Hands-on security Angelines Alberto Morillas Ciemat

Para ver esta película, debedisponer de QuickTime™ y deun descompresor TIFF (LZW).


Hands-on security

Angelines Alberto MorillasCiemat



•SERVER: glite-tutor.ct.infn.it

• glite-tutor2.ct.infn.it

•USERNAME: sevillaXX

•PASSWORD: GridSEVXX

•PASSPHRASE: SEVILLA

• where XX = 01…30

How to access to the UI



Authentication and Authorization

• INSPECTING PERSONAL CERTIFICATE

.globus: your personal certificate, two separate files (public and private keys)

You need them for the authenticated connections with all the other elements.

Check the permissions (you won´t be able to create a proxy if they are wrong)

ls –l .globus-rw-r--r-- usercert.pem-r-------- userkey.pem




• INSPECTING PERSONAL CERTIFICATE

Look inside your certificate

grid-cert-info

Important information Creation and expiration date Name and subject of the CA Common Name (CN) of the certificate owner Certificate subject




• Creation of a proxy with voms extensions

This step is comparable to a login on the grid.

voms-proxy-init --voms gilda




• CHECK YOUR VOMS PROXY

To get info about your proxy

voms-proxy-info -all

It shows two different lifetimes: First is related to the proxy itself The second one is referred to the AC infos

added by the VOMS server.

Important: your proxy has 12 hours of live



MyProxyUse

• Register a long living proxy in the MyProxy server (grid001.ct.infn.it)

Allows you to create and store a long term proxy certificate

myproxy-init --voms gilda

The –s option allows you to specify the name of the myproxy server you want to contact

myproxy-init --voms gilda –s grid001.ct.infn.it



MyProxyUse


The –d option allows you to create and store a long term proxy with your DN.

myproxy-init --voms gilda –s grid001.ct.infn.it -d

Without this option, the name of the stored proxy is the same of the user in the local machine



MyProxyUse


The –l option allows you to create and store a long term proxy with a name specified by the user

myproxy-init --voms gilda –s grid001.ct.infn.it –l

GILDA_TUTOR

Each user can create and store several proxies in a myproxy server, but each remote proxy is linked to the specified username



MyProxyUse

• Gather information about the proxy in the MyProxy server

You can get info on myproxy server about your proxy

myproxy-info –s grid001.ct.infn.it

If the credentials have been initialized with the –d switch, you also have to specify it when using myproxy-info

myproxy-info –s grid001.ct.infn.it -d



MyProxyUse


If the credentials have been initialized with the –l switch, you also have to specify it when using myproxy-info

myproxy-info –s grid001.ct.infn.it –l

GILDA_TUTOR

Note the differences in the usename of each proxy



MyProxyUse


If in your UI there is no local proxy, it´s not possible to be authenticated in the myproxy server

In this case is needed to get a delegate proxy form the MyProxy sever or create a local proxy with

voms-proxy-init



MyProxyUse

• Get a delegated proxy from the MyProxy server

It allow you to get a proxy from the myproxy server

Destroy the proxy in the local machine and verify it doesn-t exist anymore

voms-proxy-destroyvoms-proxy-info

couldn´t find a valid proxy



MyProxyUse


Now in your UI (virtual o real), there is no local proxy.

To get a proxy from the myproxy sever

myproxy-get-delegation –s grid001.ct.infn.it



MyProxyUse


With –d option

myproxy-get-delegation –s grid001.ct.infn.it –d

Verify now that the user has a local proxy

voms-proxy-info



MyProxyUse

• Destroy remote proxy

You can destroy your remote proxy

myproxy-destroy –s grid001.ct.infn.it

Check your remote proxy

myproxy-info –s grid001.ct.infn.it



MyProxyUse


Destroy your remote proxy with -d

myproxy-destroy –s grid001.ct.infn.it -d

Check your remote proxy with -d

myproxy-info –s grid001.ct.infn.it -d



MyProxyUse


Destroy your remote proxy with -l

myproxy-destroy –s grid001.ct.infn.it –l

GILDA_TUTOR

Check your remote proxy with -L

myproxy-info –s grid001.ct.infn.it –l

GILDA_TUTOR

Documents

Hands-on security Angelines Alberto Morillas Ciemat