|
|
|
Roadrunner Allocations and Gaining Access
The National Computational Science Alliance (Alliance) and its member institution the Albuquerque High-Performance Computing Center (AHPCC) at the University of New Mexico make the Roadrunner Linux Supercluster available to principal investigators at U.S. educational, research, and government institutions. A principal investigator (PI) may not be a high school, undergraduate, or graduate student; a qualified advisor must serve in this capacity. A postdoc is eligible to serve as PI. As an eligible PI you may apply for an allocation of compute time or service units for a project. A service unit (SU) is roughly one processor hour of compute time. A precise definition for SUs on the cluster can be found in the charging algorithm section. Once you have received an allocation of SUs for your project you may add people including colleagues and students to your project and obtain accounts for them on the cluster. 2.0 Applying for an allocation How you apply for an allocation of compute time or SUs on the cluster depends on the size of the allocation you request. 2.1 Small or startup allocations Startup allocations are available for new users or users who have modest computational requirements (fewer than 10,000 hours). To apply, an eligible PI must complete and submit AHPCC's online application. You may request a startup award at any time, and requests take about one month to process. Only one startup account on the cluster is given to each PI. Allocations of more than 10,000 hours must be requested through one of two peer-review committees within the Alliance. For such large allocations the request and review process is managed by the Allocations Group at the National Center for Supercomputing Applications (NCSA). See the Applying for High-Performance Computing Resources page at NCSA for details and instructions. Please note that the resource on which you are given an allocation, as well as the size of the award, is up to the discretion of the committee(s). A list of all the computational resources offered by the Alliance is available online. 2.3 Award notification and default passwords After your request for an allocation on the Roadrunner cluster has been granted, you will receive by postal mail a notification that contains your default password. Please save the sheet with your default password in a safe and permanent location. Should you at sometime change your password and then later forget it, you may contact the Alliance Consulting Office and request that your password be reset to the default. The consulting staff will not disclose your default password so you must retain the original copy. This policy does not apply if you have an Alliance digital certificate that you are using to connect to Alliance resources. In this case, you are not sent a default password at all. Once you are notified that your account is active, you use your digital certificate to connect to the Roadrunner cluster. For more information about Alliance digital certificates and the Alliance Public Key Infrastructure (PKI) refer to the Alliance PKI pages. NCSA offers a webpage with tips on selecting good passwords that you should consider when you establish your new password for your account. A small fraction of the available compute time on the Roadrunner cluster is allocated as guest accounts directly by AHPCC. For more information on these types of accounts, send email to help@ahpcc.unm.edu at AHPCC. 3.0 Security and connecting to the cluster The Alliance has a history of establishing and maintaining a high degree of security on the available high-performance systems and on the networks that connect to those systems. This aggressive policy seeks to identify and address potential or real security breaches, and the result is a solid high-performance computing environment with a high level of security. 3.1 Eliminating clear text passwords So-called "clear text passwords" are unencrypted and unscrambled and thus vulnerable to detection by "sniffers" on the Internet. Internet "sniffing" can allow hackers to obtain passwords. Hackers often use the newly discovered passwords to login to a system. To prevent sniffing, AHPCC and the Alliance have taken the following steps:
3.2 Software for connecting securely Standard SSH You may connect to the Roadrunner cluster using a standard SSH client or program. (At this time only the SSH1 protocol is supported.) Further details about SSH, including links to sources for SSH binaries are available at www.ssh.org. To connect or login to an interactive node of the cluster using standard SSH:
When prompted enter your password. Because a SSH session is encrypted from the beginning, your password is not sent as clear text across the network. PKI-enabled SSH You may connect to the Roadrunner cluster using an Alliance digital certificate and a PKI-enabled version of SSH. The advantage of using a digital certificate is that you can use the same certificate to authenticate to and access all Alliance resources for which you have an allocation. In addition you need only authenticate once per session since your valid electronic credentials are forwarded from site to site as you visit various Alliance hosts. Further details about the Alliance PKI and obtaining and using an Alliance digital certificate are available online. To authenticate to the Alliance grid using your Alliance digital certificate enter
and when prompted enter your personal passphrase for your certificate. Then use a PKI-enabled version of SSH to connect to Roadrunner:
Because you have already authenticated to the Alliance using your digital certificate, you are not prompted for a password to connect to the cluster. A standard FTP session is not encrypted and passwords are sent as plain text over the network. For this reason you are not allowed to use a standard FTP client or program to transfer files to Roadrunner while connected to another host. Instead you must use one of the methods outlined below to transfer files to Roadrunner. Once you are connected to Roadrunner, however, you may use standard FTP to connect to another system and transfer files. Once you are connected to Roadrunner, use standard FTP to transfer files to and from that system. SCP You can use the secure copy protocol (SCP) to copy files to the cluster. SCP uses SSH for data transfer and uses the same authentication as SSH so that your password is not sent as clear text over the network. Because SCP uses the same authentication as SSH you use SCP in the same way whether you are using a standard SSH client or a PKI-enabled client. SCP clients or programs are generally distributed as part of a SSH distribution. See www.ssh.org for details. The syntax for using SCP to copy a file from your local machine to the Roadrunner cluster is
where file is the name of the local file, login is your login name on the cluster, and remote is the location of the file on the cluster. Note thatremote must be a full path name or a path relative to your home directory on the cluster. For example,
will copy the file mydata.dat to the directory Experiment01 in user joeuser's home directory. PKI-enabled FTP You may transfer files to the Roadrunner cluster using an Alliance digital certificate and a PKI-enabled version of FTP. See Using GSI enabled FTP (gsiftp) for details. 3.4 Reporting Security Incidents To report a security problem contact the Alliance Technology Management Group Helpdesk at (217) 244-0710 anytime. For security questions or non-emergency incident information, please email the Alliance Incident Response & Security Team at irst@ncsa.uiuc.edu or call (217) 244-2341 during normal University business hours (8:00 a.m. to 5 p.m., Central Time). |
|
|
