To preface this:  You are responsible for knowing, and complying with applicable Harvard Information Security Policy (controls that apply to DSL3 and lower), Harvard Research Data Security Policy, and any applicable contracts / data use agreements.

FASSE data transfers generally work the same as transfers for other environments.  For example:

• When connected to the FASSE VPN realm, you can copy files to and from the FASSE cluster, assuming this meets policy/DUA compliance requirements.
• While on FASSE nodes (compute, login, etc.) and the FASSE VPN, you have full access to the Internet through a proxy.
  • Generally, this means that you can push to or pull from any HTTPS, SFTP, or other service that supports a proxy.
  • For example, this means you should be able to pull data from data providers that provide an HTTPS, SFTP, or other service.  You may need to adjust certain configurations and workflows to use the proxy – Some details on this here

With that said, given that FASSE is rated for data security level (DSL) 3 data:

• Do not store DSL 3 / FASSE data in your home directory.
• If you have a DUA that requires encryption at rest, you must not use scratch for any data that the DUA applies to.  Neither local scratch, nor our global scratch, support encryption at rest.
• FASSE VPN, login, compute, and VDI environments use a proxy.  Some transfer solutions do not work through a proxy.  If you run into this:
  • Please ensure you have tried to use a proxy, and if you still run into trouble,
  • Open a ticket with rchelp@rc.fas.harvard.edu indicating
    • What you have tried
    • What you expected to happen
    • What actually happened
    • Include specific commands, where these ran, and output messages including all errors.
• Data security level 3 / FASSE storage is intentionally not included in Globus by default.  If you would like your FASSE project to be exposed through Globus, consider the following:
  • If any data in this project is governed by a contract / data use agreement (DUA), please review the DUA to ensure Globus is compliant.  You might consult your School Security Officer for this.
    • An example scenario where Globus would not be compliant:  DUAs indicating that a VPN or private network must be used for all access to the data.  Globus makes data available over the Internet without a VPN or private network
  • Please submit a ticket to rchelp@rc.fas.harvard.edu as follows:
    • This must include the path to the project to add to Globus (e.g. “/n/piname_project_l3”)
    • This must indicate that the PI attests to Globus being compliant with any contracts/DUAs governing the data in this project storage
    • This must be from, or receive a reply directly from the PI for this project confirming this information
• For Storage, FASSE storage is intentionally not provided SMB shares by default.  If you need your FASSE project exposed through an SMB share, consider the following:
  • Please submit a ticket to rchelp@rc.fas.harvard.edu as follows:
    • This must include the path to the project (e.g. “/n/piname_project_l3”)
    • This must indicate that the PI attests to understanding and accepting the risks of enabling SMB access to this data, given that any system or network that can talk to this tiered storage, could access this data if the credentials from an account in the project were used.  Some example scenarios:
      • Someone with access to your storage accesses it / copies data down to an unmanaged lab computer without data security level controls
      • Someone with access to your storage accidentally clicks the wrong link on a computer with access to this storage. Their computer is compromised, malware identifies SMB access to your data, and compromises the confidentiality, integrity, and/or availability of your data – maybe ransomware, stealing the data, etc.
    • This must include a brief explanation of why SMB access is needed, and from where you will use this SMB access
    • This must be from, or receive a reply directly from the PI for this project confirming this information

If you have any questions or concerns, please do not hesitate to consult us at at security@rc.fas.harvard.edu, although in some cases we may end up pulling in or pointing you to your school privsec officer.

The FAS Secure Environment (FASSE) is a secure multi-tenant cluster environment to provide Harvard researchers access to a secure enclave for analysis of sensitive datasets with DUA‘s and IRB’s classified as Level 3. All servers in the FASSE environment are physically located inside an access-controlled data center. We have implemented security controls and access control lists to restrict access.

Access to the cluster is restricted via a Virtual Private Network (VPN) and only authorized users/groups will be added to the FASSE VPN realm. If you do not belong to a FASSE project group, you cannot access the FASSE VPN or cluster.

We provide different storage tiers based on project needs. Please review storage options. 

Note: As this is a secure environment, your home folder on FASSE is separate from any home folder you might have on the FASRC (Cannon) cluster. Data from the secure level 3 (FASSE) environment should not be transferred into level 2 space (Cannon).

FASSE is not rated for Level 4/DSL 4 data  If you require a Level 4 environment, please contact University RC (URC) to discuss options.
FASRC does not provide a Level 4 secure environment.

See also:

• Cluster Security Level Ratings
• Committee on the Use of Human Subjects – Investigator Manual: https://cuhs.harvard.edu/you-begin-prepare-your-irb-application
• Office of Regulatory Affairs and Research Compliance – Investigator Manual: https://www.hsph.harvard.edu/regulatory-affairs-and-research-compliance/investigator-manual/

STEP 0: HRDSP REQUIREMENTS

In order to have a FASSE DSL3 environment created for a project, the project owner or PI must first satisfy the HRDSP application requirements. FASRC (or the HRDSP section here) is required by the university to review any documents (DUA/DAT/IRB) before a new FASSE project is created and/or any data is copied to the cluster. This information will also help FASRC determine how the environment should be set up, who the contacts are, and how project group names should be constructed.

FASRC cannot advise you on this step, please contact VPR for assistance and guidance.

HRDSP: Harvard Research Data Security Policy site
HRDSP: Applications Summary and Order of Reviews

Step 1: Sign up for a FASRC Account

If you do not already have a FASRC account (otherwise skip to Step 2):

PI/Project Owner

• If you are a Harvard faculty PI (or non-faculty researcher with explicit PI rights) you should have or request an account as a Faculty/Non-Faculty PI with FASRC. How Do I Get a FAS Research Computing Account?
• If you are not a Harvard faculty PI (or non-faculty researcher with explicit PI rights), you will need to have/sign up for an account under a Harvard PI/sponsor. How Do I Get a FAS Research Computing Account?

Users

Before you can access the FASSE cluster you need to request a Research Computing account, selecting your PI as your sponsor (in this case, this is a Harvard faculty PI [or in some cases, a non-faculty researcher with PI rights], not necessarily the person listed on an IRB or DUA). See How Do I Get a Research Computing Account for instructions if you do not yet have an account. If your Harvard PI does not exist, please direct them to this same page and the directions in the previous paragraph.

New Accounts

If you have an existing account or have already completed the following three steps, you can skip this section. But please note the FASSE VPN realm (@fasse) noted below. You must connect to this realm to access any FASSE resources.

Password Set

Once you have your FASRC account, you will receive an email with the same information as below, but step one is to set your password. This will be done using your email address and our password reset system.

OpenAuth (two-factor)

To access FASSE and most FASRC services, including the FASRC VPN, you will need your personal FASRC OpenAuth two-factor (2FA) token. This can be set up on your smartphone using an app or downloaded as a Java applet to run on your desktop/laptop.

FASSE VPN

In order to access any secure system or environment in FASRC, you will need to connect to the FASRC VPN. The FASRC VPN is separate from other Harvard VPNs you may already be using.  To connect to a FASSE environment, you will connect to the FASRC VPN (vpn.rc.fas.harvard.edu) using the @fasse realm (ex. – jharvard@fasse), your FASRC password, and your OpenAuth 2FA code.

Step 2: Request a FASSE Project

If you have completed the HRDSP process and you and your PI have FASRC accounts, you can proceed to fill out the

FASSE New Project Request Form (Harvard Key login required)

USING FASSE

Accessing the FASSE environment.

FASSE VPN

To connect to a FASSE environment, you will connect to the FASRC VPN (vpn.rc.fas.harvard.edu) using the @fasse realm (ex. – jharvard@fasse), your FASRC password, and your OpenAuth 2FA code.  If you’re used to using Cannon, note that the VPN realm, @fasse, is different from the @fasrc realm you’re used to using.

SLURM and Partitions

To manage the workload on the cluster we use SLURM. Partition is the term that Slurm uses for queues. Partitions can be thought of as a set of resources and parameters around their use.  You can use spart to find out what partitions you have access to. Following are the partitions available on the FASSE cluster.

To run jobs on the main cluster instead, please refer to Running Jobs (Cannon)

Do not use salloc

Do not use salloc on FASSE.  Salloc is not available on FASSE for security reasons.  For interactive access, please use the FASSE VDI (see below).

Open OnDemand (OOD) Access

OpenOnDemand (OOD) or VDI (virtual desktop interface) is a virtual GUI interface that provides everything from pre-built apps to interactive command line access within a familiar desktop-like environment.

The FASSE OOD is available when connected to our @fasse VPN realm, through your web browser.  Please visit to access the service: https://fasseood.rc.fas.harvard.edu

See the following documentation for further information on how to leverage OOD on FASRC clusters:

1. OOD Dashboard and Remote Desktop
2. R and RStudio Server
3. OOD Remote Desktop and Software

Command Line Access

Command-line access is also available for those who need/want to run jobs using a CLI. Login nodes for FASSE can be accessed by SSH at fasselogin.rc.fas.harvard.edu:

ssh jharvard@fasselogin.rc.fas.harvard.edu

Note that FASSE does not allow to run interactive jobs. Instead, you have to use OOD to run interactive jobs.

See our FASSE CLI documentation for further information. [Link Pending] 

Interim Documentation: See the very similar main cluster doc in the interim

FASSE FAQ