Security of daemon communication

LSF daemons in a MultiCluster environment use privileged port authentication by default. LSF mbatchd and lim daemons can be configured to communicate over non-privileged ports. If disabling the privileged port authentication makes you concerned about the security of daemon authentication, you can use an eauth program to enable any method of authentication for secure communication between clusters.

Configuring an eauth or setting LSF_MC_NON_PRIVILEGED_PORTS to N disables privileged port authentication.

Note:

Windows does not use privileged ports for authentication.

Requirements
  • All clusters must be configured to use non-privileged ports for LSF daemon communication.

  • If you use a firewall, it must accept incoming communication from non-privileged source ports if the destination ports are the LIM port configured LSF_LIM_PORT in lsf.conf and mbatchd port configured in LSB_MBD_PORT in lsf.conf.

  • If you use a firewall, it must allow outgoing communication from non-privileged source ports to non-privileged destination ports.

  1. To make LSF daemons use non-privileged ports, edit lsf.conf in every cluster as shown:

    LSF_MC_NON_PRIVILEGED_PORTS=Y

  2. To make the changes take effect, restart the master LIM and MBD in every cluster, and the LIM on all master host candidates. For example, if a cluster’s master host is hostA and master host candidate is hostB, run the following commands in that cluster:
    lsadmin limrestart hostA
    lsadmin limrestart hostB
    badmin mbdrestart