Whose Bits Are They, Anyway? Access Controlled Applications Built - - PowerPoint PPT Presentation
Whose Bits Are They, Anyway? Access Controlled Applications Built Around AFS DJ Byrne djbyrne@jpl.nasa.gov Jet Propulsion Laboratory Information Services - File/Web Service Engineer http://fil.jpl.nasa.gov/ SLAC AFS Best Practices Workshop
2004-03-25 SLAC AFS Best Practices - djbyrne 1
djbyrne@jpl.nasa.gov Jet Propulsion Laboratory Information Services - File/Web Service Engineer http://fil.jpl.nasa.gov/ SLAC AFS Best Practices Workshop March 25, 2004
2004-03-25 SLAC AFS Best Practices - djbyrne 2 2004-03-25 SLAC AFS Best Practices - djbyrne 2
2004-03-25 SLAC AFS Best Practices - djbyrne 3 2004-03-25 SLAC AFS Best Practices - djbyrne 3
2004-03-25 SLAC AFS Best Practices - djbyrne 4 2004-03-25 SLAC AFS Best Practices - djbyrne 4
2004-03-25 SLAC AFS Best Practices - djbyrne 5 2004-03-25 SLAC AFS Best Practices - djbyrne 5
2004-03-25 SLAC AFS Best Practices - djbyrne 6 2004-03-25 SLAC AFS Best Practices - djbyrne 6
2004-03-25 SLAC AFS Best Practices - djbyrne 7 2004-03-25 SLAC AFS Best Practices - djbyrne 7
2004-03-25 SLAC AFS Best Practices - djbyrne 8 2004-03-25 SLAC AFS Best Practices - djbyrne 8
2004-03-25 SLAC AFS Best Practices - djbyrne 9 2004-03-25 SLAC AFS Best Practices - djbyrne 9
2004-03-25 SLAC AFS Best Practices - djbyrne 10 2004-03-25 SLAC AFS Best Practices - djbyrne 10
kerberos principals [BP]
srvtab/keytab
PTS entries matching some of the principals [BP] LDAP objects [CP]
“password” attribute Vendor availability. Simple, lightweight Cleartext binds on port 389 [E], SSL on 636
IP address as authentication [E] Policies like expirations and strength have to be agreed on, and therefore published So how does a user get told their password expires tomorrow? And which interface do they use to reset the password?
No hooks in kerberos servers (?)
2004-03-25 SLAC AFS Best Practices - djbyrne 11 2004-03-25 SLAC AFS Best Practices - djbyrne 11
System:anyuser is Just Plain Evil, except for public outreach material [E] System:authuser is only A Slightly Lesser Evil at JPL, because it doesn’ t actually say anything about the principal. [E]
Dangerous common mis-conceptions include JPL employee US person Someone we could contact if we need to
jpl.networks for IP-based authentication [E] Actively managed by attentive humans [BP] Automatically generated from some out-of-band data source, like “everyone in section 366” [BP] Insufficient meta-data for administrative details
We rely heavily on naming conventions instead
2004-03-25 SLAC AFS Best Practices - djbyrne 12 2004-03-25 SLAC AFS Best Practices - djbyrne 12
Lightweight Directory Access Protocol
X500 without the cumbersome stuff…
like security
“Meta-directory” collects and publishes from many “gold sources”
Personnel Projects Individual
Base group “jimo” Ya can’ t beat a general-purpose DB with extensible attributes.
Description: Jupiter Icy Moons Orbiter jplService: emaillist, afs_pts_group Memberurl: LDAP filter expression to auto-generate group
Auto-generated derivative groups
jimo.us jimo.jpl jimo.usjpl
2004-03-25 SLAC AFS Best Practices - djbyrne 13 2004-03-25 SLAC AFS Best Practices - djbyrne 13
2004-03-25 SLAC AFS Best Practices - djbyrne 14 2004-03-25 SLAC AFS Best Practices - djbyrne 14
ACLs
Individuals [P] Role-based groups [BP] “IP ACLs” [CP][E] srvtab/keytab [BP] token passing [BP?]
nsconfig/htaccess [CP]
By web client IP [CP][E]
By username authentication [BP?]
Application-specific [BP] Mapping [E]
E.g., database of “protected” URLs Ignores power of indirection, which is the whole point of popular words like “distributed,” “web,” and “hyper.”
2004-03-25 SLAC AFS Best Practices - djbyrne 15 2004-03-25 SLAC AFS Best Practices - djbyrne 15
2004-03-25 SLAC AFS Best Practices - djbyrne 16 2004-03-25 SLAC AFS Best Practices - djbyrne 16
2004-03-25 SLAC AFS Best Practices - djbyrne 17 2004-03-25 SLAC AFS Best Practices - djbyrne 17