Recommendations for Static Firewall Configuration in D-Grid



Similar documents
Globus Toolkit Firewall Requirements. Abstract

Using Globus Toolkit

A Tutorial on Configuring and Deploying GridFTP for Managing Data Movement in Grid/HPC Environments

GRIP:Creating Interoperability between Grids

F-Secure Messaging Security Gateway. Deployment Guide

The ENEA-EGEE site: Access to non-standard platforms

Sun Grid Engine, a new scheduler for EGEE

Status and Integration of AP2 Monitoring and Online Steering

A Survey Study on Monitoring Service for Grid

UFTP High-performance data transfer for UNICORE

Configuration Guide BES12. Version 12.3

GT 6.0 GRAM5 Key Concepts

User Manual. Onsight Management Suite Version 5.1. Another Innovation by Librestream

Syslog & xinetd. Stephen Pilon

BlackBerry Enterprise Service 10. Version: Configuration Guide

CHAPTER 4 PROPOSED GRID NETWORK MONITORING ARCHITECTURE AND SYSTEM DESIGN

Device Log Export ENGLISH

Sun Grid Engine, a new scheduler for EGEE middleware

TUTORIAL. Rebecca Breu, Bastian Demuth, André Giesler, Bastian Tweddell (FZ Jülich) {r.breu, b.demuth, a.giesler,

Architecture and Data Flow Overview. BlackBerry Enterprise Service Version: Quick Reference

DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Oracle E-Business Suite 12

Configuration Guide. BlackBerry Enterprise Service 12. Version 12.0

Configuration Guide BES12. Version 12.2

1.6 HOW-TO GUIDELINES

Configuration Guide BES12. Version 12.1

F-SECURE MESSAGING SECURITY GATEWAY

DMZ Secure Proxy Environment setup for IP Forwarding

Configuration Guide. BES12 Cloud

Laptop Backup - Administrator Guide (Windows)

HAMBURG ZEUTHEN. DESY Tier 2 and NAF. Peter Wegner, Birgit Lewendel for DESY-IT/DV. Tier 2: Status and News NAF: Status, Plans and Questions

How to simulate network devices using the Verax SNMP Simulator (Linux/Windows)

Instruments in Grid: the New Instrument Element

Roberto Barbera. Centralized bookkeeping and monitoring in ALICE

Automatic Configuration of Slave Nameservers (BIND only)

ΕΠΛ 674: Εργαστήριο 5 Firewalls

GridWay: Open Source Meta-scheduling Technology for Grid Computing

Cisco TelePresence Video Communication Server (Cisco VCS) IP Port Usage for Firewall Traversal. Cisco VCS X8.5 December 2014

Dell UPS Local Node Manager USER'S GUIDE EXTENSION FOR MICROSOFT VIRTUAL ARCHITECTURES Dellups.com

Ciphermail Gateway Separate Front-end and Back-end Configuration Guide

Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users

White Paper. Traversing Firewalls with Video over IP: Issues and Solutions

UNCLASSIFIED. BlackBerry Enterprise Server Isolation in a Microsoft Exchange Environment (ITSG-23)

Configuring MailArchiva with Insight Server

Cisco Expressway IP Port Usage for Firewall Traversal. Cisco Expressway X8.1 D December 2013

How To. Instreamer to Exstreamer connection. Project Name: Document Type: Document Revision: Instreamer to Exstreamer connection. How To 1.

Troubleshooting BlackBerry Enterprise Service 10 version Instructor Manual

Report from SARA/NIKHEF T1 and associated T2s

Automating Server Firewalls

Mass Storage at GridKa

Wavelink Avalanche Mobility Center Linux Reference Guide

Apache CloudStack 4.x (incubating) Network Setup: excerpt from Installation Guide. Revised February 28, :32 pm Pacific

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science

Cisco Collaboration with Microsoft Interoperability

Quick Start Guide. Sendio System Protection Appliance. Sendio 5.0

WirelessOffice Administrator LDAP/Active Directory Support

Installation and Configuration Guide. Version 5.2

Cloud Computing. Lecture 5 Grid Case Studies

Grid Scheduling Architectures with Globus GridWay and Sun Grid Engine

An approach to grid scheduling by using Condor-G Matchmaking mechanism

The dcache Storage Element

SolarWinds Log & Event Manager

BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: Security Note

Intelligent Power Protector User manual extension for Microsoft Virtual architectures: Hyper-V 6.0 Manager Hyper-V Server (R1&R2)

Grid Computing With FreeBSD

Multi-Homing Security Gateway

DeltaV System Health Monitoring Networking and Security

XSEDE Service Provider Software and Services Baseline. September 24, 2015 Version 1.2

Document No. FO1101 Issue Date: Work Group: FibreOP Technical Team October 31, 2013 FINAL:

Deploying EMC Documentum WDK Applications with IBM WebSEAL as a Reverse Proxy

Network System Management. Creating an Active Directory Domain

Deploying ModusGate with Exchange Server. (Version 4.0+)

SuperLumin Nemesis. Administration Guide. February 2011

Spam Marshall SpamWall Step-by-Step Installation Guide for Exchange 5.5

How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN

If you prefer to use your own SSH client, configure NG Admin with the path to the executable:

SysPatrol - Server Security Monitor

Forward proxy server vs reverse proxy server

DEPLOYMENT GUIDE Version 1.1. Deploying F5 with Oracle Application Server 10g

Chapter 1 - Web Server Management and Cluster Topology

How To Load balance traffic of Mail server hosted in the Internal network and redirect traffic over preferred Interface

CERN local High Availability solutions and experiences. Thorsten Kleinwort CERN IT/FIO WLCG Tier 2 workshop CERN

Transcription:

D-Grid Integrationsprojekt (DGI-2) Fachgebiet 3-3 Firewalls Recommendations for Static Firewall Configuration in D-Grid Version 1.5, 21. Mai 2008

D-Grid Integrationsprojekt (DGI-2) Autoren: Gian Luca Volpato (RRZN, Leibniz Universität Hannover) Christian Grimm (RRZN, Leibniz Universität Hannover) Das diesem Bericht zugrundeliegende Vorhaben wurde mit Mitteln des Bundesministeriums für Bildung und Forschung unter dem Förderkennzeichen 01IG07014F gefördert. Die Verantwortung für den Inhalt dieser Veröffentlichung liegt bei den Autoren.

Index 1! INTRODUCTION...5! 2! COMPUTING RESOURCES...6! 2.1! Globus Toolkit 4...6! 2.2! LCG/gLite...7! 2.3! UNICORE...8! 3! DATA MANAGEMENT...10! 3.1! SRM/dCache...10! 3.2! OGSA-DAI...11! 4! WORKER NODES...13! 4.1! LCG/gLite WN...13! 5! LOGIN NODES...15! 5.1! LCG/gLite User Interface...15! 5.2! Interactive Node...16! 6! REGISTRATION OF GRID SERVICES...18! REFERENCES...19! APPENDIX A: CONTROLLING THE EPHEMERAL PORT RANGE IN GT4 [WEL06]...20! APPENDIX B: CONTROLLING THE EPHEMERAL PORT RANGE IN LCG/GLITE AND SRM/DCACHE [WEL06]...21! APPENDIX C: FIREWALL FILTERING RULES CONFIGURATION FOR GLOBUS TOOLKIT 4...23! APPENDIX D: FIREWALL FILTERING RULES CONFIGURATION FOR LCG/GLITE...24! APPENDIX E: FIREWALL FILTERING RULES CONFIGURATION FOR UNICORE...25! APPENDIX F: FIREWALL FILTERING RULES CONFIGURATION FOR SRM/DCACHE AND OGSA- DAI...26! APPENDIX G: FIREWALL FILTERING RULES CONFIGURATION FOR THE INTERACTIVE NODE FOR DEVELOPMENT AND TESTING...27! 3

List of abbreviations BDII Berkeley Database Information Index CE Computing Element DAI Data Access and Integration DMZ DeMilitarized Zone DN Distinguished Name GIIS Grid Information Index Server GRAM Grid Resource Acquisition and Management GRIS Grid Resource Information Server GSI Grid Security Infrastructure GT4 Globus Toolkit 4 LCG LHC Computing Grid LHC Large Hadron Collider MDS Monitoring and Discovery System MON Monitoring box NJS Network Job Supervisor OGSA Open Grid Services Architecture RFT Reliable File Transfer RGMA Relational Grid Monitoring Architecture SE Storage Element SRM Storage Resource Management UI User Interface WS Web Service WSRF Web Services Resource Framework 4

1 Introduction The document Static Firewall Configuration for Grid Middleware released by DGI FG3-5 in January 2006 analyzed the interaction between Grid middlewares and firewalls. Two major results were outlined: a list of network ports and associated transport protocols used by Grid services and a set of firewall configurations (IP filtering rules) that allow seamless communications among these services. This document refines the previous work introducing recommendations for middleware deployment and defining one single port range to be adopted by all resource providers within D-Grid. The immediate benefit will be a simplified firewall configuration. Although a certain number of ports needs to stay permanently open, it is possible to mitigate the risk of external attacks constraining the incoming connections to be originated from a specific set of IP addresses (or IP sub-networks). The registration in a common, shared, directory of all hosts running services in D-Grid service will enable such a solution. The core of this document describes the recommended configurations for the middleware components that the D-Grid operational concept [DGI-BeKo] requires to be installed at the resource providers: 1. Computing resources: Globus Toolkit 4 LCG/gLite Unicore 2. Data management: SRM/dCache OGSA-DAI 3. s: LCG/gLite WN 4. Login nodes: LCG/gLite UI Interactive node (for development and testing) 5

2 Computing Resources 2.1 Globus Toolkit 4 Resource providers deploying Globus Toolkit 4 are advised to use the following ports in their configuration. Host Service Port (TCP) Modification to default settings GRAM + MDS + RFT WS-GRAM 8443 Range 20000-25000 No Yes WS-MDS 8443 No GridFTP 2811 Range 20000-25000 No Yes RFT 8443 No Table 1: GT4 port configuration With the above recommendations in place the firewall configuration for Globus Toolkit 4 becomes as described in Appendix C. Deployment of GT4 in D-Grid should be performed configuring the middleware services as depicted in Figure 1, i.e.: Install GRAM, MDS, GridFTP and RFT on one single host. Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Resource Provider Batch System Master GRAM MDS GridFTP Firewall 2811, 8443, 20000-25000 Internet... RFT Figure 1: GT4 recommended deployment at resource providers To adjust the standard Globus Toolkit 4 installation to the specific D-Grid recommendations the following change must be applied: Set the controllable ephemeral port range to the interval 20000-25000. 6

Controllable Ephemeral Port Range Preliminary operational experience with the Globus Toolkit shows that approximately 20 ports per expected simultaneous user on a given host should be provided. Given an average amount of 250 simultaneous active D-Grid users, the controllable ephemeral port range is in the order of 5000 ports. The environment variable GLOBUS_TCP_PORT_RANGE and the Java system property org.globus.tcp.port.range restrict the ephemeral ports to a specific range. This range should be formatted as min,max (comma separated values) and it should be configured in all Globus Toolkit 4 affected components through the following procedure: 1. Configuration of WS-GRAM. 2. Configuration of GridFTP. 3. Configuration of C libraries, client applications and services. 4. Configuration of Java libraries, client applications and services. Appendix A describes with details how to set the port range to the interval 20000 25000. 2.2 LCG/gLite Resource providers deploying LCG/gLite are advised to use the following ports in their configuration. Host Service Port Modification to default settings CE + MON + Site-BDII GRAM 2119 Range 20000-25000 No Yes BDII 2170 No GridFTP 2811 Range 20000-25000 No Yes MON-RGMA 8443 No Table 2: LCG/gLite port configuration With the above recommendations in place the firewall configuration for LCG/gLite becomes as described in Appendix D. Deployment of LCG/gLite in D-Grid should be performed configuring the middleware services as depicted in Figure 2, i.e.: Install LCG CE, MON and Site-BDII on one single host. Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. To adjust the standard LCG/gLite installation to the specific D-Grid recommendations the following change must be applied: Set the controllable ephemeral port range to the interval 20000 25000. 7

Resource Provider Batch System Master GRAM BDII GridFTP Firewall 2119, 2170, 2811, 8443, 20000-25000 Internet... MON-RGMA Figure 2: LCG/gLite recommended deployment at resource providers Controllable Ephemeral Port Range Preliminary operational experience with the Globus Toolkit shows that approximately 20 ports per expected simultaneous user on a given host should be provided. Given an average amount of 250 simultaneous active D-Grid users, the controllable ephemeral port range is in the order of 5000 ports. The environment variable GLOBUS_TCP_PORT_RANGE restricts the ephemeral ports to a specific range. The value of this variable should be formatted as min,max (comma separated values). Setting this environment variable in all LCG/gLite affected components is achieved through the following procedure: 1. Configuration of GT libraries. 2. Configuration of GRAM Gatekeeper and JobManager. 3. Configuration of GridFTP. Appendix B describes with details how to set the port range to the interval 20000 25000. 2.3 UNICORE Resource providers deploying Unicore are advised to use the following port in their configuration. Host Service Port Modification to default settings NJS + TSI + UUDB NJS 1128 Yes Table 3: Unicore port configuration With the above recommendations in place the firewall configuration for Unicore becomes as described in Appendix E. Deployment of Unicore in D-Grid should be performed configuring the middleware services as depicted in Figure 3, i.e.: Install NJS, TSI and UUDB on one single host. 8

Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewalls are also indicated. It should be noticed that incoming connections directed to the NJS should be allowed only when initiated by the official D-Grid Unicore Gateways provided by Forschungszentrum Jülich (zam177.zam.kfa-juelich.de) and Forschungszentrum Karlsruhe (iwrunicore.fzk.de). These Gateways are the single point of contacts for all external Unicore connections and act as a filter in front of the NJS. Resource Provider Batch System Master NJS TSI UUDB Firewall 1128 Gateway... Figure 3: Unicore recommended deployment at resource providers To adjust the standard Unicore installation to the specific D-Grid recommendations the following change must be applied: Set the port used by NJS to 1128/tcp. NJS Resource providers may deploy one ore more NJSs. Each NJS should listen for connection requests from the Gateways on port 1128/tcp. This port value is configured in the file njs/conf/njs.properties by the parameter njs.gateway_port [Ber06]. The site firewall should allow connections between the Gateways and the NJSs. Since the IP addresses of these hosts are known in advance, the firewall can be easily configured in order to allow network communication only among these entities. With the above recommendations in place the firewall configuration for Unicore becomes as described in Appendix E. 9

3 Data Management 3.1 SRM/dCache Resource providers deploying SRM/dCache are advised to use the following ports in their configuration. Host Service Port Modification to default settings GRIS 2135 No dcache SE GridFTP 2811 Range 20000-25000 No Yes SRMv1 8443 No Table 4: SRM/dCache port configuration With the above recommendations in place the firewall configuration for SRM/dCache becomes as described in Appendix F. Deployment of SRM/dCache should be performed configuring the data management services as depicted in Figure 4, i.e.: Install dcache SE on one single host. Solid lines represent connections between the involved parties. Communications with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Resource Provider Storage Pool dcache SE Firewall 2135, 2811, 8443, 20000-25000 Internet Figure 4: SRM/dCache recommended deployment at resource providers To adjust the standard SRM/dCache installation to the specific D-Grid recommendations the following change must be applied: Set the controllable ephemeral port range to the interval 20000-25000. 10

Controllable Ephemeral Port Range Preliminary operational experience with the Globus Toolkit shows that approximately 20 ports per expected simultaneous user on a given host should be provided. Given an average amount of 250 simultaneous active D-Grid users, the controllable ephemeral port range is in the order of 5000 ports. The environment variable GLOBUS_TCP_PORT_RANGE restricts the ephemeral ports to a specific range. The value of this variable should be formatted as min,max (comma separated values). Setting this environment variable in all SRM/dCache affected components is achieved through the following procedure: 1. Configuration of GT libraries. 2. Configuration of GridFTP. Appendix B describes with details how to set the port range to the interval 20000 25000. 3.2 OGSA-DAI Resource providers deploying OGSA-DAI software are advised to use the following port in their configuration. Host Service Port (TCP) Modification to default settings OGSA-DAI WSRF - DAI 8443 No Table 5: OGSA-DAI port configuration With the above recommendations in place the firewall configuration for SRM/dCache becomes as described in Appendix F. Deployment of OGSA-DAI software should be performed configuring the data management services as depicted in Figure 5, i.e.: Install OGSA-DAI components on one single host. Solid lines represent connections between the involved parties. Communications with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Resource Provider Database OGSA-DAI Firewall 8443 Internet Figure 5: OGSA-DAI recommended deployment at resource providers 11

No additional configuration is required to adjust the standard OGSA-DAI installation to the specific D- Grid recommendations. 12

4 s 4.1 LCG/gLite WN Resource providers deploying LCG/gLite WN software are advised to use the following ports in their configuration. Host Service Port (TCP) Modification to default settings WN GridFTP Range 20000-25000 Yes Table 6: LCG/gLite WN port configuration With the above recommendations in place the firewall configuration for the s becomes as described in Appendix D. Deployment of the s in D-Grid should be performed configuring the software as depicted in Figure 6, i.e.: Install the LCG/gLite WN package on all batch system nodes. Install the OGSA-DAI client package on all batch system nodes. Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Enabling connections directed to the WNs is actually optional and each resource provider is free to decide whether to allow it or not. When incoming connections are forbidden the GridFTP client installed in the WN can work only in single-stream mode. Performance of data transfer operations between WNs and SEs may therefore be negatively affected. Resource Provider... Batch System Master Firewall 20000-25000 Internet Figure 6: LCG/gLite WN recommended deployment at resource providers To adjust the standard LCG/gLite installation to the specific D-Grid recommendations the following change must be applied: Set the controllable ephemeral port range to the interval 20000-25000. 13

Controllable Ephemeral Port Range Preliminary operational experience with the Globus Toolkit shows that approximately 20 ports per expected simultaneous user on a given host should be provided. Given an average amount of 250 simultaneous active D-Grid users, the controllable ephemeral port range is in the order of 5000 ports. The environment variable GLOBUS_TCP_PORT_RANGE restricts the ephemeral ports to a specific range. The value of this variable should be formatted as min,max (comma separated values). Setting this environment variable in all LCG/gLite affected components is achieved through the following procedure: 1. Configuration of GT libraries. Appendix B describes with details how to set the port range to the interval 20000 25000. 14

5 Login nodes 5.1 LCG/gLite User Interface Resource providers deploying a User Interface are advised to use the following ports in their configuration. Host Service Port (TCP) Modification to default settings UI SSH 22 No GridFTP Range 20000-25000 Yes Table 7: User Interface port configuration With the above recommendations in place the firewall configuration for the LCG/gLite UI becomes as described in Appendix D. Deployment of the UI should be performed configuring the middleware services as depicted in Figure 7, i.e.: Install the LCG/gLite UI package on one single host. Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Resource Provider UI Firewall 22, 20000-25000 Internet Figure 7: User Interface recommended deployment at resource providers To adjust the standard LCG/gLite UI installation to the specific D-Grid recommendations the following change must be applied: Set the controllable ephemeral port range to the interval 20000-25000. Controllable Ephemeral Port Range Preliminary operational experience with the Globus Toolkit shows that approximately 20 ports per expected simultaneous user on a given host should be provided. Given an average amount of 250 simultaneous active D-Grid users, the controllable ephemeral port range is in the order of 5000 ports. The environment variable GLOBUS_TCP_PORT_RANGE restricts the ephemeral ports to a specific range. The value of this variable should be formatted as min,max (comma separated values). Setting 15

this environment variable in all LCG/gLite affected components is achieved through the following procedure: 1. Configuration of GT libraries. Appendix B describes with details how to set the port range to the interval 20000 25000. 5.2 Interactive Node Resource providers deploying an interactive node for code development and testing are advised to use the following ports in their configuration. Host Service Port (TCP) Modification to default settings Interactive node UNICORE-SSH 22 No GSI-SSH 2222 Yes Table 8: Interactive node port configuration With the above recommendations in place the firewall configuration for the interactive node becomes as described in Appendix G. Deployment of the interactive node should be performed configuring the middleware services as depicted in Figure 8, i.e.: Install GSI-SSH on one single host. Enable UNICORE-SSH on the same host. Solid lines represent connections between the involved parties. Communication with external entities is displayed on the right side of the figure, where ports to be enabled for incoming connections through the firewall are also indicated. Resource Provider Interactive Firewall 22, 2222 Internet Figure 8: Interactive node recommended deployment at resource providers To adjust the standard interactive node installation to the specific D-Grid recommendations the following change must be applied: Set the port used by the GSI-SSH server to 2222/tcp. 16

GSI-SSH The GSI-SSH server runs by default on port 22/tcp. The same port is used also for normal SSH connection. In order to separate the traffic of the two services it is recommend using port 2222/tcp for the GSI-SSH server. Assuming a GSI-SSH server is already installed and running, performing the following steps allows changing its port to the recommended value 2222/tcp: 1. Edit the file $GLOBUS_LOCATION/etc/ssh/sshd_config and set Port=2222 2. Edit the file /etc/services and insert a new line gsisshd 2222/tcp 3. Restart the gsisshd daemon. 17

6 Registration of Grid Services To improve the overall security level of the Grid resources managed by a provider it is highly beneficial to know the IP addresses (or IP sub-networks) of all hosts deploying middleware services in D-Grid. All installations should be registered in a central directory. This information would allow the enforcement of rigorous firewall rules, minimizing the risk of external attacks and intrusions. The firewall located at the border of the resource provider network should allow incoming connections only when all the following criteria are satisfied: The source IP address is registered in the central directory. The destination IP address matches an internal host running a middleware service. The destination port either is a well-known port or is within the recommended TCP controllable range 20000 25000. Directory service The availability of a directory service holding the IP addresses (IP sub-networks) of all hosts deploying middleware components is a key element for the enforcement of optimal, strict firewall rules. The administration and management of this service should be centralized in one single institute. The directory should be constantly accessible online and should offer a notification service to inform interested people about insertions/deletions/modifications of the list. Entries in the directory should contain at least the following information: Fully Qualified Domain Name IP address DN of host certificate (when available) Institute Set of Grid services running on the host Email address of system administrator Telephone number of system administrator Email address of security administrator Telephone number of security administrator 18

References [Ber06] S.van den Berghe, Using the NJS and TSI (V4), March 2006 http://www.unicore.eu/documentation/manuals/unicore5/files/njs_tsi_manual.pdf [DGI-BeKo] D-Grid DGI, Betriebskonzept für die D-Grid Infrastrktur, October 2007 http://www.d-grid.de/fileadmin/user_upload/documents/kern-d- Grid/Betriebskonzept/D-Grid-Betriebskonzept.pdf [Wel06] V.Welch. Globus Toolkit Firewall Requirements. Version 9, October 2006 http://www.globus.org/toolkit/security/firewalls/globus-firewall-requirements-9.pdf 19

Appendix A: Controlling the ephemeral port range in GT4 [Wel06] Configuration of WS-GRAM The recommended way to configure the controllable ephemeral port range for WS-GRAM is through modification of the start-stop script file. Edit the file $GLOBUS_LOCATION/start-stop and add one environment variable: export GLOBUS_TCP_PORT_RANGE=20000,25000 Configuration of GridFTP The recommended way to configure the controllable ephemeral port range for GridFTP is through modification of the xinet daemon. Edit the file /etc/xinetd.d/gridftp and add one env line: env += GLOBUS_TCP_PORT_RANGE=20000,25000 Configuration of C libraries, client applications and services Edit the file /etc/profile and insert a new line: export GLOBUS_TCP_PORT_RANGE=20000,25000 Configuration of Java libraries, client applications and services The Java System Property org.globus.tcp.port.range controls the ephemeral port range. There are three alternative ways to configure it: 1. Edit the file ~/.globus/cog.properties and insert a new line: tcp.port.range=20000,25000 This is the recommended method, since all Java libraries automatically read this value. 2. Pass the value on the command line: % java Dorg.globus.tcp.port.range=20000,25000 3. Specify the value directly in the application: System.setProperty( tcp.port.range, 20000,25000 ) 20

Appendix B: Controlling the ephemeral port range in LCG/gLite and SRM/dCache [Wel06] Configuration of the GT libraries Edit the file /etc/profile and insert a new line: export GLOBUS_TCP_PORT_RANGE=20000,25000 Configuration of GRAM Gatekeeper and JobManager There are four alternative ways to configure GRAM Gatekeeper and Job-Manager: 1. Modify the glite configuration file. (replace $GLITE_LOCATION with its actual path) Edit the file $GLITE_LOCATION/etc/globus-job-manager.conf and add one line: -globus-tcp-port-range "20000 25000" 2. Use a wrapper script. (replace $GLOBUS_LOCATION with its actual path): % mv $GLOBUS_LOCATION/libexec/globus-job-manager \ $GLOBUS_LOCATION/libexec/globus-job-manager.real % cat > $GLOBUS_LOCATION/libexec/globus-job-manager #!/bin/sh GLOBUS_TCP_PORT_RANGE=20000,25000 export GLOBUS_TCP_PORT_RANGE exec $GLOBUS_LOCATION/libexec/globus-job-manager.real $@ ^D % chmod 755 $GLOBUS_LOCATION/libexec/globus-job-manager 3. Modify the xinet daemon. Edit the file /etc/xinetd.d/globus-gatekeeper and add one env line: (replace $GLOBUS_LOCATION with its actual path): service globus-gatekeeper { } socket_type = stream protocol = tcp wait = no user = root server = $GLOBUS_LOCATION/sbin/globus-gatekeeper server_args = conf $GLOBUS_LOCATION/etc/globus-gatekeeper.conf disable = no env += GLOBUS_TCP_PORT_RANGE=20000,25000 21

4. Modify the inet daemon. Change the line in the file inetd.conf that starts the Gatekeeper. (replace $GLOBUS_LOCATION with its actual path): gatekeeper stream tcp nowait root \ /bin/env env GLOBUS_TCP_PORT_RANGE=20000,25000 \ $GLOBUS_LOCATION/sbin/globus-gatekeeper conf \ $GLOBUS_LOCATION/etc/globus-gatekeeper.conf Configuration of GridFTP There are two alternative ways to configure GridFTP: 1. Modify the xinet daemon. Edit the file /etc/xinetd.d/gsiftp and add a env line: (replace $GLOBUS_LOCATION with its actual path): service gsiftp { } socket_type = stream protocol = tcp wait = no user = root server = $GLOBUS_LOCATION/sbin/in.ftpd server_args = l -a disable = no env += GLOBUS_TCP_PORT_RANGE=20000,25000 2. Modify the inet daemon. Change the line in the file inetd.conf that starts the GridFTP server. (replace $GLOBUS_LOCATION with its actual path): gsiftp stream tcp nowait root \ /bin/env env GLOBUS_TCP_PORT_RANGE=20000,25000 \ $GLOBUS_LOCATION/sbin/in.ftpd l a 22

Appendix C: Firewall filtering rules configuration for Globus Toolkit 4 This table describes the incoming network connections for service nodes running Globus Toolkit 4, when all resource providers implement the recommended configuration. C = Controllable Ephemeral Port Range: 20000-25000. This port range is locally configurable using the GLOBUS_TCP_PORT_RANGE environment variable and the Java System Property org.globus.tcp.port.range. Node GRAM + MDS + RFT Service Source Destination Host Port (TCP) Host Port (TCP) WS-GRAM (job submission) any UI * Localhost 8443 WS-GRAM (job management) any UI * Localhost C WS-MDS External clients * Localhost 8443 GridFTP control External clients C Localhost 2811 GridFTP data (single channel) External clients C Localhost C GridFTP data (multiple channel) External clients C Localhost C RFT any UI, WN * Localhost 8443 23

Appendix D: Firewall filtering rules configuration for LCG/gLite This table describes the incoming network connections for service nodes running LCG/gLite, when all resource providers implement the recommended configuration. C = Controllable Ephemeral Port Range: 20000-25000. This port range is locally configurable using the GLOBUS_TCP_PORT_RANGE environment variable. Node LCG CE + MON + Site-BDII Service Source Destination Host Port (TCP) Host Port (TCP) GRAM Gatekeeper any RB C Localhost 2119 GRAM JobManager any RB C Localhost C BDII (LDAP) any BDII, RB, UI, WN * Localhost 2170 GridFTP control any UI, CE, SE, WN C Localhost 2811 GridFTP data (single channel) any UI, CE, SE, WN C Localhost C GridFTP data (multiple channel) any UI, CE, SE, WN C Localhost C RGMA MON Information Catalogue, any MON * Localhost 8443 GridFTP data (multiple channel) any SE C Localhost C UI SSH Any Host * Localhost 22 GridFTP data (multiple channel) any WMS, CE, DPM C Localhost C 24

Appendix E: Firewall filtering rules configuration for Unicore This table describes the incoming network connections for service nodes running Unicore, when all resource providers implement the recommended configuration. Node NJS + TSI + UUDB NJS Service Source Destination Host Port (TCP) Host Port (TCP) UNICORE Gateways: iwrunicore.fzk.de * Localhost 1128 zam177.zam.kfa-juelich.de 25

Appendix F: Firewall filtering rules configuration for SRM/dCache and OGSA-DAI This table describes the incoming and outgoing network connections for service nodes running SRM/dCache and OGSA-DAI, when all resource providers implement the recommended configuration. C = Controllable Ephemeral Port Range: 20000-25000. This port range is locally configurable using the GLOBUS_TCP_PORT_RANGE environment variable. dcache Node Service Source Destination Host Port (TCP) Host Port (TCP) GRIS (LDAP) any BDII, RB, UI, CE, SE, WN * Localhost 2135 GridFTP control any UI, CE, SE, WN C Localhost 2811 GridFTP data (single channel) any UI, CE, SE, WN C Localhost C GridFTP data (multiple channel) any UI, CE, SE, WN C Localhost C SRMv1 any UI, WN, SE * Localhost 8443 OGSA-DAI WSRF - DAI any UI, WN * Localhost 8443 26

Appendix G: Firewall filtering rules configuration for the interactive node for development and testing This table describes the incoming and outgoing network connections for interactive node for code development and testing, when all resource providers implement the recommended configuration. Node Interactive node Service Source Destination Host Port (TCP) Host Port (TCP) SSH Any Host * Localhost 22 GSI-SSH Any UI * Localhost 2222 27