Security for Dummies pps

Security for Dummies Project Title: OGSA-DAI Document Title: Security for Dummies Document Identifier: SECURITY-FOR-DUMMIES-v1.2 Editor: Mike Jackson Approval List: NCH Document History: Personnel MJJ MJJ NCH MJJ Date 29/10/03 16/10/03 17/9/03 25/07/03 Summary Revised in light of comments from Jarek Gawor Revised in light of comments from Charles Bacon Approved for external distribution Version 1.2 1.1 1.0 0.1 SECURITY-FOR-DUMMIES-v1.2 Contents 2 1 2 3 4 5 6 7 Introduction 4 Security Concepts 5 2.1 Public Key Cryptography 5 2.1.1 Securing Private Keys 5 2.2 Signing 5 2.3 Certificates 5 2.3.1 Certificate Authorities 6 2.4 Mutual Authentication 6 2.5 Confidential Communication 6 2.6 Delegation, Single Sign-On and Proxies 7 2.7 Grid Map Files 7 Globus Toolkit 3 Grid Security Infrastructure (GSI) 8 3.1 Why? 8 3.2 Java Authentication and Authorization Service (JAAS) 8 3.3 Message Level Security 8 3.3.1 GSI Secure Conversation 9 3.3.2 GSI XML Signature 9 3.4 Server-side Security 9 3.4.1 WS-Security Handler 10 3.4.2 Security Policy Handler 10 3.4.3 Authorization Handler 10 3.4.4 Service 11 3.4.5 Reply to Client 11 3.5 Client-side Security 11 3.5.1 Outbound Client-side Security Handlers 12 3.5.2 Inbound Client-side Handler (WS-Security Client Handler) 12 General Configuration 13 4.1 Set GLOBUS_LOCATION 13 4.2 Install JAAS 13 4.3 Configure Tomcat 13 4.4 Note a xalan.jar Issue 13 Globus Toolkit Installation 14 5.1 Install Globus Toolkit 3 and Configure Environment Variables 14 5.2 Configure GSI 14 5.3 The /etc/grid-security directory 15 5.3.1 Creating /etc/grid-security 15 5.3.2 Contents of /etc/grid-security 16 5.4 /etc/grid-security/grid-mapfile 17 5.5 Get a Host Certificate 18 5.5.1 Get a Host Certificate from the Globus CA 18 Configuring Server-side Security 20 6.1 Security Handlers 20 6.2 GSI Authentication Service 20 6.3 Operation Providers and Notification 20 6.4 Service Credentials 21 6.5 Service Authorization Settings 21 6.6 Security Deployment Descriptors 22 6.6.1 Specifying Security Deployment Descriptor Locations 22 6.6.2 Security Deployment Descriptor Content 22 6.6.3 Default Security Deployment Descriptor 25 Client Development 26 7.1 Security Handlers 26 7.2 The <USER>/.globus Directory 26 7.2.1 Keys and Certificates from Multiple CAs 27 7.3 Get a User Certificate 27 7.3.1 Get a User Certificate from the Globus CA 27 7.3.2 Keys and Certificates from Multiple CAs 30 SECURITY-FOR-DUMMIES-v1.2 3 7.4 Configure Java CoG 30 7.4.1 7.4.2 Java CoG Default Values 30 Providing a cog.properties File 31 7.5 Generate a Client Proxy 31 7.5.1 7.5.2 7.5.3 Generate a Proxy Using the grid-proxy-init Script 32 Generate a Proxy Using the org.globus.tools.ProxyInit Program 33 Generate a Proxy Using the org.globus.tools.proxy.GridProxyInit Program 33 7.6 Write Your Client 34 7.6.1 7.6.2 Required Classes 34 Configure the Service Stub Prior to Each Operation Call 34 7.7 7.8 Run Your Client 36 Common Problems 37 7.8.1 7.8.2 7.8.3 7.8.4 7.8.5 7.8.6 Class Missing when Running Client 37 Class Missing when Running Client 37 Server-side SEC05 Error 37 Server-side SEC06 Error 37 Authentication Error 37 FileNotFound Error 37 8 9 Other Useful Information 39 8.1 GT3 Scripts 39 8.2 Useful Credential Manipulation 39 8.2.1 To get default (user proxy) credentials 39 8.2.2 To save credentials 39 8.2.3 To load user proxy from a file 39 8.2.4 To get remaining lifetime of the credential 39 8.2.5 To get the identity of the credential (in Globus format) 40 8.3 Useful Service Operations 40 8.3.1 Setting service owner with caller's delegated credential 40 8.3.2 Getting caller's identity 40 8.3.3 Getting the JAAS invocation Subject 40 8.3.4 Credential Refresh 41 8.4 GSI Notifications 41 8.4.1 Sink 41 8.4.2 Source 41 8.5 Limitations 42 8.5.1 ServiceLocator/GridLocator Reuse 42 8.5.2 Persistent Services Activation Run-As Identity 42 8.6 Credential Acquisition Rules 42 Getting Certificates from the UK Grid Support Centre 43 10 Sources / Further Information 44 10.1 10.2 10.3 10.4 10.5 Overview 44 Grid Security Infrastructure, Certificates and Proxies 44 General Globus Toolkit 3 Security Documentation 45 Java CoG Kit 45 JAAS 45 SECURITY-FOR-DUMMIES-v1.2 1 Introduction This document provides an introduction to using message level security, in particular GSI Secure Conversation message level security, with the Globus Toolkit 3. It is based upon and replicates 4 documentation listed in section 10 but combines this into a (hopefully) more coherent and useful form. Transport level security is not described since this is to be deprecated in future releases. I did not have root access so some of the issues relating to configuring GSI and installing host certificates is conjecture (!). SECURITY-FOR-DUMMIES-v1.2 2 Security Concepts This section provides a brief overview of general security concepts for reference or refreshment. 2.1 Public Key Cryptography • Keys are mathematical numbers. • Public key is known to the world. • Private key is known only to you. Sender: EncryptedMessage = SenderPrivateKey(OriginalMessage) Receiver: OriginalMessage = SenderPublicKey(EncryptedMessage) OR Sender: EncryptedMessage = ReceiverPublicKey(OriginalMessage) Receiver: OriginalMessage = ReceiverPrivateKey(EncryptedMessage) 2.1.1 Securing Private Keys • Private keys are stored in files. • Encrypted via a password/pass phrase. • User must enter the pass phrase to access the private key. 2.2 Signing • Assures recipient that message has not been interfered with since it left the sender. 5 • • • The sender and recipient use an agreed publicly-available algorithm for both signing messages and validating the signature of messages. Sender: o Hash = PublicAlgorithm(Message). o EncryptedHash = SenderPrivateKey(Hash). o SignedMessage + EncryptedHash + Message. o Sends SignedMessage. Recipient: o Receives SignedMessage. o Extracts Message from SignedMessage. o RequiredHash = PublicAlgorithm(Message) o Extracts EncryptedHash from SignedMessage. o Hash = SenderPublicKey(EncryptedHash) o If RequiredHash = Hash then the SignedMessage was not interfered with. 2.3 Certificates • • Identifies users and services – vital for identification and authentication. Includes: o Subject name: identity of user or service represented AKA distinguished name. o Public key of subject. o Identity of Certificate Authority (CA) signing certificate. o Digital signature of CA. SECURITY-FOR-DUMMIES-v1.2 o Details on the public algorithm the CA used to sign the certificate. • X509 format – defined by the IETF (Internet Engineering Task Force). o Binds a public key to a name. 6 o Can be shared with other public key-based software e.g. Netscape, Internet Explorer. • Host certif icate s: o AKA server certificates. o These can be needed for a server to perform secure operations. In GT3 these are needed for GridFTP and GRAM services, for example. 2.3.1 Certificate Authorities • • • • • AKA trusted party / issuer. Provide certificates for users. To get a certificate: o User’s public + private key pair used to create a Certificate Request. o Certificate Request and public key forwarded to CA. o CA creates and signs certificate and returns to user. CA certificate provides a guarantees that the public key belongs to subject and that the CA guarantees the identity of the subject. The identity of the subject is established by the CA via non-cryptographic means. 2.4 Mutual Authentication • • • • Uses certificates. Requires co-operating agents to trust each other’s CAs. o Need copies of CA certificates – including CA’s public keys. o Need to trust that certificates actually do belong to the CAs. SSL Protocol (AKA Transport Layer Security (TLS)). Example: o A connects to B. o A gives their certificate to B. o B validates A’s certificate by checking the CA’s digital signature to ensure that: A’s CA signed certificate. A’s certificate not tampered with. o B can now trust the CA that signed A’s certificate. o B validates A: B sends a random message to A. A encrypts message using their private key. A sends the encrypted message to B. B decrypts the encrypted message using A’s public key as stored in A’s certificate. If the result is the original random message send by B to A then A is indeed who they claim to be. o A then validates B via validation of B’s CA, their certificate and the use of a random message as above. 2.5 Confidential Communication • • Communication integrity: eavesdroppers can read communications but not modify them. Signing messages supports this. Communication privacy: eavesdroppers cannot read communications. Encrypting messages supports this. SECURITY-FOR-DUMMIES-v1.2 2.6 Delegation, Single Sign-On and Proxies • Extension of SSL protocol. • Designed to avoid re-entry of pass phrases for accessing private keys in situations where a large number of signed or encrypted messages are being generated. • User creates a proxy which has a new: o Proxy private key. o Proxy certificate: New proxy public key. User identity + indication that it is a proxy. Signature of the user – certificate is signed by user and not a CA. A life time. • Proxy private key is stored in file: o Access permissions are used to restrict access. o There is no pass phrase providing additional security however. • Mutual authentication example: o A creates a proxy Ap. o Ap connects to B. o Ap gives a proxy certificate to B. o Ap also gives A’s certificate to B. 7 o B uses A’s certificate to validate the signature on Ap’s certificate – did A sign Ap’s certificate? o B uses A’s certificate – in particular information on the CA that signed A’s certificate – to validate A. 2.7 Grid Map Files • • Grid Map Files are used for resource authorization. Map Grid identities – subject name on a user’s X509 security certificate to a local identity associated with a user account. SECURITY-FOR-DUMMIES-v1.2 3 Globus Toolkit 3 Grid Security Infrastructure (GSI) 8 Globus Toolkit 3 Java Grid Security Infrastructure (GSI) is based on the implementation of GSI in the Java CoG Kit. GT3 provides message level security based on WS-Security, XML Encryption and XML Signature standards. The Java GSI implementation is an implementation of the Java Generic Security Services API (GSS- API). It supports the GSS-API extensions and the new proxy certificate format specifications as defined by the Global Grid Forum. GT3’s security library features include: • • • • • • • • Secure communication and authentication. Mutual authentication. Single sign-on including credential delegation and proxies: o Authentication. o Message protection. PKI – Public Key Infrastructure. Instance-based security – each service instance can have its own credentials, gridmap file, etc. Declarative security – the security behavior of a service can be specified in a security deployment descriptor. Programmatic security – security API are provided to service developers for fine-grained security control. Java Authentication and Authorization Service (JAAS) integration – permits services to be independent from underlying authentication technologies. GSI’s default configuration is non-confidential communications – only authentication is supported. However, private keys shared between communicating parties for encryption and decryption can be configured if desired. Communication integrity is supported by default however communication privacy can also be configured. 3.1 Why? • • • Need for secure communication (authenticated and perhaps confidential) between elements of a computational Grid. Need to support security across organizational boundaries, thus prohibiting a centrally- managed security system. Need to support "single sign-on" for users of the Grid, including delegation of credentials for computations that involve multiple resources and/or sites. 3.2 Java Authentication and Authorization Service (JAAS) The Java Authentication and Authorization Service (JAAS) is a standard extension to Java 1.3 and is a part of Java 1.4. JAAS provides access control based on where code originates from, who signed the code, and who runs the code. 3.3 Message Level Security • Base d on the following standards o WS-Security o XML Encryption SECURITY-FOR-DUMMIES-v1.2 o XML Signature • Security is applied entirely at the SOAP level. 3.3.1 GSI Secure Conversation • AKA GSI Secure Session. • Session-based security model. • Uses a GSI Secure Conversation Service to establish a context between two parties, for example a client and a service. • Context is established before any data is communicated. • This context provides a shared secret key. • Parties uses context to sign, verify, encrypt, and decrypt messages. • Clients can then securely communicate with service and vice versa. • Trust between parties is established at the outset of communications between the parties. 9 Subsequent messages can then be transmitted and received with less overhead since trust does not have to be re-established on a message-by-message basis. 3.3.2 GSI XML Signature • • • • AKA GSI Secure Message. Per-message-based security model. Messages are signed with X509 certificates. Greater computational overhead than GSI Secure Conversation. 3.4 Server-side Security • • • Client Message flow and processing that occurs for a security-enabled service. Security is specified via deployment descriptors. JAX-RPC handlers that are involved in security-related message processing on a server. Server Hosting Environment JAAS Security Policy Authorization WS-Security Handler Handler Handler Service Sec Conv Msg Handler SecConv Service Figure 1:Server-side security – GSI Secure Conversation SECURITY-FOR-DUMMIES-v1.2 Server Hosting Environment JAAS Security Policy Authorization WS-Security Handler Handler Handler Client Service XML Sig Handler Figure 2: Server-side security – GSI XML Signature The SOAP engine invokes several security-related handlers as follows: 3.4.1 WS-Security Handler • Searches the message for any WS-Security headers. • Extracts any keying material: o An X509 certificate and associated certificate chain. o OR o Reference to a previously established secure conversation session. • Checks any signatures and/or decrypts elements in the SOAP body. • Populates a peer Java Authentication and Authorization Service (JAAS) subject object – which represents some user – with principals and any associated keying material whose veracity was ascertained during the signature checking or decryption step. 3.4.2 Security Policy Handler • Checks that incoming messages fulfill any security requirements the service has. • Requirements are specified, on a per-operation basis, as part of a security descriptor during deployment. • Identifies the correct JAAS subject to associate with the current thread of execution. o Chooses between: Peer subject populated by the WS-Security handler. Subject associated with the hosting environment. Subject associated with the service itself. 10 Association is done by the pivot handler, a non-security handler that handles the details of delivering the message the service. 3.4.3 Authorization Handler • • • Verifies that the principal established by the WS-Security handler is authorized to invoke the service. Type of authorization that is performed is specified as part of a deployment descriptor. Three authorization modes: o none o self – which authorizes incoming messages whose associated principal/identity coincides with the service owner. [...]... Deployment Descriptor Locations The securityConfig parameter is used for persistent services For example: The instance-securityConfig parameter is used for transient services created by factory services For example: The location of the security deployment descriptor... provides a list of options to the grid-cert-request program SECURITY- FOR- DUMMIES- v1.2 20 6 Configuring Server-side Security 6.1 Security Handlers Message level security is handled by a few client- and server- side Axis/JAX-RPC handlers These handlers must be properly installed in order for the message level security to work The /webapps/ogsa/WEB-INF/server-config.wsdd file must define the following... performed, the access to the service is allowed The method cannot be specified with any other authentication method Note that the org.globus.ogsa.impl .security. authentication.SecurityPolicyHandler handler must be installed properly in order for this to work (see section 6.1) If the security deployment descriptor is not specified, authentication method enforcement is not performed SECURITY- FOR- DUMMIES- v1.2... service has one set) 6.6.3 Default Security Deployment Descriptor The security deployment descriptor in org/globus/ogsa/impl /security/ descriptor/gsi -security- config.xml provides is a generic descriptor that can be used to secure a service with GSI secure conversation authentication mechanism SECURITY- FOR- DUMMIES- v1.2 26 7 Client Development 7.1 Security Handlers Message level security is handled by a few... Issue An older version of Xalan was shipped with Java 1.4.0/1.4.1 than the version the GT3 security libraries require The $GLOBUS_LOCATION/lib/xalan.jar file should be used SECURITY- FOR- DUMMIES- v1.2 14 5 Globus Toolkit Installation This section describes information relating to configuring GT3 for security and for generating and installing host private keys and certificates 5.1 Install Globus Toolkit... name=""> elements For example, the following security deployment descriptor specifies that: • • All methods are to be run with the security identity of the caller GSI Secure Conversation authentication is to be applied on all method calls SECURITY- FOR- DUMMIES- v1.2 23 ... the setup-gsi program so you can skip this section SECURITY- FOR- DUMMIES- v1.2 16 If you did not have root access then you should ask your administrator to create the directory /etc/gridsecurity and make it world-readable: # mkdir /etc/grid -security # chmod 0755 /etc/grid -security In /etc/grid -security make a certificates directory # mkdir /etc/grid -security/ certificates This can either be a copy of... client-side security handlers SECURITY- FOR- DUMMIES- v1.2 12 Client Hosting Environment Sec Msg Handler Client Service WS-Sec Client Handler Server Hosting Environment Figure 4: Client-side security – GSI XML Signature 3.5.1 Outbound Client-side Security Handlers GSI Secure Conversation – Secure Conversation Service Handler • • • • • Only operational for GSI Secure Conversation Establishes a security session... grid -security- config GSI : CONF IGURATION PROCEDURE Before you use the Grid Security Infrastructure, you should first define the DN (distinguished name) that should be used for your organization's X509 certificates If you do not define a DN, a default DN will be assigned to you This script will ask some questions about site specific information This information is used to configure the Grid Security. .. must be within the /webapps/ogsa/WEB-INF/classes directory or within a JAR file within the /webapps/ogsa/WEB-INF/lib directory i.e accessible from the CLASSPATH 6.6.2 Security Deployment Descriptor Content The security deployment descriptor is contained within a element Method-based security properties (for some properties) can be contained . Security for Dummies Project Title: OGSA-DAI Document Title: Security for Dummies Document Identifier: SECURITY- FOR- DUMMIES- v1.2 Editor: Mike Jackson Approval. host certificates is conjecture (!). SECURITY- FOR- DUMMIES- v1.2 2 Security Concepts This section provides a brief overview of general security concepts for reference or refreshment. 2.1 Public. X509 security certificate to a local identity associated with a user account. SECURITY- FOR- DUMMIES- v1.2 3 Globus Toolkit 3 Grid Security Infrastructure (GSI) 8 Globus Toolkit 3 Java Grid Security