The FAS Secure Environment (FASSE) is a secure multi-tenant cluster environment to provide Harvard researchers access to a secure enclave for analysis of sensitive datasets with DUA‘s and IRB’s classified as Level 3. All servers in the FASSE environment are physically located inside an access-controlled data center. We have implemented security controls and access control lists to restrict access.

Access to the cluster is restricted via a Virtual Private Network (VPN) and only authorized users/groups will be added to the FASSE VPN realm. If you do not belong to a FASSE project group, you cannot access the FASSE VPN or cluster.

We provide different storage tiers based on project needs. Please review storage options. 

Note: As this is a secure environment, your home folder on FASSE is separate from any home folder you might have on the FASRC (Cannon) cluster. Data from the secure level 3 (FASSE) environment should not be transferred into level 2 space (Cannon).

FASSE is not rated for Level 4/DSL 4 data  If you require a Level 4 environment, please contact University RC (URC) to discuss options.
FASRC does not provide a Level 4 secure environment.

See also:

• Cluster Security Level Ratings
• Committee on the Use of Human Subjects – Investigator Manual: https://cuhs.harvard.edu/you-begin-prepare-your-irb-application
• Office of Regulatory Affairs and Research Compliance – Investigator Manual: https://www.hsph.harvard.edu/regulatory-affairs-and-research-compliance/investigator-manual/

STEP 0: HRDSP REQUIREMENTS

In order to have a FASSE DSL3 environment created for a project, the project owner or PI must first satisfy the HRDSP application requirements. FASRC (or the HRDSP section here) is required by the university to review any documents (DUA/DAT/IRB) before a new FASSE project is created and/or any data is copied to the cluster. This information will also help FASRC determine how the environment should be set up, who the contacts are, and how project group names should be constructed.

FASRC cannot advise you on this step, please contact VPR for assistance and guidance.

HRDSP: Harvard Research Data Security Policy site
HRDSP: Applications Summary and Order of Reviews

Step 1: Sign up for a FASRC Account

(if you do not already have one)

Account Signup

PI/Project Owner

• If you are a Harvard faculty PI (or non-faculty researcher with explicit PI rights) you should have or request an account as a Faculty/Non-Faculty PI with FASRC. How Do I Get a FAS Research Computing Account?
• If you are not a Harvard faculty PI (or non-faculty researcher with explicit PI rights), you will need to have/sign up for an account under a Harvard PI/sponsor. How Do I Get a FAS Research Computing Account?

Users

Before you can access the FASSE cluster you need to request a Research Computing account, selecting your PI as your sponsor (in this case, this is a Harvard faculty PI [or in some cases, a non-faculty researcher with PI rights], not necessarily the person listed on an IRB or DUA). See How Do I Get a Research Computing Account for instructions if you do not yet have an account. If your Harvard PI does not exist, please direct them to this same page and the directions in the previous paragraph.

New Accounts

If you have an existing account or have already completed the following three steps, you can skip this section. But please note the FASSE VPN realm (@fasse) noted below. You must connect to this realm to access any FASSE resources.

Password Set

Once you have your FASRC account, you will receive an email with the same information as below, but step one is to set your password. This will be done using your email address and our password reset system.

OpenAuth (two-factor)

To access FASSE and most FASRC services, including the FASRC VPN, you will need your personal FASRC OpenAuth two-factor (2FA) token. This can be set up on your smartphone using an app or downloaded as a Java applet to run on your desktop/laptop.

FASSE VPN

In order to access any secure system or environment in FASRC, you will need to connect to the FASRC VPN. The FASRC VPN is separate from other Harvard VPNs you may already be using.  To connect to a FASSE environment, you will connect to the FASRC VPN (vpn.rc.fas.harvard.edu) using the @fasse realm (ex. – jharvard@fasse), your FASRC password, and your OpenAuth 2FA code.

Step 2: Request a FASSE Project

If you have completed the HRDSP process and you and your PI have FASRC accounts, you can proceed to fill out the

FASSE New Project Request Form (Harvard Key login required)

USING FASSE

Accessing the FASSE environment.

FASSE VPN

To connect to a FASSE environment, you will connect to the FASRC VPN (vpn.rc.fas.harvard.edu) using the @fasse realm (ex. – jharvard@fasse), your FASRC password, and your OpenAuth 2FA code.  If you’re used to using Cannon, note that the VPN realm, @fasse, is different from the @fasrc realm you’re used to using.

SLURM and Partitions

To manage the workload on the cluster we use SLURM. Partition is the term that Slurm uses for queues. Partitions can be thought of as a set of resources and parameters around their use.  You can use spart to find out what partitions you have access to. Following are the partitions available on the FASSE cluster.

To run jobs on the main cluster instead, please refer to Running Jobs (Cannon)

Do not use salloc

Do not use salloc on FASSE.  Salloc is not available on FASSE for security reasons.  For interactive access, please use the FASSE VDI (see below).

Open OnDemand (OOD) Access

OpenOnDemand (OOD) or VDI (virtual desktop interface) is a virtual GUI interface that provides everything from pre-built apps to interactive command line access within a familiar desktop-like environment.

The FASSE OOD is available when connected to our @fasse VPN realm, through your web browser.  Please visit to access the service: https://fasseood.rc.fas.harvard.edu

See our FASSE VDI documentation for further information. FASSE VDI/OpenOnDemand

Command Line Access

Command-line access is also available for those who need/want to run jobs using a CLI. Login nodes for FASSE can be accessed by SSH at fasselogin.rc.fas.harvard.edu:

ssh jharvard@fasselogin.rc.fas.harvard.edu

Note that FASSE does not allow to run interactive jobs. Instead, you have to use OOD to run interactive jobs.

See our FASSE CLI documentation for further information. [Link Pending] 

Interim Documentation: See the very similar main cluster doc in the interim

FASSE FAQ

1. Get an FASRC account if you do not already have one
2. Set or reset your FASRC password: https://portal.rc.fas.harvard.edu/p3/pwreset/
3. Set up 2 factor authentication, which is also called 2FA: https://docs.rc.fas.harvard.edu/kb/openauth/
4. Get your VPN working: https://docs.rc.fas.harvard.edu/kb/vpn-setup/
   1. You will not be able to log into the FASSE VPN until you are a member of a FASSE project group, but you can log into the general fasrc VPN realm following the above instructions.

Set up or join a project group

If you do not have a group for your project:

1. Satisfy HRDSP application requirements
2. Fill out the FASSE New Project Request Form

If you want to join an existing project group

1. Navigate to the Add Grants page in portal
2. Find the project group you want to be added to
3. Select the checkbox for the project group you want to be added to
4. Your PI will have to approve the addition.  Once you’re notified of the approval, it can take up to an hour for your permissions to be configured. If you’re not able to access the VPN or your home directory, try waiting an hour and logging in again.

Start using FASSE once your account and project group are configured

Getting started on FASSE

If you are on FASSE or a VPN realm or server that is behind a firewall, there are times when you still need to reach the outside Internet. For example, you may need to install a conda, Stata, or R package. In that case, you will need to add a proxy setting to your environment.

Please note: Don’t set proxy on Cannon as it will back the internet. Our proxy does not allow all traffic, but should allow access to things necessary for your work.

Setting the proxy from the terminal

You can issue the following commands either manually each time you need access, or you can add them to your .bashrc so that the proxy is always configured when you log in or launch a new shell.

export http_proxy=http://rcproxy.rc.fas.harvard.edu:3128
export https_proxy=http://rcproxy.rc.fas.harvard.edu:3128

Setting the proxy for web browsing

For web browsing, your browser may work if set to ‘Use system proxy settings’ (Auto-detect proxy’ may also work). If this does not work automatically, you will need to manually add the proxies to your browser. You will need to disable this when not on the VPN.  Settings are as follows:

HTTP Proxy: http://rcproxy.rc.fas.harvard.edu
Port: 3128
HTTPS Proxy: http://rcproxy.rc.fas.harvard.edu
Port: 3128

The http:// is intentional for https_proxy. Your data are still encrypted between your web browser and the web server.

Also note that some applications only work if you give it the proxy address without the http://.  If your application is not working using the above definitions try: rcproxy.rc.fas.harvard.edu:3128

Setting proxy for sftp

For sftp you can add the ProxyCommand options like so (where username@example.com is the remote username and remote system you are connecting to) :

sftp -o ConnectTimeout=3 -o ProxyCommand='/usr/bin/nc --proxy rcproxy.rc.fas.harvard.edu:3128 %h %p' username@example.com

Setting the proxy for Stata

Stata sometimes loads libraries via http.  For security reasons, http access on FASSE must happen via a proxy.  Proxy access can be configured in Stata with the following commands:

set httpproxy on
set httpproxyhost rcproxy.rc.fas.harvard.edu
set httpproxyport 3128

Proxy settings appear to persist after Stata is closed, so it is recommended to issue the following command when exiting stata:

set httpproxy off

Setting the proxy for RStudio

Occasionally, Installing a package on RStudio may require HTTP. You can set http_proxy to allow this from FASSE.  This can be done for one time use from within R:

Sys.setenv(http_proxy="http://rcproxy.rc.fas.harvard.edu:3128")
Sys.setenv(https_proxy="http://rcproxy.rc.fas.harvard.edu:3128")

It can also be set permanently by placing this in ~/.renviron:

http_proxy="http://rcproxy.rc.fas.harvard.edu:3128"
https_proxy="http://rcproxy.rc.fas.harvard.edu:3128"

You can run these from inside R to check that the proxies are set:

Sys.getenv("http_proxy")
Sys.getenv("https_proxy")

To unset these variables run:

Sys.unsetenv("http_proxy")
Sys.unsetenv("https_proxy")

Setting the proxy for Jupyter Notebook

You can run these commands to set the proxies on FASSE:

import os
os.environ['http_proxy'] = "http://rcproxy.rc.fas.harvard.edu:3128"
os.environ['https_proxy'] = "https://rcproxy.rc.fas.harvard.edu:3128"

If you get the output  <Response [200]>, proxies are appropriately set:

import requests
requests.get("https://google.com")
<Response [200]>

The steps above can be seen in the screen shot:

Setting the proxy for the Virtual Remote Desktop’s Firefox

When working from the virtual remote desktop in FASSE you will have to configure Firefox manually.  To configure a proxy in Firefox go to Preferences>General>Connection Settings and configure as follows:

Github

Cloning a repository from Github does not work using ssh. You have to use https. For example:

git clone https://github.com/fasrc/User_Codes.git

And not:

git clone git@github.com:fasrc/User_Codes.git