sftpmay be specified, using
       the -sshoption for uploading and downloading files.

       The remote command or shell runs with the same user id as the running job, and it is initialized with the
       same working directory. The environment is initialized to be the same  as  that  of  the  job,  plus  any
       changes  made  by  the  shell  setup  scripts  and  any environment variables passed by the sshclient. In
       addition, the environment variable  _CONDOR_JOB_PIDS is defined. It is a  space-separated  list  of  PIDs
       associated  with the job. At a minimum, the list will contain the PID of the process started when the job
       was launched, and it will be the first item in  the  list.  It  may  contain  additional  PIDs  of  other
       processes that the job has created.

       The  sshsession  and  all  processes  it  creates  are  treated  by HTCondor as though they are processes
       belonging to the job. If the slot is preempted or suspended, the sshsession is killed or suspended  along
       with the job. If the job exits before the sshsession finishes, the slot remains in the Claimed Busy state
       and  is  treated  as  though not all job processes have exited until all sshsessions are closed. Multiple
       sshsessions may be created to the same job at the same time. Resource consumption of the sshdprocess  and
       all  processes  spawned  by it are monitored by the condor_starteras though these processes belong to the
       job, so any policies such as  PREEMPT that enforce a limit on resource consumption also take into account
       resources consumed by the sshsession.

       condor_ssh_to_jobstores ssh keys in temporary files within a newly created and uniquely named  directory.
       The  newly  created  directory will be within the directory defined by the environment variable  TMPDIR .
       When the ssh session is finished, this directory and the ssh keys contained within it are removed.

       See the HTCondor administrator's manual  section  on  configuration  for  details  of  the  configuration
       variables related to condor_ssh_to_job.

       An   sshsession   works   by   first   authenticating   and   authorizing  a  secure  connection  between
       condor_ssh_to_joband the condor_starterdaemon, using HTCondor protocols. The  condor_startergenerates  an
       ssh  key pair and sends it securely to condor_ssh_to_job. Then the condor_starterspawns sshdin inetd mode
       with its stdin and stdout attached to the TCP connection from condor_ssh_to_job. condor_ssh_to_jobacts as
       a proxy for the sshclient to communicate with sshd, using the existing connection authorized by HTCondor.
       At no point is sshdlistening on the network for connections or running with  any  privileges  other  than
       that of the user identity running the job.If CCB is being used to enable connectivity to the execute node
       from  outside  of  a firewall or private network, condor_ssh_to_jobis able to make use of CCB in order to
       form the sshconnection.

       The login shell of the user id running the job is used to run the requested  command,  sshdsubsystem,  or
       interactive  shell. This is hard-coded behavior in OpenSSHand cannot be overridden by configuration. This
       means that condor_ssh_to_jobaccess is effectively disabled if the login shell disables access, as in  the
       example programs /bin/trueand /sbin/nologin.

       condor_ssh_to_jobis  intended  to work with OpenSSHas installed in typical environments. It does not work
       on Windows platforms. If the sshprograms are installed in non-standard locations, then the paths to these
       programs will need to be  customized  within  the  HTCondor  configuration.  Versions  of  sshother  than
       OpenSSHmay work, but they will likely require additional configuration of command-line arguments, changes
       to     the     sshdconfiguration     template     file,     and     possibly    modification    of    the
       $(LIBEXEC)/condor_ssh_to_job_sshd_setup script used by the condor_starterto set up sshd.

Options

       -help

          Display brief usage information and exit.

       -debug

          Causes debugging information to be sent to  stderr , based on the value of the configuration  variable
          TOOL_DEBUG

       -name schedd-name

          Specify an alternate condor_schedd, if the default (local) one is not desired.

       -pool pool-name

          Specify an alternate HTCondor pool, if the default one is not desired.

       -ssh ssh-command

          Specify  an  alternate sshprogram to run in place of ssh, for example sftpor scp. Additional arguments
          are specified as ssh-command. Since the arguments are delimited by spaces, place  double  quote  marks
          around  the  whole  command,  to  prevent  the  shell  from  splitting  it  into multiple arguments to
          condor_ssh_to_job . If any arguments must contain spaces, enclose them within single quotes.

       -keygen-options ssh-keygen-options

          Specify additional arguments to the ssh_keygenprogram, for creating the ssh key that is used  for  the
          duration  of  the  session.  For example, a different number of bits could be used, or a different key
          type than the default.

       -shells shell1,shell2,...

          Specify a comma-separated list of shells to attempt to launch. If the first shell does  not  exist  on
          the remote machine, then the following ones in the list will be tried. If none of the specified shells
          can  be  found,  /bin/shis  used  by  default.  If  this  option  is not specified, it defaults to the
          environment variable  SHELL from within the condor_ssh_to_job environment.

       -auto-retry

          Specifies that if the job is not yet running, condor_ssh_to_job should keep trying periodically  until
          it succeeds or encounters some other error.

       -remove-on-interrupt

          If specified, attempt to remove the job from the queue if condor_ssh_to_job is interrupted via a ctrl-
          c or otherwise terminated abnormally.

       -X

          Enable X11 forwarding.

Examples

       % condor_ssh_to_job  32.0
       Welcome to slot2@tonic.cs.wisc.edu!
       Your condor job is running with pid(s) 65881.
       % gdb -p 65881
       (gdb) where
       % logout
       Connection to condor-job.tonic.cs.wisc.edu closed.

       To upload or download files interactively with sftp:

       % condor_ssh_to_job  -ssh sftp 32.0
       Connecting to condor-job.tonic.cs.wisc.edu...
       sftp> ls
       sftp> get outputfile.dat

       This  example  shows  downloading a file from the job with scp. The string "remote" is used in place of a
       host name in this example. It is not necessary to insert the correct remote host name, or  even  a  valid
       one,  because  the  connection  to  the  job  is created automatically. Therefore, the placeholder string
       "remote" is perfectly fine.

       % condor_ssh_to_job  -ssh scp 32 remote:outputfile.dat .

       This example uses condor_ssh_to_jobto accomplish the task of running rsyncto  synchronize  a  local  file
       with  a  remote  file in the job's working directory. Job id 32.0 is used in place of a host name in this
       example. This causes rsyncto insert the expected job id in the arguments to condor_ssh_to_job.

       % rsync -v -e "condor_ssh_to_job " 32.0:outputfile.dat .

       Note that condor_ssh_to_jobwas added to HTCondor in version 7.3. If one uses condor_ssh_to_jobto  connect
       to  a job on an execute machine running a version of HTCondor older than the 7.3 series, the command will
       fail with the error message

       Failed to send CREATE_JOB_OWNER_SEC_SESSION to starter

Exit Status

       condor_ssh_to_jobwill exit with a non-zero status value if it fails to set  up  an  ssh  session.  If  it
       succeeds, it will exit with the status value of the remote command or shell.

Author

       Center for High Throughput Computing, University of Wisconsin-Madison

Copyright

       Copyright (C) 1990-2013 Center for High Throughput Computing, Computer Sciences Department, University of
       Wisconsin-Madison, Madison, WI. All Rights Reserved. Licensed under the Apache License, Version 2.0.

                                                  January 2014                              condor_ssh_to_job(1)