Choose timezone
Your profile timezone:
Joint Security Policy Group meeting (9 and 10 October 2008)
→
Europe/Zurich
Various (CERN)
Various
CERN
Description
Meeting of the joint WLCG/EGEE security policy group.
Phone conference
Call +41227676000
Access code: 0133055
JSPG meeting (http://indico.cern.ch/conferenceDisplay.py?confId=38223)
Thu Oct 9 2008
Attending: David, Denise, Oxana, Maria, Romain, Jim, Pal
Introductions and agenda review.
David presented News.
New volunteers to join the Group:
- Matthew Villian (UK NGS)
- Susanna from Poznan SC
- Fredrick Share (representing VOs)
David Myers is now the CERN security officer.
Denise is still helping us as a consultant.
Approval status of recently completed policy documents:
- VO operations policy
- Multi user pilot jobs
- Traceability/Logging
- CA Approval
WLCG MB approved all 4 policies.
EGEE TMB approved CA Approval and Traceability/Logging policies.
EGEE TMB used to be called TCG. PEB became AMB.
EGEE TMB had concerns about VO Op and Pilot Jobs policies.
VO Op:
Concern by "This document will be signed by authorized signatury."
Pilot Jobs:
Concern about mechanisms for site approval.
Concern about mechanisms for separating user jobs from Pilot jobs.
EGEE TMB approved VO Op and Pilot Jobs policies at the next meeting.
EGEE needs convering letters that describe how JSPG policy is implemented.
Thus: All 4 documents approved by EGEE TMB and WLCG MB.
Need a short document that describes the JSPG policy development process?
Policy coordination between production grids:
Infrastructure Policy Group (IPG) ad-hoc group setup in February for
the major production grids (OSG, TeraGrid, Naregi, EGEE, DEISA),
related to OGF Grid Interoperability Now (GIN) group. By invitation
only. IPG met first during Boston OGF meeting, then during Singapore
OGF meeting in September. David presented at the Singapore meeting
(slides on the agenda page). IPG interested in harmonization of
security policies. Each of the IPG participants submitted a summary
of their grid security policies before the Singapore meeting. Next
IPG meeting in OSG25 (March 2009).
JSPG future for EGI:
EGI blueprint describes an ongoing requirement for policy maintenance.
Grid-specific covering documents:
Example: EGEE Site Operations Policy.
https://edms.cern.ch/document/819783
We need a clear definition of roles that set who each policy applies to.
The EGEE Site Operations Policy document is very user unfriendly.
Can we produce the JSPG documents as templates that the Grid fills in?
Do we need a glossary?
How do we represent sections of the policy that should be filled in by
each implementing grid? Italics? Footnotes? MS Word change tracking?
Example: Grid Site Operations Policy (EGEESiteOperationsPolicy-v1.4a.doc)
(CERN-EDMS-819783).
We modified the Grid Site Operations Policy using italics for pieces
that can be modified by the implementing grid.
Fredric joined.
Maria presented input to VOMS/VOMS Admin/VOMRS requirements:
VOMRS Workshop 21-24 October 2008:
http://indico.cern.ch/conferenceDisplay.py?confId=42799
Goal: Convergence of VOMRS and VOMS Admin.
Major changes from VOMS Admin 1.5 to 2.0 interface.
VOMRS Functionality questionnaire was sent in July.
Responses only from D0 and a German VO.
Add functionality from VOMRS into VOMS Admin, such as:
- show AUP to users
- periodically expire memberships
FNAL's ongoing support of VOMRS is limited: maintenance only.
EGEE SCG should discuss issues regarding VOMS Admin support.
What would we like to see added to VOMS Admin?
- Registering Robot certificates. This should already just work?
Fredric presented VO questionnaire results (VO_Surveys_EGEE08.pdf).
EUGridPMA AuthZ working group is looking at minimum requirements for
the secure operation of VOMS servers.
We should encourage NGIs to run VOMS servers on behalf of the VO.
Models for VO relationship with Grids:
In EGEE, VOs much manage users. VOs are asked for information they
don't have?
The VO has contact information for the users.
How do we address illegal use of grid systems?
Users need to know that they may be prosecuted for their actions.
Need the ability to traceback actions to the user.
The Grid AUP notifies users that they are liable.
The Top Level Security Policy also refers to illegal acivities being
reported to law enforcement agencies.
How do VOs validate requests for membership?
Current practice is a cause for concern.
VOs register with EGEE. Would a VO need to register separately with
each grid? Better to have VO register with home grid.
What VO info does the home grid need to share with other grids?
VO Registration Policy:
http://www.jspg.org/wiki/VO_Registration_Policy
See notes at:
http://www.jspg.org/wiki/Talk:VO_Registration_Policy#Oct_9_2008_JSPG_Meeting_Notes
VO Membership Management Policy:
http://www.jspg.org/wiki/VO_Membership_Management_Policy
See notes at:
http://www.jspg.org/wiki/Talk:VO_Membership_Management_Policy#Oct_9_2008_JSPG_Meeting_Notes
==================================================
Fri Oct 10 2008
Attending: Dave, Jim, Fredric, Romain, Denise, Christos (via phone),
David Groep (via phone)
Continued discussion of VO Membership Management Policy:
http://www.jspg.org/wiki/VO_Membership_Management_Policy
http://www.jspg.org/wiki/Talk:VO_Membership_Management_Policy
Discussion of Web Portal policy:
BiG Grid policy has been adopted but not widely discussed?
4 classes of portals.
Need a definition for "long-lived". Could use 1Ms definition used elsewhere.
MyProxy protocol sends a password over an SSL channel, so the
requirement on not sending re-usable private data in encrypted form
must be relaxed to support MyProxy.
"Keep enough information" -> "persistently keep"? "audit logs"?
Refer to audit/logging policy.
Is the portal resource provider (site) or a VO?
Can we re-use the existing VO and site policies?
Need to reference the multi-user pilot job policy.
David Groep will send around a new version of this document.
Discussion of Data Privacy issues:
VOs want user-level accounting.
Apple accounting mechanism is capable of storing user DN.
Sites were refusing to transfer user-level accounting info to central
database for user privacy reasons.
Report job-level accounting and VO resource brokers could map from
jobs to users?
EGEE/LCG sites analyze logs and encrypt user DN before transmitting
user-level accounting, encrypted with public key of accounting service.
Can't match encrypted DNs due to salts.
Everyone can see per-VO data. VO members can see VO groups/roles.
VO resource managers can see the users.
Publishing data enables peer monitoring.
Privacy Policy documents: EDMS 840299 & 855382
https://edms.cern.ch/document/1978755492/1
Current policy draft is based on informing the users and obtaining
their consent, but if it's not optional for use of resources, this is
more like a contractual requirement.
The EGEE Security Team doesn't use accounting information, but would
like to.
The OSG Security Team does use accounting information for incident
investigations.
OSG draft privacy policy:
http://osg-docdb.opensciencegrid.org/cgi-bin/ShowDocument?docid=741
TeraGrid draft privacy policy:
http://www.teragridforum.org/mediawiki/index.php?title=Privacy_Policy
Discussed recently by academic federations in Europe:
http://www.terena.org/activities/tf-emc2/ecam/docs/FAMfinal.doc
In US InCommon Federation, member Universities sign a binding
contract/agreement, in contrast to US grids which are not legal
entities strictly speaking.
Proposed next face-to-face meeting date: Jan 22-23 (CERN).
There are minutes attached to this event.
Show them.