Slurm (slurmdbd.conf file permissions): slurmdbd.conf is installed world-readable, which leaks the accounting

Impact

slurmdbd.conf is installed world-readable, which leaks the accounting database's credentials to every local account on the host. Whoever reads it connects to MySQL as slurmdbd and owns the accounting data directly, bypassing Slurm entirely.

Who can reach it

Any local user on the host running slurmdbd - which on smaller clusters is the same box as slurmctld or even a login node.

What to do

Upgrade to Slurm 18.08.9 or 19.05.5, then chmod 600 slurmdbd.conf and chown it to the SlurmUser. Rotate the database password too - assume it was readable for the whole time the file sat at the default mode.

References