Security¶
Introduction¶
This document details the security framework for Open OnDemand, providing essential information that administrators need to know for secure deployment and operation.
Note
If you’re here to report a vulerability, you may refer to Vulnerability Management.
Considerations¶
This section outlines key security advantages and areas for vigilance within the Open OnDemand environment.
Advantages¶
Per-user Nginx (PUN) Architecture: By running individual Nginx instances per user, Open OnDemand ensures that actions such as file access are conducted under user-specific non-root privileges, which isolates processes and enhances security.
Robust Authentication: Open OnDemand supports various authentication methods. It particularly emphasizes secure protocols over less secure options like Basic or LDAP authentication, reinforcing its commitment to high security standards.
Limitations¶
HTTP Traffic to Origin Servers: Traffic to backend services, including computational resources like Jupyter servers, is currently over HTTP, which is unencrypted. Plans are underway to upgrade this to HTTPS to ensure encryption of data in transit, thereby bolstering security.
Controls¶
These are things the the out of the box OnDemand installation will provide that some centers may want to change or disable altogether.
File Access: OnDemand lets users navigate the file system. While file permissions limit what a user can view and navigate to, some centers may want to limit this even further. One option is to Block or Allow Directory Access to limit what directories users may navigate to. Additionally, you may want to disable or limit access to the application. You can do this through Disabling applications.
Conclusion¶
Maintaining a secure and robust operational environment is critical for the success of Open OnDemand. Administrators are encouraged to implement the security practices recommended in this guide and to regularly review security settings and updates.
Relevant References¶
Security Topics
- Vulnerability Management
- Overview
- Logging
- Customizations
- Disabling applications
- Announcements
- Message of the Day (MOTD)
- Branding
- Overriding Pages
- Add URLs to Help Menu
- Add Shortcuts to Files Menu
- Configuration Profiles
- Changing the Navigation bar
- Interactive Apps Menu
- Set Upload Limits
- Set Download Limits
- Block or Allow Directory Access
- Disabling Users
- Set Default SSH Host
- Set SSH Allowlist
- Set OOD SSH Port
- Shell App SSH Command Wrapper
- Fix Unauthorized WebSocket Connection in Shell App
- Custom Job Composer Templates
- Job Composer Script Size Limit
- Hiding Job Arrays
- Custom Error Page for Missing Home Directory on Launch
- Pinning Applications to the Dashboard
- Custom layouts in the dashboard
- Customize Text in OnDemand
- Disk Quota Warnings on Dashboard
- Balance Warnings on Dashboard
- Maintenance Mode
- Grafana support
- Disable Host Link in Batch Connect Session Card
- Set Illegal Job Name Characters
- Customize Dex Theme
- XDMoD Integration
- Accessing Remote File Systems
- Cancel Interactive Sessions
- Custom Pages
- Support Tickets