wiki:TI12_Security/Security0612

Version 2 (modified by pjkersha, 13 years ago) (diff)

--

Security Status December 2006

Highlights

  • Web service interface working between WebSphere? and Python using WS-Security
    • Using digital signature
    • confidentiality using SSL - easier than getting WS-Security encryption working between WebSphere and python
    • Although the WS-Secuirty standard is established the tooling has not reached full maturity. With WebSphere?, you can do most of what you want but it is a subset of the full standard.
  • Carried out a major update of python web services from ZSI version 1.6 to 2.0 rc3. This includes using doc/literal wrapped style WSDL. Also, now using Twisted resource framework for python web server.

DEWS Security Critical Path and resource allocation (applicable to NDG also)

  1. WS-Security WebSphere? - Python interface (Done)
  2. Securing Geoserver. While we expect this work to be done at the Met Office (in cooperation with ESSC), we expect to be providing consultancy on the token signature evaluation etc and coordinating the work (2 days effort)

3.Update security WS interfaces for Session Manager, Attribute Authority and Simple CA. NB: Attribute Authority and SimpleCA code is part complete. (10 days effort, 12 total). 1.re-write of rpc encoded WSDLs to wrapped/doc/literal style 2.move previous ZSI 1.6 based code to ZSI 2.0 rc3 3.remove custom pyXMLSec based message security and replace with new WS-Security handler 4.Refactor pyXMLSec digital signature. This is used in for signing WS messages but ALSO for signing Attribute Certificates. Attribute Certificates are signed using an enveloped signature independently of being sent over the wire via a WS. (3 days effort, 15 total) Two alternatives: 1.Refactor signature code removing pyXMLSec code and replacing with new signature code as used with WS-Security signature handler 2.Dispense with enveloped signature for Attribute Certificates and rely on signature applied by WS-Security handler at the point of message dispatch Option 1) is preferred to ensure independence of transport layer. 5.MyProxy? pure python client. Python code to connect to myproxy-server over SSL using M2Crypto and implement the various commands needed: myproxy-logon, myproxy-store, myproxy-destroy. Current status: working MyProxy? store method working. (3 days, 18 total). 1.complete MyProxy? logon method 2.Write MyProxy? destroy method (removes a credential from repository) 6.Oracle Attribute Authority interface for the Python Attribute Authority (to be based on code developed within NDG at BODC). (1 day, 19 total). 1.Take Siva's code used for BODC Oracle interface and use for LostWax? Attribute Authority 7.Install Security at the MetOffice? and Lost Wax (and possible ESSC too). Go to sites to install or revise installation guide so that it can be done unsupervised. (5 days, 23 total). 1.MetOffice? - install Attribute Authority. (Note that no MyProxy? is needed for DEWS at this stage). 2.LostWax? - install Attribute Authority, Session Manager and MyProxy?. LostWax? have a target machine running Redhat available. 3.Establish what will happen at ESSC.

At this point we have 23 days work identified. Ideally however, we should have done the following before installing software, and we need to allow for a further 5 days of support for meetings etc.

8.Eggify security. Current status: security code is now separated into server, client, common and unit test packages. Ideally all the code components needed by clients (user clients and application clients) should be in easy to install packages. As many server components as possible should also be eggified, but it is recognised that until Twisted is eggified this may not be that useful. (5 days, 33 total). 1.Complete setup.py script for each package and overall setup.py to create individual eggs for client and server and overall egg to create whole bundle 2.Add scripting to create configuration files and installation location for the 3.Scripting to create security scripts for security bin directory (there's a standard egg way of doing this) 9.Auditing and Logging. Security will need to interact with the Lost Wax logging service. (5 days, 38 total). Note that this can be done after delivery of the security package and done as an update. 1.Interface with LostWax? logging service 2.Remaining documentation for auditing logging workpackage