Differences between revisions 1 and 12 (spanning 11 versions)
⇤ ← Revision 1 as of 2006-03-22 16:26:32 →
Size: 2201
Editor: WolfgangFriebel
Comment: initial incomplete page
← Revision 12 as of 2006-03-28 17:09:15 → ⇥
Size: 6684
Editor: WolfgangFriebel
Comment:
Deletions are marked like this. Additions are marked like this.
Line 2: Line 2:
[[TableOfContents]]
Line 6: Line 6:
Needs a third party to establish a trust relation. In High energy Physics Kerberos4 Needs a third party to establish a trust relation. In High energy Physics (HEP) Kerberos4
Line 15: Line 15:
===== Talks at HEPiX meetings related to Kerberos ===== ==== Talks at HEPiX meetings related to Kerberos ====
Line 21: Line 21:
 * INFN (Apr 02) [http://www.ts.infn.it/events/hepix2002/talks/lgiacchetti2.ppt L.Giachetti: Who Let The Dog(s) In ?] (update on strong authentication at FNAL)
Line 22: Line 23:
===== Software with Kerberos Support =====  * LAL (Apr 01) [http://events.lal.in2p3.fr/conferences/HEPIX/presentations/Tuesday/Kaletka-W2000-Kerberos.ppt M.Kaletka: W2000 Kerberos Experience]

See also the FNAL solution:
 * (Feb 05) [http://www.fnal.gov/docs/strongauth/ Strong Authentication at Fermilab]
==== Software with Kerberos Support ====
Line 29: Line 34:
 * Batchsystems: SunGridEngine, LSF  * Batchsystems: [:SGEwithAFS: SunGridEngine], LSF
Line 31: Line 36:
 * Libraries: PAM, GSSAPI, SASL, perl Modules(Authen-SASL, Authen-Krb5)
 * Protocols: Socks5		  * Libraries: PAM, GSSAPI ([http://www.ietf.org/rfc/rfc1508.txt version 1] and [http://www.ietf.org/rfc/rfc2743.txt version2]), [http://www.ietf.org/rfc/rfc2222.txt SASL], perl Modules(Authen-SASL, Authen-Krb5)
 * Protocols: LDAP, IMAP, SMTP (via SASL) Socks5
Line 35: Line 40:
Other UNIX software could be made Kerberos5 aware by using the SASL or GSS API.
=== Public key infrastructure ===		 Other UNIX software is or could be made Kerberos5 aware by using the SASL or GSS API.

==== Software contributions from the HEP community ====
 * Migration from a kaserver based AFS cell to a Kerberos5 based cell is facilitated by [ftp://ftp.ifh.de/pub/unix/kerberos/heimdalsync heimdalsync] (DESY)
 * Setup of a Kerberos 5 realm from scratch (Heimdal), fill it with AFS db data: [ftp://ftp.ifh.de/pub/unix/kerberos/krb5setuphd krb5setuphd] (DESY)
 * Patched perl module [ftp://ftp.ifh.de/pub/unix/kerberos/Heimdal-Kadm5-0.2-perl5.8.tar.gz Heimdal::Kadm5] for perl 5.8 (DESY)
 * Enhanced Perl Module for SASL server side support [http://www.wi-bw.tfh-wildau.de/~pboettch/home/index.php?site=asc Authen::SASL::Cyrus] (DESY)

=== Authentication using public key infrastructure ===

Public key cryptography is an assymetric key method. It uses a pair of keys, called public and private key. The public key is intended for distribution, while the private key needs to be kept secret. Both keys are connected through a mathematical relation, which is highly asymmetric in terms of computational effort to derive one key from the other.

Knowing the public key it should be practically impossible to derive the private key.

In order to verify that a public key is associated with the real issuer, a '''Public Key Infrastructure''' (PKI) is installed. In most practical cases within HEP the keys used are so called '''X.509 Certificates'''. The verification of these certificates is done trough a hierarchy of trusted third parties, called '''Certification Authorities''' (CA).

The various deployed grid solutions (e.g. LCG) all use authentification with certificates

==== Software that is using Certificates ====
 * Libraries: [http://www.openssl.org/ OpenSSL]

==== Talks at HEPiX meetings related to authentication using certificates ====
 * Triumf (Oct 03) [http://www.triumf.ca/hepix2003/pres/23-06/apace/ A.Pace: An introduction to PKI and a few deployment hints]
 * NIKHEF (May 03) [http://www.nikhef.nl/hepix/pres/groep.ppt D.Groep: Grid security and site authorization in EDG]
For other talks on this subject see also "Talks at HEPiX meetings related to Single Sign On" below and
 * A. Pace: 2004 Cern school of computing [http://csc.web.cern.ch/CSC/2004/This_year_school/Programme/Handouts_PDF_Files/grid_intro_pki_updt.pdf An Introduction to Public Key Infrastructure]

=== Single Sign On ===

==== Talks at HEPiX meetings related to Single Sign On ====
 * Roma (Apr 06) [http://hepix.caspur.it/spring2006/agenda.php Jens Jensen: Single sign-on at RAL]
 * Roma (Apr 06) [http://hepix.caspur.it/spring2006/agenda.php Alberto Pace: Integrating Grid Certificates and Kerberos Authentication services]
 * SLAC (Oct 05) [http://www.slac.stanford.edu/conf/hepix05/talks/tuesday/aparicio.ppt R.G.Aparicio: Progress report in CERN Certification authority deployment and Single Sign On with Certificates]
 * SLAC (Oct 05) [http://www.slac.stanford.edu/conf/hepix05/talks/tuesday/gordon.ppt J.Gordon: RAL Progress in Single Sign On]
 * Karlsruhe (May 05) [http://hepix.fzk.de/upload/lectures/2005-04-29%20SSO-Hepix.ppt E.Ormancy, A.Pace: Cross platform single-sign-on using client certificates]

There is also a report on using [http://www.wi-bw.tfh-wildau.de/~pboettch/home/sso/ SSO at the TFH Wildau] (in german) which is using Kerberos on UNIX and a trust relationship with the realm on Windows (tested also at DESY)
=== Other topics ===
==== One time passwords ====
 * Roma (Apr 06) [http://hepix.caspur.it/spring2006/agenda.php R.Petkus: One-time-password integration at BNL]
==== Synchronisation of passwords across platforms ====
 * Karlsruhe (May 05) [http://hepix.fzk.de/upload/lectures/DESY-jahnke-zumbusch-HEPiX2005.pdf D.Jahnke: DESY-Registry -- cross-platform user administration]
 * BNL (Oct 04) [http://www.rhic.bnl.gov/hepix/talks/041018pm/corosu.ppt M.Corosu: INFN TRIP Project] (authenticated WLAN access)

Authentication technologies

TableOfContents

Authentication using symmetric key cryptography

Key for encryption and decryption is the same (or easily derived from the other key). Needs a third party to establish a trust relation. In High energy Physics (HEP) Kerberos4 and Kerberos5 are used. Kerberos4 has security flaws and is largely replaced by Kerberos5.

Kerberos5

Defined in [http://www.ietf.org/rfc/rfc4120.txt RFC4120], API defined in [http://www.ietf.org/rfc/rfc4121.txt RFC4121]

Currently implemented in 3 major variants: MIT Kerberos, Heimdal Kerberos, Windows Kerberos

See also the FNAL solution:

Software with Kerberos Support

Usually the software mentioned below does not come with Kerberos support by default, configuration or recompilation is required in most cases.

  • Webserver: IIS, Apache (so called Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) support)
  • Webclients: Internet Explorer, Mozilla, Firefox
  • Mailserver: Cyrus-IMAP, UW-IMAP
  • Mailclients: pine, Mozilla, Thunderbird

  • Batchsystems: [:SGEwithAFS: SunGridEngine], LSF

  • Filesystems: AFS, NFSv4

  • Libraries: PAM, GSSAPI ([http://www.ietf.org/rfc/rfc1508.txt version 1] and [http://www.ietf.org/rfc/rfc2743.txt version2]), [http://www.ietf.org/rfc/rfc2222.txt SASL], perl Modules(Authen-SASL, Authen-Krb5)

  • Protocols: LDAP, IMAP, SMTP (via SASL) Socks5
  • Client/Server programs: openssh, telnet, ftp, su, arc, arcx

Other UNIX software is or could be made Kerberos5 aware by using the SASL or GSS API.

Software contributions from the HEP community

Authentication using public key infrastructure

Public key cryptography is an assymetric key method. It uses a pair of keys, called public and private key. The public key is intended for distribution, while the private key needs to be kept secret. Both keys are connected through a mathematical relation, which is highly asymmetric in terms of computational effort to derive one key from the other.

Knowing the public key it should be practically impossible to derive the private key.

In order to verify that a public key is associated with the real issuer, a Public Key Infrastructure (PKI) is installed. In most practical cases within HEP the keys used are so called X.509 Certificates. The verification of these certificates is done trough a hierarchy of trusted third parties, called Certification Authorities (CA).

The various deployed grid solutions (e.g. LCG) all use authentification with certificates

Software that is using Certificates

For other talks on this subject see also "Talks at HEPiX meetings related to Single Sign On" below and

Single Sign On

There is also a report on using [http://www.wi-bw.tfh-wildau.de/~pboettch/home/sso/ SSO at the TFH Wildau] (in german) which is using Kerberos on UNIX and a trust relationship with the realm on Windows (tested also at DESY)

Other topics

One time passwords

Synchronisation of passwords across platforms

DVInfo/Authentication_technologies_in_use_at_HEP (last edited 2008-10-30 11:40:12 by localhost)