A Secure Bioinformatics Linux Lab in an Educational Research Environment

In delivering a new bioinformatics curriculum in the Graduate School at the University of Medicine and Dentistry of New Jersey, we undertook the challenge of incorporating new computational resources over an existing research support infrastructure, adding new services and platforms and reacting to an increasingly burdensome responsibility to protect ourselves from network threats. Our new environment spans two cities and links Linux workstations, Linux servers, Silicon Graphics workstations, a Sun 6800 Enterprise Server and the Internet. Open-source solutions combined with selective use of commercial resources integrate in a cost-effective, service-friendly, bioinformatics research environment. In this report, we describe solutions to a set of challenges in our core, Linux-driven server/client environment.

As with many universities, our public computer labs are Microsoft boxes with the Office suite, and we have a set of clients--Web, secure telnet, secure FTP, IMAP2 mail and X. The bioinformatics software the university hosted lay behind these workstations, on Sun/Solaris and SGI/Irix servers. We needed an environment in which we could do several things: (1) manage workstations efficiently, (2) quickly add or delete applications, (3) rebuild workstations, (4) ensure availability and storage and (5) address network and data security issues.

We recognized that software and configuration information should be stored in a centralized server and available to authenticated clients. Our generic Web and e-mail servers already were overburdened with these services. In addition, each of those servers faced its own distinctive security threats and solutions. A better approach would be to establish a separate server dedicated to serving the scientific community, a scientific server. We needed to bring this project in on a modest budget.

Almost any server/workstation environment dedicated to scientific research might have offered multiple benefits,including parallel processing, centralized administration and secure storage systems. However, many fail in an important aspect in our two-city arena. We have a high demand for visualization, and users need X server clients such as ReflectionX, Exceed and Cygwin. X server clients display graphical interfaces to users accessing programs on a server or an X client. Most molecular modeling software requires visualization using OpenGL. In a local area network, this kind of architecture should suffice. However, our intercampus network was not always up to the task.

Our solution to this set of challenges was to build a bioinformatics computer lab environment dedicated to teaching and research. This lab is designed to be secure, resilient to attacks and failure and adaptable to an array of software and modes of access by authenticated users.

We began with the operating system choice. We elected Linux, for many of the usual reasons: open-source, secure, easily manageable and free availability made it attractive in an educational environment with limited funds. But in that economic mood, we still chose one step up, selecting Red Hat Enterprise Linux due to the support that commercial systems provide, including workstation monitoring, patches and upgrades using the Red Hat Network. We went with Intel x86 computers because we had a number on hand and they made good economic sense. Plus, if we were to fail, we still would have boxes that otherwise could be deployed.

As now deployed, our Piscataway lab has 14 Red Hat Enterprise Linux workstations and two Enterprise Linux servers. In the Newark lab, (where the facility is smaller), we have four Red Hat Enterprise Linux workstations and one Enterprise Linux server. All Piscataway workstations are identical in terms of hardware, as are all Newark workstations; there are minor differences between the two sets, however.

We outlined a set of initial tasks: build a server to run DHCP, host Red Hat CDs for Kickstart installations, authenticate users, host users' home directories and provide a Web and database server. To that end, we did an installation of Red Hat Enterprise Linux AS on two separate PCs in Piscataway and one in Newark to act as our servers--one primary, one backup and one Web/database server.

We also needed DHCP services to permit authorized users access to the network with personal laptops and not to run our workstations. Accommodating the laptop users, the MAC address of a user's laptop was determined, and for each laptop we have an entry similar to the following, where each host is identified by the user's username.

subnet 192.168.1.0 netmask 255.255.255.0 {
     deny unknown-clients;

     # DHCP range		
     range 192.168.1.240 192.168.1.245;

     # known clients
     host golharam { hardware ethernet 00:12:34:56:78:90; }
     ...
}