Bug 618389
| Summary: | Security Chapter | ||
|---|---|---|---|
| Product: | Red Hat Enterprise MRG | Reporter: | Robert Rati <rrati> |
| Component: | Grid_User_Guide | Assignee: | Lana Brindley <lbrindle> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Jeff Needle <jneedle> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | Development | CC: | eerlands, mhideo |
| Target Milestone: | 1.3 | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-10-14 20:37:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 596241 | ||
|
Description
Robert Rati
2010-07-26 19:57:04 UTC
Also add a table with the following information:
Server: Activity: Security Context:
Collector Query AdTypes: READ
All but Collector
Collector Query Collector ADMINISTRATOR
Collector Invalidate AdTypes: DAEMON
All but STARTD,
SCHEDD, MASTER
Collector Update AdTypes: DAEMON
All but STARTD,
SCHEDD, MASTER,COLLECTOR
Collector Update COLLECTOR ALLOW
Collector Invalidate/Update STARTD ADVERTISE_STARTD
Collector Invalidate/Update SCHEDD ADVERTISE_SCHEDD
Collector Invalidate/Update MASTER ADVERTISE_MASTER
Collector Merge STARTD NEGOTIATOR
All Signalling DAEMON
All Keep Alives DAEMON
All Reconfig WRITE
All Read Configuration READ
All Runtime Configuration ALLOW
All Daemon Off ADMINISTRATOR
All Fetch/Purge Logs ADMINISTRATOR
HAD All HA functionality DAEMON
Master Reconfig ADMINISTRATOR
Master Restart ADMINISTRATOR
Master Daemons On/Off ADMINISTRATOR
Negotiator Reschedule DAEMON
Negotiator Reset Usage ADMINISTRATOR
Negotiator Delete User ADMINISTRATOR
Negotiator Set Priorities ADMINISTRATOR
Negotiator Set Usage Stats ADMINISTRATOR
Negotiator Get Priorities/Resources READ
Scheduler Get Matches DAEMON
Scheduler Negotiation NEGOTIATOR
Scheduler Reschedule WRITE
Scheduler Reconfig OWNER
Scheduler Release Claim, Kill Job, WRITE
Spool Job/File Operations
Scheduler Reuse Shadow DAEMON
Scheduler Startd Heartbeat DAEMON
Scheduler Store Credentials WRITE
Scheduler Read Job Queue READ
Scheduler Write Job Queue WRITE
Scheduler Transfer Queue WRITE
Scheduler Update Shadow DAEMON
Startd Heartbeat DAEMON
Startd Deactivate Claim DAEMON
Startd Retrieve Startd/Job Info READ
Startd Activate/Request/Release Claim WRITE
Startd Vacate Claims OWNER
Startd Negotiation Info NEGOTIATOR
Startd ClassAd Commands WRITE
Startd VM Universe Commands DAEMON
Starter ClassAd Commands WRITE
Starter Hold Job DAEMON
Starter Create Job Security Session DAEMON
Starter Start SSHD READ
Also, probably want to add the "Single-level CA" example, as an example of setting an SSL certificate authority, from:
http://pages.cs.wisc.edu/~zmiller/ca-howto/
There's an early draft of the chapter now available on the stage. Some information from the Condor manual has not been included at this stage due to time and resource constraints. If there are any further sections that *need* including, please specify them. The table in Comment 2 has not yet been added. Can you please advise on the sub-section it needs to go into, and surrounding text. L In the Authentication section, this seems like useful info: If the configuration for a machine does not define any variable for SEC_<access-level>_AUTHENTICATION, then Condor uses a default value of OPTIONAL. Authentication will be required for any operation which modifies the job queue, such as condor_qedit and condor_rm. If the configuration for a machine does not define any variable for SEC_<access-level>_AUTHENTICATION_METHODS, the default value for a Unix machine is FS, KERBEROS. This default value for a Windows machine is NTSSPI, KERBEROS We mention "Security negotiation is used to determine what security features are required for each connection: authentication, encryption, integrity checking, or a combination." but have left out the sections on Encryption, Integrity, and Authorization. I think these sections should be included, along with 3.6.9 Host Based security. I see a part of the table from comment 2 in the Access Levels, which I think is a good place for it but the whole table needs to be included. Right now, I only see a subset. The row/column headings for Tables 3.2 and 3.3 look out of whack. (In reply to comment #1) > Also add a table with the following information: > Server: Activity: Security Context: > Collector Query AdTypes: READ > All but Collector > Collector Query Collector ADMINISTRATOR > Collector Invalidate AdTypes: DAEMON > All but STARTD, > SCHEDD, MASTER > Collector Update AdTypes: DAEMON > All but STARTD, > SCHEDD, MASTER,COLLECTOR > Collector Update COLLECTOR ALLOW > Collector Invalidate/Update STARTD ADVERTISE_STARTD > Collector Invalidate/Update SCHEDD ADVERTISE_SCHEDD > Collector Invalidate/Update MASTER ADVERTISE_MASTER > Collector Merge STARTD NEGOTIATOR > All Signalling DAEMON > All Keep Alives DAEMON > All Reconfig WRITE > All Read Configuration READ > All Runtime Configuration ALLOW > All Daemon Off ADMINISTRATOR > All Fetch/Purge Logs ADMINISTRATOR > HAD All HA functionality DAEMON > Master Reconfig ADMINISTRATOR > Master Restart ADMINISTRATOR > Master Daemons On/Off ADMINISTRATOR > Negotiator Reschedule DAEMON > Negotiator Reset Usage ADMINISTRATOR > Negotiator Delete User ADMINISTRATOR > Negotiator Set Priorities ADMINISTRATOR > Negotiator Set Usage Stats ADMINISTRATOR > Negotiator Get Priorities/Resources READ > Scheduler Get Matches DAEMON > Scheduler Negotiation NEGOTIATOR > Scheduler Reschedule WRITE > Scheduler Reconfig OWNER > Scheduler Release Claim, Kill Job, WRITE > Spool Job/File Operations > Scheduler Reuse Shadow DAEMON > Scheduler Startd Heartbeat DAEMON > Scheduler Store Credentials WRITE > Scheduler Read Job Queue READ > Scheduler Write Job Queue WRITE > Scheduler Transfer Queue WRITE > Scheduler Update Shadow DAEMON > Startd Heartbeat DAEMON > Startd Deactivate Claim DAEMON > Startd Retrieve Startd/Job Info READ > Startd Activate/Request/Release Claim WRITE > Startd Vacate Claims OWNER > Startd Negotiation Info NEGOTIATOR > Startd ClassAd Commands WRITE > Startd VM Universe Commands DAEMON > Starter ClassAd Commands WRITE > Starter Hold Job DAEMON > Starter Create Job Security Session DAEMON > Starter Start SSHD READ > > Done. LKB (In reply to comment #3) > In the Authentication section, this seems like useful info: > If the configuration for a machine does not define any variable for > SEC_<access-level>_AUTHENTICATION, then Condor uses a default value of > OPTIONAL. Authentication will be required for any operation which modifies the > job queue, such as condor_qedit and condor_rm. If the configuration for a > machine does not define any variable for > SEC_<access-level>_AUTHENTICATION_METHODS, the default value for a Unix machine > is FS, KERBEROS. This default value for a Windows machine is NTSSPI, KERBEROS <para> If no variable is defined for <command>SEC_<replaceable>access-level</replaceable>_AUTHENTICATION</command>, a default value of <parameter>OPTIONAL</parameter> will be used. In this case, authentication is required for any operation which modifies the job queue, such as <command>condor_qedit</command> and <command>condor_rm</command>. </para> <para> If no variable is defined for <command>SEC_<replaceable>access-level</replaceable>_AUTHENTICATION_METHODS</command>, a default value of <parameter>FS, KERBEROS</parameter> will be defined. On a &WINDOWS; machine, it will default to <parameter>NTSSPI, KERBEROS</parameter>. </para> > > We mention "Security negotiation is used to determine what security features > are required for each connection: authentication, encryption, integrity > checking, or a combination." but have left out the sections on Encryption, > Integrity, and Authorization. I think these sections should be included, along > with 3.6.9 Host Based security. They're coming. Authentication and Integrity are now up. Hopefully, Authorization will be there soon. > > I see a part of the table from comment 2 in the Access Levels, which I think is > a good place for it but the whole table needs to be included. Right now, I > only see a subset. Done. LKB |