From Vd

We need to have a focus on security aspects in the testing and implementation of Dione, the Harvesting project.

Server security

The Dione servers are

• ROCKS server - must be a ROCKS installation
• Other servers

Due to I/O / security demands there may be a need to separate some server functionality from the ROCKS server, some of these may be:

• Login server: Server for submiting of jobs - preferably a ROCKS installation, due to library version requirements
• File server: Home directories - may run any OS distribution
• Virtual Machine image staging server - may run any OS distribution

The ROCKS server and the login nodes may pose a problem, as they must be installed as ROCKS machines. In Dione these server will be IP-chained to just be able to communicate on required ports:

ROCKS server open ports

• Port 22 for login
• Port 80 for HTTP
• Two open SGE queuing system ports for communication with compute nodes

Node security

Dione compute nodes have need to communicate to Dione servers only. All Dione compute nodes will thus be closed to any other networks then to the server network (129.240.15 in PILOT 2). This is secured by applying ipchaining of all Dione nodes.