KFKI RMKI CA Review EUGridPMA May 26-28, Copenhagen Szabolcs Hernáth MTA KFKI RMKI pki.kfki.hu.

Slides:

Advertisements

Similar presentations

Usage of PGP in TACAR 19th OGF Meeting Chapel Hill, USA February 1, 2007 Licia Florio Project Development Officer

Advertisements

Status of Auditing Guidelines Document Oct. 15 Yoshio Tanaka, AIST.

Classic X.509 secured profile version 4.2 Proposed Changes David Groep, Apr 20 th, 2009.

Hungrid A Possible Distributed Computing Platform for Hungarian Fusion Research Szabolcs Hernáth MTA KFKI RMKI EFDA RP Workshop.

1 ASGCCA Self-Audit Report APGridPMA Jinny Chien March

CNIC Grid CA/SDG CA Self Audit Kejun (Kevin) Dong Computer Network Information Center (CNIC) Chinese Academy of Sciences APGridPMA F2F.

1 REUNA Certificate Authority Juan Carlos Martínez REUNA Chile Rio de Janeiro,27/03/2006, F2F meeting, TAGPMA.

NRENs supporting Grids using current Grid technology TERENA NREN-GRID Workshop Amsterdam Milan Sova CESNET.

9/20/2000www.cren.net1 Root Key Cutting and Ceremony at MIT 11/17/99.

NECTEC-GOC CA APGrid PMA face-to-face meeting. October, Sornthep Vannarat National Electronics and Computer Technology Center, Thailand.

National Institute of Advanced Industrial Science and Technology Self-audit report of AIST GRID CA Yoshio Tanaka Information.

NAREGI CA Updates Kento Aida NAREGI CA/NII Kento Aida, National Institute of Informatics APGrid PMA meeting 04/20/2008.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Interoperability Shibboleth - gLite Christoph.

March 27, 2006TAGPMA - Rio de Janeiro1 Short Lived Credential Services Profile Tony J. Genovese The Americas Grid PMA DOEGridsATF/ESnet/LBNL.

National Institute of Advanced Industrial Science and Technology Brief status report of AIST GRID CA APGridPMA Singapore September 16 Yoshio.

NECTEC-GOC CA Self Audit 7 th APGrid PMA Face-to-Face meeting March 8 th, 2010 Large-Scale Simulation Research Laboratory Sornthep Vannarat Large-Scale.

PKI Activities at Virginia September 2000 Jim Jokl

IHEP Grid CA Status Report Gongxing Sun F2F Meeting 20 Apr Computing Centre, IHEP,CAS,China.

IHEP Grid CA Status Report Wei F2F Meeting 8 Mar Computing Centre, IHEP,CAS,China.

KFKI CA József Kadlecsik KFKI RMKI

User Certificate Application: ASGCCA. Agenda Introduction ASGCCA User Responsibilities Certificate application form RA verify identity of users User generate.

IHEP Grid CA Status Report Gongxing Sun 5 th F2F Meeting 16 Sep Computer Center, IHEP,CAS,China.

Profile for Portal-based Credential Services (POCS) Yoshio Tanaka International Grid Trust Federation APGrid PMA AIST.

EUGridPMA status and updates David Groep, GGF18. EUGridPMA Status Update, TAGPMA Ottawa David Groep – Items  EUGridPMA.

KISTI Grid CA Status Report Korea Institute of Science and Technology Information Sangwan Kim Jae-Hyuck Kwan

Sam Morrison APAC CA – APGridPMA - ISGC2010 APAC CA Self Audit and status update Sam Morrison ARCS.

OSG PKI Contingency and Recovery Plans Mine Altunay, Von Welch October 16, 2012.

“Trust me …” Policy and Practices in PKI David L. Wasley Fall 2006 PKI Workshop.

On Robots J Jensen STFC Rutherford Appleton Lab Banff, July 2007.

NECTEC-GOC CA The 3 rd APGrid PMA face-to-face meeting. June, Suriya U-ruekolan National Electronics and Computer Technology Center, Thailand.

APGrid PMA face-to-face meeting, 9/16/2008 PRAGMA-UCSD CA Team Pacific Rim Application and Grid Middleware Assembly

Security Policy Update WLCG GDB CERN, 14 May 2008 David Kelsey STFC/RAL

Community PKIs Initiatives Updates TF-EMC2 Meeting Loughborough, UK 6-7 May, 2009 Licia Florio, TERENA

0 NAREGI CA Status Report APGrid F2F meeting in Singapore June 4, 2007 Rumiko Masuko.

KEK GRID CA Takashi Sasaki Computing Research Center KEK.

8-Mar-01D.P.Kelsey, Certificates, WP6, Amsterdam1 WP6: Certificates for DataGrid Testbeds David Kelsey CLRC/RAL, UK

MICS Authentication Profile Maintenance & Update Presented for review and discussion to the TAGPMA On 1May09 by Marg Murray.

FP6−2004−Infrastructures−6-SSA E-infrastructure shared between Europe and Latin America The Latin American Catch-all Grid Certification.

NIIF CA Status Update and Self-Audit Results 15 th EUGridPMA meeting Nicosia Tamás Máray NIIF Institute.

Baltic Grid Certification Authority 15th EUGridPMA, January 28th 2009, Nicosia1 Self-audit Hardi Teder EENet.

TR-GRID CA Self-Auditing Results and Status Update EUGridPMA Meeting September 12-14, 2011 Marrakesh Feyza Eryol, Onur Temizsoylu TUBITAK-ULAKBIM

HKU Computer Centre Grid Certificate Authority Status Update Lilian Chan IT Services, The University of Hong Kong APGrid.

FP6−2004−Infrastructures−6-SSA [ Empowering e Science across the Mediterranean ] Rome, Tutorial for Certification Authority Managers,

BG.ACAD CA HTTP :// CA. ACAD. BG S ELF - AUDIT REPORT 2014 Vladimir Dimitrov IICT-BAS ( 32 nd EUGridPMA Meeting Poznan, 8-10.

QuoVadis accreditation with EuGridPMA Alessandro Usai

Summary of Poznan EUGridPMA32 September EUGridPMA Poznan 2014 meeting – 2 David Groep – Welcome back at PSNC.

18 th EUGridPMA, Dublin / SRCE CA Self Audit SRCE CA Self Audit Emir Imamagić SRCE Croatia.

Academia Sinica Grid Computing Certification Authority F2F interview (Malaysia )

NECTEC-GOC CA A Brief Status Report 13 th APGrid PMA Face-to-Face meeting March 24 th, 2014 Large-Scale Simulation Research Laboratory Information Communications.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Operating Systems & Information Services CERN IT Department CH-1211 Geneva 23 Switzerland.

Feyza Eryol TÜBİTAK ULAKBİM TR-GRID CA SELF-AUDIT & UPDATES.

UK e-Science Certification Authority Self Audit Jens Jensen EUGridPMA meeting, Berlin.

Jens' obligatory soap box Can't be a PMA without a SoapBox A random collection of Soapy things Nicosia, Jan 2009.

EGI-InSPIRE RI EGI (IGTF Liaison Function) EGI-InSPIRE RI IGTF & EUGridPMA status update SHA-2 – and more (David Groep,

UGRID CA Self-audit report Sergii Stirenko 21 st EUGRIDPMA Meeting Utrecht 24 January 2011.

HellasGrid CA self Audit. In general We do operations well Our policy documents need work (mostly to make the text clearer in a few sections) 2.

News from EUGridPMA EGI OMB, 22 Jan 2013 David Kelsey (STFC) Using notes from David Groep 22/01/20131EUGridPMA News.

Updates from the EUGridPMA David Groep, Oct 17 st, 2007.

29 th EUGridPMA meeting, September 2013, Bucharest AEGIS Certification Authority Dušan Radovanović University of Belgrade Computer Centre.

© 2007 Open Grid Forum Authentication Service Profile Christos Kanellopoulos 14 th EUGridPMA, Lisbon, PT October 7 th, 2008.

PKGrid CA Self-Audit 2012 Adeel-ur-Rehman Mansoor Sheikh.

IRAN-GRID CA Self Audit IRAN-GRID CA Self Audit Report Shahin Rouhani IRAN-GRID Tehran Iran Shahin Rouhani Grid Computation Group IPM, Tehran, Iran May.

eduroam-as-a-service

AEGIS Certification Authority

HellasGrid CA & euGridPMA

MaGrid CA Self audit and update

Emir Imamagić University Computing Centre (Srce)

Bill Yau HKU Grid Certificate Authority (HKU Grid CA) Self Audit & Status Report Bill Yau

BG.ACAD CA Self-audit report 2018

Presentation transcript:

KFKI RMKI CA Review EUGridPMA May 26-28, Copenhagen Szabolcs Hernáth MTA KFKI RMKI pki.kfki.hu

Overview Background & History Present Status & Future Plans Self-assessment & Issues Lessons learned & Suggestions Discussion…

1. Background & History Why 2 CAs in Hungary? - Community needed the service in NREN CA (NIIF) was planned, but no progress or roadmap - RMKI had ~90% of LCG users & resources EUGridPMA in Brussels, Sept. 2004: - KFKI RMKI CA presented - PMA demanded community agreement to preempt a 2 CA situation Dec. 2004: Community agreement presented - Hungarian grid community will endorse KFKI RMKI CA until the NIIF CA can setup an RA at KFKI campus - PMA accepted the agreement, KFKI RMKI CA accredited - started production in Jan Recent progress in the setup of NIIF RA

2. Present Status Reliable operation on Debian/OpenCA Stats: - All issued: 230 (6 for testing) - Revoked: 126 (none compromised) - Valid: 47 (14 user, 33 host) - All host: 145 (68 DNs, even less idenities) - All user: 79 (50 DNs, even less identities) - All CRLs: 120 (1 overdue  ) NIIF RA progress: - RA secure admin interface deployed & tested (based on tokens) - User web interface in development - IdP for NIIF AAI Federation in deployment (for user preauth) - RA contract in preparation

3. Future Plans NIIF RA in production later this year Will probably keep the CA for local purposes - will rekey or extend the root - could produce new CP/CPS After the NIIF RA is in production, will replace all grid certs Need to leave the club  …

4. Self-assessment Work in progress, preliminary results Major issues: CA (5) CP/CPS is RFC 2527 D/D (7) Secure environment, access control & log D/D (9) Secure environment undocumented/unaudited D (11) CA key protection B/D (50) Operational audit D/D (51) List of personnel D Major Issues: RA (2) Identity vetting (user) B/C (3) Identity vetting (host) A/C (4) FQDN ownership B/C (10) Record archival in auditable form C

5. Other Issues Insufficient resources No long-term planning (was not expected) Missing operational documents Too many hats ‘Rescheduled’ paperwork

6. Recommendations More is less: - specify everything as strict as possible - write all operational documents before production Operational audit/review ASAP (before production) Separation of GRID namespace is recommended Accreditation profile version should be recorded on accreditation Audit guidelines updates for AP changes? (versions for each AP version?) Separate audit guidelines for different APs?

Thankyou !