Admin Cluster Data Privacy - Revision history

Robert-schade-e757@uni-paderborn.de: Created page with "Cluster Data Priavcy Cluster Data Privacy {{DISPLAYTITLE:Cluster Data Privacy (Admin Guide)}}
2022-10-27T06:21:41Z

Created page with "Cluster Data Priavcy<nowiki /> Cluster Data Privacy<nowiki /> {{DISPLAYTITLE:Cluster Data Privacy (Admin Guide)}}<no..."

New page
[[Category:HPC-Admin|Cluster Data Priavcy]]<nowiki />
[[Category:HPC.NRW-Best-Practices|Cluster Data Privacy]]<nowiki />
{{DISPLAYTITLE:Cluster Data Privacy (Admin Guide)}}<nowiki />

== Practical Measures to increase Data Privacy on HPC Systems ==

=== SLURM ===
==== Visibility of Jobs ====
Slurm can be configured with the PrivateData option which can take different arguments depending on which information should be restricted. A detailed list can be found at [https://slurm.schedmd.com/slurm.conf.html]. This option has to be added to the slurm.conf and the slurmdbd.conf.
For a HPC system the following choice is a good starting point:
<pre>
PrivateData=accounts,users,usage,jobs,events
</pre>

==== Visibility of Data during a Job ====
Slurm job container ([https://slurm.schedmd.com/job_container.conf.html]) can be used to isolate the usage of /dev/shm and /tmp when nodes are shared between jobs.

==== Accounting Data ====
The Slurmdbd support the automatic purging of data (events, jobs, reservations, job steps, usage) in the accounting database based on a time schedule with the options PurgeEventAfter, PurgeJobAfter, PurgeResvAfter, PurgeStepAfter, PurgeSuspendAfter, PurgeTXNAfter, and PurgeUsageAfter. Together with the archiving functionality and especially the ArchiveScript fine-grained purging can be realized.

=== Visibility of Processes ===
The visibility of processes of other users on the frontend nodes or compute nodes with options like hidepid ([https://www.kernel.org/doc/html/latest/filesystems/proc.html#mount-options]), ProtectProc and ProcSubset ([https://www.freedesktop.org/software/systemd/man/systemd.exec.html]). However, careful testing of services especially monitoring services is required to avoid side effects.

=== Visibility of Login Information ===
The access to files like /var/log/lastlog, /var/run/utmp, and /var/log/wtmp can be restricted to disable tools like who, last and lastlog.