TGQR 2010Q2 Report.pdf - Teragridforum.org

8.6.7 SDSC
SDSC put our Dash resource into production on April 1 for Startup allocations. Dash is
precursor experimental system for Gordon coming in 2011.
8.6.8 UC/ANL
The UChicago/Argonne RP has continued to host repo.teragrid.org, which includes the TeraGridwide
CVS repository.
8.7 GIG Operations
The GRAM5 usage collector software was updated on globus-usage.teragrid.org. Ongoing
support of MyProxy and Kerberos servers for TeraGrid at NCSA, the mail.teragrid.org server, as
well as the MyProxy, GSI-OpenSSH, and GSI-SSHTerm software used by TeraGrid continued.
This includes regular maintenance as well as addressing incoming support tickets. The CIC IDM
WG TeraGrid Pilot, worked with the TeraGrid Security WG to obtain sign-off on the Federated
IDM Security Incident Response Policy. After updating the policy to address the TG Security
WG's comments, the TG Security WG voted to approve the policy (8 in favor, 3 abstain). The
policy was also presented at the InCommon Campus Authentication & Middlware Planning
meeting on June 22, 2010.
8.8 Security
8.8.1 Security Working Group
Summary of Security Incidents: There were five compromised user accounts and two login node
compromises. A machine used by science gateway developers was compromised which lead to
other account credentials being captured. In some instances the attackers inserted unauthorized
SSH keys into users directories to allow alternate methods of access. The Incident Response
team has disabled all of the accounts involved and audited TeraGrid productions machines for the
known fraudulent SSHKeys. Securing Community Account
Revisited: Victor Hazlewood has been documenting community account usage on the TG.
Currently, documentation of the use cases for 22 science gateways is provided at Teragrid Forum
wiki Science Gateway Use Cases site
A summary of software used and security methods employed for the user accounts used at the
RPs is available in the Summary Table at this website. We are planning on setting up a meeting to
discuss community account management and implementation in the near future with Victor and
Nancy. Goal is to establish some standards or commonly accepted positions relating to
community accounts, for example: Community account cannot have an interactive shell session
on productions machines).
Accessing the community account information page: With the move of the Teragrid webserver to
LifeRay complete, the access control permissions for specific areas of the website needed to be
re-defined. The docs group contacted Jim Marsteller to ask who should have access to the science
gateway info page. Since this page is used to look up contact information for community
accounts, ever member of the incident response team requires access to this page. Jim supplied
the docs group the names of all of those on the TG security contact list so they have access.
Vetted/Unvetted Process Review: The Core2 working group team has been working on an
implementation document for Vetted & Unvetted TGUP accounts in order to move forward with
improving the account creation process with TGUP. The security working group was asked to
review the document and provide comments. Jim sent Maytal the security working group's
comments on May 35th. One of the major questions is whether the pops reconciliation process
will still have a TG staff member vetting the authenticity of a user generated account request.
88