Armored Node for Sensitive Data: Difference between revisions
No edit summary |
|||
| Line 15: | Line 15: | ||
Once the job has started, connect inside the job: | Once the job has started, connect inside the job: | ||
<code class="host"> | <code class="host">frontend:</code><code class="command">oarsub</code> -C <code class="replace">JOB ID</code> | ||
Get the assigned VLAN number: | Get the assigned VLAN number: | ||
<code class="host"> | <code class="host">frontend:</code><code class="command">kavlan</code> -V | ||
Get the reserved node: | Get the reserved node: | ||
<code class="host"> | <code class="host">frontend:</code><code class="command">uniq</code> $OAR_NODEFILE | ||
Deploy the node with the debian10-x64-big environment, inside the VLAN: | Deploy the node with the debian10-x64-big environment, inside the VLAN: | ||
<code class="host"> | <code class="host">frontend:</code><code class="command">kadeploy3</code> -e debian10-x64-big -m <code class="replace">NODE</code> --vlan <code class="replace">VLAN NUMBER</code> -k | ||
Now wait for the deployment to complete. | Now wait for the deployment to complete. | ||
== Securing the node with g5k-armor-node.py == | |||
Connect to the node from the outside of Grid'5000, using the node name suffixed by the Kavlan number (since the node was deployed inside a Kavlan vlan). After securing the node, this will be the only allowed way to connect to the node, as SSH will only be authorized from Grid'5000 access machines: | |||
<code class="host">your machine:</code><code class="command">ssh -J <code class="replace">YOUR_G5K_LOGIN</code>@access.grid5000.fr root@<code class="replace">node-X-kavlan-Y.site</code>.grid5000.fr | |||
Revision as of 18:02, 7 April 2021
|
Note |
|---|---|
This page is actively maintained by the Grid'5000 team. If you encounter problems, please report them (see the Support page). Additionally, as it is a wiki page, you are free to make minor corrections yourself if needed. If you would like to suggest a more fundamental change, please contact the Grid'5000 team. | |
This page documents how to secure a Grid'5000 node, making it suitable to host and process more sensitive data. The process is based on a tool (g5k-armor-node.py) that runs on a debian10-x64-big environment.
Node reservation and deployment
Identify your requirements:
- Select a cluster that suits your needs (for example using the Hardware page).
- Estimate for how long you will need the resources. If they exceed what is allowed for the default queue in the Usage Policy, maybe the production queue will match your needs. If the duration also exceeds what is allowed by the production queue (more than one week needed), you should follow the procedure explained on the Usage Policy page to request an exception. Remember that your data will be destroyed at the end of the reservation.
Reserve a node and a VLAN, for example with:
nancy frontend:oarsub-q production -t deploy -l {"type='kavlan'"}/vlan=1+{"cluster='CLUSTER'"}/nodes=1,walltime=WALLTIME-rSTART DATE
FIXME: mention reserving additional disks
Once the job has started, connect inside the job:
frontend:oarsub-CJOB ID
Get the assigned VLAN number:
frontend:kavlan-V
Get the reserved node:
frontend:uniq$OAR_NODEFILE
Deploy the node with the debian10-x64-big environment, inside the VLAN:
frontend:kadeploy3-e debian10-x64-big -mNODE--vlanVLAN NUMBER-k
Now wait for the deployment to complete.
Securing the node with g5k-armor-node.py
Connect to the node from the outside of Grid'5000, using the node name suffixed by the Kavlan number (since the node was deployed inside a Kavlan vlan). After securing the node, this will be the only allowed way to connect to the node, as SSH will only be authorized from Grid'5000 access machines:
your machine:ssh -JYOUR_G5K_LOGIN@access.grid5000.fr root@node-X-kavlan-Y.site.grid5000.fr