Name

       condor_ssh_to_job create - an ssh session to a running job

Synopsis

       condor_ssh_to_job [-help]

       condor_ssh_to_job[-debug]  [-name schedd-name] [-pool pool-name] [-ssh ssh-command] [-keygen-options ssh-
       keygen-options]   [-shells   shell1,shell2,...]   [-auto-retry]    [-remove-on-interrupt]    cluster    |
       cluster.process | cluster.process.node [remote-command]

Description

       condor_ssh_to_jobcreates  an sshsession to a running job. The job is specified with the argument. If only
       the job clusterid is given, then the job processid defaults to the value 0.

       It is available in Unix HTCondor distributions, and it works for vanilla, vm, java, local,  and  parallel
       universe  jobs.  The  user  must  be  the  owner  of  the job or must be a queue super user, and both the
       condor_scheddand  condor_starterdaemons  must  allow  condor_ssh_to_jobaccess.  If  no   remote-commandis
       specified,  an  interactive shell is created. An alternate sshprogram such as sftpmay be specified, using
       the -sshoption for uploading and downloading files.

       The remote command or shell runs with the same user id as the running job, and it is initialized with the
       same  working  directory.  The  environment  is  initialized  to be the same as that of the job, plus any
       changes made by the shell setup scripts and  any  environment  variables  passed  by  the  sshclient.  In
       addition,  the  environment  variable   _CONDOR_JOB_PIDS is defined. It is a space-separated list of PIDs
       associated with the job. At a minimum, the list will contain the PID of the process started when the  job
       was  launched,  and  it  will  be  the  first  item  in the list. It may contain additional PIDs of other
       processes that the job has created.

       The sshsession and all processes it creates  are  treated  by  HTCondor  as  though  they  are  processes
       belonging  to the job. If the slot is preempted or suspended, the sshsession is killed or suspended along
       with the job. If the job exits before the sshsession finishes, the slot remains in the Claimed Busy state
       and  is  treated  as  though not all job processes have exited until all sshsessions are closed. Multiple
       sshsessions may be created to the same job at the same time. Resource consumption of the sshdprocess  and
       all  processes  spawned  by it are monitored by the condor_starteras though these processes belong to the
       job, so any policies such as  PREEMPT that enforce a limit on resource consumption also take into account
       resources consumed by the sshsession.

       condor_ssh_to_jobstores  ssh keys in temporary files within a newly created and uniquely named directory.
       The newly created directory will be within the directory defined by the environment  variable   TMPDIR  .
       When the ssh session is finished, this directory and the ssh keys contained within it are removed.

       See  the  HTCondor  administrator's  manual  section  on  configuration  for details of the configuration
       variables related to condor_ssh_to_job.

       An  sshsession  works  by  first   authenticating   and   authorizing   a   secure   connection   between
       condor_ssh_to_joband  the  condor_starterdaemon, using HTCondor protocols. The condor_startergenerates an
       ssh key pair and sends it securely to condor_ssh_to_job. Then the condor_starterspawns sshdin inetd  mode
       with its stdin and stdout attached to the TCP connection from condor_ssh_to_job. condor_ssh_to_jobacts as
       a proxy for the sshclient to communicate with sshd, using the existing connection authorized by HTCondor.
       At  no  point  is  sshdlistening on the network for connections or running with any privileges other than
       that of the user identity running the job.If CCB is being used to enable connectivity to the execute node
       from  outside  of  a firewall or private network, condor_ssh_to_jobis able to make use of CCB in order to
       form the sshconnection.

       The login shell of the user id running the job is used to run the requested  command,  sshdsubsystem,  or
       interactive  shell. This is hard-coded behavior in OpenSSHand cannot be overridden by configuration. This
       means that condor_ssh_to_jobaccess is effectively disabled if the login shell disables access, as in  the
       example programs /bin/trueand /sbin/nologin.

       condor_ssh_to_jobis  intended  to work with OpenSSHas installed in typical environments. It does not work
       on Windows platforms. If the sshprograms are installed in non-standard locations, then the paths to these
       programs  will  need  to  be  customized  within  the  HTCondor  configuration. Versions of sshother than
       OpenSSHmay work, but they will likely require additional configuration of command-line arguments, changes
       to     the     sshdconfiguration     template     file,     and     possibly    modification    of    the
       $(LIBEXEC)/condor_ssh_to_job_sshd_setup script used by the condor_starterto set up sshd.

Options

       -help

          Display brief usage information and exit.

       -debug

          Causes debugging information to be sent to  stderr , based on the value of the configuration  variable
          TOOL_DEBUG

       -name schedd-name

          Specify an alternate condor_schedd, if the default (local) one is not desired.

       -pool pool-name

          Specify an alternate HTCondor pool, if the default one is not desired.

       -ssh ssh-command

          Specify  an  alternate sshprogram to run in place of ssh, for example sftpor scp. Additional arguments
          are specified as ssh-command. Since the arguments are delimited by spaces, place  double  quote  marks
          around  the  whole  command,  to  prevent  the  shell  from  splitting  it  into multiple arguments to
          condor_ssh_to_job . If any arguments must contain spaces, enclose them within single quotes.

       -keygen-options ssh-keygen-options

          Specify additional arguments to the ssh_keygenprogram, for creating the ssh key that is used  for  the
          duration  of  the  session.  For example, a different number of bits could be used, or a different key
          type than the default.

       -shells shell1,shell2,...

          Specify a comma-separated list of shells to attempt to launch. If the first shell does  not  exist  on
          the remote machine, then the following ones in the list will be tried. If none of the specified shells
          can be found, /bin/shis used by default.  If  this  option  is  not  specified,  it  defaults  to  the
          environment variable  SHELL from within the condor_ssh_to_job environment.

       -auto-retry

          Specifies  that if the job is not yet running, condor_ssh_to_job should keep trying periodically until
          it succeeds or encounters some other error.

       -remove-on-interrupt

          If specified, attempt to remove the job from the queue if condor_ssh_to_job is interrupted via a ctrl-
          c or otherwise terminated abnormally.

       -X

          Enable X11 forwarding.

Examples

       % condor_ssh_to_job  32.0
       Welcome to slot2@tonic.cs.wisc.edu!
       Your condor job is running with pid(s) 65881.
       % gdb -p 65881
       (gdb) where
       % logout
       Connection to condor-job.tonic.cs.wisc.edu closed.

       To upload or download files interactively with sftp:

       % condor_ssh_to_job  -ssh sftp 32.0
       Connecting to condor-job.tonic.cs.wisc.edu...
       sftp> ls
       sftp> get outputfile.dat

       This  example  shows  downloading a file from the job with scp. The string "remote" is used in place of a
       host name in this example. It is not necessary to insert the correct remote host name, or  even  a  valid
       one,  because  the  connection  to  the  job  is created automatically. Therefore, the placeholder string
       "remote" is perfectly fine.

       % condor_ssh_to_job  -ssh scp 32 remote:outputfile.dat .

       This example uses condor_ssh_to_jobto accomplish the task of running rsyncto  synchronize  a  local  file
       with  a  remote  file in the job's working directory. Job id 32.0 is used in place of a host name in this
       example. This causes rsyncto insert the expected job id in the arguments to condor_ssh_to_job.

       % rsync -v -e "condor_ssh_to_job " 32.0:outputfile.dat .

       Note that condor_ssh_to_jobwas added to HTCondor in version 7.3. If one uses condor_ssh_to_jobto  connect
       to  a job on an execute machine running a version of HTCondor older than the 7.3 series, the command will
       fail with the error message

       Failed to send CREATE_JOB_OWNER_SEC_SESSION to starter

Exit Status

       condor_ssh_to_jobwill exit with a non-zero status value if it fails to set  up  an  ssh  session.  If  it
       succeeds, it will exit with the status value of the remote command or shell.

Author

       Center for High Throughput Computing, University of Wisconsin-Madison

Copyright

       Copyright (C) 1990-2013 Center for High Throughput Computing, Computer Sciences Department, University of
       Wisconsin-Madison, Madison, WI. All Rights Reserved. Licensed under the Apache License, Version 2.0.

                                                  January 2014                              condor_ssh_to_job(1)