Security recommendations DPM Jean-Philippe Baud CERN/IT

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 2 Introduction Disk Pool Manager (DPM) – Manages storage on disk servers – SRM support (1.1, 2.1 and 2.2) – rfio, gridftp, http(s), xroot – NFS 4.1 interface under development Deployment status – ~200 DPMs in production – 70 VOs supported

EMI INFSO-RI Architecture Very important to backup ! Store physical files -- Namespace -- Authorization -- Replicas -- DPM config -- All requests (SRM, transfers…) Standard Storage Interface Can all be installed on a single machine Data Control

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 4 Starting/Stopping services General pattern: – service start|stop|restart|status Head node: – dpm – dpnsdaemon – srmv1, srmv2, srmv2.2 – dpm-manager-xrd, dpm-manager-cms (optional xrootd) Disk nodes: – globus-gridftp-server – rfiod – dpm-xrd, dpm-cms (optional xrootd) – dpm-httpd (optional http(s))

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 5 Log files (1) The services are logging to local log files – DPM server: /var/log/dpm/log – DPM Name Server: /var/log/dpns/log – SRM servers: /var/log/srmv1/log, /var/log/srmv2/log, /var/log/srmv2.2/log – RFIO server: /var/log/rfiod/log – DPM-enabled GridFTP: /var/log/dpm- gsiftp/gridftp.log, /var/log/dpm-gsiftp/dpm- gsiftp.log – Optional web server (Apache); errors also in syslog: /var/log/dpm-httpd/access, /var/log/dpm- httpd/errors – Optional xrootd: /var/log/xrootd/log, /var/log/olbd/log

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 6 Log files (2) Log format: – 04/13 13:24: ,0 Cns_srv_lstat: NS092 - lstat request by /DC=ch/DC=cern/OU=Organic Units/OU=Users/CN=baud/CN=373165/CN=Jean-Philippe Baud (101,101) from lxbra2301.cern.ch – 04/13 13:24: ,0 Cns_srv_lstat: NS098 - lstat 0 /dpm/cern.ch/home/dteam/baud – 04/13 13:24: ,0 Cns_srv_lstat: returns 0 Important messages to look for: – “timeout” – “Csec”, “is banned” – “error:” and “error :” – Number of threads in use Log files are rotated daily, keeping the last 90 days.

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 7 Service ports dpnsdaemon (5010) - DPM name service for the hierarchical namespace and metadata dpm(5015) - storage management, proprietary protocol srmv1(8443), srmv2(8444), srmv2.2(8446) – storage management, web service protocols over httpg secure rfio(5001, ) - file access protocol gridftp(2811, ) - grid file transfer protocol http(s)(80,443) - HTTP(S) file access protocol (optional) xroot(1094,1095)- xroot file access protocol (optional) ldap (2170) - standard BDII GIP IPv6 support

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 8 Authentication/Authorization Authentication – X509 proxies with or without VOMS extension – Handled by 2 plugins: Csec and cgsi Authorization – Virtual ids: DNs are mapped to virtual uids when first seen FQANs are mapped to virtual gids when first seen – ACLs on: Name space entries (Posix) Disk pools Dedicated spaces – Privileged operations(pool creation, filesystem drain, …) can only be triggered by superuser on trusted hosts – Physical files are owned by ‘dpmmgr’ Files could be on centrally managed Worker Nodes

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 9 Configuration files Most of the configuration parameters are kept in the DB: – Disk pool attributes, filesystem statuses … sysconfig files – DPNS_HOST and DPM_HOST – ALLOW_COREDUMP – Log files location DB connect strings – /opt/lcg/etc/NSCONFIG, /opt/lcg/etc/DPMCONFIG /etc/shift.conf – Trusted hosts DPNS TRUST … DPM TRUST … RFIO TRUST – RFIO options (buffer sizes)

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 10 Banning Requests are rejected if any of DN, CA, VO or primary FQAN attribute is banned Requests having a proxy including a banned secondary FQAN are allowed to proceed as if that FQAN had not been present in the proxy The banning information is cached in the DPNS DB for fast access The banning can be done in 2 ways: – Sysadmin can use dpns-modifyusrmap and dpns- modifygrpmap – A cron job can query the Argus service and automatically update the DPNS DB Banning is part of DPM 1.8.0

EMI INFSO-RI /09/2010 Security recommendations DPM, EGI TF, Amsterdam 11 Documentation – User documentation – Admin documentation – Roadmap – Source code – Current version number tions tions – Tutorials