Database Access Management Giacomo Tenaglia CERN IT/DB HEPiX - - PowerPoint PPT Presentation

▶
database access management
SMART_READER_LITE
LIVE PREVIEW

Database Access Management Giacomo Tenaglia CERN IT/DB HEPiX - - PowerPoint PPT Presentation

Sep 17, 2022 191 likes •593 views

Database Access Management Giacomo Tenaglia CERN IT/DB HEPiX Spring 2012 CERN IT Department CH-1211 Geneva 23 Switzerland www.cern.ch/ i t Agenda Scenario and requirements DAM: overview Implementation details CERN IT

slide-1
SLIDE 1

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Database Access Management

Giacomo Tenaglia CERN IT/DB HEPiX Spring 2012

slide-2
SLIDE 2

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Agenda

  • Scenario and requirements
  • DAM: overview
  • Implementation details

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-3
SLIDE 3

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Scenario

  • O(100) servers
  • “Clusters” of 1 to 6 nodes
  • Access via SSH
  • High turnover of people

– Admins – Users

  • “Flat” network

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-4
SLIDE 4

Requirements: DB clusters

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-5
SLIDE 5

Requirements: DB clusters

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-6
SLIDE 6

Requirements: DB clusters

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-7
SLIDE 7

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-8
SLIDE 8

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-9
SLIDE 9

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-10
SLIDE 10

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-11
SLIDE 11

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-12
SLIDE 12

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-13
SLIDE 13

Requirements: Middleware

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-14
SLIDE 14

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Requirements

  • Functional requirements

– Group management

  • Track relationships (“who can access what”)
  • Membership delegation to group admins
  • Cluster equivalence

– Ease key management – CLI and Web – Use standard CERN IT tools

  • Security requirements

– Revoke access – PKI not shared passwords

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-15
SLIDE 15

DAM Overview

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-16
SLIDE 16

DAM Overview

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-17
SLIDE 17

DAM Overview

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-18
SLIDE 18

DAM Overview

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-19
SLIDE 19

System Requirements

  • Database

– Currently Oracle, API can be ported

  • Management Server

– Password-less access to managed nodes

  • LDAP directory with groups (if needed)

– Currently e-groups published via LDAP

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-20
SLIDE 20

Interface for Administrators

  • APEX screenshot

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-21
SLIDE 21

How It Works

  • APEX screenshot
slide-22
SLIDE 22

How It Works

  • APEX screenshot
slide-23
SLIDE 23

Interface for Users

  • APEX screenshot

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-24
SLIDE 24

How It Works: APEX

  • APEX screenshot

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-25
SLIDE 25

Interface for Group Admins

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-26
SLIDE 26

How It Works: APEX

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-27
SLIDE 27

Implementation Details

  • PL/SQL API, Perl, APEX Application
  • Extensive use of Kerberos

– Service keytab on management host

  • Tested with CERN Security Team

– Easier for users than SSH keys

  • LDAP groups managed by users (“egroups”)

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-28
SLIDE 28

Implementation Details

  • Parallel “Access refresh”
  • Source accounts

– Generate private keys on the nodes

  • Managed servers pre-seeding

– Integrated in CMS

  • Revoke public key

– Consistency checks upon refresh

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-29
SLIDE 29

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-30
SLIDE 30

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-31
SLIDE 31

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-32
SLIDE 32

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-33
SLIDE 33

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-34
SLIDE 34

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-35
SLIDE 35

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-36
SLIDE 36

How It Works

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-37
SLIDE 37

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Current usage

  • 500 servers
  • 2000 accounts
  • 5 teams (developers, DBA, sysadmins)
  • 150 groups

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-38
SLIDE 38

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Summary

  • DAM helps secure our environment
  • Key success factor for 11g migration
  • API and source code could be made

available to other sites if interested

Database Access Management - G. Tenaglia - HEPiX Spring 2012

slide-39
SLIDE 39

CERN IT Department CH-1211 Geneva 23 Switzerland

www.cern.ch/ it

Q&A Thank you!

Giacomo.Tenaglia@cern.ch

Credits: Alvaro Gonzalez Alvarez Andrea Ieri, Artur Wiecek, Dawid Wojcik Jacek Wojcieszuk

Database Access Management - G. Tenaglia - HEPiX Spring 2012