Security and Privacy

The RedRaider cluster is shared by thousands of researchers, so its security depends on two things: the work HPCC staff do every day to protect the systems, and a few habits we ask of every user. This page explains both, and what to do if something looks wrong.

1. Conditions of access

Per Texas statutes, TTU information resources are strategic assets of the state of Texas that must be managed as valuable state resources. As such, use of TTU information resources is subject to university OPs and other applicable laws. Unauthorized use is prohibited, usage may be subject to security testing and monitoring, misuse is subject to criminal prosecution, and users have no expectation of privacy except as otherwise provided by applicable privacy laws.

HPCC systems are Texas Tech University information resources and strategic assets of the State of Texas. Their use is governed by Texas Tech operating policies, in particular OP 52.01, Information Technology Operations and OP 52.04, Information Technology Security, and by applicable law.

Only authorized use is permitted. Misuse may lead to suspension of access and to disciplinary or criminal action.
Use of HPCC systems may be monitored and is subject to security testing.
Users have no expectation of privacy on HPCC systems, except as provided by applicable privacy laws.

2. Shared responsibility

HPCC staff	You
Keep every system patched and supported	Keep your eRaider password and SSH keys private, and never share your account with anybody
Protect the systems against malware and intrusion	Keep confidential, sensitive or regulated data off the cluster
Make sure only active, sponsored accounts can sign in	Keep your files private, and share them only as described in Sharing HPCC File Access
Monitor the systems and respond to incidents	Run work in jobs, not on the login nodes (Login Node Usage Policy)
Back up home directories periodically	Report anything unusual to HPCC Support right away

3. How we protect the cluster

Area	What we do
Accounts and sign-in	Accounts are created and sponsorships managed through the HPCC Account Registration portal. You sign in with your eRaider password or an SSH key. An account whose sponsorship has expired, or whose eRaider account is disabled, can no longer sign in to the cluster.
Security updates	All servers and login nodes are updated twice a month with the latest security patches. Compute nodes are updated regularly without interrupting running or queued jobs. Urgent security patches are applied as soon as they are available, outside the regular schedule if necessary.
Supported software	The cluster runs an operating system with vendor long-term support, so security fixes keep arriving for the whole life of each release.
Clean, consistent nodes	Login and compute nodes start from centrally built system images that are rebuilt with every update. Every node of a kind runs the same tested system image, and a rebooted node always starts clean.
Vulnerability scanning	The cluster is continuously checked with modern vulnerability scanning tools, so HPCC staff can find and fix weaknesses as quickly as possible.
Malware protection	Login nodes and core servers run malware protection with real-time scanning.
Access control inside each system	Servers and login nodes run SELinux, which limits what each service may do even if it were attacked.
Hardened configuration	Servers follow a security baseline based on industry benchmarks: only required services run, sign-in settings are restricted, and every system has its own firewall.
Network	The cluster's internal networks cannot be reached from the internet. Only the services users need are exposed, and system management runs on separate, isolated networks.
Encryption	Sign-in, file transfers and the web portals are encrypted (SSH, Globus and HTTPS).
Monitoring	System logs are collected centrally, and an automated service watches the login nodes so that no single user can slow them down for everyone.

4. Protecting your own data

Keep your data private. Your home directory is private by default: only you can read it. Keep your work and scratch directories private as well. To check, run:

ls -ld $HOME /lustre/work/$USER /lustre/scratch/$USER

Each line should start with
```
drwx------
```
.
If one does not, make it private with
```
chmod 700 DIRECTORY
```
.
To share files with someone, follow Sharing HPCC File Access. It grants access to the specific people you choose. Never open a directory to all users.

Please also:

Keep your SSH keys private. Your ~/.ssh directory must be readable only by you, and never copy a private key to a shared directory.
Do not store confidential, sensitive or regulated data on the cluster file systems. Files on a shared cluster are not a place for such data, whatever their permissions.
Do not send confidential data to external AI services. AI agents may be used only on compute nodes; see the Login Node Usage Policy.
Home directories are backed up periodically. If you need a backup copy of your data removed, contact HPCC Support.

See the TTU HPCC Data Policies for storage, retention and data management rules.

5. Privacy

What information we keep

Information	What it includes	Why
Account information	Your name, eRaider ID, TTU email address, department and sponsor, from eRaider and the HPCC Account Registration portal	To create and manage your account and contact you
Job records	For every job: account, partition, requested and used resources, start and end times, job name and final state	To run the scheduler, answer support questions, and report usage and allocations. Job records are kept long term.
Sign-in and system records	Sign-ins, file transfers and system logs	Security, troubleshooting and incident response
Login node usage monitoring	Which programs run on the login nodes and how much CPU, memory and data transfer each user uses. File contents are never read.	To enforce the Login Node Usage Policy
Backups	A periodic copy of every home directory	To restore lost or damaged files

What other users can see

The RedRaider cluster is a shared system, and some information about your work is visible to every other user:

Your jobs. Commands such as squeue and sacct show all users' jobs, including your user ID, job name, account, partition, nodes, run time and resource use.
Your usage, to your sponsor. Sponsors and PIs can see usage reports for the jobs of their group.
Your running programs. On a login node or a compute node, other users can see the names and command lines of your processes.
Your directory names. The names of the top-level directories in
```
/home
```
,
```
/lustre/work
```
and
```
/lustre/scratch
```
are visible, though their contents are private.

So, never put confidential information, passwords or access tokens in job names, file names or command-line arguments.

6. Staff access to files

Regardless of file and directory permissions, HPCC system administrators and Texas Tech IT security personnel may access user files when needed to manage the storage systems or to investigate a security incident. A sponsoring faculty or staff member may request access to your files to ensure the continuity of research.

7. Reporting a security problem

Contact HPCC Support at hpccsupport@ttu.edu right away if:

you think someone else has used your account, or your password or SSH key has been exposed;
you see files, processes or jobs under your account that you did not create;
you receive an email or message that asks for your eRaider password or claims to come from HPCC. HPCC staff will never ask for your password.

High Performance Computing Center

Phone
806.742.4350
Email
hpccsupport@ttu.edu