[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [HTCondor-users] ADD_WINDOWS_FIREWALL default has also changed from True (8.6.12) to $(CondorIsAdmin)=False (8.8.12)



Ah, OK thanks Zach.

 

condor_config_val -master CondorIsAdmin

 

does indeed return True. Yet again displaying my lack of a full understanding of HTCondor intricacies! 😉 😊

 

Thanks for the clarification.

 

Cheers

 

Greg

 

From: Zach Miller <zmiller@xxxxxxxxxxx>
Sent: Thursday, 25 February 2021 11:06 PM
To: Hitchen, Greg (IM&T, Kensington WA) <Greg.Hitchen@xxxxxxxx>; HTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Subject: Re: ADD_WINDOWS_FIREWALL default has also changed from True (8.6.12) to $(CondorIsAdmin)=False (8.8.12)

 

Hi Greg,

 

This is a little confusing.  The tool "condor_config_val" is being run as an unprivileged user, so it doesn't think "CondorIsAdmin" is true.

 

You can ask the master directly what it's view of the world is:

   condor_config_val -master CondorIsAdmin

 

And if it was started as a service it should return "True".

 

However, I agree that the manual could use a little clarification here.  I'll make an update.  Thanks.

 

 

Cheers,

-zach

 

 

-----Original Message-----
From: Hitchen, Greg (IM&T, Kensington WA) <Greg.Hitchen@xxxxxxxx>
Date: Thursday, February 25, 2021 at 1:54 AM
To: HTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Cc: Zach Miller <zmiller@xxxxxxxxxxx>
Subject: ADD_WINDOWS_FIREWALL default has also changed from True (8.6.12) to $(CondorIsAdmin)=False (8.8.12)

Hi Zach

 

Just something else I noticed when looking at other changed default values between 8.6.12 and 8.8.12?

 

From the docs:

 

********************************************************************************************************

ADD_WINDOWS_FIREWALL_EXCEPTION

When set to False, the condor_master will not automatically add HTCondor to the Windows Firewall list of trusted applications.

Such trusted applications can accept incoming connections without interference from the firewall. This only affects machines

running Windows XP SP2 or higher. The default is True.

********************************************************************************************************

 

Checking default values for 8.6.12 and 8.8.12

 

****************************************************************

condor_config_val -dump -verbose on a windows machine with version 8.6.12

 

ADD_WINDOWS_FIREWALL_EXCEPTION = true

# at: <Default>

# expanded: true

# default: true

 

CondorIsAdmin = false

# at: <Detected>

# expanded: false

 

****************************************************************

condor_config_val -dump -verbose on a windows machine with version 8.8.12

 

ADD_WINDOWS_FIREWALL_EXCEPTION = $(CondorIsAdmin)

# at: <Default>

# expanded: false

# default: $(CondorIsAdmin)

 

CondorIsAdmin = false

# at: <Detected>

# expanded: false

 

***************************************************************

 

So either the documentation is incorrect, or the default is incorrect?

 

 

Cheers

 

Greg

 

 

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> On Behalf Of Zach Miller

Sent: Friday, 19 February 2021 10:34 PM

To: HTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>

Subject: Re: [HTCondor-users] Ticket #6463: Change IS_OWNER default to False

 

 

 

Hi Greg,

 

As you suggested, manually setting IS_OWNER to the previous default value should fix that issue and if that's all you care about fixing, that's probably easiest.

 

However, you might want to consider instead setting "use POLICY:Desktop".  This is a "metaknob" which is a shortcut for setting a whole bunch of things.  Here's exactly what that does:

 

use POLICY:Desktop is

        WANT_SUSPEND=($(SmallJob) || $(KeyboardNotBusy) || $(IsVanilla) ) && ( $(SUSPEND))

        WANT_VACATE=$(ActivationTimer) > 600 || $(IsVanilla)

        SUSPEND=($(KeyboardBusy) || ( (CpuBusyTime > 120) && $(ActivationTimer) > 90))

        CONTINUE=($(CPUIdle) && ($(ActivityTimer) > 10) && (KeyboardIdle > $(ContinueIdleTime)))

        PREEMPT=(((Activity == "Suspended") && ($(ActivityTimer) > $(MaxSuspendTime))) || (SUSPEND && (WANT_SUSPEND == False)))

        START=((KeyboardIdle > $(StartIdleTime)) && ( $(CPUIdle) || (State != "Unclaimed" && State != "Owner")) )

        KILL=False

        MaxJobRetirementTime=0

        CLAIM_WORKLIFE=

        SLOTS_CONNECTED_TO_KEYBOARD=$(NUM_CPUS)

        IS_OWNER=(START =?= False)

 

 

As you can see, the list line restores that particular behaviour.  You may want some of the other behaviors listed there, or maybe you are also setting those manually elsewhere in your config.  The idea is that if you set the metaknob instead, and down the line we figure out ways to improve "a good policy for a desktop", you won't have to change your config and it will pick up the new meaning and settings of the metaknob.

 

 

Cheers,

-zach

 

 

-----Original Message-----

From: HTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of Hitchen, Greg (IM&T, Kensington WA) <Greg.Hitchen@xxxxxxxx>

Date: Friday, February 19, 2021 at 2:03 AM

To: HTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>

Subject: [HTCondor-users] Ticket #6463: Change IS_OWNER default to False

I think weâve just been bitten by this change when upgrading from 8.6.12 to 8.8.12

 

 

 

Looking through the 8.7 development series changelog shows:

 

 

 

Version 8.7.6

 

Release Notes:

 

    HTCondor version 8.7.6 released on January 4, 2018.

 

New Features:

 

    Changed the default value of configuration parameter IS_OWNER to False. The previous default value is now set as part of the use POLICY : Desktop configuration template. (Ticket #6463)

 

IS_OWNER = (START =?= False)

 

 

 

 

 

 

âThe Owner state (and IS_OWNER) is an artifact of Condor's cycle-scavenging roots."

 

 

 

We ARE cycle scavenging from staff desktops/laptops. I assume if we explicitly set:

 

IS_OWNER = (START =?= False)

 

in the config files then the previous behaviour will be restored?

 

 

 

Thanks

 

 

 

Cheers

 

 

 

Greg

 

 

 

P.S. some more checking default configs show some other (maybe important?) differences.

 

 

 

8.6.12                                                                                              8.8.12

 

ADD_WINDOWS_FIREWALL_EXCEPTION = true                  ADD_WINDOWS_FIREWALL_EXCEPTION = false

 

CondorIsAdmin = true                                                                CondorIsAdmin = false

 

CURB_MATCHMAKING = false                                                 CURB_MATCHMAKING = RecentDaemonCoreDutyCycle > 0.98

 

 

 

I donât think the matchmaking one will cause probs, and thereâs a bunch of others to

 

do with concurrent uploads/downloads and negotiator max times that shouldnât be an issue.