CDA SC510 Guia do Utilizador descarregar pdf (Página 22)

IST-033576 D2.1.4

Signature ok

subject=/C=FR/ST=Bretagne/L=Rennes/O=INRIA/OU=IRISA/CN=Yvon Jego

u/emailAddress=Yvon.Jegou-at-irisa.fr/CN=28216

Getting CA Private Key

Enter pass phrase for security/XtreemOS-Yvon/Yvon-key.pem:

success in creating proxy

cmd --> 3

---- 3. Set attributes in proxy -----

Input proxy: .xos/firstproxy.pem

Input attributes: /VO=xtreemos/ROLE=admin

Generating RSA private key, 512 bit long modulus

..........++++++++++++

.++++++++++++

success to set proxy

cmd --> 0

yjegou:

In this prototype, the user adds attributes to his proxy certiﬁcate. This pro-

cedure is insecure as these attributes can be used as credentials when evaluating

policies. In the ﬁnal version, attributes will be managed by the certiﬁcate distribu-

tion authority (CDA), and the certiﬁcate validation process should check that no

extra attribute can be added.

3.4 PAM conﬁguration

3.4.1 Checking the pam_xos.so PAM plugin using pam_app_conv

The pam_app_conv utility, when run as root, logs a user in an XtreemOS box

using his proxy certiﬁcate.

pam_app_conv conﬁguration ﬁle: The pam_app_conv conﬁguration ﬁle

located in the /etc/pam.d/ should contain the following references to the

pam_xos plugin.

root: cat /etc/pam.d/pam_app_conv

auth sufficient /usr/local/lib/pam_xos.so -d

account sufficient /usr/local/lib/pam_xos.so -d

session sufficient /usr/local/lib/pam_xos.so -d

root:

The “-d” option to pam_xos.so enables tracing of the plugin during the

tests.

XtreemOS–Integrated Project 20/49

1 2 ... 17 18 19 20 21 22 23 24 25 26 27 ... 50 51

Sem comentários

CDA SC510 Guia do Utilizador Página 22