Grid PKI and security training

1
Grid PKI and security training

• ??????? ????????,
• ??? ???????????? ????????
• ????????, 17 ?????? 2005.

2
????????? ?????

• ??????? ????? ????????????????? ???????.
• Public Key Infrastructure ? X.509-???????????.
• ?????????????? ? ????????? ?????????? ? LCG-2.
• ??????? ??????????? ? ??????????? ????.
• VOMS Virtual Organisation Membership Service.
• MyProxy ?????? ?????????? proxy-????????????.
• ??????????? ???????????? ? LCG-2 ? gLite.
• ???????????? ?????.

3
????????? ????????????????? ???????.

• ???????? ?????????? (?????????) ????? ????????,
  ??????????? ??? ??????????/??????????? ??????.
• ???? ???????? ????????? ??????????.
• ?????????????? ???????? ??????????? ????????.
• ??????????? ????????????? ??????? ? ??????
  ??????????.
• ?????????????????? ??????????? ????????????
  ?????? ??????? ????????????????? ?????? ????????.
• ??????????? ???????????? ???????????? ??????.
• ???????? ??????? ?????????? ??? ?????????????
  ????????? ??????.
• Non-repudiation ????????????? ????????
  ?????????????? ???????? ???????.

4
????????? ??????????

• ???????????? ????????
• (DES, IDEA, BlowFish)

• ?????????????? ????????
• (RSA, DSA, Elliptic Curve)

5
?????????????? ?????????

• ????? ???? ????????? ? ????????? ?????
  ???????????????.
• ????? ?????????? ???????? ???? ??????????,
  ???????? ???? ???????????.
• ????? ???????? ??????? ???????? ????
  ??????????, ???????? ???? ???????????.
• ???????? ??????? ????? ??????? ?????? ????????
  ????????? ????? non-repudiation ??? ???????
  ??????? ????????? ????? ?????? ? ??? ??????????
  ?????????.
• ?????????????? ????????? ????? ?? ?????????
  ??????? ?????????????? ????????.
• ??????????? ???????? ????????? ????? ?????????
  ??????????? ????????.
• ?????????????? ????????? ??????? ?????????
  ???????????? (???????? ? 1000 ???), ??????? ???
  ?????????? ?????? ?????? ????????? ?????????
  ?????????? ?????????????? ???????? ???
  ?????????? ???????????? ?????????? ?????????? ?
  ???????????? ???????? ??? ?????????? ??????.

6
X.509 ???????????

• ??????? ????????????? ??????????????, ????????
  ???????????, ???????? ???????, non-repudiation.
• ???????? ??????? ??? (hash) ??????,
  ????????????? ???????? ??????.
• ??????? ????? ???? ????????? ? ??????? ?????????
  ?????.
• ?????? ?????????? ??????? (CA) ????????????
  ?????????????? ??????????? ???????????? ????????,
  ???????????? DN.
• ??????? ??????????? ???????? ?? ??????? ???????
  ???????, ??????????? ???? ??????????.

????????? ??????????? (RFC3280)
?????????? ???????????
Distinguished Name (DN) ?????????? ???
???????????, ??????????? ? ?????
X.500 /CRU/ODataGrid/CNDataGrid CA
7
PKI, Public Key Infrastructure

• Certification Authority ?????? ? ????????
  ???????????. ???????? ??????? ??????????
  ????????.
• Registration Authority ???????????? ?????
  ??????? ?? ?????????/????? ???????????.
• ???????? ??????????? ????? ????????????
  ???????? ???? ? ?????????? ??? ?????????? ?
  ???????? ???????.
• ?????? ??????, ???????????? ???????? ???? ???
  ?????????? ??????, ??????????? ???????? ???????
  ??? ????????????????? ????????? ????????? ?????.
• ????????? ??????????? ??? ??????????????
  ???????????? ? ?????? ?????????? ???????????? ???
  Certificate Revocation List, CRL.
• ???? ???????????? ??????? ?? ???????
  ??????????? ?? (self-signed) ???????????
  ????????? ??????? (CA).

8
Challenge-response authentication

• ????? (?) ????? ????????????????? ???? (?).
• ? ???????? ???? ?????????? ?????, ??? ?????????
  ???????????? ??????????? ? ??????? (??? ???????
  ????????) CA.
• ? ???????? ???? ???????????? ????? (challenge) ?
  ???????? ??????????? ?? ???????? ?????? ????.
• ? ??????? ????????? ?????? ? ???????? ?????
  (response) ?????.
• ? ?????????????? ????? ???? ? ??????? ???????????
  ????? ????????? ????? ? ?????????? ????????? ?
  ????????? ??????.
• ???? ????????? ???????, ?? ??? ?????????????
  ??????? ???????? ??????, ??????????????
  ???????????.

9
Challenge-response authentication

• ????????????? ???????????? ?????? ????? ??????
  ????? ??? ?? ?????? ???????? ?????. ???????
  challenge ?????? ?????????? ? ??????????
  ?????????? ?????? ???? ? ?????.
• ??? ???????? ??????????? ????? ??????????? ?????
  ?????? ???????? ?? ????? ?????? ? ????
  ????????????, ?????????? ???????????? ? ?.?.
• ???? ????? ????????????????? ???? ? ????? ???
  ????? ????????????????? ?????, ?? ????? ??
  ??????? ???????? ???? ? ???????? ??????????????.
• ????? ?????????? ?? ????? ??????????, ??? ???
  ???????? ?????????????? ????? ???? ?????????????
  ???. ????? ???? ???-??, ? ???? ???? ???????? ????
  ???? ??? ?? ??????????? ???.

10
Single Sign-On

• ??????? ???????????? ????? ?????????????? ?
  ????????? ?????????? ??? ?????????????????
  ????????????? ????????????.
• ??????? ?????????? ?????????? ??????????
  ????????? ?????? ??????? ?????? ??????????.
• LCG-2 ?????????????? ? ????????? ???????????
  proxy-????????????, ???????? ???????? PKIX.

• Limited Proxy ?? ????? ???? ??????????? ?????,
  ?? ????????????????? ?? gatekeeper.
• Proxy-?????????? ?? ????? ???? ???????, ???????
  ???????? ????????????? proxy ????? ????????????.
• ????????? proxy ?? ??????????? ?????????????
  ????? ?????????????, ??? ????? ???? CA ????????
  Kerberos CA.

11
?????????????? ? ?????????

• ??????? ?????????
• ??????? ??????? ???? ??????.
• ???????? ???? ?????????? ?????????????.
• ??????????? ???????? ???? (??????????)
  ???????????? ???????? ?????? ?? ???? ????????
  ????????????.
• GRAM, Replica Services, RB GSI-?????????????? ?
  ??????? ??????? proxy ????????? proxy.
• GridFTP GSI/SSL-?????????????? ? ???????
  (???????) proxy, ????????? ???.
• Web-??????? TLS-???????? ??????????????
  ????????? ? ?????????????? ?????????? G-HTTPS
  GET-PROXY-REQ ? PUT-PROXY-CERT.
• Java ?????????????? Java Secure Sockets
  Extension TrustManager. ???????????
  G-HTTPS-?????????.

12
??????????? ???????????

• ???????????? ???????? ???????? ? ???????????,
  ?????, ?????????? ? ?????????????? ???????????
  ??????? -- LCG-2 User Guide.
• VO ? ??????????? ????? ?????? LDAP ??? HTTP (???
  VOMS) ??????, ????????????? Distinguished Names
  ???????????? ????????????? ?????????? VO.
• LCG-2 ???? /etc/grid-security/grid-mapfile,
  ???? ?????????? ???? ??????????? ???????????,
  ??? ?????????? ???????????????? ????? ?????? VO.
• VOMS ???????? ??? ?????????? ????? ????????????
  ?????? VO ? ???????? ???????????????? ?????.
  ?????? ????????????? LDAP/HTTP ??? ???????????
  ????????????? ????? ?????????????? VOMS-???????.
  ?????????? ????????? ????????? Relational
  Database.

13
?????? ??????????? LCAS

• LCAS ????? ???????????? ??????? ??? ???????????
  ????????????. ??? ???????? ??????????? ??????????
  ???????? ?????????? ???? ??????? (??????????
  AND).
• userallow.mod ???? ???????????? ?????? ?
  ???????. ???? ???????????? allowed_users.db.
  (grid-mapfile)
• userban.mod ????????? ?????? ? ???????
  ????????? ?????????????, ????????? ? ?????
  ban_users.db.
• timeslots.mod ? ????? timeslots.db ???????
  ?????????? ???????, ? ??????? ???????? ??????.
• voms.mod ?????????? ????????????? ?? ??????
  ???????????? VOMS. ???????? ????? ? ?????????,
  GACL ? XACML ????????. ??-????????? ????????.
• ??????? ?????? ?????????? RSL-??????, ???????????
  ?????????? ?????? ????????????.

14
Credential Mapping Service

• LCMAPS ??????? ?? ????????? ???????????? ???????
  ? ?????????? Evaluation Manager.
• ??????? ?? ??????? ???????? X.509 Proxy ?
  ???????? ?????? ? RSL. ???????? ?????? ?????
  ????????? ?????????, ????????????? ???????????
  ????????.
• localaccount.mod ?????????? ????????? ???????
  ??????. ?????? ???? A ???????? ?????????.
• poolaccount.mod ?????????? ??????????? ???????
  ?????? (poolaccount). ??? A.
• posix_enf.mod ????????????? ????????? ????????
  ????????? POSIX-?????? setreuid(), setregid() ?
  setgroups(). ?????? ???? E ?????????????
  ?????????.
• voms.mod ?????????? ????????? ???????????? ??
  ????????? VOMS-??????. ??? A.

15
LCMAPS Evaluation Manager

• ??????? ?????????? ???????????? ???????
  ???????????? ??????????? Evaluation Manager ??
  ?????? ?????????? ????? ???????? ???????
  lcmaps.db.
• ???????? ??? ???????, ?????? ??????? ??????????
  ??????. ???????? ???????? ?????????????????
  ???????? ????????? ? ????? ????????????
  ?????????
• localaccount -gt posix_enf poolaccount
• poolaccount -gt bad_user
• bad_user -gt posix_enf

• ????????? ?????????? ???????? ???????????? ?????
  ???????? ?????????? ???????????? ??????.

16
VOMS VO Membership Service

• ????????? ??????? ????????????? ?????????
  ????????? ? ????????????????? ?????? ?
  ?????????????.
• ????????? ???????? ????????????? ??????????
  gridmap-????? ?????? ???????? ??? ??????????.
• ?? ??????? ???????????? ?? ?????????? ???????????
  ?????????? ? ????????????????? proxy-???????????.
• ? ???? proxy-?????????? ????? ???? ????????
  ?????????? ?? ?????????? VOMS-????????.
• ? ????? ?????? ???????????? ????????? ??????? ?
  ????????????? ??????? voms-proxy-init ??????
  grid-proxy-init.
• ????????????? ?????????? VOMS-????????
  ????????? ??????????? ?????? ? ???????????? ?
  ???????????? ????????.

17
????????? VOMS-??????????

• ????????? VOMS ?????? (group), ???? (role) ?
  ??????????? (capability). ?? ??????????
  ????????.
• ????????? ?????????
• /VO/group/subgroup(s)/Rolerole/Capability
  cap
• /grid.org/replicator/optimisation,
  /grid.org/RoleAdmin,
• /grid.org/production/RoleTester/Capabilitylong_j
  obs
• VOMS-?????? ????? ?????????? ?????????? ?
  ???????? ? ??????? ??? ? ???? ? ??????????
  ??????. ? proxy ????? ?????????? ??????
  ??????????? ?????????? ??????? ??????????
  ??????????.
• ???????? VO ?????? ???????????? ????????????? ?
  ?????????? gridmap.
• ????????? ????? ???????? ?????? ???????????
  X.509, RFC 3281 Attrubute Certificate, GACL ?
  XACML.

18
VOMS migration plan
19
?????? MyProxy

• MyProxy (MP) ????????? (????? ??????????)
  proxy-??????????? ??? ????????????? ????????????.
• myproxy-init ??????? ?????????????? proxy,
  ??????? ??????????? ?? ??????, ???????????????
  ?????? MP.
• ?? ????????????? ??????????? ??????????
  proxy-??????????? ?????? Resource Broker.
• MyProxy ?? ?????? ????????? ??????? ?????
  proxy-???????????? ????????????? ???????????
  ?????.
• MP ??? ????????????, ????? ???????????? ?????
  ???????????? ???????? (accepted_credentials) ?
  ????? RB ????? ????????? ???????????
  (authorized_renewers).
• ????????? MyProxy ???????????? ??????? ???????
  ???? ?????????? ????? ??????? ?? ??? ?????
  ???????? ??????????????? ???????????
  (??-????????? 7 ????).

20
????? ? gLite ? LCG-2

• ????????? ????????? OCSP ?????? ?????? CRL.
• ????????? ????????? ??????, ? ?????????
  ???????? ????????????????? ???????? ???????.
• ?????????? ?????????????? (AuthN) ? ?????????
  ??????????. ??????? ????? ???????? ???????? TLS.
• ????????? Site Integrated Proxy Services (SIPS)
  CA, ??????? ????? ???????? proxy-???????????
  ????????? Kerberos, ??????????? ?????-????? ?
  ?.?. ?????? X.509 ????????????. ?????? ????????
  ???????.
• ???????? ???????????????? ?????????.
• WorkSpace Service, ??????????? ????????? ???????
  ?????? ? ???????????? ????????????????.
• ????????????? JVM, Xen, VMWare, User-Mode Linux?
• ??????? ???????? Dynamic Connectivity Service
  ?????? ???????????, ? LCG-2 ? gLite 1.0
  ??????????? ?? ?????.

21
gLite ?????? ??????? ???????????

• Policy Information Point, PIP ???????? ?
  ????????? ????????? ????????????? ???????.
• Policy Decision Point, PDP ??????????? ??
  ??????????? PIP, ????????? ??????? ? ?????????? ?
  ??????? ??????? ??? ? ?????????? ????????
  ???????.
• Policy Enforcement Point, PEP ???????? ???????
  ?? PDP ? PIP, ??????? ??????? ?? ???????????.
• Policy Administration Point, PAP ?????????
  ???????? ??? ?????? ???????.

22
gLite ???????? ? ???????????

• ?????????? ??????? ????? ???????????? ?????????
  ? ?????????? ???????? ? ????????? ?????????. ??
  ????????? ?????? ?????????? ????????? ?????????.
• ?????????? ??????? ????? ???????????? ???
  ???????????? ??????? ??????????? ????? ???????
  UNIX, VOMS, LCAS, LCMAPS, GACL ? ?.?.
• ?????????? ??????? ?????????? ????? ??????
  ???????? ??????? XACML, PDL, PAM, SAML ? ?.?.
• ???????? ?????????????? ???????? ???????????
  ?????? ????? ??????????? ??????????? ???????.
• ??????????? ? ?????? (legacy) ???????? ?????
  ?????????????? ?? ?????? ??????????? ?????????.
  ????????, ? GridFTP ??????????? ?????????? LCAS ?
  LCMAPS ???????????.

23
?????? ? ?????? gLite I/O.

• ?????? Grid-?????? ????? ??????? ?????? ??????
  gLite I/O ???????? ?? Storage Element ? ???????
  ???????????? gstorage, ???????? ??????????? ???
  ?????. ??? ? ??????????? ??? ?????? ???.
• ?????? ????????? ??????? ?? ???????????, ???
  ????????????? ? ?????????, ??????????
  proxy-???????????? ? Credential Mapping System
  ??? ??????.
• ?? ????????? ????? ???????????? ??????????? ???.
• ?????????? ?????????? ??????? ???????
  ??????????? ?? ????????? ??????? ??????,
  ?????????? proxy ? ?????????.
• ???????? ??????? ????????? ??????????????
  ????????? ???????????????.
• ????? ? ????????????????? ???? ??????? ?
  ?????????? ???????? ? ? ????????? ????????
  ???????.

24
???????????? ?????

• http//rea.mbslab.kiae.ru/PKI-Training/