如何在CentOS 7中使用Firewalld启用MPI Mpirun

Question

如何在CentOS 7中使用Firewalld启用MPI Mpirun

3

我正试图在CentOS 7操作系统上的小型集群上运行MPI。防火墙正在阻止其运行。这是我得到的错误：

    $ mpirun -np 30 -hostfile hosts.txt mpi_sample_program/mpitest
    ------------------------------------------------------------
    A process or daemon was unable to complete a TCP connection
to another process:
  Local host:    marcher5
  Remote host:   ***.***.***.***.***
This is usually caused by a firewall on the remote host. Please
check that any firewall (e.g., iptables) has been disabled and
try again.
------------------------------------------------------------
--------------------------------------------------------------------------
ORTE was unable to reliably start one or more daemons.
This usually is caused by:

* not finding the required libraries and/or binaries on
  one or more nodes. Please check your PATH and LD_LIBRARY_PATH
  settings, or configure OMPI with --enable-orterun-prefix-by-default

* lack of authority to execute on one or more specified nodes.
  Please verify your allocation and authorities.

* the inability to write startup files into /tmp (--tmpdir/orte_tmpdir_base).
  Please check with your sys admin to determine the correct location to use.

*  compilation of the orted with dynamic libraries when static are required
  (e.g., on Cray). Please check your configure cmd line and consider using
  one of the contrib/platform definitions for your system type.

* an inability to create a connection back to mpirun due to a
  lack of common network interfaces and/or no route found between
  them. Please check network connectivity (including firewalls
  and network routing requirements).
--------------------------------------------------------------------------

当我使用sudo systemctl disable firewalld禁用防火墙时，MPI运行得很好。我已经尝试了一个星期，试图添加一个允许MPI运行而不关闭firewalld的规则，但是它还没有成功。我可以使用sudo iptables -A INPUT -s -j ACCEPT来实现，它起作用了。但现在由于Centos 7的原因，我必须使用firewall-cmd。你建议我怎么做才能不危及群集的安全性？我应该添加一个允许节点之间所有流量的规则吗？

我当前的firewall-cmd配置如下：

$ firewall-cmd --list-all
work (default, active)
  interfaces: eno1
  sources:
  services: dhcpv6-client ipp-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

- east.charm

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- east.charm · Accepted Answer

我尝试使用以下方法添加来源：

sudo firewall-cmd --permanent --zone=work --add-source=[host_IP]

但仍然无法使MPI应用程序正确运行。于是决定唯一的方法是制定一条规则，允许节点之间的所有流量。我运行了这两个命令。

sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -s  [server+IP] -j ACCEPT

firewall-cmd --reload

它像魔法一样运行良好。虽然不确定从安全角度来看，这是否是最佳解决方案。