[Chtc-users] HTC jobs with "WantFlocking" also ran in OSG since Sep 2016

[chtc-users@xxxxxxxxxxx]

Greetings CHTC Users,

The below information only applies to users of the HTC System from CHTC-managed submit servers who have used "WantFlocking = true".ÂUsers of the HPC Cluster and users of the HTC System who have not used "WantFlocking = true" can ignore the below message.

We've just fixed an issue that allowed HTCondor jobs with "+WantFlocking = true" to also run in our Open Science Grid (OSG) pool, even if they did notÂspecify "+WantGlidein = true". This unintended behavior had been taking place since September of 2016 as the result of a misconfiguration of our campus OSG gateway server.Â

As of yesterday when we detected the problem, we worked immediately with OSG staff to reverse the mistaken configuration, and only jobs with "+WantGlidein = true" in the submit file will match to new OSG slots.Â

Jobs that did not indicate "+WantFlocking = true" didÂnotÂrun in OSG, and were correctly limited to only running in the CHTC pool by other in-place measures. If your jobs additionally required the HTC Gluster, high-memory servers, or other CHTC-only resources, your jobs still would not have run in the Open Science Grid, as they would have only matched to execute servers in the CHTC pool.

Implications

If you have only used the "+WantFlocking" feature (and not "+WantGlidein"), you were already opting in to having your jobs run on computers that are owned, operated, and shared by individuals who are not CHTC staff or users. Even though we had no reports from users of their jobs running in OSG when they only meant to "flock", it is likely that you may not have noticed, because the outcomes are very similar as for flocking to other campus pools.

While we are not worried about any specific security concerns for "flocking" jobs that likely ran on the OSG, we would like to hear from you if you have any specific concerns about the fact that your "WantFlocking" jobs likely also ran on the OSG.

In the Future

We are now taking extra steps on our CHTC-managed submit servers to ensure that a similar misconfiguration in the future would not allow 'Flocking' jobs to accidentally match to the Open Science Grid.

If you have already and only been using "+WantFlocking = true", you can now also add "+WantGlidein = true" and get the same throughput as for the last six months, though please contact us if you are worried about doing so.

Questions and Comments

should be sent to chtc@xxxxxxxxxxx, as is the case for all contact with CHTC staff by CHTC users

Thank you,

Your CHTC Team