Enhancing HPC Security with a User-Based Firewall
This addresses security vulnerabilities in HPC systems for administrators and users by providing an incremental improvement over existing authentication methods.
The paper tackles the lack of authentication in HPC internal networks by prototyping a user-based firewall using Linux netfilter, which enforces connection rules without requiring developer or user intervention and remains invisible to most users.
HPC systems traditionally allow their users unrestricted use of their internal network. While this network is normally controlled enough to guarantee privacy without the need for encryption, it does not provide a method to authenticate peer connections. Protocols built upon this internal network must provide their own authentication. Many methods have been employed to perform this authentication. However, support for all of these methods requires the HPC application developer to include support and the user to configure and enable these services. The user-based firewall capability we have prototyped enables a set of rules governing connections across the HPC internal network to be put into place using Linux netfilter. By using an operating system-level capability, the system is not reliant on any developer or user actions to enable security. The rules we have chosen and implemented are crafted to not impact the vast majority of users and be completely invisible to them.