The GridSite Security System Andrew McNab and Shiv Kaushal University of Manchester.

Slides:

Advertisements

Similar presentations

30-31 Jan 2003J G Jensen, RAL/WP5 Storage Elephant Grid Access to Mass Storage.

Advertisements

Security middleware Andrew McNab University of Manchester.

DataGrid is a project funded by the European Union CHEP 2003 – March 2003 – Grid-based access control – n° 1 Grid-based access control for Unix environments,

29 June 2006 GridSite Andrew McNabwww.gridsite.org VOMS and VOs Andrew McNab University of Manchester.

The GridSite Toolbar Shiv Kaushal The University of Manchester All Hands Meeting 2006.

Andrew McNab - Manchester HEP - 2 May 2002 Testbed and Authorisation EU DataGrid Testbed 1 Job Lifecycle Software releases Authorisation at your site Grid/Web.

Middleware technology and software quality issues Andrew McNab Grid Security Research Fellow University of Manchester.

Jianlin Zhu Huazhong Normal University Running AliEn Secure Services.

1 Configuring Internet- related services (April 22, 2015) © Abdou Illia, Spring 2015.

Andrew McNab - EDG Access Control - 14 Jan 2003 EU DataGrid security with GSI and Globus Andrew McNab University of Manchester

The GridSite Security Framework Andrew McNab University of Manchester.

20 March 2007 VOMS etc Andrew McNabwww.gridsite.org VOMS etc Andrew McNab University of Manchester.

Andrew McNab - Manchester HEP - 6 November Old version of website was maintained from Unix command line => needed (gsi)ssh access.

WebFTS as a first WLCG/HEP FIM pilot

EGEE Security Area 13 May 2004 EGEE Security Area Stakeholders JRA3 middleware Architecture What we have for Unix and Java What.

1 3 Web Proxies Web Protocols and Practice. 2 Topics Web Protocols and Practice WEB PROXIES  Web Proxy Definition  Three of the Most Common Intermediaries.

10 May 2007 HTTP - - User data via HTTP(S) Andrew McNab University of Manchester.

Andrew McNab - GACL - 16 Dec 2003 Grid Access Control Language Andrew McNab, University of Manchester

3 May 2006 GridSite Andrew McNabwww.gridsite.org Web Services for Grids in Scripts and C using GridSite Andrew McNab University of.

Andrew McNab - EDG Access Control - 17 Jan 2003 EDG Site Access Control (ie Local Authorisation and Accounts) Andrew McNab, University of Manchester

Security Middleware and VOMS service status Andrew McNab Grid Security Research Fellow University of Manchester.

Andrew McNab - GridPP Security - 24 Feb 2003 GridPP Security Middleware Andrew McNab, University of Manchester

Andrew McNab - SlashGrid, HTTPS, fileGridSite SlashGrid, HTTPS and fileGridSite 30 October 2002 Andrew McNab, University of Manchester

Andrew McNab - GridSite/G-HTTPS - 17 Feb 2003 GridSite and G-HTTPS update Andrew McNab, University of Manchester

Grid Security work in 2006 Andrew McNab Grid Security Research Fellow University of Manchester.

1 Apache. 2 Module - Apache ♦ Overview This module focuses on configuring and customizing Apache web server. Apache is a commonly used Hypertext Transfer.

Grid Security and VO Management Andrew McNab University of Manchester.

POSTER TEMPLATE BY: Whitewater HTTP Vulnerabilities Nick Berry, Joe Joyce, & Kevin Vaccaro. Syntax & Routing Attempt to capture.

Andrew McNab - Access Control - 28 May 2002 Access Control and User Management (ie Local Authorisation and Accounts) Andrew McNab, University of Manchester.

10/20/2015 ©2006 Scott Miller, University of Victoria 1 Alternative Content Distribution Methods Non-CGI/SSI Content Serving.

1 Welcome to CSC 301 Web Programming Charles Frank.

EU DataGrid (EDG) & GridPP Authorization and Access Control User VOMS C CA 2. certificate dn, ca, key 1. request 3. certificate 4. VOMS cred: VO, groups,

Shibboleth: An Introduction

EGEE is a project funded by the European Union under contract IST Gap analysis draft v2 Olle Mulmo, David Groep, Joni Hahkala JRA3 Gap, 10.

Security Middleware in GridPP2 5 Feb 2004 Security Middleware in GridPP2 Current Status – GridSite GridPP2 Themes – libgridsite.

Andrew McNab - GridSite/EDG/GGF - 29 Sept 2003 GridSite, EDG and GGF Andrew McNab, University of Manchester

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security Token Service Valéry Tschopp - SWITCH.

EDG Security European DataGrid Project Security Coordination Group

Grid Security in a production environment: 4 years of running Andrew McNab University of Manchester.

Andrew McNab - Security - 1 July 2003 Security: Authorization, Access Control and Usage Control Andrew McNab, University of Manchester

NA-MIC National Alliance for Medical Image Computing UCSD: Engineering Core 2 Portal and Grid Infrastructure.

Andrew McNab - Grid HTTP/HTTPS extensions Grid HTTP/HTTPS extensions 18 November 2002 Andrew McNab, University of Manchester

GridSite Web Servers for bulk file transfers & storage Andrew McNab Grid Security Research Fellow University of Manchester, UK.

EGEE User Forum Data Management session Development of gLite Web Service Based Security Components for the ATLAS Metadata Interface Thomas Doherty GridPP.

2007cs Servers on the Web. The World-Wide Web 2007 cs CSS JS HTML Server Browser JS CSS HTML Transfer of resources using HTTP.

Andrew McNabSecurity Middleware, GridPP8, 23 Sept 2003Slide 1 Security Middleware Andrew McNab High Energy Physics University of Manchester.

Services Security A. Casajus R. Graciani. 12/12/ Overview DIRAC Security Infrastructure HSGE Transport Authentication Authorization DIRAC Authorization.

Andrew McNabGrid in 2002, Manchester HEP, 7 Jan 2003Slide 1 Grid Work in 2002 Andrew McNab High Energy Physics University of Manchester.

Andrew McNab - EDG Access Control - 17 Jun 2003 EU DataGrid and GridPP Authorization and Access Control Andrew McNab, University of Manchester

Grid Security work in 2004 Andrew McNab Grid Security Research Fellow University of Manchester.

Security Middleware 3 June 2004 Security Middleware Current Status – GridSite deployments – Architecture GridPP2 – Web services.

1 AHM, 2–4 Sept 2003 e-Science Centre GRID Authorization Framework for CCLRC Data Portal Ananta Manandhar.

John Kewley e-Science Centre All Hands Meeting st September, Nottingham GROWL: A Lightweight Grid Services Toolkit and Applications John Kewley.

INFSO-RI Enabling Grids for E-sciencE EGEE is a project funded by the European Union under contract IST Job sandboxes.

GRID Security & DIRAC A. Casajus R. Graciani A. Tsaregorodtsev.

Security Middleware Andrew McNab University of Manchester.

Andrew McNab - HTTP/HTTPS extensions HTTP/HTTPS as Grid data transport 6 March 2003 Andrew McNab, University of Manchester

(ITI310) By Eng. BASSEM ALSAID SESSIONS 10: Internet Information Services (IIS)

DataGrid Security Wrapup Linda Cornwall 4 th March 2004.

Storage Element Security Jens G Jensen, WP5 Barcelona, May 2003.

Overview of the New Security Model Akos Frohner (CERN) WP8 Meeting VI DataGRID Conference Barcelone, May 2003.

Andrew McNabSlashGrid/GFS BOF, GGF9, 7 Oct 2003Slide 1 SlashGrid = “/grid” Andrew McNab High Energy Physics University of Manchester

GridSite status Andrew McNab University of Manchester.

Manuel Brugnoli, Elisa Heymann UAB

Third Party Transfers & Attribute URI ideas

Server Concepts Dr. Charles W. Kann.

IBM Certified WAS 8.5 Administrator

Configuring Internet-related services

Shiv Kaushal, University of Manchester

Presentation transcript:

The GridSite Security System Andrew McNab and Shiv Kaushal University of Manchester

29 September 2004A.McNab – GridSite Outline ● What is GridSite? ● Components ● Philosophy ● Architecture ● Credential parsing ● GACL access policies ● HTTPS Downgrade ● Delegation ● SOAP/WS in GridSite

29 September 2004A.McNab – GridSite What is GridSite? ● GridSite has evolved from a set of website management tools, used by GridPP in ● It still provides some basic website tools ● Edit or upload files/pages via your web browser ● Create directories, manage access control etc ● However, our emphasis is now on adding grid security support to the industry-standard Apache webserver ● From 2001, GridSite recognised X.509 user certs in web browsers, so this has been a natural progression. ● We do all this in a modular way to help 3 rd parties.

29 September 2004A.McNab – GridSite GridSite Components ● Central component is libgridsite ● Provides reusable C/C++ functions ● Handles X.509/GSI/VOMS credentials ● Parses GACL(/XACML) policy files ● Provides some HTTP/HTML utilities ● mod_gridsite plugs into Apache 2.0 ● Uses libgridsite functions to add GSI/VOMS support ● And to allow fine grained access control with GACL ● grst-admin.cgi provides website management tools ● htcp command provides scp-like copies via HTTP(S)

29 September 2004A.McNab – GridSite Philosophy ● Re-use as much of Apache as possible ● Original gridsite.cgi filter became mod_gridsite ● Use standard config files, Apache internal settings etc ● Less work for us when Apache/OpenSSL vulnerabilities & patches are published ● Support dynamic content in any language ● via standalone CGIs or built-ins like mod_perl ● Keep generally useful machinery in a library ● Can be re-used by other server-side or even client tools ● Think about efficiency ● eg make sure HTTPS connection reuse isn't prevented

29 September 2004A.McNab – GridSite Architecture mod_ssl: plain HTTPS > env vars mod_gridsite: GACL access control + GACL > env vars mod_gridsite:.html headers and footers CGI, PHP,.shtml, mod_perl mod_jk: JSP with Tomcat HTTP Grst-admin.cgi: page editing, file upload, ACL editing etc. mod_gridsite: file PUT and DELETE GridSite 1.0.x mod_gridsite: GSI / VOMS OpenSSL callback wrappers

29 September 2004A.McNab – GridSite Credential Parsing ● Apache mod_ssl provides X.509 parsing and checking natively ● To support jobs or agents with GSI proxies, we need to deal with their “invalid” certificate chain ● This is done by intercepting OpenSSL callbacks ● Functions that understand GSI proxy chains are in libgridsite ● Valid proxies are treated like valid X.509 certs ● Normal mod_ssl environment variables are created ● If VOMS attribute certs are present, variables are exported downstream with their values too.

29 September 2004A.McNab – GridSite GACL access policies ● Apache has a simple access model based on IP number and username / password credentials. ● GridSite adds to this by being able to use GACL access policies for fine grained access control. ● GACL handling is done within libgridsite ● It's used outside Apache by some other LCG/EGEE components ● Read/write/execute/list/admin permissions can be granted according to X.509/GSI DN, VO DN Lists or VOMS attribute certificates. ● grst-admin.cgi provides a GUI editor for GACL files.

29 September 2004A.McNab – GridSite HTTPS Downgrade ● For large files, GridSite has an option to negotiate access via HTTPS and then do the transfer via HTTP. ● This is done using the standard HTTP redirect mechanism. ● Clients can suggest downgrade by making their HTTPS request with an HTTP-Downgrade-Size header ● If the file is bigger than the size given, the server may issue a redirect to an HTTP version of the file. ● HTTP authentication is done using a one-time passcode, returned over HTTPS as an HTTP cookie. ● Like HTTP, this is vulnerable to man-in-the-middle snooping ● But can't be used for replay attacks.

29 September 2004A.McNab – GridSite Delegation During EDG we produced a delegation-over-HTTPS extension to GridSite – (protocol implemented for Java by EDG WP2) EGEE JRA3 has agreed to support delegation via a web services Delegation portType – We've produced a prototype standalone delegation service. – Delegation handling functions being added to libgridsite for other services to use directly. – Will also add delegation support to mod_gridsite, by intercepting SOAP messages upstream.

29 September 2004A.McNab – GridSite SOAP in GridSite ● EGEE intention is to use “SOAP over HTTPS” first. ● Apache/GridSite provides a language-neutral Grid security aware container for C/C++/Perl/etc services. ● We expect many services to continue with transport level security because of large performance benefit of SSL/TLS session reuse. ● However, we also intend to add upstream SOAP parsing capability within mod_gridsite ● Initially to provide delegation support transparently ● As needed, we will add support for SOAP message level security handling within the web server.

29 September 2004A.McNab – GridSite Summary ● GridSite has grown from a set of tools use by a grid collaboration into a piece of grid middleware ● Aims to provide native support for Grid security credentials and policies within Apache web platform. ● And to provide reusable security tools for other systems. ● The architecture is deliberately chosen to simplify the operational aspects of running a GridSite service. ● Current work is focussing on support for Web Services running on Apache/GridSite in languages other than Java.