January 2007 - ogsa-wg - lists.ogf.org

action item AI-0115b
by Ellen Stokes 25 Jan '07

25 Jan '07

Here's the text for action item AI-0115b to be discussed on OGSA call Thurs Jan 25. https://forge.gridforum.org/sf/go/doc14121?nav=1 Ellen

1 0

action item AI-0115a
by Ellen Stokes 24 Jan '07

24 Jan '07

Here's data for AI-0115a: Ellen will send out the link to a DMTF feedback template form. The following link articulates the DMTF feedback policy (which one must accept before returning feedback)...it's tied into their IPR policy. http://www.dmtf.org/standards/feedback/ Once you've clicked on the acceptance box, you're presented with the feedback form... I've attached a PDF of the feedback policy and acceptance forms for your convenience. Ellen

1 0

Re: [ogsa-wg] [ogsa-authn-bof] Authentication in OGSA
by Dave Berry 24 Jan '07

24 Jan '07

Alan, What do you mean by "access" to HPC resources? There are several possible scenarios hidden behind this word. Here are some. 1. The ability to log in to the remote HPC resource (e.g. using GSISSH) to compile code and perform other activities. This might be required for application developers (although I'd argue that virtualisation should be used to remove this need). 2. The ability to submit arbitrary jobs for remote execution on a remote HPC resource, without a login capability per se. This is the "traditional" HPC case. 3. The ability to use a portal (or other user-friendly system) that provides a small set of applications that the portal runs on a remote HPC resource. This is becoming common as Grid spreads beyond the traditional HPC community. In the third case, note that no users have the ability to run arbitrary code on the HPC resource, so the threat from stolen or misused authentication is considerably reduced. Another question is where the vulnerability lies in each scheme. It is well known than passwords are subject to various attacks including trojans and cracking. On the other hand, I'm told that certificates can be snooped and copied by system administrators (at least in some implementations). There are organisations where this would be considered an unacceptable security risk. Finally, the big problem is that certificate management is currently way too complicated for many users. Perhaps this will disappear with the advent of better tools (Infocard maybe?) but at present I am involved with several Grid projects where any attempt to impose GSI will doom the project. This has been well documented from other cases too. Dave. > -----Original Message----- > From: ogsa-wg-bounces(a)ogf.org > [mailto:ogsa-wg-bounces@ogf.org] On Behalf Of Alan Sill > Sent: 22 January 2007 18:12 > To: Blair Dillaway > Cc: OGSA Authentication WG BoF; security-area(a)ogf.org; > ogsa-wg(a)gridforum.org > Subject: Re: [ogsa-wg] [ogsa-authn-bof] Authentication in OGSA > > Let us look for a compromise at OGF-19 on this issue. I > specifically > think these additions are not supported, nor are they supportable, > for high-performance computing resource access under OGSA either in > philosophy or in implementation as written. It is possible that > sufficient attention to qualification on the topics of levels of > assurance (for which there is a BOF), identity management (for which > in the Federated ID systems there is an all-day session), and/or > tying the username/password to systems of sufficient strength for > identity management and verification could allow a qualified > extension of this use case to be written to support > username/password > access in selected cases. > > Best, > Alan > > On Jan 22, 2007, at 11:46 AM, Blair Dillaway wrote: > > > Hi All, > > > > In helping to draft the HPC Basic Profile security > specification under > > consideration, I did review the latest drafts of the OGSA-BSP-Secure > > Channel specification. The HPC security proposal is > compatible with > > the > > recommendations in that document as cited in the text, though it > > allows > > for some additional functionality. This was deemed necessary, after > > discussion with the HPC Profile WG chairpersons, to > adequately support > > interoperability between existing products. > > > > Specific differences include: > > - Mutual authN based on X.509 certificates is not required, as a > > client username/password option is provided > > - TLS 1.0 is not mandatory when establishing an HTTP-based > > connection. SSL3.0 and TLS 1.1 are also allowed > > > > The mandatory and optional TLS/SSL cipher suites and guidance in > > OGS-BSP-SC are adopted. > > > > I hope that background helps facilitate discussion of the > proposal. It > > is certainly worth discussing whether we can bring these > two documents > > into even tighter alignment while still fully meeting the needs > > each was > > intended to address. > > > > Regards, > > Blair Dillaway > > > > -----Original Message----- > > From: ogsa-authn-bof-bounces(a)ogf.org > > [mailto:ogsa-authn-bof-bounces@ogf.org] On Behalf Of Hiro Kishimoto > > Sent: Monday, January 22, 2007 1:33 AM > > To: Alan Sill; Andrew Grimshaw; Marty Humphrey > > Cc: OGSA Authentication WG BoF; security-area(a)ogf.org; > > ogsa-wg(a)gridforum.org > > Subject: Re: [ogsa-authn-bof] [ogsa-wg] Authentication in OGSA > > > > Hi Alan, Andrew, and Marty, > > > > OGSA Security Profile - secure channel is certificate base > and I think > > HPCP WG can utilize (and maybe extents) it for your interoperability > > purpose. > > > > If you can make this Thursday call, we will allocate some time for > > this discussion. If Thursday does not for you, please come to OGSA > > security session (Mon 29 Jan, 2pm) at OGF19 for farther discussion. > > > > Thanks, > > ---- > > Hiro Kishimoto > > > > Alan Sill wrote: > >> Hi Andrew and the OGSA-WG, > >> > >> I apologize for missing the meeting last Thursday on this > topic. We > >> have a machine full of new cluster and grid equipment, and I have > >> been > > > >> fully occupied commissioning and configuring it. > >> > >> I am afraid that I differ rather strongly with the direction being > > taken > >> with regard to the HPC profile at this stage. My view is strongly > > that > >> simple username/password login, even SSL secured, is quite > > demonstrably > >> insufficiently secure to deploy as a model for authentication and > > access > >> to high performance computing. I disagree fairly strongly that any > > sort > >> of stop-gap of this nature should be written into the HPC profile, > >> distributed or promoted at this time. > >> > >> I have an excuse for having taken so long to reply on this > topic. It > >> was necessary for me to investigate as thoroughly as possible the > >> current state of deployment of GSI-secured alternatives to > >> username/password login and to do so in a way that would > allow me to > >> give a credible response to all of you regarding the state > of the art > > on > >> this topic. > >> > >> At this point I am assured and feel sufficiently confident to > >> proceed, > > > >> either at OGF-19 or before, with Andrew, Marty, and whoever else > >> would > > > >> like to participate on a revision of the HPC profile that > would cover > >> more secure basic access to high performance cluster and storage > > systems > >> based on GSIOpenSSH and similar software that uses either GT4 or an > >> equivalent callout. We are writing standards, not implementations, > > but > >> I wished to be sure that the state of the art on existing > >> implementations would be consistent with making this > recommendation. > >> > >> It is essential from my point of view to promote secure > access to HPC > >> resources. As the bulk of the compromise attacks that have been > >> successful over the past 2 to 3 years on HPC resources has been > > through > >> discovery and reuse of username/password combinations from ordinary > >> users (at least as I read the recent record), I think that > now is not > >> the right time to propose backing off from the use of strong > >> cryptographic methods to use HPC resources in grid > settings. The use > > of > >> strong cryptography does not have to be limited to X.509 "pure > > classic" > >> PKI, and I look forward to an active discussion on > federated identity > >> and related topics to be held at the OGF meeting next week. It is > > clear > >> to me that recent improvements to the availability and > technology for > >> authentication, authorization and attribute transmission will make > > many > >> modes of access to grid resources possible with > appropriate security > >> that up to now have been either impossible or confined to limited > >> implementation. > >> > >> For the moment, I would like to suggest that a revision of the HPC > >> profile propose that "only GSI or equivalently secure > >> architectures be > > > >> used for direct access to HPC resources" and that the document be > >> revised specifically to discourage the direct access by users to > > highly > >> capable computational and to secure storage resources by > >> username/password mechanisms. In my own project, we use > GSI-OpenSSH > > via > >> grid-mapfiles. I have been able to confirm that current > > implementations > >> of GSI-OpenSSH are capable of interoperating with more general > >> callout-based systems, including attribute-based AuthZ systems, > > without > >> modification. Therefore it is not necessary for users to have > >> username/password access if direct login is needed on an > HPC system. > >> > >> As a further enhancement to the document and to the profile, I > >> feel it > > > >> would be useful to describe architectures for pure-computational > > (i.e., > >> batch-only access), for pure-login (i.e., front-end and submission > >> access), pure-storage (i.e., stage-in/stage-out and related data > >> handling) and for the interesting use case of "managed fork" (i.e., > >> interactive but sand-boxed grid access) systems. I believe these > >> changes would result in an improved HPC profile that would be of > > better > >> total usability within the HPC community. This document is NOT > >> attached, instead your original one is for discussion, but > I believe > > can > >> be worked out in the context of discussions to be held at > OGF-19 next > > week. > >> > >> Sorry for being (apparently but not really) strident, but I believe > > the > >> above reflects current best practices better than recommending > >> username/password support for direct login to HPC systems. I would > > not > >> personally be able to support the current draft as written. > >> > >> Thanks and best wishes, > >> Alan > >> > >> On Jan 18, 2007, at 2:16 PM, Andrew Grimshaw wrote: > >> > >>> All, > >>> > >>> On this mornings call I volunteered to see what was up > with the HPC > >>> profile working group with respect to authentication. Recall > >>> that we > > > >>> need some sort of authentication story in the short run > or we cannot > >>> put together any form or realistic, cross-organizational, compute > >>> grids with BES, or for that matter data grids using RNS/ByteIO. > >>> > >>> > >>> > >>> Attached is a short white paper from the HPC Profile WG (or maybe > > just > >>> the three authors). It is BES-specific, but I think the > ideas may be > >>> generalized to a broader set of OGSA services. I think we should > >>> consider it, or something like it. > >>> > >>> > >>> > >>> Note that it does NOT deal with the ultimate authentication and > >>> delegation problem that we will face. Rather, I > personally (speaking > >>> only for myself, and not even the people in my research > group) think > >>> that this sort of solution is a stop gap that we can use > for awhile, > >>> and that we will ultimately deprecate in favor of > whatever comes out > >>> of the OGSA-Authentication WG. > >>> > >>> > >>> > >>> So, for your reading pleasure - and with my thanks to Marty for > > giving > >>> me a copy. > >>> > >>> > >>> > >>> A > >>> > >>> > >>> > >>> > >>> > >>> > >>> > >>> Andrew Grimshaw > >>> > >>> Professor of Computer Science > >>> > >>> University of Virginia > >>> > >>> 434-982-2204 > >>> > >>> grimshaw(a)cs.virginia.edu > >>> > >>> -- > >>> > >>> ogsa-wg mailing list > >>> ogsa-wg(a)ogf.org > >>> http://www.ogf.org/mailman/listinfo/ogsa-wg > >> > >> > >> > >> > >> > > Alan Sill, Ph.D > TIGRE Senior Scientist, High Performance Computing Center > Adjunct Professor of Physics > TTU > > ==================================================================== > : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : > : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : > ==================================================================== > > >

1 0

Updated: OGSA Teleconference
by Andreas Savva 24 Jan '07

24 Jan '07

BEGIN:VCALENDAR PRODID:-//Microsoft Corporation//Outlook 11.0 MIMEDIR//EN VERSION:2.0 METHOD:REQUEST BEGIN:VEVENT ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=TRUE:MAILTO:ogsa-wg@ogf.org ORGANIZER:MAILTO:andreas.savva@jp.fujitsu.com DTSTART:20070125T130000Z DTEND:20070125T145900Z TRANSP:OPAQUE SEQUENCE:2 UID:040000008200E00074C5B7101A82E00800000000C029D3120A3FC7010000000000000000100 00000EC65B41E95063A41904E2F7770879BFE DTSTAMP:20070124T073659Z DESCRIPTION:When: 2007年1月25日木曜日 22:00-23:59 (GMT+09:00) 大阪、札幌、東京.\n\n*~*~*~*~*~*~*~*~*~*\n\n<pre>\n\nThe following is a proposed agenda for OGSA-WG telecon on Jan. 25th\nThursday from 7am - 9am (CST).\n\n** OGSA-WG and fellow WGs will have interim F2F meeting in March.\n** Probably in the week of March 12 on west coast.\n\n** Please let us know your availability by answering Zoomerang survey\n** before January 25 Thursday.\n\n** http://www.zoomerang.com/survey.zgi?p=WEB2263EM6QY3S\n\nDial-in numbers for Thursday:\n Free: +1-888-452-0308\n Intl/Toll: +(210) 234-7446\n PIN: 71815\n See more information:\n - https://forge.gridforum.org/sf/go/wiki1477\n\nScreen share service will be provided.\n URL: http://ogsa.glance.net\n Session key: 0125\n See more explanation:\n https://forge.gridforum.org/sf/go/wiki1584\n\n1) Early discussion (20 min)\n Note taker assignment\n Roll call\n Telecon minutes approval (Jan. 22)\n - https://forge.gridforum.org/sf/go/doc14102\n Action Items status review (see the bottom of this email)\n Agenda bashing\n\n2) OGF19 sessions update (Hiro\, 20 min)\n Session owners: Please update the wiki page with the agenda.\n - https://forge.gridforum.org/sf/go/wiki1678\n\n3) March F2F update (Hiro\, 20 min)\n 14 people answered.\n https://forge.gridforum.org/sf/go/wiki1685\n\n4) BES container model document review (Ellen Stokes\, 30 min)\n> Ellen is planning to have a final draft in place before the Thursday\n> call. \n> \n> AI-0122g: Ellen will ask for comments from specific people in the\n> BES-WG (Andrew Grimshaw \, Steven Newhouse\, Chris Smith\,\n> etc.)\n\n5) Wrap up (10 min)\n AOB\n\n<*NEXT CALL*>\nhttps://forge.gridforum.org/sf/go/wiki1477\n\nOGF19: week of Jan. 29\n\n<*ACTION ITEMS*>\nhttps://forge.gridforum.org/sf/go/wiki1569\n\n > From Jan. 18 call\n\nAI-0118a: Jay Unger to provide a definition of state (for the glossary)\nAI-0118b: Ellen\, Tom and Jay to look at WS-Policy nd assess any overlap\n with the current XQuery efforts\nAI-0118e: Andrew to draft invitation mail and publish to the list (and\n to specific people) to draw attention to the OGSA Workflow\n session\nAI-0118f: Michel to invite A-Ware and other EU projects for BPEL\n coverage at OGF19 OGSA session 5\n\n > From Jan. 15 call\n\n AI-0115a: Ellen will send out the link to a DMTF feedback\n template form.\n AI-0115b: Ellen will summarize the review of the DMTF documents and\n review the text at a future call.\n\n > From Nov. 30 call\n AI-11.30a: Michel to talk with Tom and Ellen on how to go about\n documenting his current proof of concept in the Info\n model Arch doc.\n\n > From Nov. 9 pm F2F.\n AI.11.09.pm-a: Ellen and Tom to write up a "Information Model\n profile document: BES Container"\n AI.11.09.pm-c: Andrew to produce a document drafting the definition\n of QoS\n AI.11.09.pm-d: Andrew to contact the HPCP WG regarding future\n involvement to create profile(s) on\, e.g. BES\, JSDL\n etc.\n\n > From Sept. 15 OGSA F2F\n AI-0915d: Tom will post BP base faults issue to tracker\n\n > From Aug. 17 call\n AI-0817a: Dave Berry and Jay Unger will approach groups (GIN\,\n Globus\, etc) that have implemented practical grids and\n start a discussion on how they handle data:\n - how data is treated as a resource that can be scheduled\n - how transfers are modeled\n - how files are advertised\n - how applications find files (query\, by knowledge\,?)\n (Due Oct. 9)\n\n > From July 20 F2F\n- EGR-WG (Ravi) will contact Geoffrey Fox and invites him to\n contribute use cases.\n- Andreas to go through the minutes and formulate a reply mail to\n Geoffrey on each artifact covered in these minutes.\n\nPostponed:\nUntil next reference model call (Jan. 22nd):\n AI-1023c: Tom volunteered to review Hiro's HPC Cluster use case\n slides and make appropriate changes to indicate where the\n CIM Profile would fit in and how it would link into the\n Reference Model.\n AI-1023d: Paul will add more items to list on slide 6 of the HPC\n Cluster use case\n AI-1023g: Hiro will look at other parts of slide 5 and identify\n further possible refinements of this use case.\n\n\n\n</pre>\n SUMMARY:Updated: OGSA Teleconference PRIORITY:5 X-MICROSOFT-CDO-IMPORTANCE:1 CLASS:PUBLIC BEGIN:VALARM TRIGGER:-PT15M ACTION:DISPLAY DESCRIPTION:Reminder END:VALARM END:VEVENT END:VCALENDAR

1 0

Proposed agenda for Jan. 25th call
by Hiro Kishimoto 24 Jan '07

24 Jan '07

Hi all, The following is a proposed agenda for OGSA-WG telecon on Jan. 25th Thursday from 7am - 9am (CST). ** OGSA-WG and fellow WGs will have interim F2F meeting in March. ** Probably in the week of March 12 on west coast. ** Please let us know your availability by answering Zoomerang survey ** before January 25 Thursday. ** http://www.zoomerang.com/survey.zgi?p=WEB2263EM6QY3S Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +(210) 234-7446 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0125 See more explanation: https://forge.gridforum.org/sf/go/wiki1584 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Jan. 22) - https://forge.gridforum.org/sf/go/doc14102 Action Items status review (see the bottom of this email) Agenda bashing 2) OGF19 sessions update (Hiro, 20 min) Session owners: Please update the wiki page with the agenda. - https://forge.gridforum.org/sf/go/wiki1678 3) March F2F update (Hiro, 20 min) 14 people answered. https://forge.gridforum.org/sf/go/wiki1685 4) BES container model document review (Ellen Stokes, 30 min) > Ellen is planning to have a final draft in place before the Thursday > call. > > AI-0122g: Ellen will ask for comments from specific people in the > BES-WG (Andrew Grimshaw , Steven Newhouse, Chris Smith, > etc.) 5) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477 OGF19: week of Jan. 29 <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569 > From Jan. 18 call AI-0118a: Jay Unger to provide a definition of state (for the glossary) AI-0118b: Ellen, Tom and Jay to look at WS-Policy nd assess any overlap with the current XQuery efforts AI-0118e: Andrew to draft invitation mail and publish to the list (and to specific people) to draw attention to the OGSA Workflow session AI-0118f: Michel to invite A-Ware and other EU projects for BPEL coverage at OGF19 OGSA session 5 > From Jan. 15 call AI-0115a: Ellen will send out the link to a DMTF feedback template form. AI-0115b: Ellen will summarize the review of the DMTF documents and review the text at a future call. > From Nov. 30 call AI-11.30a: Michel to talk with Tom and Ellen on how to go about documenting his current proof of concept in the Info model Arch doc. > From Nov. 9 pm F2F. AI.11.09.pm-a: Ellen and Tom to write up a "Information Model profile document: BES Container" AI.11.09.pm-c: Andrew to produce a document drafting the definition of QoS AI.11.09.pm-d: Andrew to contact the HPCP WG regarding future involvement to create profile(s) on, e.g. BES, JSDL etc. > From Sept. 15 OGSA F2F AI-0915d: Tom will post BP base faults issue to tracker > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Due Oct. 9) > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. Postponed: Until next reference model call (Jan. 22nd): AI-1023c: Tom volunteered to review Hiro's HPC Cluster use case slides and make appropriate changes to indicate where the CIM Profile would fit in and how it would link into the Reference Model. AI-1023d: Paul will add more items to list on slide 6 of the HPC Cluster use case AI-1023g: Hiro will look at other parts of slide 5 and identify further possible refinements of this use case. ---- Hiro Kishimoto

1 0

FYI: OGF19 OGSA-related sessions
by Andreas Savva 23 Jan '07

23 Jan '07

For convenience I have added the OGSA-WG OGF19 sessions to the OGSA-WG online calendar. I have also added a few other OGF19 sessions that are related to recent discussions. You can look at the OGSA calendar through gridforge: https://forge.gridforum.org/sf/linkedapplication/do/viewLinkedApplication/p… or http://tinyurl.com/krhe3 (I'll try to make sure this calendar is up to date but you should still check the real OGF19 schedule for any last minute changes.) -- Andreas Savva Fujitsu Laboratories Ltd

1 0

Authentication in OGSA
by Andrew Grimshaw 22 Jan '07

22 Jan '07

All, On this mornings call I volunteered to see what was up with the HPC profile working group with respect to authentication. Recall that we need some sort of authentication story in the short run or we cannot put together any form or realistic, cross-organizational, compute grids with BES, or for that matter data grids using RNS/ByteIO. Attached is a short white paper from the HPC Profile WG (or maybe just the three authors). It is BES-specific, but I think the ideas may be generalized to a broader set of OGSA services. I think we should consider it, or something like it. Note that it does NOT deal with the ultimate authentication and delegation problem that we will face. Rather, I personally (speaking only for myself, and not even the people in my research group) think that this sort of solution is a stop gap that we can use for awhile, and that we will ultimately deprecate in favor of whatever comes out of the OGSA-Authentication WG. So, for your reading pleasure - and with my thanks to Marty for giving me a copy. A Andrew Grimshaw Professor of Computer Science University of Virginia 434-982-2204 grimshaw(a)cs.virginia.edu

8 16

Needs and requirements for Quality of Service in the Grid (BoF)
by A.S.McGough 22 Jan '07

22 Jan '07

All, At the last OGSA f2f meeting I was asked to arrange a BoF meeting at the next OGF meeting on Quality of Service. This has been arranged for OGF19 on Thursday afternoon at 4pm. I'd like to solicit support for this BoF in two forms. First of all requesting that people attend this BoF if they feel they have any interest in the area of QoS. The second is to seek people to present ideas at the BoF. The intention is to discover what if anything OGF should be doing about QoS. I'm keen for presentations on what people feel is needed for QoS and also people with existing solutions to the issue of QoS in the Grid. Please let me know if you have anything which may be suitable. Many thanks, steve.. -- ------------------------------------------------------------------------ Dr A. Stephen McGough http://www.doc.ic.ac.uk/~asm ------------------------------------------------------------------------ Technical Coordinator, London e-Science Centre, Imperial College London, Department of Computing, 180 Queen's Gate, London SW7 2BZ, UK tel: +44 (0)207-594-8409 fax: +44 (0)207-581-8024 ------------------------------------------------------------------------

1 0

March interim F2F meeting survay
by Hiro Kishimoto 22 Jan '07

22 Jan '07

Hi all, OGSA-WG and fellow WGs will have interim F2F meeting in March. Probably in the week of March 12 on west coast. Please let us know your availability by answering Zoomerang survey before January 25 Thursday. http://www.zoomerang.com/survey.zgi?p=WEB2263EM6QY3S We will discuss on upcoming Thursday call and choose date and venue in next week at OGF19. Thanks, -- Hiro Kishimoto

1 0

Phone conf minutes for 18 Jan 07
by Michel Drescher 22 Jan '07

22 Jan '07

Folks, minutes are on Gridforge: http://forge.gridforum.org/sf/go/doc14099?nav=1 Cheers, Michel -- Michel <dot> Drescher <at> uk <dot> fujitsu <dot> com Fujitsu Laboratories of Europe +44 20 8606 4834

4 5