How to apply least‑privilege security when launching MAPDL via PyAnsys on a Slurm HPC cluster?

Question

When starting MAPDL from Python using ansys.mapdl.core.launch_mapdl (as shown in the shared‑topology example), the process is launched with the user's current credentials and environment. In a Slurm‑managed cluster that also uses NFS/BeeGFS storage and MPI over InfiniBand, what specific steps should be taken to restrict the MAPDL process to the minimum required privileges? Consider aspects such as:

File‑system permissions for the working directory, input files, and output results.
Environment variables that affect MPI initialization (e.g., MPI_IB_PKEY) to avoid the "multiple pkey found" warnings.
Any MAPDL or PyAnsys options that reduce the attack surface (e.g., limiting external script execution, disabling unnecessary plugins).

Provide a concise, step‑by‑step checklist that references the launch command and the MPI pkey issue observed in the cluster logs.

Tasadduq Burney · Answer

Because the provided sources do not contain specific information about MAPDL, PyAnsys, Slurm, or MPI pkey handling, the following steps are based on general security best practices and reasonable assumptions for a typical HPC environment. Treat this as a draft that should be reviewed and adapted by your site’s security and systems administrators.

Isolate the working directory
    
      Create a dedicated directory for the job (e.g., /scratch/$USER/mapdl_job_$SLURM_JOBID) owned by the submitting user.
      Set permissions to 700 (read/write/execute for owner only) so other users cannot access input or output files.
      If shared storage is required, use group‑owned directories with 770 and restrict the group to the specific project or job allocation.

Restrict environment variables
    
      Launch the job with a clean environment: srun --export=NONE ... or explicitly unset variables that are not needed (e.g., unset MPI_IB_PKEY).
      If the cluster warns about "multiple pkey found", set only the pkey that matches the InfiniBand partition you are authorized to use, e.g., export MPI_IB_PKEY=0x8001.
      Remove or unset variables that could affect MPI plugin loading (e.g., OMPI_MCA, I_MPI) unless they are required for your MPI implementation.

Limit MAPDL/PyAnsys capabilities
    
      Use the launch_mapdl argument override=True only when necessary; otherwise let PyAnsys use its default, restricted execution mode.
      Disable external script execution by setting the MAPDL command /INPUT, to a trusted location only, or use the -b (batch) flag to avoid interactive GUI.
      If your MAPDL installation supports it, start with the -nosplash and -noGUI options to reduce loaded plugins.

Run under the least privileged account
    
      Submit the Slurm job as a regular user (not root or a service account with elevated privileges).
      If the cluster uses job‑specific accounts (e.g., slurm_user_$SLURM_JOBID), configure the job to run under that account via --uid or --gid options.

Verify and clean up
    
      After the job completes, check the directory permissions and remove any temporary files that contain sensitive data.
      Review the job’s Slurm output (slurm-$SLURM_JOBID.out) for warnings about environment variables or MPI pkey mismatches.
      If any unexpected privileges or warnings appear, adjust the environment or directory settings and re‑run.

These steps should be tested in a non‑production partition first. Adjust paths, group names, and MPI pkey values to match your site’s configuration.

How to apply least‑privilege security when launching MAPDL via PyAnsys on a Slurm HPC cluster?

1 answer

Your perspective belongs here.

1 question comment