Grid Security M. Jouvin / C. Loomis (LAL-Orsay) jouvin@lal.in2p3.fr Grid Administration Training LAL, Orsay, September 2008, 15-19

Grid Security - M. Jouvin Agenda Requirements and Constraints Different Components Certificates Virtual Organizations Proxies Grid Security - M. Jouvin 27/11/2018

Security Requirements Grid is a massively distributed system: More than 5000 users belonging to many different communities More than 250 sites around the world Bi-lateral relationships don’t scale, trust relationships must exist between: Sites and site administrators Users (e.g. privacy) Site administrators and users Security infrastructure must generation trust between all the actors for the grid to work Grid Security - M. Jouvin 27/11/2018

Main Features Required Authentication Who is the user ? Authorization Check right to do an action Auditing Who did what and when ? Traceability of actions is critical for trust in case of problem Accounting Identify resources used by a user Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Constraints Must be flexible, scalable and evolutive: Nobody can know everybody else Performance must be reasonable Must allows controlled access from any country Usage must be “simple” : If not, nobody will use it Tradeoffs required between security and simplicity Must allow right delegation (e.g. to a service) Grid Security - M. Jouvin 27/11/2018

Grid Security Infrastructure (GSI) De-facto standard for grid middleware Developped by Globus project (U.S.A.) Used by almost all production grids Based on a « Public Key Infrastructure » Every entity has both a public key and a private key Only one key can match the other Format : X509v3 Main features : Single sign-on : password protecting private key is entered once for a certain period of time Delegation : a person or a service may authorize another service to act on his behalf Allow another entity to use one’s authentication and authorization Mutual authentication : originator and recipient both authenticate other party Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Certificate… A grid-compliant (x509v3) certificate may be issued for: A physical person (personal certificate) A machine (host certificate) An application (service certificate) Not yet used Public key (certificate) Signed by an authority after checking who is the owner Publicly available, published on the network Private key Stored on user’s machine Encrypted, must be password protected A certificate is an identity card: doesn’t give any specific right Used to identify owner of a right by services Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin … Certificate Main informations in certificate: Subject or DN : unique identifier of certificate owner Replace username in grid world Validity duration of certificate : generally 1 year X509v3 extensions What the certificate can be used for Owner’s email 2 different formats usable with grid: PKCS12 : 1 file containing both private key and public key PEM : 2 files, 1 for private key, 1 for public key All Globus and gLite tools can use PKCS12 but they use a different file name…!!! usercert.p12 for gLite, usercred.p12 for Globus The easiest is to symlink one to the other Grid Security - M. Jouvin 27/11/2018

Who Signs Certificates? Certification Authority (CA) Is responsible for checking entity identity before issuing certificate 1 per country or sometimes a group of country (~35) Establish trust relationships with other CAs Coordinate security activities in its country In France, only « GRID-FR » certificates are accepted on EGEE http://igc.services.cnrs.fr/GRID-FR : Load « AC Certificates » then request a personal certificate Policy Management Authority (PMA) Define minimul rules a CA must adhere to to be valid on grid CA auditing and accreditation International Grid Trust Federation (http://www.gridpma.org) EUGridPMA (http://www.eugridpma.org/) … Grid Security - M. Jouvin 27/11/2018

Virtual Organizations Virtual Organizations (VOs) Group of people with common goals VO members organized in groups and subgroups A VO member may also have a role in its group/subgroup VO membership determines what resources can be used Groups and roles may modify access right to resources Several criteria for VO membership: Experiment or disciplinary based: biomed, alice, atlas, esr, … Laboratory or institute : vo.lal.in2p3.fr, vo.u-psud.fr, vo.ucad.sn, … Projects : embrace, gridpp, auvergrid, … Others : dteam, ops, … 1 utilisateur may belong to several VOs CIC Portal allow to list all registered VOs: http://cic.gridops.org/index.php?section=home&page=volist New VO must normally be registered… Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Authorization Actors VO Administrator: Decide who may be a member of the VO Organize members in groups and sub-groups Define roles A VO may have several administrator Site administrator: Responsible for deciding which VO can use the site resources Define resource access control based on VO requirements VOMS Service (VO Membership Service) allow VO administrators to manage their members. Grid services use VOMS to check group and roles (FQANs) and decide access rights Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Delegation Users cannot authorize every transaction in the grid: To many jobs Jobs are not necessarily local 1 job may involve several service Requires to delegate access rights to jobs and grid services Private key is a too sensitive information, with a long lifetime to be transmitted to grid services and jobs A “proxy” is created from the certificate and transmitted to services Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin « Proxy » New certificate derived from user’s certificate: Signed by user’s certificate Similar process as user’s certificate signed by the issuing CA Very short period of validity By default, ~1/2 day Includes all VO, groups, role (FQANs) the user have Stored in a file sent with job and to services Short life proxy (around 12 heures) voms-proxy-init (--voms), -info, -destroy Long life proxy myproxy-init, -info, -destroy, -get-delegation Required a valid VOMS proxy (short lived) Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Other Services  Grid services logs their action to allow auditing Understand who is doing what, where and when Understand global behaviour of the system Accounting Central database containing per VO view of used resources http://www3.egee.cesga.es/gridsite/accounting/CESGA/egee_view.html No quota currently available in the middleware Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Summary EGEE security is based on Globus GSI + VOMS Authentication A network of CAs sign entity’s certificate (person, host or service) Certificate is a “grid passeport” for the user Authorization Based on virtual organizations (VO) Site administrators are responsible for configuring authorization, based on VO requirements « Proxies » Contain information about VO, groups and role of a user at one point in time Allow to delegate access rights to grid services and jobs Grid Security - M. Jouvin 27/11/2018

Grid Security - M. Jouvin Useful Links Man pages for voms-proxy-xxx and myproxy-xxx commands GRIF gLite tutorial: https://trac.lal.in2p3.fr/GridSupport/wiki/Tutorial/Authorization Grid Security - M. Jouvin 27/11/2018