230 likes | 360 Views
Practices on Security. Liang ZHAO Peking University. Generic Instructions. Run the application “SSH Secure Shell Client” from your desktop. Click the button “Quick Connect” The host name is “ gilda07.ihep.ac.cn ” User name : beijing01, beijing02, … beijing40
E N D
Practices on Security Liang ZHAO Peking University
Generic Instructions • Run the application “SSH Secure Shell Client” from your desktop. • Click the button “Quick Connect” • The host name is “gilda07.ihep.ac.cn” • User name :beijing01, beijing02, … beijing40 • Please use the number allocated to you on the check in list • Password: GridBEI01, GridBEI02, ..., GridBEI40 • Pass Phrase (for all users): BEIJING Practices on Security
Check your certificate • .globusdirectory now contains your personal public / private keys • [gilda07] /home/beijing01/.globus > ll • total 8 • -rw-r--r-- 1 beijing01 users 1070 Nov 9 17:57 usercert.pem • -r-------- 1 beijing01 users 963 Nov 9 17:57 userkey.pem • Pay attention to permissions • userkey.pemcontains your private key, and must be readable just by yourself (400) • usercert.pemcontains your public key, which should be readable also from outside (644) • You can have now a look inside your certificate with the command grid-cert-info Practices on Security
grid-cert-info [gilda07] /home/beijing01/.globus > grid-cert-info Certificate: Data: Version: 3 (0x2) Serial Number: 6092 (0x17cc) Signature Algorithm: md5WithRSAEncryption Issuer: C=IT, O=GILDA, CN=GILDA Certification Authority Validity Not Before: Nov 9 09:36:33 2006 GMT Not After : Dec 4 09:36:33 2006 GMT Subject: C=IT, O=GILDA, OU=Personal Certificate, L=BEIJING, CN=BEIJING01 Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): …………………………………... Practices on Security
voms-proxy-init • Before you can run jobs you need to create a proxy, which allows jobs to run on the grid. • Two types can be created, short-term and long term. It is better to get into the habit of always creating a short term one and then a long term one if needed. • Create a short term proxy (lifetime<12h) • Command syntax voms-proxy-init <--voms VO_Name> [options] -cert <certfile> Non-standard location of user certificate -key <keyfile> Non-standard location of user key -userconf <file> Non-standard location for user-defined voms server addresses • You may use voms-proxy-init –voms gilda • Default location for voms server address file is /opt/glite/etc/vomses or $HOME/.glite/vomses • Syntax : “vo-nickname" “voms server FQDN" “port“ “voms server \ certificate subject" “vo name Practices on Security
voms-proxy-init • If everything is ok, you should have: [gilda07] /home/beijing01/.globus > voms-proxy-init --voms gilda Cannot find file or dir: /home/beijing01/.glite/vomses Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 Enter GRID pass phrase: Creating temporary proxy ....................................... Done Contacting voms.ct.infn.it:15001 [/C=IT/O=INFN/OU=Host/L=Catania/CN=voms.ct.infn.it] "gilda" Done Creating proxy ........................................... Done Your proxy is valid until Tue Nov 21 22:19:23 2006 Practices on Security
voms-proxy-info Once that your proxy has been created, you can gather info on it through the voms-proxy-info command. It is much more useful if ran with the -alloption, because it will show also the VO related infos added by the VOMS server. You may note also two different lifetimes : first is related to the proxy itself, the second one is referred to the Attributes Certificate info added by the VOMS server. They have to be valid both in order to be fully enabled to perform operations. Practices on Security
voms-proxy-info [gilda07] /home/beijing01 > voms-proxy-info -all subject : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy issuer : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 identity : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 type : proxy strength : 512 bits path : /tmp/x509up_u33417 timeleft : 11:59:57 === VO gilda extension information === VO : gilda subject : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 issuer : /C=IT/O=INFN/OU=Host/L=Catania/CN=voms.ct.infn.it attribute : /gilda/Role=NULL/Capability=NULL timeleft : 11:59:43 Practices on Security
voms-proxy-destroy You may need to destroy one proxy before it naturally expires Use the command voms-proxy-destroy Practices on Security
myproxy-init • To create and store a long-term proxy certificate on a proxy server, allowing proxies to be renewed and extending their effective lifetime beyond 12 hours. • Command Syntax: • myproxy-init --voms <vo_name> • Principal options -c <hours> Lifetime of delegated proxy on server (default 1 week) -t <hours> Lifetime of proxies delegated by server (default 12 hours) -d Stores credential with the distinguished name in proxy, instead of user name (mandatory for some data management services and proxy renewal) -s <hostname> Specifies the myproxy server where to store credentials Practices on Security
myproxy-info • This command is used to retrieve info on stored credentials • Need local credentials to be performed • You nee to execute voms-proxy-init or myproxy-get-delegation before running myproxy-info • If credentials have been initialized with –d switch, you have also to specify it there, otherwise such error may occur: [gilda07] /home/beijing01 > myproxy-info Received ERROR_RESPONSE: Credentials do not exist no credentials found for user beijing01, owner "/C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01" Practices on Security
myproxy-get-delegation • This command is used to retrieve a delegation from a long lived proxy stored on myproxy server • It is independent by the machine ! You don’t need to have your certificate on board • If credentials have been initialized with –d switch, you have to specify it also in myproxy-get-delegation request Practices on Security
myproxy-destroy • Delete, if existing, the long lived credentials on the specified myproxy server • Need local credentials to be performed • You need to execute voms-proxy-init or myproxy-get-delegation before running myproxy-destroy • If credentials have been initialized with –d switch, you have to specify it also in myproxy-get-delegation request Practices on Security
Example1 [gilda07] /home/beijing01 > myproxy-init –voms gilda Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 Enter GRID pass phrase for this identity: Creating proxy ..................................... Done Proxy Verify OK Your proxy is valid until: Tue Nov 28 11:53:52 2006 Enter MyProxy pass phrase: Verifying password - Enter MyProxy pass phrase: A proxy valid for 168 hours (7.0 days) for user beijing01 now exists on grid001.ct.infn.it. [gilda07] /home/beijing01 > myproxy-init –d –voms gilda Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 Enter GRID pass phrase for this identity: Creating proxy ..................................................... Done Proxy Verify OK Your proxy is valid until: Tue Nov 28 11:54:39 2006 Enter MyProxy pass phrase: Verifying password - Enter MyProxy pass phrase: A proxy valid for 168 hours (7.0 days) for user /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 now exists on grid001.ct.infn.it. Practices on Security
Example2 Local proxy has been destroyed !!! –d parameter is needed [gilda07] /home/beijing01 > voms-proxy-destroy [gilda07] /home/beijing01 > voms-proxy-info Couldn't find a valid proxy. [gilda07] /home/beijing01 > myproxy-init –d --voms gilda Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 Enter GRID pass phrase for this identity: Creating proxy ................................. Done Proxy Verify OK Your proxy is valid until: Tue Nov 28 12:31:33 2006 Enter MyProxy pass phrase: Verifying password - Enter MyProxy pass phrase: A proxy valid for 168 hours (7.0 days) for user /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 now exists on grid001.ct.infn.it. [gilda07] /home/beijing01 > myproxy-get-delegation Enter MyProxy pass phrase: ERROR from server: Credentials do not exist Unable to retrieve credential information Failed to receive a proxy. Practices on Security
Example2 • Get a new proxy from MyProxy server [gilda07] /home/beijing01 > myproxy-get-delegation -d Enter MyProxy pass phrase: A proxy has been received for user /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 in /tmp/x509up_u33417 [gilda07] /home/beijing01 > voms-proxy-info WARNING: Unable to verify signature! Server certificate possibly not installed. Error: VOMS extension not found! subject : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy/CN=proxy issuer : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy identity : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy type : unknown strength : 512 bits path : /tmp/x509up_u33417 timeleft : 11:59:57 Practices on Security
Example3 [gilda07] /home/beijing01 > myproxy-init -c 100 -t 10 --voms gilda Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01 Enter GRID pass phrase for this identity: Creating proxy ............................... Done Proxy Verify OK Your proxy is valid until: Sat Nov 25 15:57:20 2006 Enter MyProxy pass phrase: Verifying password - Enter MyProxy pass phrase: A proxy valid for 100 hours (4.2 days) for user beijing01 now exists on grid001.ct.infn.it. [gilda07] /home/beijing01 > myproxy-get-delegation Enter MyProxy pass phrase: A proxy has been received for user beijing01 in /tmp/x509up_u33417 [gilda07] /home/beijing01 > voms-proxy-info subject : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy/CN=proxy issuer : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy identity : /C=IT/O=GILDA/OU=Personal Certificate/L=BEIJING/CN=BEIJING01/CN=proxy/CN=proxy type : unknown strength : 512 bits path : /tmp/x509up_u33417 timeleft : 9:59:51 Practices on Security
Exercise Create a proxy with voms-proxy-init, then verify obtained credentials with voms-proxy-info Destroy the local proxy Create a myproxy with –d option Get delegaion from myproxy server Check the status of the local proxy Try other options of myproxy commands Practices on Security
How to obtain a certificate Visit https://gridca.ihep.ac.cn/ Practices on Security
How to obtain a certificate • Step1: Submit the User Certificate Application Form • Step2: Online request for certificate • https://gridca.ihep.ac.cn/cgi-public/pki?cmd=user_csr • Organization: PKU • Organization Unit: PHYS • Step3: Get your certificate • https://gridca.ihep.ac.cn/getcert.html • Step4: Export the certificate Practices on Security
Manage your certificate Exporting the digital certificate with the private key from IE Open the IE browser, choice the "Tools" menu, click "Internet Options". Click the "Content" tab, then choose "Certificates". Click your certificate that you want to export. Click the "Export" button Click "Next" in the "Export Wizard" window Select "Export private key". Click "Next" Make sure "Personal Information Exchange -PKCS#12" is checked, and also the "Enable strong protection".The "Delete private key if successful" must be unchecked. The "Include all certificate in path" button should be unchecked, too. Click "Next". Type the passphrase(twice) that you use to protect your private key. We recommend you choice 8 characters pass phrase. Click "Next". Type the name of the file where you want to store your certificate. Click "Next". Click "Finish" Practices on Security
Convert certificate formats • How to convert certificate format between PKCS12 and PEM ? • For user certificate:To get the key and certificate from a PKCS12 file (.p12 or .pfx) • openssl pkcs12 -in user.p12-out userkey.pem-nocerts • openssl pkcs12 -in user.p12-out usercert.pem-nokeys -clcerts • To convert pem (.crt and .key files) to a PKCS12 file • openssl pkcs12 -export -in usercert.pem-inkey userkey.pem-out user.p12 • PKCS12 files can be imported to your web browser Practices on Security
Exercise • Convert your certificate, which is located in .globus directory , to PKCS12 format • Import the .p12 files into Internet Explorer • You may need to set a pass phrase for the certificate • Export the certificate from Internet Explorer, using a different file name in saving • Convert the exported certificate into PEM format Practices on Security