Fusion Grid Certificate Manager

May 18, 2005

1 System Elements [1](#system-elements)

1.1 Web server [1](#web-server)

1.2 MyProxy Server [1](#myproxy-server)

1.3 Cron Jobs [2](#cron-jobs)

1.4 FusionGrid CA [2](#fusiongrid-ca)

1.5 Document and script locations. [2](#document-and-script-locations.)

1.6 Web pages and scripts [3](#web-pages-and-scripts)

1.7 Saved state [4](#saved-state)

2 Securing cert.fusiongrid.org [4](#securing-cert.fusiongrid.org)

3 Useful Information [5](#useful-information)

3.1 myProxy commands [5](#myproxy-commands)

3.2 How to generate a p12 file [6](#how-to-generate-a-p12-file)

# System Elements

The FusionGrid certification management system consists of an
SSL-enabled Apache Web server, a MyProxy server, a cron job all running
on cert.fusiongrid.org (aka natasha.lbl.gov); a set of cgi-scripts and
Web forms run by the Web server; and a dedicated CA run by ESnet.

The host machine has been secured in a number of ways.

## Web server

-   Runs as user fgcm

-   To start /www/bin/apachectl startssl

-   To stop /www/bin/apachectl stop

Directories in /www:

-   cgi-bin - contains script for web and cronjobs

-   cgi-bin/private -- contains ShowProxies.py

-   conf -- contains httpd.conf and ssl.conf

-   docs -- contains general system documentation

-   logs - contains apache logs

-   applogs - contains logs generated by applications

-   htdocs - webpages and template files

-   CertRequests - saved state and keyfiles for requests in motion.

-   Users - saved state files moved here when request is processed.

-   BadRequests - if request to jade fails, key/statefiles go here.

## MyProxy Server

-   Runs as user fgcm, using cert.fusiongrid.org certificate from
    /home/users/fgcm/hostcert.pem,hostkey.pem

-   To start/stop the myproxy-server: /etc/rc.d/myproxy start \| stop

-   binary is /globus/globus-2.4.3/ALL /sbin/myproxy-server

-   configuration file is in
    /globus/globus-2.4.3/ALL/etc/myproxy-server.conf

-   runs on the default port 7512

-   certificates are in /var/myproxy accessible only by fgcm

## Cron Jobs

> **cert.fusiongrid.org FGCM crontab in /var/spool/cron/tabs/fgcm**
>
> PATH=/usr/bin:/usr/sbin:/sbin:/bin:/usr/lib/news/bin
>
> SHELL=/bin/sh
>
> MAILTO=MMGoode@lbl.gov
>
> 2,12,22,32,42,52 \* \* \* \* cd /www/cgi-bin ; /usr/bin/python
> loadCert.py
>
> 7 \* \* \* \* /usr/bin/rsync -avWq /var/myproxy/
> /home/portnoy/u5/fgcm/myproxy_backup

**cert.fusiongrid.org ROOT crontab in /var/spool/cron/tabs/root**

PATH=/usr/bin:/usr/sbin:/sbin:/bin:/usr/lib/news/bin

SHELL=/bin/sh

> MAILTO=MMGoode@lbl.gov
>
> 5 3 \* \* \* /usr/local/bin/fss -c -R /usr/local/etc/fss.conf -D
> /usr/local/etc/fss.db
>
> \# update credential to mirror server
>
> 11 1 \* \* \* /usr/bin/rsync -a \--delete \--rsh=ssh /var/myproxy/
> roam.fusiongrid.org:/var/

## FusionGrid CA

http:/jade.es.net:9001 enroll, retrieve

https:/jade.es.net:9002 enroll, retrieve, renew, revoke,

https:/jade.es.net:8102/ca/ Agent

b2a23916.0 CA certificate

## Document and script locations.

**CVS Repository** at /home/u1/repository/NewFusionGrid

htdocs - the forms that are served by cert.fusiongrid.org/

cgi-bin - the scripts that cert.fusiongrid.org uses

cgi-bin/private -- ShowProxies.py script

devools -- scripts supporting sandbox checkout development

conf -- apache webserver configuration files

docs -- any documentation generated in relation to the project

dsdFusionGridhtdocs -- the pages that are served by
dsd.lbl.gov/FusionGrid/

all others -- empty directories to create the hierarchy for checkout
development

cvs checkout fusiongrid will create the entire structure.

**/www/htdocs** is a checkout of
/home/u1/repository/NewFusionGrid/htdocs and contains the html forms for
using the Certificate Manager interface.

**/www/cgi-bin** is a checkout of
/home/u1/repository/NewFusionGrid/cgi-bin and contains the scripts used
by the CertServer interface.

**/www/cgi-bin/private** is a checkout of /
home/u1/repository/NewFusionGrid/cgi-bin/private.

It is protected to user admin. The password can be found in the passhint
file in that directory.

Currently ShowProxies.py is the only protected script.

**/www/conf** is a checkout of /home/u1/repository/NewFusionGrid/conf
and contains the apache webserver configuration files.

**/www/docs** is a checkout of /home/u1/repository/NewFusionGrid/docs
and contains project documentation.

**/home/www/htdocs/FusionGrid** contains the html pages describing
certificate

management and downloading the scripts for credential self-management

## Web pages and scripts

certRequest.html - form to request a new long-term certificate

calls webRequestCert.py

scripts:

webRequestCert.py - called by the certRequest form

validates/extracts the arguments input by the certRequest.html page,

generates cert request

sends request to jade

saves the private key and user information

notifies user that request has been submitted via web form feedback

loadCert.py - called when notification is received that the

certificate has been issued.

logs into fgcm email account

processes any pending requests

Calls the CA interface to retrieve the signed cert

Uses the saved state information to find the corresponding private key.

username and password

verifies that keypair and cert match

calls myproxy-admin-load-credential -c cert.pem -y key.pem -l username
--t 1209600

adds the user to the ROAM database at MIT

moves state files to /www/Users

deletes old key/cert files if not in debug mode.

sends mail to the user that he can now use the certificate via

myproxy-get-delegation -s cert.fusiongrid.org -l \"username\"

changePass.py - a utility for users to change their passwords in

myproxy server. State files no longer contain passwords at this point.

webRequest.py - a library file, contains constant values, paths

and any code shared between relevant applications

grun.py -- generates a proxy for the user and runs a submits a globus
job to the selected host.

hint.py -- mails a validated user their password hint.

ShowProxies.py -- displays the users currently active in the myproxy
repository.

It is password protected to user admin.

All scripts are written in python and rely on the python standard
library for the bulk of their functionality. The notable exception to
this is the use of the m2cyrpto library which exposes a python interface
to the Openssl C API. This is used for the generation of certificate
requests and validating the returned certificate against the keypair
that was used in generation.

## Saved state

A per user file -in /www/CertRequests named by the CN.info contains:

username, sponsor, affiliation, phone, fax, email, address,

password hint, cert retrieval URL

The private keys are also stored there named CN-key.pem

These state files are moved to /www/Users upon a successful load and
passwords are removed.

**Folders in fgcm email account:**

INBOX - all incoming mail here.

processed - when all is well, mails are moved here for safekeeping.

failures - when all is not well, request mail moved here for inspection.

# Securing cert.fusiongrid.org

No NIS running

> Local accounts for only mrt, mgoode, fgcm. Accounts have different
> passwords than our NIS accounts.

Limited NFS

> Only /home/portnoy/u1 and u5 are mounted. (for Mary and Monte's home
> directories, and a credential backup area on u5/fgcm.)
>
> all globus and system executables/libraries are local.

Yast2 set to do automatic updates from LBL SuSE patch repository.

Firewalled to only allow

> sshd, nfs, http, https, myproxy

Limited ssh logins

> From bosshog, boris, bullwinkle, mrt and monte home machines and
> roam.fusiongrid.org.
>
> Set in /etc/hosts.allow.
>
> Root logins are allowed by sshd to give Tom access.
>
> Ssh keys are allowed to give Tom access. The only keys are Tom's in
> root and Mary's home key in \~mrt/.ssh

Runs the /usr/local/bin/fss ( <http://www.insecure.dk/fss> ) file
integrity checker as a root cron job.

> /sbin, /bin. /lib, /usr/bin, /etc, /globus

The myproxy repository is backed up hourly

FGCM user cron runs archival rsync job to a partition in tape backup
rotation.

# Useful Information

## myProxy commands

man pages are installed on natasha and at
http://grid.ncsa.uiuc.edu/myproxy/man/

myproxy-admin-load-credential -c cert.pem -y key.pem -l username

Run by fgcm on natasha. User fgcm must have read permission to key.pem

myproxy-get-delegation -s cert.fusiongrid.org -l username --t hours

(not to be used) myproxyinit -s cert.fusiongrid.org

Generates a proxy and then calls myproxy to delegate a proxy and store

in in the /var/myProxy/mrt.certs on cert.fusiongrid.org

Commands are:

myproxy-init(1)

myproxy-info(1)

myproxy-get-delegation(1)

myproxy-destroy(1)

myproxy-change-pass-phrase(1)

myproxy-server.config(5)

myproxy-admin-adduser(8) (uses globus simple CA to sign certificates)

myproxy-admin-change-pass(8)

myproxy-admin-query(8)

myproxy-admin-load-credential(8)

myproxy-server(8)

Certificates can be retrieved/renewed by giving a passphase (normal

users) or by having a certificate (portal). -n means nopassword is

required, anonymous retrievers/renewers are only allowed if a password

is required.

If credentials are named using the credname argument, you can have

more than one per username. Otherwise adding a new credential replaces

the existing one.

## How to generate a p12 file

How to use openssl pkcs12

openssl pkcs12 -in cert -inkey key -export -out p12file