---
name: "pam_oar_adopt"
section: "8"
platform: "linux"
package: "oar-node"
version: "2.6.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/pam_oar_adopt"
---

# pam\_oar\_adopt(8)

OAR's pam\_exec script to manage ssh connections to OAR nodes

## NAME

pam\_oar\_adopt - OAR's pam\_exec script to manage ssh connections to OAR nodes

## SYNOPSIS

**pam\_oar\_adopt -a** for PAM account

**pam\_oar\_adopt -s** for PAM session

## DESCRIPTION

This script is part of the OAR resources and jobs manager software.

PAM can be configured to let users **ssh** (basic ssh, not via **oarsh**) to OAR nodes and place the created processes in the job's cgroup. It will also prevent any ssh connection to nodes that are not properly reserved.

This uses the **pam\_exec** module with the **pam\_oar\_adopt** script and the **pam\_env** module.

Once enabled, if a user has reserved a node and then connects to it using ssh, PAM will find out the job's **cgroup** and place the ssh remote process in it. It will also load the job's environment variables.

If a user tries to ssh to a node that is either not reserved, or not reserved in full (all compute resources of the node must be reserved) or reserved multiple times (e.g. 2 different jobs reserving each a subset of the node's compute resources, or using the timesharing job type), the connection will fail.

Please note that while using ssh is very convenient, **oarsh** provides extra features to connect to jobs.

## CONFIGURATION

To **enable** this feature, one must configure **pam\_oar\_adopt** in PAM and activate it in its configuration file (**/etc/oar/pam\_oar\_adopt.conf**).

### PAM CONFIGURATION

Make sure the **ssh** service (on port 22, not OAR's dedicated ssh service on port 6667) enables PAM. **/etc/ssh/sshd\_config** must contain:

```
 UsePAM yes
```

Follows an example of configuration of PAM with **pam\_oar\_adopt** on Debian-like systems:

- **/etc/pam.d/common-account**

  The following can be set as the first PAM directive in common-account:

  ```
   account required      pam_exec.so quiet stdout /usr/sbin/pam_oar_adopt -a
  ```

- **/etc/pam.d/common-session** and **/etc/pam.d/common-session-noninteractive**

  The following can be set as the last PAM directives in common-session and common-session-noninteractive:

  ```
   session required   pam_exec.so quiet stdout /usr/sbin/pam_oar_adopt -s
   session optional   pam_env.so readenv=1 envfile=/var/lib/oar/pam.env
  ```

On Debian-like systems, one can also use the **pam-auth-update** command to configure PAM and, by default, this PAM profile is installed with the oar-node package.

### PAM\_OAR\_ADOPT CONFIGURATION

The **/etc/oar/pam\_oar\_adopt.conf** file contains the following configuration options:

- **MODE** weather **pam\_oar\_adopt** is enabled or not. Possible values are:

  - **enforced**: **pam\_oar\_adopt** is enabled and will prevent any ssh connection to nodes that are not properly reserved.

    - **disabled**: **pam\_oar\_adopt** is disabled.

    By default, **pam\_oar\_adopt** is disabled.

  \[DEPRECATED\] For compatibility reasons, if the **/etc/oar/pam\_oar\_adopt\_enabled** file exists, regardless of **/etc/oar/pam\_oar\_adopt.conf**, then **pam\_oar\_adopt** is enabled.

- **WARN**

  In **disabled** mode, **pam\_oar\_adopt** will warn users about what would have been done if it was enabled. Possible values are:

  - **yes**: warn users (default).

    - **no**: do not warn users about **pam\_oar\_adopt** doing nothing.

    - **USER\_UID\_MIN**

  In **enforced** mode, **pam\_oar\_adopt** will ignore (not prevent) ssh connections from users with a UID lower than **USER\_UID\_MIN**. This is useful to allow system users to connect to nodes without being part of a job. The default value is 1000.

## NOTES

It is a good practice to prevent users to connect to OAR nodes outside of jobs (except system users: at least root and the **oar** user).

Configuring **pam\_oar\_adopt** does it, but it can also be enforced using **pam\_access** or the AllowedUsers directive in **/etc/ssh/sshd\_config**.

Conversely, in an installation where either of OAR's deploy or cosystem job types is used, which requires the oar-node package to also be installed on the deploy or cosystem frontend, it is usually normal to let any user ssh to that frontend regardless of jobs. As a result on such a frontend, **pam\_oar\_adopt** should not be installed (on Debian-like systems, one may use **pam-auth-update** to deactivate the oar-node PAM profile).

## SEE ALSO

[**pam**(7)](/pam/7.md), [**pam.conf**(5)](/pam.conf/5.md), [**pam.d**(5)](/pam.d/5.md), [**pam\_exec**(8)](/pam_exec/8.md), [**pam\_env**(7)](/pam_env/7.md), [**pam\_access**(8)](/pam_access/8.md), [**pam-auth-update**(8)](/pam-auth-update/8.md), [**ssh**(1)](/ssh/1.md), [**sshd\_config**(5)](/sshd_config/5.md), [**oarsh**(1)](/oarsh/1.md)

## COPYRIGHTS

```
 Copyright 2003-2025 Laboratoire d'Informatique de Grenoble (http://www.liglab.fr). This software is licensed under the GNU General Public License Version 2 or above. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
```