1. 5 January 2003USA-Israel BSF Grid collaboration1 Submitting Grid jobs through firewalls TAU: Halina Abramowicz, Itzhak Ben Akiva, David Horn WI: Ehud Duchovni, David Front, Lorne Levinson, Morton Taragin, Rafi Yaari www.weizmann.ac.il/~dfront/Submittingwww.weizmann.ac.il/~dfront/Submitting Grid jobs through firewalls.ppt

2. 5 January 2003USA-Israel BSF Grid collaboration2 Topics The issue Testing Firewalls in the presence of web services Firewalls and OGSA ‘Grid firewall security service’ – teaching firewalls ‘Grid security’

3. 5 January 2003USA-Israel BSF Grid collaboration3 The issue Various Grid projects experience difficulties submitting Grid jobs through firewalls: –Security managers are not willing to open firewall (dynamic ranges of) ports, required for Grid jobs, in order to prevent compromising local network security –Resources at domains that require a secureid to access, are not accessible by automated Grid applications Our goal: Contribute to research that deals with this issue Preliminary testing mission: –Learn what difficulties are experienced while submitting (VDT) Grid jobs between firewall guarded sites at multiple Israeli universities

4. 5 January 2003USA-Israel BSF Grid collaboration4 Testing: settings A Weizmann Institute Fire wall Main (secureid) domain DMZ eio01.weizmann.ac.il eio03.weizmann.ac.il Condor-GUser Globus GRAM GridFT P MDS

5. 5 January 2003USA-Israel BSF Grid collaboration5 Testing: settings B Weizmann Institute TelAviv University Fire wall Fire wall Main (secureid) domain DMZ eio01.weizmann.ac.il Globus Condor-GUser GRAM GridFTP MDS

6. 5 January 2003USA-Israel BSF Grid collaboration6 Testing: results Security managers cooperated At WI, ports were opened only for testing At WI, a permanent Grid dedicated DMZ cluster is envisioned No major difficulties have been experienced

7. 5 January 2003USA-Israel BSF Grid collaboration7 Testing results: Used ports (Setting A) Submit Globus job: Request: 2119Response: A range of ports Globus MDS: Request: 2135Response: 2135 GridFTP: Request: 2811Response: 113 + a range of ports Submit Condor job: Request: 2119Response: 37774. Range of ports of responses starts at about 33000 and going up Conclusion: Nothing unexpected

8. 5 January 2003USA-Israel BSF Grid collaboration8 Firewalls in the presence of Grid web services It may be more relevant to learn firewalls in the presence of Grid web services than firewalls in the presence of Globus 2 Web services use http port ‘Traditionally’, http port is not blocked by firewalls Firewalls are being enhanced to block web services streams by adding XML interpretation capability Hence, Grid web services will also have to deal with firewalls

9. 5 January 2003USA-Israel BSF Grid collaboration9 Firewalls and OGSA OGSA security group, published an architecture and roadmap at: http://www.cs.virginia.edu/~humphrey/ogsa-sec-wg/ Among other security grid services, ‘firewall friendly’ grid service will be specified At: ‘OGSA firewall Interoperability’ The ‘firewall friendly’ seems to replace rather than communicate with a firewall

10. 5 January 2003USA-Israel BSF Grid collaboration10 Replacing firewalls by an OGSA firewall?

11. 5 January 2003USA-Israel BSF Grid collaboration11 Current (and future?) Grid security Grid Cluster at DMZ firewall Grid client Grid gate keeper Client may submit resource request Firewall is not directly aware of Grid security. Hence, more resources should be allowed through firewalls than really required, causing a security compromise. Organization

12. 5 January 2003USA-Israel BSF Grid collaboration12 Morton Taragin’s suggestion: Define a ‘Grid firewall security service’, teaching firewalls ‘Grid security’ Grid Cluster at DMZ Grid firewall security server firewall Grid client Grid gate keeper 1) Grid firewall security request 2) ‘ Allow resource through ’ request 3) Client may submit resource request Organization