Hands on Security, Authentication and Authorization Virginia Martín-Rubio Pascual RedIRIS/Red.es Curso Grid y e-Ciencia 2010, Valencia 6- 9 Julio 2010

SERVER: cg02.ific.uv.es (SL5) cg01.ific.uv.es(SL4) USERNAME: tutXX PASSWORD: ngiXX PASSPHRASE: ngi1234 where XX = 01…24 UI access

Locate your personal certificate:.globus: directory which contains our certificate, two separated files (public and private keys). You need them for the authenticated connections with all the other elements. Check the permissions (you won´t be able to create a proxy if they are wrong) ~]$ ls -l.globus/ total 16 -r--r--r-- 1 tut25 tut Jun 15 09:42 usercert.pem -r tut25 tut Jun 15 09:42 userkey.pem Authentication and Authorization

Look inside your certificate: grid-cert-info ~]$ grid-cert-info Certificate: Data: … Issuer: C=ES, O=IFCA, CN=IFCA Formacion Grid CA Validity Not Before: May 28 00:00: GMT Not After : Jul 12 00:00: GMT Subject: C=ES, O=IFCA, CN=tut25 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:aa:…:72:81 Exponent: (0x10001) … Important Information: Creation and expiration date Name and subject of the CA Common Name (CN) of the certificate owner Certificate subject Authentication and Authorization

Creation of a proxy with VOMS extensiones (=VOMS proxy): This step is comparable to a login on the Grid: voms-proxy-init --voms vo.formacion.es-ngi.eu ~]$ voms-proxy-init --voms vo.formacion.es-ngi.eu Cannot find file or dir: /home/tut25/.glite/vomses Enter GRID pass phrase: Your identity: /C=ES/O=IFCA/CN=tut25 Creating temporary proxy Done Contacting voms01.ifca.es:15004 [/DC=es/DC=irisgrid/O=ifca/CN=host/voms01.ifca.es] "vo.formacion.es-ngi.eu" Done Creating proxy Done Your proxy is valid until Mon Jul 5 23:10: Authentication and Authorization

Check VOMS proxy information: voms-proxy-info -all We show two kind of diferent lifetimes: The first one is the proxy certificate’s lifetime. The second one is for the AC information added by VOMS server. The proxy certificate has a lifetime of 12 hours. ~]$ voms-proxy-info -all subject : /C=ES/O=IFCA/CN=tut25/CN=proxy issuer : /C=ES/O=IFCA/CN=tut25 identity : /C=ES/O=IFCA/CN=tut25 type : proxy strength : 1024 bits path : /tmp/x509up_u5733 timeleft : 11:58:55 === VO vo.formacion.es-ngi.eu extension information === VO : vo.formacion.es-ngi.eu subject : /C=ES/O=IFCA/CN=tut25 issuer : /DC=es/DC=irisgrid/O=ifca/CN=host/voms01.ifca.es attribute : /vo.formacion.es-ngi.eu/Role=NULL/Capability=NULL timeleft : 11:58:55 uri : voms01.ifca.es:15004 Authentication and Authorization

Logout del grid For deleting the VOMS proxy voms-proxy-destroy Authentication and Authorization

Register a long living proxy in the MyProxy server (gridpx01.ifca.es) myproxy-init The –s option alows you to specify the name of the myproxy server you want to contact. Withoout this option the name of the myproxy server is taken of the enviroment variable: MYPROXY_SERVER. The –d option allows you to create and store a long term proxy with your DN. Without this option, the name of the stored proxy is the same of the user in the local machine. The –l option allows you to create and store a long term proxy with a name specified by the user. Each user can create and store several proxies in a myproxy server, but each remote proxy is linked to the specified username. The –c option allows you to specify the myproxy lifetime (hours). myproxy-init –s gridpx01.ifca.es –d –l tut25 –c 48  MyProxy use  Creation

 ~]$ myproxy-init –s gridpx01.ifca.es –d –l tut25 –c 48 Your identity: /C=ES/O=IFCA/CN=tut25 Enter GRID pass phrase for this identity: Creating proxy Done Proxy Verify OK Your proxy is valid until: Wed Jul 7 15:15: Enter MyProxy pass phrase: Verifying - Enter MyProxy pass phrase: A proxy valid for 48 hours (2.0 days) for user tut25 now exists on gridpx01.ifca.es. MyProxy use  Creation

Gather information about the proxy certificate stored in myproxy server. If in your UI there is no local proxy, it´s not possible to be authenticated in the myproxy server. So you have to delegate the proxy certificate from the myproxy server or create a proxy local certificate: myproxy-get-delegation, you can add VOMS extensions (similar to voms-proxy-init) o without VOMS extensions ( similar to grid-proxy-init). After that you can get the proxy certificate stored in myproxy server information:  MyProxy use  Information

 ~]$ myproxy-info –s gridpx01.ifca.es –d username: tut25 owner: /C=ES/O=IFCA/CN=tut25 timeleft: 47:59:52 (2.0 days) If the credentials have been initialized with –d or -s, you also have to specify it when using myproxy-info. If the credentials have been initialized with –l, you also have to specify it when using myproxy-info: ~]$ myproxy-infogridpx01.ifca.es –d -l tut25 username: tut25 owner: /C=ES/O=IFCA/CN=tut25 timeleft: 47:58:04 (2.0 days) It’s very important the username of the proxy, because it’s which identifies and makes difference with the other proxies that you can have stored in your local machine. MyProxy use  Information

Proxy certificate delegation from myproxy server It allows you to get a proxy certificate from the myproxy server to your local machine. First at all, we have to destroy the proxy certificates that we have created and verify it doesn’t exist anymore: ~]$ voms-proxy-destroy ~]$ voms-proxy-info Couldn't find a valid proxy. Now we can delegate the proxy certificate from the myproxy server: myproxy-get-delegation The –d option allows us to create and store the delegated proxy certificate with our DN as subject. Without this option, the name of the local proxy is the same of the user in the local machine. The –voms option allows us to add VOMS extensions for a specific VO. MyProxy use  Delegation

~]$ myproxy-get-delegation -l tut25 --voms vo.formacion.es-ngi.eu Enter MyProxy pass phrase: Cannot find file or dir: /home/tut25/.glite/vomses Your identity: /C=ES/O=IFCA/CN=tut25/CN=proxy/CN=proxy/CN=proxy Creating temporary proxy Done Contacting voms01.ifca.es:15004 [/DC=es/DC=irisgrid/O=ifca/CN=host/voms01.ifca.es] "vo.formacion.es-ngi.eu" Done Creating proxy Done Your proxy is valid until Tue Jul 6 03:07: A credential has been received for user tut25 in /tmp/x509up_u5733. Verify now that the user has a local proxy: voms-proxy-info -all MyProxy use  Delegation

~]$ voms-proxy-info -all subject : /C=ES/O=IFCA/CN=tut25/CN=proxy/CN=proxy/CN=proxy/CN=proxy issuer : /C=ES/O=IFCA/CN=tut25/CN=proxy/CN=proxy/CN=proxy identity : /C=ES/O=IFCA/CN=tut25/CN=proxy/CN=proxy/CN=proxy type : proxy strength : 1024 bits path : /tmp/x509up_u5733 timeleft : 11:57:53 === VO vo.formacion.es-ngi.eu extension information === VO : vo.formacion.es-ngi.eu subject : /C=ES/O=IFCA/CN=tut25 issuer : /DC=es/DC=irisgrid/O=ifca/CN=host/voms01.ifca.es attribute : /vo.formacion.es-ngi.eu/Role=NULL/Capability=NULL timeleft : 11:57:53 uri : voms01.ifca.es:15004 MyProxy use  Delegation

Remote proxy destruction (in myproxy server) ~]$ myproxy-destroy -s gridpx01.ifca.es -l tut25 Default MyProxy credential for user tut25 was successfully removed Check your remote proxy: ~]$ myproxy-info -s gridpx01.ifca.es ERROR from myproxy-server (gridpx01.ifca.es): no credentials found for user tut25, owner "/C=ES/O=IFCA/CN=tut25” MyProxy use  Destruction

16 Thanks for your attention! Questions?