System of Monitoring/Management of resources and security for a Grid based on Globus Toolkit

Transcription

1 System of Monitoring/Management of resources and security for a Grid based on Globus Toolkit Luis Rodrigo de Oliveira Gonçalves lrodrigo@lncc.br Laboratório Nacional de Computação Científica LNCC 2 June 2006 Curitiba - Brasil WCGA06 - IV Workshop on Computational Grids and Applications

2 Introduction We would like to monitor resources and security in Grids on a continuous base and whenever new nodes come into to the environment To able to do management, monitoring and adjustments of the environment carried by scripts sent via the ports available in Globus 2

3 Giga Network 3

4 InteGridade + Sinergia IC/UFF- Sinergia LNCC- InteGridade IC - UNICAMP CBPF PUC-RJ UFES II - UFRGS RNP-GIGA Network Internet NCSA / UIUC Support: - RNP - FINEP - FUNTTEL - PCI-LNCC Length: ~700 Km up to 10 Gbps 4

5 Objectives Monitoring : the activity of hosts in the Net and the Grid available resources in the Grid historical behavior of hosts state of the environment in determined instant Middleware Management : validity verification of the certificates Mapfile management users administration Security Management : generate/verify security politics apply the adjustment of security to the environment 5

6 Motivation - Complexity in the administration /management of heterogeneous and distributed environments - Absence of tools for management of resources supplied for middleware of the Grid - Absence of a basic set of controls of security to be applied in the environment - Difficulty in the verification/maintenance of the level of security of the environment - Difficulty in the application of adjustments of security guard in all the environment 6

7 Grid Middleware Grid Middleware used 1st prototype over Globus being extended to run over Globus 4 Services involved GRAM: submission/control of applications; MDS: discovery of resources; GSI: movement of data and security 7

8 Globus Toolkit 4 components Security Data Management Execution Management Information System Common Runtime 8

9 Verification Model - Defines how to carry through the automatic level tack verification of an environment to ISO/IEC Based on architecture TCP/IP - Independent of Hardware and Software - Basic Components: - Primary Agent of Verification - APV - Secondary Agent of Verification - ASV - Agent of Collection of Data - ACD - Data Repository - Translation of the controls in scripts of collection - Collection on-i lease of the data 9

10 Verification Hierarchic 10

11 Model Adaptation to Grids The Globus Toolkit provides mechanisms for : Authentication of hosts and users Transfer of scripts Execution/control of applications and scripts For the implementation is necessary only : Primary Agent of Verification APV (front-end and backend) Data Repository - adapted Data Collector Scripts Administrative Scripts Environment Adjustment Scripts So each Grid node function as an ACD The ASV does not need to be implemented 11

12 New Verification Hierarchic 12

13 SiMPaSeg Protoype - Security monitoring in grids 1st protoype - Implements 15 NBR ISO/IEC analisys - Does a passive security verification - Divided in 4 modules - All grid users are allowed to run the analisys limited to user s access level 13

14 SiMGeS Protoype - Passive Resources Monitoring of the Network and Grids - Management and adjustment of the security automatic collection in loco no administrators interference basic set of controls - Semi-automatic adjustments of the environment - Management of Grid middleware 14

15 Network and Grid Monitoring - Sweeping of the net and fingerprinting - Collection based on the MDS of host - Historical and current data of the environment - Statistics 15

16 Network and Grid Monitoring 16

17 Network and Grid Monitoring 17

18 Management - Using the functionality of Grid middleware - Local Account with administrative permission - Managed Resources Validity of the Certificates Users Certificates Generation User Mapping Time Synchronization 18

19 Security Management - Using middleware functionalities - Privileged Account - Automatic and in loco hosts analysis - Applications will allow to create/apply Politics of standardized security Individual politics in each domain Basic set of controls (NBR ISO/IEC 17799) Hosts Half-automatic Adjustment dependent of approval of the administrator of the set of controls applied to the host 19

20 Security Management - ISO/IEC International Standard of Security of the Information - Basic set of controls - Can be applied to several administrative domains - Some of controls already tested/implemented 20

21 Security Management Grid Policies - Creation/Insertion of new politicies based on Host security based on Grid security - Construction of a basic check-list for Hosts for Grids - Controls based on other standars and politicies - Operational System Generic and/or Dependent Controls - Collecting/Adjustments based on: Scripts: Bash/Sh/Python/Perl/Lua Programs: Java/C/C++ 21

22 Security Management Active Analisys Initiated and monitored by the Domain/Grid administrator A sigle instance in execution Data access restricted Selection of Host/Grid Selection of politicies/controls Collection in loco History of analysis 22

23 Security Management Adjustments Use of Grid middleware Without direct intervention of administrator Local account with privileged access Based in the results of the analysis Applied with the authorization of administrator Historiy of the applied adjustments 23

24 Current implementation status - Detected a anormal functioning of the MDS Server - Monitoring of the Network/Grid for the front-end (history/current state) - Some controls of NBR already implemented/tested - Management of mapfile already tested - Time Synchronization - Management of the certificates in test 24

25 Next steps - Interface for the execution of the analysis - Interface for the management of the Globus - Tools for adjustment - Statistics of the Net/Grid - Implementation of a modified version of the services of MDS supplied for the Globus - Implementation of tools to facilitate the management of the environment of execution of the users 25

26 Final remarks Although not completetly implemented, the proposed tool already allows the attainment of some information on the environment Some tests verified that process collection can be carried without the installation of new software Mapping of the certificate used for the system in a privileged account, was possible: to apply adjustments to the Middleware configuration to carry out time synchronization In some cases of adjustment of the environment, it was necessary to update the version of the installed software 26

27 References FAGUNDES, Fábio de Oliveira; Elaboração de uma política de segurança para grades computacionais ; IME - Instituto Militar de Engenharia; Sept GONÇALVES, L. R. de O.; Um Modelo para Verificação, Homologação e Certificação de Aderência à Norma Nacional de Segurança de Informação - NBR ISO/IEC ; Universidade Federal do Rio de Janeiro; Feb GONÇALVES, L. R. de O.; de MORAES, Luis Felipe; Modelo de verificação de aderência de um ambiente à NBR/ISO-IEC 17799:2005. Abril 2006 NBR ISO/IEC 17799: Tecnologia da Informação - Código de Práticas para a gestão da Segurança da Informação; Associação Brasileira de Normas Técnicas; Agosto 2005 TIERNEY, Brian; NetLogger: A Toolkit for Distributed System Performance Tuning and Debugging; 2002 ARKIN, Ofir, A remote active OS fingerprinting tool using ICMP;

28 Obrigado!!! 28