Set MJS Cluster Security :: Network Administration (MATLAB® Distributed Computing Server™)

Product Documentation

Search MATLAB Documentation
R2012a Documentation → MATLAB Distributed Computing Server
View documentation for other releases	Learn more about MATLAB Distributed Computing Server

Contents

Index

• System Administrator's Guide

• Introduction

• Network Administration

• Prepare for Parallel Computing

Install and Configure

• Use a Different MPI Build on UNIX Operating Systems

• Shut Down a Job Manager Cluster

• Customize Services

• Access Service Record Files

• Set MJS Cluster Security

Set the Security Level

Local, MJS, and Network Passwords

Set Secure Communication

• Troubleshooting

License Errors

Memory Errors on UNIX Operating Systems

Run Server Processes from a Windows Network Installation

Required Ports

Ephemeral TCP Ports with Job Manager

Host Communications Problems

Verify Multicast Communications

• Admin Center

Stop, Destroy, Resume, Restart Processes

Move a Worker

Update the Display

• Control Script Reference

Glossary

Set MJS Cluster Security

On this page…
Set the Security Level Local, MJS, and Network Passwords Set Secure Communication

On this page…

Set the Security Level

Local, MJS, and Network Passwords

Set Secure Communication

Set the Security Level

You set the job manager or MJS security level with the SECURITY_LEVEL parameter in the mdce_def file before starting the mdce service on your cluster nodes. The mdce_def file indicates what values are allowed, and briefly describes each security level.

The following table describes the available security levels for accessing an MJS and its jobs.

Security Level Description User Requirements

Security Level	Description	User Requirements
0	No security. Any user can access any job. Tasks run as the user who started the mdce process on the worker machines (typically root or Local System). This is the default, and is the behavior in all releases prior to R2010b.	Jobs are associated with the default user name of the programmer, but no protection is provided.
1	Jobs are identified with the submitting user. Any user can access any job; a dialog warns if the accessed job belongs to another user. Tasks run as the user who started the mdce process on the worker machines (typically root or Local System).	A dialog requires you to establish a user name when you first access the job manager. Your job manager (MJS) user name does not have to match your system/network user name. No passwords are used.
2	Job manager (MJS) password protection on jobs. Jobs and tasks are identified with the submitting user, and are password protected. Other users cannot access your jobs. Tasks run as the user who started the mdce process on the worker machines (typically root or Local System).	When you start the job manager (MJS), it prompts you to provide a new password for that job manager's admin account, which can be used for accessing all users' jobs and tasks. A dialog box requires you to establish a user name and password when you first access the job manager (MJS) from the MATLAB client. Your job manager (MJS) user name and password do not have to match your system/network user name and password.
3	In addition to the security of level 2, tasks run as the submitting user on worker machines. Jobs and tasks are identified with the submitting user, and are password protected. Other users cannot access your jobs. Tasks run as the user who submitted the job.	On UNIX systems, the mdce process on the cluster nodes must be started by the root user. The job manager (MJS) must use secure communication with the workers (set in the `mdce_def` file). When you start the job manager (MJS), it prompts you to provide a new password for that job manager's admin account, which can be used for accessing all users' jobs and tasks. A dialog box requires you to establish a user name and password when you first access the job manager (MJS) from the MATLAB client. Your job manager (MJS) user name and password must be the same as your system/network user name and password, because the worker must log you in to run the task as you. All users that tasks run as, require read and write permissions to the `CHECKPOINTBASE` folder and all its subfolders.

No security.

Any user can access any job.
Tasks run as the user who started the mdce process on the worker machines (typically root or Local System).
This is the default, and is the behavior in all releases prior to R2010b.

Jobs are associated with the default user name of the programmer, but no protection is provided.

Jobs are identified with the submitting user.

Any user can access any job; a dialog warns if the accessed job belongs to another user.
Tasks run as the user who started the mdce process on the worker machines (typically root or Local System).

A dialog requires you to establish a user name when you first access the job manager.
Your job manager (MJS) user name does not have to match your system/network user name.
No passwords are used.

Job manager (MJS) password protection on jobs.

Jobs and tasks are identified with the submitting user, and are password protected. Other users cannot access your jobs.
Tasks run as the user who started the mdce process on the worker machines (typically root or Local System).

When you start the job manager (MJS), it prompts you to provide a new password for that job manager's admin account, which can be used for accessing all users' jobs and tasks.
A dialog box requires you to establish a user name and password when you first access the job manager (MJS) from the MATLAB client.
Your job manager (MJS) user name and password do not have to match your system/network user name and password.

In addition to the security of level 2, tasks run as the submitting user on worker machines.

Jobs and tasks are identified with the submitting user, and are password protected. Other users cannot access your jobs.
Tasks run as the user who submitted the job.

On UNIX systems, the mdce process on the cluster nodes must be started by the root user.
The job manager (MJS) must use secure communication with the workers (set in the mdce_def file).
When you start the job manager (MJS), it prompts you to provide a new password for that job manager's admin account, which can be used for accessing all users' jobs and tasks.
A dialog box requires you to establish a user name and password when you first access the job manager (MJS) from the MATLAB client.
Your job manager (MJS) user name and password must be the same as your system/network user name and password, because the worker must log you in to run the task as you.
All users that tasks run as, require read and write permissions to the CHECKPOINTBASE folder and all its subfolders.

Local, MJS, and Network Passwords

For any security, the job manager (MJS) identifies every job with the user who submits the job. Therefore, whenever you access the MJS or a job, the MJS must be aware of who you are.

At security level 0, the MJS and job objects' UserName property is set to the login name of the person who creates the job; this setting can be changed at any time. For all higher security levels, the first access to the MJS causes a dialog box to open which asks for your username; if the security level is 2 or 3, you must also provide a password. The username and password you provide for the MJS needs to match your network username and password only if you are using security level 3; otherwise, you can create a new username and password unique for the MJS. For your convenience, you can choose how long to save your username and password on the local computer, so that you do not need to enter them every time you access your job.

For information about changing a password and logging out of an MJS, see changePassword and logout.

Set Secure Communication

To establish secure encrypted communication between job manager (MJS) and workers, set the USE_SECURE_COMMUNICATION parameter in the mdce_def file.

You must also provide a value for the SHARED_SECRET_FILE parameter in the mdce_def file, identifying where the file can be found from the job manager (MJS) perspective. To create this file, run either script:

matlabroot/toolbox/distcomp/bin/createSharedSecret (UNIX)
matlabroot\toolbox\distcomp\bin\createSharedSecret.bat (Windows)

The secret file establishes trust between the processes on different machines.

In a shared file system, all the nodes can point to the same secret file, and they can even all share the same mdce_def file.
In a nonshared file system, create a secret file with the provided script, then copy the file to each node and make sure each node's mdce_def file indicates where its particular secret file is located.

Note Secure communication is required when using job manager (MJS) security level 3.

Access Service Record Files

Troubleshooting

Free Parallel Computing Interactive Kit

See how to solve large problems with minimal effort and reduce simulation time.

Get free kit

Trials Available

Try the latest versions of parallel computing products.

Get trial software