EMI Pseudonymity System provides users with a way to hide their true identity behind a pseudonymous identit

White, John

English

ZENODO

Pseudonymity  System Administrator Guide  Date: 26.04.2012  EUROPEAN MIDDLEWARE INITIATIVE  PSEUDONYMITY  SYSTEM ADMINISTRATOR GUIDE Document Version: 1.0 EMI Component Version:  1.1.0 Date: 26.04.2012           This work is co-funded by the EC EMI project under the FP7 Collaborative Projects Grant Agreement Nr. INFSO-RI-261611. Pseudonymity Server: ConfigurationIntroductionEMI Pseudonymity System is meant for providing its users a way to hide their true identity behind apseudonymous identity. The term refers to a lesser degree of anonymity, as the relationships between thepseudonyms and the true identities can be revealed eg. in the cases of misuse. Users obtain pseudonymousidentities from the Pseudonymity Service by using their existing Grid identity for authentication andauthorization. The service registers the newly issued pseudonyms to the VO's attribute authority as aliases tothe users' existing certificates. The service is accessed with a dedicated client tool.This guide explains how to install and configure the server-side.QuickstartThe nature of the pseudonymity server is to integrate very closely with two external parties: the online CA andattribute authority (VOMS). For this reason, there is no quick guide for making the software work withoutinteroperating closely with the administrators of the external parties.InstallationMake sure that the host has NTP properly configured. Clock skew between the clients, server and externalparties may cause many types of failures.The server can be installed from the EMI repositories. The package name pseudonymity-server.For SL5/SL6, the installation can be done using the command yum install pseudonymity-server.Main configuration FileThe pseudonymity server is configured through the use of the pseudonymity-server.ini file. This fileis a standard INI file with different defined sections.The StandaloneServer section contains properties related the service as a whole and how it listens forincoming requests. The DNBuilder section controls how the DNs are built for the outgoing certificates. TheAttributeDefinitions section controls how the VO attributes are configured. TheCertificatePolicy section controls what kind of extensions are included in the outgoing certificates.The CAClient section configures the communication with an external online Certification Authority, as theAAClient section configures the external Attribute Authority (VOMS). The Auditor and AuditAdminsections control how the audit data is stored into a database as the ACL and AdministratorACL sectionsfinally control who are authorized to use and administrate the service.Main configuration OptionsStandaloneServer sectionProperty Description Required? Default Valuehostname hostname of the hostrunning the serviceY Noneport port number that the Y 8443 Pseudonymity Server: Configuration 1service is listening towebapp_context Web applicationcontextY /pseudowarfile full pathname to theWeb applicationarchive (WAR)Y /usr/share/pseudonymity/server/wars/pseudo.warcertificate full pathname to thecertificate protectingthe endpointY /etc/grid-security/hostcert.pemprivate_key full pathname to theprivate keyprotecting theendpointY /etc/grid-security/hostkey.pemcrl_enabled is revocation listcheck enabled for theincoming certificatesN truecrl_update_interval interval for updatingthe revocation listsN 30m (= 30minutes)trust_store_dir full pathname to thedirectory containingthe certificatesN /etc/grid-security/certificatesmax_request_queue_size maximum queue sizefor the incomingrequestsN -1 (= unbounded)max_connections maximum amount ofparallel connectionsN 64shutdown_command (internal) commandfor shutting down theserviceN shutdownshutdown_port port for shuttingdown the serviceY 8444DNBuilder sectionProperty Description Required? Default Valueimplementation classimplementingthe requiredinterfaceY org.glite.pseudo.server.dn.impl.PseudoDNBuilderDNTemplate Template forbuilding theDNsY C=FI,O=HIP,OU=Tech,DC=pseudotest,CN=${pseudoIdentifier}IDLength The length ofthepseudoIdentifer-part of the DNY 8AttributeDefinitions sectionProperty Description Required? Default Valueimplementation class implementingthe required interfaceY org.glite.pseudo.server.attribute.AttributeDefinitionsImplStandaloneServer section 2ConfigFile full pathname for theconfiguration fileY /etc/pseudonymity/server/attribute-defs.xmlCertificatePolicy sectionProperty Description Required? Default Valueimplementation classimplementingthe requiredinterfaceY org.glite.pseudo.server.policy.impl.MandatoryCertificateExtensionsPolicyextensionId identifier forthe extensionN e.g. KeyUsageextensionCritical is theextensioncritical or notN e.g. trueextensionValue the value forthe extensionN e.g. DigitalSignature,KeyEnciphermentCAClient sectionProperty Description Required? Default Valueimplementation class implementing therequired interfaceY org.glite.pseudo.server.caclient.impl.CMPClientEndpoint endpoint for the CMPserviceY NoneCertificateFile full pathname for thecertificate file used in theclient authenticationY /etc/grid-security/servicecert.pemKeyFile full pathname for theprivate key file used in theclient authenticationY /etc/grid-security/servicekey.pemKeyPasswd password protecting theprivate keyN NoneRequireCRLCheck is revocation list checkrequired for the serviceendpointY falseTruststoreFile full pathname for thetruststore fileY NoneTruststorePasswd password protecting thetruststoreY NoneCADN CMP-related configurationparameterY NoneSenderDN CMP-related configurationparameterY NoneRecipientDN CMP-related configurationparameterY NoneSenderKID CMP-related configurationparameterY NoneSharedSecret CMP-related configurationparameterY NoneOwfAlgId CMP-related configurationparameterN 1.3.14.3.2.26AttributeDefinitions section 3IterCount CMP-related configurationparameterN 1MacAlgId CMP-related configurationparameterN 1.3.6.1.5.5.8.1.2SaltString CMP-related configurationparameterN NoneProtectiongAlgId CMP-related configurationparameterN 1.2.840.113533.7.66.13AAClient sectionProperty Description Required? Default Valueimplementation class implementing therequired interfaceY org.glite.pseudo.server.aaclient.impl.VOMSClientEndpoint endpoint for theVOMSCertificatesserviceY NoneCertificateFile full pathname for thecertificate file used in theclient authenticationY /etc/grid-security/servicecert.pemKeyFile full pathname for theprivate key file used inthe client authenticationY /etc/grid-security/servicekey.pemKeyPasswd password protecting theprivate keyN NoneRequireCRLCheck is revocation list checkrequired for the serviceendpointY falseAuditor sectionProperty Description Required? Default Valueimplementation classimplementingthe requiredinterfaceY org.glite.pseudo.server.auditor.impl.HibernateAuditorHibernateConfiguration full pathnamefor theHibernateconfigurationfileY /etc/pseudonymity/server/hibernate/auditeventdatabase.hibernate.cfg.xmlHibernateMappings full pathnamefor theHibernatemappingsconfigurationfileY /etc/pseudonymity/server/hibernate/HibernateAuditEventDatabase.hbm.xmlPersonImplementation classimplementatingthe requiredPerson interfaceY org.glite.pseudo.server.auditor.impl.AuditPersonEntryImplEventImplementation class Y org.glite.pseudo.server.auditor.impl.AuditEventEntryImplCAClient section 4implementingthe requiredEvent interfaceAuditAdmin sectionProperty Description Required? Default Valueimplementation classimplementingthe requiredinterfaceY org.glite.pseudo.server.auditor.impl.HibernateAuditAdminHibernateConfiguration full pathnamefor theHibernateconfigurationfileY /etc/pseudonymity/server/hibernate/auditeventdatabase.hibernate.cfg.xmlHibernateMappings full pathnamefor theHibernatemappingsconfigurationfileY /etc/pseudonymity/server/hibernate/HibernateAuditEventDatabase.hbm.xmlPersonImplementation classimplementatingthe requiredPerson interfaceY org.glite.pseudo.server.auditor.impl.AuditPersonEntryImplEventImplementation classimplementingthe requiredEvent interfaceY org.glite.pseudo.server.auditor.impl.AuditEventEntryImplACL sectionProperty Description Required? Default Valueimplementation class implementingthe requiredinterfaceY org.glite.pseudo.server.acl.impl.XMLFileAccessControlListACLFile full pathname forthe configurationfileY /etc/pseudonymity/server/acl.xmlAdministratorACL sectionProperty Description Required? Default Valueimplementation class implementingthe requiredinterfaceY org.glite.pseudo.server.acl.impl.XMLFileAccessControlListACLFile full pathname forthe configurationfileY /etc/pseudonymity/server/acl-admin.xmlAuditor section 5Example pseudonymity-server.ini fileThe following example file contain an example for the configuration file:[StandaloneServer]hostname = example.orgport = 8443webapp_context = /pseudowarfile = /usr/share/pseudonymity/server/wars/pseudo.warcertificate = /etc/grid-security/hostcert.pemprivate_key = /etc/grid-security/hostkey.pemcrl_enabled = truecrl_update_interval = 30mtrust_store_dir = /etc/grid-security/certificatesmax_request_queue_size = 10max_connections = 20shutdown_command = shutdownshutdown_port = 8444[DNBuilder]implementation = org.glite.pseudo.server.dn.impl.PseudoDNBuilderDNTemplate = C=FI,O=HIP,OU=Tech,DC=pseudotest,CN=${pseudoIdentifier}IDLength = 8[AttributeDefinitions]implementation = org.glite.pseudo.server.attribute.AttributeDefinitionsImplConfigFile = /etc/pseudonymity/server/attribute-defs.xml[CertificatePolicy]implementation = org.glite.pseudo.server.policy.impl.MandatoryCertificateExtensionsPolicyextensionId = KeyUsageextensionCritical = trueextensionValue = DigitalSignature,KeyEnciphermentextensionId = CertificatePoliciesextensionCritical = falseextensionValue = 2.16.756.1.2.6.4.1.0extensionId = ExtendedKeyUsageextensionCritical = falseextensionValue = ClientAuth[CAClient]implementation = org.glite.pseudo.server.caclient.impl.CMPClientEndpoint = https://example.org/CACertificateFile = /etc/grid-security/servicecert.pemKeyFile = /etc/grid-security/servicekey.pemKeyPasswd = changeitTruststoreFile = /etc/grid-security/truststore.jksTruststorePasswd = changeitRequireCRLCheck = falseCADN = CN=HIP-TEK Pseudo Test CA,OU=Tech,O=HIP,C=FISenderDN = C=FIRecipientDN = C=FISenderKID = 1234567890SharedSecret = 0987654321OwfAlgId = 1.3.14.3.2.26IterCount = 1MacAlgId = 1.3.6.1.5.5.8.1.2SaltString =ProtectionAlgId = 1.2.840.113533.7.66.13[AAClient]implementation = org.glite.pseudo.server.aaclient.impl.VOMSClientEndpoint = https://voms.example.org/endpointCertificateFile = /etc/grid-security/servicecert.pemKeyFile = /etc/grid-security/servicekey.pem Example pseudonymity-server.ini file 6RequireCRLCheck = false[Auditor]implementation = org.glite.pseudo.server.auditor.impl.HibernateAuditorHibernateConfiguration = /etc/pseudonymity/server/hibernate/auditeventdatabase.hibernate.cfg.xmlHibernateMappings = /etc/pseudonymity/server/hibernate/HibernateAuditEventDatabase.hbm.xmlPersonImplementation = org.glite.pseudo.server.auditor.impl.AuditPersonEntryImplEventImplementation = org.glite.pseudo.server.auditor.impl.AuditEventEntryImpl[AuditAdmin]implementation = org.glite.pseudo.server.auditor.impl.HibernateAuditAdminHibernateConfiguration = /etc/pseudonymity/server/hibernate/auditeventdatabase.hibernate.cfg.xmlHibernateMappings = /etc/pseudonymity/server/hibernate/HibernateAuditEventDatabase.hbm.xmlPersonImplementation = org.glite.pseudo.server.auditor.impl.AuditPersonEntryImplEventImplementation = org.glite.pseudo.server.auditor.impl.AuditEventEntryImpl[AttributeDefinitions]implementation = org.glite.pseudo.server.attribute.AttributeDefinitionsImpl[ACL]implementation = org.glite.pseudo.server.acl.impl.XMLFileAccessControlListACLFile = /etc/pseudonymity/server/acl.xml[AdministratorACL]implementation = org.glite.pseudo.server.acl.impl.XMLFileAccessControlListACLFile = /etc/pseudonymity/server/acl-admin.xmlOther configuration filesThe following sections contains examples of other configuration files that are referenced from the mainconfiguration file's options (see above).Attribute definitionsAttributes are defined in an XML file containing a list of attribute definitions that can be referenced from theaccess control lists (see next sections). The AttributeDefinition has four self-explaining mandatory elements:name, header, required and displayName. Currently certificate DN and VOMS FQANs are supported.By default, this file exists at /etc/pseudonyity/server/attribute-defs.xml.Example attribute-defs.xml file<?xml version="1.0" encoding="ISO-8859-1" ?><AttributeDefinitions>   <AttributeDefinition      name="VOMS:FQAN"      header="VOMS-FQAN"      required="false"      displayName="VOMS Fully Qualified Attribute Name" />   <AttributeDefinition      name="Certificate:DN"      header="Certificate-DN"      required="false"      displayName="X.509 certificate subject DN" /></AttributeDefinitions>Access control listsTwo types of access control lists exists for the pseudonymity service: the first one controlling the normal usersaccessing the service and the other one controlling the administrator access. Other configuration files 7User access control listThe access control list contains the list of attributes that the users MUST have in order to access the service. Ifthe list is null, then all the users with a valid trusted certificate are authorized to use the service.By default, this file exists at /etc/pseudonymity/server/acl.xml.<?xml version="1.0" encoding="ISO-8859-1" ?><AccessControlList>   <AccessControlRule id="1" group="test_oracle">      <Attribute name="VOMS-FQAN">/test_oracle/g1&lt;/Attribute>   </AccessControlRule></AccessControlList>The example above would authorize all the users from the VO group /test_oracle/g1 to use the service.Administrator access control listThe administrator access control list contains the list of attributes from which the administrator must have atleast one in order to administer the service. If the list is null, then nobody is authorized to use theadministrator interface of the service.By default, this file exists at /etc/pseudonymity/server/acl-admin.xml.<?xml version="1.0" encoding="ISO-8859-1" ?><AccessControlList>   <AccessControlRule id="1" group="admins">      <Attribute name="Certificate-DN">CN=John Doe\, CN=123456\, CN=johndoe\, OU=Users\, OU=Organic Units\, DC=cern\, DC=ch</Attribute>   </AccessControlRule></AccessControlList>The example above would authorize the admin with the corresponding subject DN in the trusted certificate toaccess the administrator interface.Database configurationsThe pseudonymity service requires a relational database to store the audit information of the usage. All thedatabases supported by Hibernate are supported by the service.The database connection configurationThis file defines how the service can access the database. It is a standard Hibernate XML configuration file,and the most important configuration properties include:connection.driver_class The full class name for the JDBC driver• connection.url The url to access the database• connection.username The username to use the database• connection.password The password corresponding to the username• The configuration file below is a very simple example using MySQL, not meant for production environments:<?xml version='1.0' encoding='utf-8'?><hibernate-configuration>    <session-factory>                <property name="connection.driver_class">org.gjt.mm.mysql.Driver</property>        <property name="connection.driver_class">com.mysql.jdbc.Driver</property>        <property name="connection.url">jdbc:mysql:///glite_pseudo</property> User access control list 8        <property name="connection.username">pseudo</property>        <property name="connection.password">service</property>                <property name="connection.pool_size">0</property>                <property name="dialect">org.hibernate.dialect.MySQLDialect</property>        <property name="dialect">org.hibernate.dialect.MySQLInnoDBDialect</property>        <property name="dialect">org.hibernate.dialect.MySQLMyISAMDialect</property>                <property name="show_sql">true</property>                <property name="hbm2ddl.auto">create</property>        <property name="hibernate.current_session_context_class">org.hibernate.context.ThreadLocalSessionContext</property>     </session-factory></hibernate-configuration>This example also takes care of creating the corresponding tables to the database with the propertyhbm2ddl.auto set to create. After creating them with this option, this should be changed to update asthe other option always re-creates the tables.Object mappings configurationThis file defines how the Java objects are stored into the database. This file needs to be modified only by thedevelopers who wants to customize the Java objects first.Include the database JDBC connector to the classpathIn order for the service to use the desired JDBC connector, the JAR file must be located in/var/lib/pseudonymity/server/lib directory.-- HenriMikkonen - 22-Apr-2012This topic: EMI > PseudonymityServerConfigurationTopic revision: r5 - 25-Apr-2012 - 18:05:18 - HenriMikkonenCopyright &© by the contributing authors. All material on this collaboration platform is theproperty of the contributing authors.Ideas, requests, problems regarding TWiki? Send feedbackThe database connection configuration 9Pseudonymity Server: OperationStarting & Stopping the Service/etc/init.d/pseudonymity-service startto start the pseudonymity service/etc/init.d/pseudonymity-service stopto stop the pseudonymity service/etc/init.d/pseudonymity-service restartto restart the pseudonymity service/etc/init.d/pseudonymity-service statusto show status of the pseudonymity serviceService InformationService EndpointsThis service contains the following endpoint URLs:https://pseudo.example.org:8443/pseudo/Login - This endpoint is the recipient oflogin requests from the client tool• https://pseudo.example.org:8443/pseudo/certificate - This endpoint is therecipient of certificate requests from the client tool after login• https://pseudo.example.org:8443/pseudo/admin - This endpoint provides the adminWeb interface• Logging and LogsThis service uses the logback logging library. Java developers are probably familiar with Apache Log4J,logback is written by the developer who initially wrote Log4J and contains a cleaner API and is much moreperformant. The configuration file for the logging system can be found in/etc/pseudonymity/server/logging.xml.Enable Debug LoggingTo enable debug logging follow:Locate the line that contains logger name="org.glite.pseudo"1. On that line, change INFO to DEBUG2. NOTE always change your logging levels back to their original values once you are done debugging aproblem. Keeping the system on the debug logging level could fill up your disk partition in a short time.This topic: EMI > PseudonymityServerOperationTopic revision: r5 - 26-Apr-2012 - 13:25:03 - HenriMikkonenCopyright &© by the contributing authors. All material on this collaboration platform is theproperty of the contributing authors. Pseudonymity Server: Operation 1

PSEUDONYMITY SYSTEM ADMINISTRATOR GUIDE

https://zenodo.org/record/6871/files/pseudonymity-sys_admin_guide-1.0.pdf

PSEUDONYMITY SYSTEM ADMINISTRATOR GUIDE

Abstract

Similar works

Full text

Available Versions

ZENODO