- security-area - lists.ogf.org

Comments on draft OGF protocol description requested
by Ralph Niederberger 07 Apr '09

07 Apr '09

Dear all, my name is Ralph Niederberger. I am one of the chairs of the FVGA-WG at OGF. We are currently investigating in designing a new protocol for dynamic opening of ports within firewalls by authorized user applications. Sorry for crossposting to security-area and infrastructure-area, but I would like to get feedback from all of you concerning a draft protocol we are just preparing within our group. The draft description I have appended to this email. It would be very helpful, if you could comment on this proposal, so that the Firewall Virtualisation for Grid Applications - Work Group can work on your comments at the next OGF meeting. We know that there are many other developments, which already have tried to solve this issue, but have not seen any solution, which is widely used and/or provides a similar easy to use interface and broad range of usability. Our intention is to get as much as possible feedback, so that we can decide as soon as possible, if the direction we are going is the right one or if we have missed anything important. Dependent on your feedback, we would like to go for this solution or change the draft accordingly. Then we would like to start the following steps in parallel: a.) Getting in touch with IETF for standardization issues. b.) Implementation of a first very limited prototype (showing that it works as suggested). Step b could be separated into different parts: b1.) prototype implementation for linux iptables b2.) prototype in close cooperation with a Firewall developer (-> a first FiTP aware firewall). Anyone having contact to these guys would be fine. b3.) Communication prototypes for out of band signalling, i.e. for firewalls which are FiTP unaware. So the auth server has to start a subroutine for firewall configuration (via CLI, special firewall managament software, https, ...) b3 could be done for several firewall systems, e.g. Cisco Pix, Checkpoint, ... Here we would need experts having access to those kinds of firewalls within test environments. Next steps are very dependent on the outcome of steps a.) and b.) above. I would like to thank you all in advance for your feedback. best regards Ralph Niederberger -- *************************************************** Ralph Niederberger Juelich Supercomputing Centre Institute for Advanced Simulation Phone: +49 2461 61-4772 Fax: +49 2461 61-6656 E-Mail: r.niederberger(a)fz-juelich.de WWW: http://www.fz-juelich.de/jsc/ JSC is the coordinator of the John von Neumann Institute for Computing and member of the Gauss Centre for Supercomputing *************************************************** Forschungszentrum Jülich GmbH 52425 Jülich Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzende des Aufsichtsrats: MinDirig'in Bärbel Brumme-Bothe Geschäftsführung: Prof. Dr. Achim Bachem (Vorsitzender), Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt, Dr. Sebastian M. Schmidt ***************************************************

1 0

Security and related activities at OGF24: an overview
by David Groep 29 Aug '08

29 Aug '08

OGF24: Bustling with Security Activities In a mere few weeks OGF24 will be held in Singapore. A compact meeting, it is packed with quite a few interesting security and related sessions. If you did not plan to come, maybe these still entice you to travel to Singapore: A jointly coordinated session with GIN will focus on how to restrict delegation. In the GIN grid deployments restricting what somebody (or a process can do) is gaining prominence, and how to design such restrictions when delegating credentials (both when using proxies and in a SAML context) is something the GIN group wants to know. One hand this of course includes the syntax and technical mechanisms, and based on current standards and developments this might be addressed in the short term. But how to interpret such restrictions in a common way? If a policy is defined to restrict access to a service or service method, will the implementations of such a service react in a similar way? This session should lead the way for a new working (or research?) group to address these topics. Also at OGF24, the OGSA-AuthZ WG will be discussing the feedback received on the "Functional Components of Grid Service Provider Authorisation Service Middleware" document, which has completed its public comment on August 28th, and the "Use of XACML Request Context to Obtain an Authorisation Decision" (completed PC on Aug 13), and review the ongoing comments of the remaining proposed recommendations: - Use of SAML to retrieve Authorization Credentials - WS-TRUST and SAML to Access a Credential Validation Service This suite of four documents provides a complete view on the internals of authorization, and your contributions are welcome to ensure that the documents reflect your needs. As a follow-up to the Firewall Issues RG, a new working group "Firewall Virtualization for Grid Applications" has been started to standardize a set of service definitions for a virtualized control interface into firewalls and other mid-boxes allowing the grid applications to securely and dynamically request application/workflow-specific services from those devices, for the duration of the service. The CA Operations WG, jointly with the IGTF, organises a full-day workshop focussing on a wide range of authentication and identity management issues. On the technical side these include the definition of signing namespace constraints by relying parties, guidelines for auditing CAs, authentication service profiles, and the profile defining trust in higher-level CAs. More on the policy side, issues such as risk assessment and incident response in the IGTF community, and the management of revocation will be discussed. The Levels of Authentication Assurance (LoA) RG merged with CAOPS in OGF23, with the document "A Gap Analysis of Current LoA Definitions vs. LoA Requirements in e-Science/Grid Context" available for discussion. For the operational security side: have a look at the BoF on Intrusion detection in Grid Computing for security issues in grid computing networks and proposed the possible solutions using Intrusion detection/prevention systems. Lastly, you have probably realised that the vacant spot left by Blair Dillaway as security AD (whose term ended in March) has still not been filled. To remedy this very unfortunate situation, please think hard about who you consider to be a suitable candidate (and that may be yourself!), and contact the OGF NOMCOM or the chair Neil Chue Hong directly. See http://www.ogf.org/nomcom/ for details about the NOMCOM process and for an application form. A healthy security area and the security activities in OGF merit a full complement of security ADs to ensure continuity past 2009! I hope to see many of you in Singapore. Best Regards, David Groep. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Re: [SECURITY-AREA] Firewall Virtualization BOF: Monday evening
by Inder Monga 03 Jun '08

03 Jun '08

Thanks to everyone who came to the session and for the engaging discussion. The slides presented and the charter have been uploaded to the OGF site: http://www.ogf.org/gf/event_schedule/index.php?id=1296 Please feel free to send comments over email or to the mailing lists. Inder > _____________________________________________ > From: Monga, Inder (BL60:418) > Sent: Monday, June 02, 2008 7:34 AM > To: security-area(a)ogf.org; ghpn-wg(a)ogf.org; fi-rg(a)ogf.org > Subject: Firewall Virtualization BOF: Monday evening > > > Hi All, > > We would like your support for the Firewall Virtualization for Grid > Applications Working Group BOF. > > A common complaint we hear is that the firewall configurations to > connect two new sites takes a long time to negotiate and make happen. > After the application/experiement between the two sites is completed, > in many cases the ports stay open. By virtualizing the firewall and > providing a set of grid services, we believe that the problems/manual > administrative tasks facing multi-site grid installations and dynamic > VO formations can be simplified dramatically. By integrating within > the Grid services, we can leverage the security infrastruture for Grid > Applications, ensuring that the dynamic, automated firewall port > opening is fully authorized and authenticated, both from the user and > application perspective. > > The BOF has been organized to seek your support in defining the set of > virtualized services that can integrate any legacy firewall into the > grid infrastructure. This virtualization, though very useful for grid > applications, can be leveraged by other applications in the enterprise > as well under proper security considerations. > > The three documents we hope to work on within the group are: > 1. A standard set of service definitions that provide an abstract > interface for an authorized grid applications to specify its data-path > traversal requirements. > 2. A set of security recommendations surrounding the application > interacting with the Firewall service at the control and data plane > including AAA of the service requests > 3. A best practices document for the network-administrator and a > grid-administrator to understand the architecture and security > implications of this deployment > > The proposed detailed BOF charter and plan are attached as a word > document. > << File: Charter_FVGA.doc >> > Thanks, > Ralph and Inder > Co-chairs, Firewall Issues Research Group > >

1 0

Firewall Virtualization BOF: Monday evening
by Inder Monga 02 Jun '08

02 Jun '08

Hi All, We would like your support for the Firewall Virtualization for Grid Applications Working Group BOF. A common complaint we hear is that the firewall configurations to connect two new sites takes a long time to negotiate and make happen. After the application/experiement between the two sites is completed, in many cases the ports stay open. By virtualizing the firewall and providing a set of grid services, we believe that the problems/manual administrative tasks facing multi-site grid installations and dynamic VO formations can be simplified dramatically. By integrating within the Grid services, we can leverage the security infrastruture for Grid Applications, ensuring that the dynamic, automated firewall port opening is fully authorized and authenticated, both from the user and application perspective. The BOF has been organized to seek your support in defining the set of virtualized services that can integrate any legacy firewall into the grid infrastructure. This virtualization, though very useful for grid applications, can be leveraged by other applications in the enterprise as well under proper security considerations. The three documents we hope to work on within the group are: 1. A standard set of service definitions that provide an abstract interface for an authorized grid applications to specify its data-path traversal requirements. 2. A set of security recommendations surrounding the application interacting with the Firewall service at the control and data plane including AAA of the service requests 3. A best practices document for the network-administrator and a grid-administrator to understand the architecture and security implications of this deployment The proposed detailed BOF charter and plan are attached as a word document. <<Charter_FVGA.doc>> Thanks, Ralph and Inder Co-chairs, Firewall Issues Research Group

1 0

stepping down as AD
by Blair Dillaway 29 Apr '08

29 Apr '08

Dear Security Area Members, My term as a Security Area AD is expiring and I will be stepping down as of the end of April '08. It has been a fun and rewarding experience. I hope to see you at future OGFs, though I will miss OGF23 due to prior commitments. Regards, Blair Dillaway

1 0

Links from Security Area Meeting IdM Presentation
by Blair Dillaway 18 Oct '07

18 Oct '07

Hi all, Below are links to slides and related information Mike Jones, Microsoft's Director of Identity Partnerships, presented at the OGF21 Security Area Meeting. Copy of slides Mike used: http://research.microsoft.com/~mbj/misc/CardSpace_19-Apr-2007.ppt. Information Links: - Burton Group Identity Interop info http://identityblog.burtongroup.com/bgidps/2007/08/recapping-the-c.html. - Kim Cameron's Identity WebBlog http://www.identityblog.com/ - Cardspace information http://cardspace.netfx3.com/ Info is also available under OGF21 Meeting minutes at https://forge.gridforum.org/sf/docman/do/listDocuments/projects.sec/docman.… Regards, Blair Dillaway

1 0

***SPAM*** RE: Levels of Assurance (LoA) Session Change
by Blair Dillaway 16 Oct '07

16 Oct '07

Apologies for sending again, checking that my list subscription has been repaired From: Blair Dillaway Sent: Tuesday, October 16, 2007 3:46 PM To: 'security-area(a)ogf.org' Subject: RE: Levels of Assurance (LoA) Session Change Re-sending to hopefully avoid the SPAM filters..... From: Blair Dillaway Sent: Tuesday, October 16, 2007 3:43 PM To: 'security-area(a)ogf.org'; 'OGSA AUTHZ WG'; 'fi-rg(a)ogf.org'; 'loa-rg(a)ogf.org' Subject: Levels of Assurance (LoA) Session Change Hi all, The LoA RG session has been moved to 1:30-3:00PM on Thursday in the Discovery Room. This is one time slot earlier than before to avoid a conflict with the OGSA Express Authentication Session. I hope this doesn't cause anyone a conflict. Thanks, Blair Dillaway

1 0

***SPAM*** RE: Levels of Assurance (LoA) Session Change
by Blair Dillaway 16 Oct '07

16 Oct '07

Re-sending to hopefully avoid the SPAM filters..... From: Blair Dillaway Sent: Tuesday, October 16, 2007 3:43 PM To: 'security-area(a)ogf.org'; 'OGSA AUTHZ WG'; 'fi-rg(a)ogf.org'; 'loa-rg(a)ogf.org' Subject: Levels of Assurance (LoA) Session Change Hi all, The LoA RG session has been moved to 1:30-3:00PM on Thursday in the Discovery Room. This is one time slot earlier than before to avoid a conflict with the OGSA Express Authentication Session. I hope this doesn't cause anyone a conflict. Thanks, Blair Dillaway

1 0

***SPAM*** Levels of Assurance (LoA) Session Change
by Blair Dillaway 16 Oct '07

16 Oct '07

Hi all, The LoA RG session has been moved to 1:30-3:00PM on Thursday in the Discovery Room. This is one time slot earlier than before to avoid a conflict with the OGSA Express Authentication Session. I hope this doesn't cause anyone a conflict. Thanks, Blair Dillaway

1 0

***SPAM*** OGF 21 Security Area Meeting
by Blair Dillaway 12 Oct '07

12 Oct '07

Hi All, I want to encourage you to attend the Security Area meeting on Monday, the 15th, at 3:15PM in the Portland Room. Mike Jones, Microsoft's Director of Identity Partnerships, has agreed to join us to discuss Identity standards activity occurring outside the OGF and on-going efforts to ensure broad interoperability. This should be a great follow-on to discussions at recent OGFs on identity management, federations, and authentication. See you next week. Blair Dillaway

1 0