(Click to open topic with navigation)

Installation and Configuration > Manual installation > Installation > Installing Moab Accounting Manager

Installing Moab Accounting Manager

These instructions describe how to install and start Moab Accounting Manager (MAM).

ClosedPrerequisites

Moab Accounting Manager uses a configurable server port (default 7112) for client-server communication. If you have a firewall enabled, you will need to configure the firewall to allow the server port. If you intend to use the MAM web GUI, you will also need to allow port 443 (https).

  • For RedHat-based systems using iptables:
    • [[root]# iptables-save > /tmp/iptables.mod
    [root]# vi /tmp/iptables.mod
     
    # Add the following lines immediately *before* the line matching
    # "-A INPUT -j REJECT --reject-with icmp-host-prohibited"
    -A INPUT -p tcp --dport 7112 -j ACCEPT
    -A INPUT -p tcp --dport 443 -j ACCEPT
     
    [root]# iptables-restore < /tmp/iptables.mod
    [root]# service iptables save
  • For SuSE-based systems using SuSEfirewall2:
    • [root]# vi /etc/sysconfig/SuSEfirewall2
     
    FW_SERVICES_EXT_TCP="443 7112"
     
    [root]# service SuSEfirewall2_setup restart
ClosedDependencies and packages installation

Use the following commands to install the required Moab Accounting Manager dependencies and packages (listed in the Installing Moab Accounting Manager section above).

Install the database driver

Moab Accounting Manager uses a database for transactions and data persistence. It is recommended you use the same database used by Insight (see installation instructions in the Installation Overview). MAM uses a Perl module that works with the DBI module to provide access to the database.

  • Red Hat-based system:
    • [root]# yum install perl-DBD-Pg
  • SuSE-based system:
    • [root]# zypper install perl-DBD-Pg

Install other dependencies

  • Red Hat-based system:
    • [root]# yum install --skip-broken gcc perl-suidperl httpd mod_ssl rrdtool perl-CGI perl-CGI-Session perl-Config-Tiny perl-Crypt-CBC perl-Crypt-DES perl-Crypt-DES_EDE3 perl-Date-Manip perl-Time-HiRes perl-DBI perl-Digest-HMAC perl-Error perl-Log-Dispatch-FileRotate perl-Log-Log4perl perl-Term-ReadLine-Gnu perl-TermReadKey perl-XML-LibXML

    If installing on RHEL 6.5, you might encounter failed dependencies on perl(Config::Tiny), perl(Email::Date::Format) and perl(RRDs).

    One way to overcome this is to install the dependencies from a reputable FTP site such as rpmfind.net or pbone.net. For example:

    [root]# rpm -Uvh ftp://195.220.108.108/linux/centos/6.5/os/x86_64/Packages/rrdtool-perl-1.3.8-6.el6.x86_64.rpm
    [root]# rpm -Uvh ftp://www.rpmfind.net/linux/centos/6.5/os/x86_64/Packages/perl-Email-Date-Format-1.002-5.el6.noarch.rpm
    [root]# rpm -Uvh ftp://www.rpmfind.net/linux/centos/6.5/os/x86_64/Packages/perl-Config-Tiny-2.12-7.1.el6.noarch.rpm

    When done, re-run the original yum install command.

    Alternatively, you can install the missing modules from CPAN:

    [root]# cpan Config::Tiny Log::Log4perl Log::Dispatch::FileRotate
  • SuSE-based system:
    • [root]# zypper install gcc lsb-release apache2 openssl-devel perl-CGI-Session perl-Crypt-CBC perl-Crypt-DES perl-Date-Manip perl-DBI perl-Digest-HMAC perl-Digest-SHA1 perl-Error perl-Log-Log4perl perl-TermReadLine-Gnu perl-XML-LibXML perl-TermReadKey perl-Params-Validate perl-YAML perl-Log-Dispatch
[root]# chmod 4755 /usr/bin/sperl*

    The Config::Tiny Log::Log4perl Log::Dispatch::FileRotate modules are not distributed with SLES as RPMs. One way to overcome this is to install the RPM dependencies from a reputable FTP site such as rpmfind.net or pbone.net. For example, if you are using SLES 11 SP3, you might install the required modules by doing the following:

    [root]# rpm -Uvh ftp://ftp.pbone.net/mirror/ftp5.gwdg.de/pub/opensuse/repositories/devel:/languages:/perl/SLE_11_SP3/noarch/perl-Config-Tiny-2.14-26.2.noarch.rpm
    [root]# rpm -Uvh ftp://ftp.pbone.net/mirror/ftp5.gwdg.de/pub/opensuse/repositories/devel:/languages:/perl/SLE_11_SP3/x86_64/perl-Crypt-DES_EDE3-0.01-10.2.x86_64.rpm
    [root]# rpm -Uvh ftp://ftp.pbone.net/mirror/ftp5.gwdg.de/pub/opensuse/repositories/devel:/languages:/perl/SLE_11_SP3/x86_64/perl-Log-Dispatch-FileRotate-1.19-34.2.x86_64.rpm

    Alternatively, you can install the missing modules from CPAN:

    [root]# cpan Config::Tiny Crypt::DES_EDE3 Log::Dispatch::FileRotate

If any of the Perl module packages fail to install or are unavailable for your system, you can install it from CPAN by running cpan MODULENAME where MODULENAME is the respective perl module name.

Optional: To build a custom RPM

  1. Install rpm-build.
    2. [root]# yum install rpm-build
  2. Download the latest MAM build (mam-8.0.1.tar.gz) from the Adaptive Computing website.

    3. The variable marked <version> is the desired version of the suite; for example, 8.0.1.

  3. Untar the downloaded package.
  4. Change directories into the untarred directory.
  5. Edit the ./mam.spec file for RPM customization.
  6. Run ./rpm-build.
  7. Locate the custom RPM in rpm/RPMS/x86_64.

To install Moab Accounting Manager

  1. Create a user called mam and switch to that user.
    2. [root]# useradd -m mam
[root]# su - mam
[mam]$ mkdir src
[mam]$ cd src
  2. Download the latest MAM build (mam-8.0.1.tar.gz) from the Adaptive Computing website.
  3. Untar the MAM tarball.
    4. [mam]$ tar -zxvf mam-8.0.1.tar.gz
  4. Verify that each of the dependencies and prerequisites (listed above) are satisfied.
  5. Navigate to mam-8.0.1.
    6. [mam]$ cd mam-8.0.1
  6. Configure the software. For a list of all the configuration options, see Moab Accounting Manager configuration options. 
    [mam]$ ./configure
  7. Compile and install the software.
    8. [mam]$ make
[mam]$ exit
[root]# cd ~mam/src/mam-8.0.1
[root]# make install
  8. As the database user, create a database called mam and grant database privileges to the mam user.

    PostgreSQL should have previously been installed using the instructions in Preparing for installation.

    [root]# su - postgres
[postgres]$ psql

create database "mam";
create user mam with password 'changeme!';
\q

[postgres]$ exit

    The password you define must be synchronized with the database.password value in /opt/mam/etc/goldd.conf

    [root]# vi /opt/mam/etc/goldd.conf
     
database.password = changeme!
  9. Run the hpc.sql script to populate the Moab Accounting Manager database with objects, actions, and attributes necessary to function as an Accounting Manager. 
    [root]# su - mam
[mam]$ cd src/mam-8.0.1
[mam]$ psql mam < hpc.sql
[mam]$ exit
  10. Configure MAM to automatically start up at system boot, then start the mam service. 
    11. [root]# chkconfig --add mam
[root]# service mam start
  11. Copy the auto-generated secret key from the token.value parameter in the /opt/mam/etc/site.conf file. Add it to the moab-private.cfg file as the value of the CLIENTCFG KEY attribute so that Moab Workload Manager can communicate with Moab Accounting Manager. Restart Moab Workload Manager.
    12. [root]# vi /opt/moab/etc/moab-private.cfg
    CLIENTCFG[AM:mam] KEY=<MAMSecretKey> AUTHTYPE=HMAC64
     
[root]# service moab restart

  12. Configure Apache to use SSL (needed only for SuSE-based systems).

    SuSE-based system:

    13. [root]# a2enflag SSL
  13. ClosedIf you plan to use the web GUI, do each of the following steps:
    1. As root, add or edit the SSL virtual host definition as appropriate for your environment. To do so, configure the cgi-bin directory in ssl.conf. Below the cgi-bin directory element, create an alias for /cgi-bin pointing to your cgi-bin directory. If you chose to install to a cgi-bin sub-directory, you might want to create an alias for that as well. Also, add index.cgi to the DirectoryIndex so you can use the shorter sub-directory name.
      • RedHat-based system:
        • [root]# vi /etc/httpd/conf.d/ssl.conf

<Directory "/var/www/cgi-bin">
## Add these lines
  Options ExecCGI
  AddHandler cgi-script .cgi
  AllowOverride All
  Order allow,deny
  Allow from all
</Directory>

# Aliases for /cgi-bin
Alias /cgi-bin/ /var/www/cgi-bin/
Alias /mam /var/www/cgi-bin/mam/

# Make shorter sub-dir name available
DirectoryIndex index.cgi
      • SuSE-based system:
        • [root]# cp /etc/apache2/vhosts.d/vhost-ssl.template /etc/apache2/vhosts.d/mam-ssl.conf
[root]# vi /etc/apache2/vhosts.d/mam-ssl.conf

<Directory "/srv/www/cgi-bin">
## Add these lines
  Options ExecCGI
  AddHandler cgi-script .cgi
  AllowOverride All
  Order allow,deny
  Allow from all
</Directory>

# Aliases for /cgi-bin
Alias /cgi-bin/ /srv/www/cgi-bin/
Alias /mam /srv/www/cgi-bin/mam/

# Make shorter sub-dir name available
DirectoryIndex index.cgi
    2. For RedHat-based systems where Security Enhanced Linux (SELinux) is enforced, you need to adjust SELinux to allow the web server to make network connections, use setuid for authentication, and write to the log file. To determine the current mode of SELinux, run getenforce.
      3. [root]# getenforce
                                    
Enforcing

      If the command returns a mode of Disabled or Permissive, or if the getenforce command is not found, you can skip the rest of this step.

      If the command returns a mode of Enforcing, you can choose between options of customizing SELinux to allow the web GUI to perform its required functions or disabling SELinux on your system.

      • If you choose to customize SELinux, run steps like the following. It is important to note that SELinux can vary by version and architecture and that these instructions may not work in all possible environments.

        • If you used the --prefix=<prefix> configuration option when you configured Moab Accounting Manager, you must replace references to /opt/mam in the example below with the <prefix> you specified.

        [root]# cat > mamgui.te <<EOF
module mamgui 1.0;
require {
        type httpd_sys_script_t;
        type port_t;
        class capability setuid;
        class tcp_socket name_connect;
}
allow httpd_sys_script_t port_t:tcp_socket name_connect;
allow httpd_sys_script_t self:capability setuid;
EOF

[root]# checkmodule -M -m -o mamgui.mod mamgui.te
[root]# semodule_package -m mamgui.mod -o mamgui.pp
[root]# semodule -i mamgui.pp
        [root]# setenforce 0
[root]# chcon -v -t httpd_sys_content_t /opt/mam/log /opt/mam/log/goldg.log*
        [root]# setenforce 1
      • If you choose to disable SELinux, use the following steps:
        • [root]# vi /etc/sysconfig/selinux
                                             
SELINUX=disabled
         
[root]# setenforce 0
    3. For the highest security, it is recommended that you install a public key certificate that has been signed by a certificate authority. The exact steps to do this are specific to your distribution and the chosen certificate authority. An overview of this process for CentOS 5 is documented here. If you are using self-signed certificates, some Mozilla Firefox users might experience certificate-related difficulties accessing MAM within Moab Viewpoint for the first time.

      4. Alternatively, if your network domain can be secured from man-in-the-middle attacks, you could use a self-signed certificate. Often this does not require any additional steps since in many distributions, such as RedHat, the Apache SSL configuration provides self-signed certificates by default.

      The following steps assume you are using self-signed certificates:

      Create self-signed SSL certificate and key files.

      • Red Hat-based system:

        • RedHat ships with ready-made certificates.

      • SuSE-based system:
        • [root]# cd /etc/apache2
[root]# openssl genrsa -out ssl.key/server.key 1024
[root]# openssl req -new -key ssl.key/server.key -x509 -out ssl.crt/server.crt
    4. Start or restart the HTTP server daemon.
      • Red Hat-based system:
        • [root]# chkconfig httpd on
[root]# service httpd restart
      • SuSE-based system:
        • [root]# chkconfig apache2 on
[root]# service apache2 restart
    5. Create a password for the mam user to be used with the MAM Web GUI.
      6. [root]# su - mam
[mam]$ gchpasswd

    You can now access the GUI at https://<hostname>/cgi-bin/mam by logging in as moab and using the password you set.

  14. You can define users, accounts, charge rates, etc., as needed for your site (for more information, see the "Getting started" section of the Moab Accounting Manager Administrator Guide). An initialization script has been provided that can set up a sample initial environment (with some dummy users, accounts, charge rates, etc.) To initialize your database with this sample data, execute the script as the mam user:
    15. [mam]$ cd src/mam-8.0.1
[mam]$ test/hpc-allocation-enforcement.sh

Related topics 

© 2014 Adaptive Computing