Differences

This shows you the differences between two versions of the page.

--- howto:licensing [2022/04/07 22:16]
ccrosby
+++ howto:licensing [2025/01/29 09:00] (current)
ccrosby [SSH tunneling]
@@ Line 49: / Line 49: @@
-=== SSH tunneling ===
+==== SSH tunneling ====
 It is possible for compute nodes to communicate with the outside world using ssh-tunnels.  Users log into and transfer files to the cluster using the secure shell, secure copy and secure file transfer protocol, which all involve communication through port 22.  SSH tunnels allow connections made to a local port to be forwarded to a remote machine via a secure channel.  An example of accessing a remote license with an SSH tunnel through the node chpclic1 is the way that STAR-CCM+ users can check out a "power on demand" license from an open license server operated by the software vendor:
 <code>
@@ Line 76: / Line 76: @@
 <code>
 .24.44.124
+.24.44.6
 .24.44.129
+.24.44.83
+.114.44.7
 </code>
@@ Line 88: / Line 91: @@
   - Provide the CHPC with the license server port numbers as well as your license server's public IP address so that we can configure our firewall appropriately.
   - Once all these configurations have been set, test the connectivity from the nodes login1 and chpclic1 in the cluster.  For example, if the license service is on port 1234: <code> telnet mylicenseserver.myorganisation.co.za 1234 </code> or <code> nmap -Pn -p 1234 mylicenseserver.myorganisation.co.za </code>
-  -
+  - Now you can attempt to check out the license from a compute node.  Preferably first test this in an interactive PBS session, but the instructions are essentially the same as you would use in the following PBS job script snippet:
+<file bash JobScriptSnippet.pbs>
+#!/bin/bash
+#PBS -l select=.... etc
+# Set up the required number of ssh-tunnels to the license server ports
+ssh -f jblogs@chpclic1 -L *:1234:mylicenseserver.myorganisation.co.za:1234 -N
+ssh -f jblogs@chpclic1 -L *:1235:mylicenseserver.myorganisation.co.za:1235 -N
+# Set the appropriate license server environment variable.
+# Please RTFM of the software that you are using
+export LM_LICENSE_FILE=1234@localhost
+# Now run your code with the normal command line
+mpirun -np $nproc ......
+# Finally take down each of your ssh tunnels again
+kill -9 `ps ux | grep "ssh -f" |  grep -o -E '[0-9]+' | head -1 | sed -e 's/^0\+//' `
+kill -9 `ps ux | grep "ssh -f" |  grep -o -E '[0-9]+' | head -1 | sed -e 's/^0\+//' `
+</file>
+==== Alternative procedure for off-site license servers ====
+**If** the user has control over the off-site license server that they want to use, it is possible to access the license from inside the cluster by means of ssh-tunneling, **without** reconfiguring firewalls.  A reverse ssh-tunnel is used to forward a port on the license server to the loopback device of a cluster login node.  Unfortunately, this forwarded port is not visible to the cluster's internal network, therefore a second conventional ssh-tunneling command is used to connect this port on the loopback device to the internal network interface.  Unfortunately, it is not possible to do this with the same port, therefore some trickery is involved with intermediate port numbers.
+=== Alternative instructions ===
+  * The user must have the ability to run commands on the license server.
+  * Command line access to the license server is necessary.  If the license server is running Windows, this can be done with MobaXterm or Cygwin.
+  * Let us assume that the license server is running the license service on port 2345.
+  * On the license server command line, create the ssh tunnel:
+<code>
+ssh -R *:2346:localhost:2345 jblogs@scp.chpc.ac.za ssh -L *:2345:localhost:2346 jblogs@login1 -N -f
+</code>
+  * In plain English, this translates as: "Connect port 2345 on the license server to port 2346 on localhost at scp.chpc.ac.za.  Then connect port 2346 on the localhost of this same machine to port 2345 on the internal network interface of the machine internally known as login1, which just happens to be the same machine."
+  * Do the same for the second (or third) license port.  Do not try to do this through login1 or chpclic1 with default Ansys license ports, because the Ansys ports are already being used on these servers.  If you need to do this with an Ansys license, set different port numbers for all three ports.
+  * You can now access the license by setting the relevant environment variables as such in your job script:
+<code>
+export LM_LICENSE_FILE=2345@login1
+</code>
+  * When you take down the license tunnel, kill the tunnel process on the license server.  Then log into scp.chpc.ac.za (login1 internally), look for your secondary tunnel with ''ps ux | grep ssh'' and use a ''kill -9'' command followed by the process ID to take down the secondary tunnel on login1.

wiki.chpc.ac.za

User Tools

Site Tools

Differences

Page Tools