2 Network Administration
Security Consid
erations
The parallel com
puting products do not provide any security measures.
Therefore, be aw
are of the following security considerations:
• MATLAB workers r
un as whatever user the administrator starts the node’s
mdce service un
der. By default, the mdce service starts as
root on UNIX
operating syst
ems, and as LocalSystem on Microsoft Windows operating
systems. Becau
se MATLAB provides system calls, users can submit jobs
that execute sh
ell commands.
• The mdce servic
e does not enforce any access control or authentication.
Anyone with lo
cal or remote access to the mdce services can start and stop
their workers
and job managers, and query for their status.
• The job manage
r does not restrict access to the cluster, nor to job and task
data. Using a t
hird-party scheduler instead of the MathWorks job manager
could allow y
ou to take advantage of the security measures it provides.
• The parallel
computing processes must all be on the same side of a Þrewall,
or you must ta
ke measures to enable them to communicate with each
other throug
h the Þrewall. Workers running tasks of the same parallel
job cannot b
e Þrewalled off from each other, because their MPI-based
communicat
ion will not work.
• If certain p
orts are restricted, you can specify the ports used for parallel
computing.
See “DeÞning the Script Defaults” on page 2-13.
• If your netw
ork supports multicast, the parallel computing processes
accommoda
te multicast. However, because multicast is disabled on many
networks f
or security reasons, you might require unicast communication
between pa
rallel computing processes. Most examples of parallel
computing
scripts and functions in this documentation show unicast usage.
• If your org
anization is a member of the Internet Multicast Backbone
(MBone),
make sure that your parallel computing cluster is isolated from
MBone acc
ess if you are using multicast for parallel computing. This is
generall
y the default condition. If you have any questions about MBone
membersh
ip, contact your network administrator.
2-4
Comentários a estes Manuais