USCGrid KX.509& Enterprise Security

April 2003USCGrid at Internet22 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative  Specific experience with KX.509 at USC  KX.509 & Campus Certificate Policies

April 2003USCGrid at Internet23 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative  Specific experience with KX.509 at USC  KX.509 & Campus Certificate Policies

April 2003USCGrid at Internet24 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative What if your enterprise already has a non-PKI authentication mechanism in place? Q:

April 2003USCGrid at Internet25 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative What if your enterprise already has a non-PKI authentication mechanism in place? Can an existing security mechanism be leveraged to get the user population on the grid? Q:

April 2003USCGrid at Internet26 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative What if your enterprise already has a non-PKI authentication mechanism in place? Can an existing security mechanism be leveraged to get the user population on the grid? Or does an entire parallel PKI mechanism need to be created? Q:

April 2003USCGrid at Internet27 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative If your existing enterprise authentication mechanism is kerberos, the answer is KX.509. A:

April 2003USCGrid at Internet28 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative If your existing enterprise authentication mechanism is kerberos, the answer is KX.509. KX.509 allows you to authenticate to kerberos, then create a proxy certificate based on your kerberos credential. A:

April 2003USCGrid at Internet29 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative If your existing enterprise authentication mechanism is kerberos, the answer is KX.509. Suddenly, everyone with a kerberos credential is grid-enabled. A:

April 2003USCGrid at Internet210 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative What about server certificates? Q:

April 2003USCGrid at Internet211 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative What about server certificates? Can I use kerberos to create those? Q:

April 2003USCGrid at Internet212 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative Kerberos does not affect server certificates. A:

April 2003USCGrid at Internet213 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative Kerberos does not affect server certificates. They must still be generated or acquired the ‘old-fashioned way’ A:

April 2003USCGrid at Internet214 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative Kerberos does not affect server certificates. They must still be generated or acquired the ‘old-fashioned way’ – for instance, by purchasing one through Verisign. A:

April 2003USCGrid at Internet215 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative  Specific experience with KX.509 at USC  KX.509 & Campus Certificate Policies

April 2003USCGrid at Internet216 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC What does USC’s KX.509 setup look like? Q:

April 2003USCGrid at Internet217 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC USCGrid is comprised of a Beowulf cluster (more on that in a minute), A:

April 2003USCGrid at Internet218 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC USCGrid is comprised of a Beowulf cluster, a Sunfire 15k called almaak.usc.edu, A:

April 2003USCGrid at Internet219 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC USCGrid is comprised of the Beowulf cluster, a Sunfire 15k called almaak.usc.edu, and a recently- upgraded Condor pool made up 110 Unix workstations in a public userroom. A:

April 2003USCGrid at Internet220 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC Kerberos and KX.509 are directly available through an NSF-mounted file system, /usr/usc, to anyone with a Solaris or Linux workstation. A:

April 2003USCGrid at Internet221 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC Kerberos and KX.509 are directly available through an NSF-mounted file system, /usr/usc, to anyone with a Solaris or Linux workstation. Those with PCs or Macs must ssh to a Unix timesharing system, such as almaak. A:

April 2003USCGrid at Internet222 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC The KCA runs on hpc-master.usc.edu, the head node for our 576-node 1152-cpu Beowulf cluster. A:

April 2003USCGrid at Internet223 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC To use locally-controlled grid resources, a user’s public certificate must be added to the grid mapfile. Q:

April 2003USCGrid at Internet224 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC To use locally-controlled grid resources, a user’s public certificate must be added to the grid mapfile. KX.509 users don’t have a public certificate. Q:

April 2003USCGrid at Internet225 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC To use locally-controlled grid resources, a user must be added to the grid mapfile. KX.509 users don’t have a public certificate. How can they be added to a grid mapfile? Q:

April 2003USCGrid at Internet226 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC We have a fairly simple-minded method currently for users to follow to request that they be added to the USCGrid mapfile. A:

April 2003USCGrid at Internet227 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC We have a fairly simple-minded method currently for users to follow to request that they be added to the USCGrid mapfile. Each user must send an message containing a copy of his or her kx509 certificate to the USCGrid administrator: A:

April 2003USCGrid at Internet228 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC Example: almaak.usc.edu(23): source /usr/usc/nmi/default/setup.csh almaak.usc.edu(24): kinit Password for almaak.usc.edu(25): kx509 A:

April 2003USCGrid at Internet229 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC almaak.usc.edu(26): kxlist -p Service kx509/certificate issuer= /C=US/ST=California/L=Los Angeles /O=University of Southern California/CN=usc.edu subject= /C=US/ST=California/L=Los Angeles /O=University of Southern California serial=A8 hash=e A:

April 2003USCGrid at Internet230 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC almaak.usc.edu(27): grid-proxy-info | \ mail -s "add me to grid mapfile" \ A:

April 2003USCGrid at Internet231 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC The Unix sysadmin can then add an entry to the grid mapfile using the information from grid- proxy-info : "/C=US/ST=California/L=Los Angeles/O=University of Southern California/OU=usc.edu/CN=shelley shelley A:

April 2003USCGrid at Internet232 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC How hard is it to install and maintain KX.509? Q:

April 2003USCGrid at Internet233 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC KX.509 is my favorite NMI component. A:

April 2003USCGrid at Internet234 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC KX.509 is my favorite NMI component. You install it, A:

April 2003USCGrid at Internet235 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC KX.509 is my favorite NMI component. You install it, no problem. A:

April 2003USCGrid at Internet236 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC KX.509 is my favorite NMI component. You install it, no problem. Then it runs. A:

April 2003USCGrid at Internet237 USCGrid: KX.509 & Enterprise Security Specific experience with KX.509 at USCSpecific experience with KX.509 at USC KX.509 is my favorite NMI component. You install it, no problem. Then it runs. Really. A:

April 2003USCGrid at Internet238 USCGrid: KX.509 & Enterprise Security  KX.509 as an alternative  Specific experience with KX.509 at USC  KX.509 & Campus Certificate Policies

April 2003USCGrid at Internet239 USCGrid: KX.509 & Enterprise Security  KX.509 & Campus Certificate Policies What about certificate policies? Do I still have to implement certificate policies if we use KX.509? Q:

April 2003USCGrid at Internet240 USCGrid: KX.509 & Enterprise Security  KX.509 & Campus Certificate Policies KX.509 doesn’t buy you out of dealing with certificate policies. A:

April 2003USCGrid at Internet241 USCGrid: KX.509 & Enterprise Security  KX.509 & Campus Certificate Policies KX.509 doesn’t buy you out of dealing with certificate policies. In a small way, it’s harder to cross-certify because you’re ‘different’. A:

April 2003USCGrid at Internet242 USCGrid: KX.509 & Enterprise Security  KX.509 & Campus Certificate Policies KX.509 doesn’t buy you out of dealing with certificate policies. We’re working on this with ‘the security community’ – stay tuned. A: