[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [HTCondor-users] ERROR: HTCondor cannot run under unlocked non-system account 'condor'




Hi Angel!  Hope time finds you well!

Re the below, the issue is not with get.htcondor.org, it is with the postinstall script in the HTCondor native packages themselves -- for the curious, the code responsible is here:

   https://github.com/htcondor/htcondor/blob/main/build/packaging/debian/htcondor.postinst#L33-L40

So using apt-get directly  instead of get_htcondor  is not going to help.

The best thing to do is to change the login shell in the passwd entry for user "condor" to "/usr/sbin/nologin".  The reason the install halts is the concern that the per-existing "condor" account is accessible by some non-privileged user.  That would be a very bad thing from a security standpoint.  Angel, do you know who can login as user "condor", and do you trust that person with near root-level access???

If you truly want to continue using the pre-existing condor account and are ok with the risks, here is a workaround.  Since Ubuntu does not have a way to skip the postinstall (that I know of),  the workaround below edits the postinstall script and before doing a re-install like so:

1. Issue the curl command to get.htcondor.org as you did below, e.g. something like:

  # curl -fsSL https://get.htcondor.org | GET_HTCONDOR_PASSWORD="xxxxx" /bin/bash -s -- --channel stable --no-dry-run --central-manager cm.myorg.edu

2. Once it stops early with the below error, cut-n-paste the following commands as root (to change lines 39 and 43 in the post-install script above, sigh):

  # mv /etc/condor/condor_config /etc/condor/condor_config.bak
  # sed -i '39s/exit 1/mv \/etc\/condor\/condor_config.bak \/etc\/condor\/condor_config/' /var/lib/dpkg/info/htcondor.postinst
  # sed -i '43s/chmod/mkdir -m/' /var/lib/dpkg/info/htcondor.postinst

3. Then re-run the exact curl command you did in step #1 above to complete the install.

We will consider adding a flag to allow an install to happen even if the 'condor' account is not a system account (i.e. the account can be used to login), but it is a pretty dangerous thing, so no promises....

Hope the above helps,
Todd



On 1/12/2023 6:17 AM, Angel de Vicente wrote:
Hello,

long time since the last time I installed HTCondor, and I'm now trying
it again, using the recommended get.hcondor script
(https://htcondor.readthedocs.io/en/v10_0/getting-htcondor/install-linux-as-root.html)

System is Ubuntu 20.04, and I'm doing:

,----
| curl -fsSL https://get.htcondor.org | sudo GET_HTCONDOR_PASSWORD="xxxxx"
| /bin/bash -s -- --channel stable --no-dry-run --central-manager
| xxx.xxx.xxx.xxx 
`----

but the installation fails with:

,----
| Setting up libcgroup1:amd64 (0.41-10) ...
| Setting up htcondor (10.0.1-1.1) ...
| ERROR: HTCondor cannot run under unlocked non-system account 'condor'
| dpkg: error processing package htcondor (--configure):
|  installed htcondor package post-installation script subprocess returned error exit status 1
| Processing triggers for man-db (2.9.1-1) ...
| Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
| Errors were encountered while processing:
|  htcondor
| E: Sub-process /usr/bin/dpkg returned an error code (1)
`----

In this server we have a condor user with Active Directory, with a uid >
1000, which I assumed it was the cause of the error. So I created a
local condor system account, hoping it would solve the problem 

,----
| $ id condor
| uid=11(condor) gid=1001(condor) groups=1001(condor),191(sieinv),2000(domain users)
`----

But after removing the half-finished installation and trying again, I
get the same error.

Is this something known? Any advice on how to get around it?

Thanks,


-- 
Todd Tannenbaum <tannenba@xxxxxxxxxxx>  University of Wisconsin-Madison
Center for High Throughput Computing    Department of Computer Sciences
Calendar: https://tinyurl.com/yd55mtgd  1210 W. Dayton St. Rm #4257
Phone: (608) 263-7132                   Madison, WI 53706-1685