Ad hoc meeting to discuss EASE, INF and prometheus
When: 14:00, Wednesday 26th February 2014
Where: IF-1.09
Who: George, Kenny, Toby
- Progress with the new EASE KDCs
- New EASE KDCs will run 1.12.something, compiled from source,
rather than a distribution's version.
- They're not in production yet. The aim is to convert TEST.EASE
around late-March, with EASE itself being moved a month or so later
all being well.
- Service-levels are still to be defined.
- 1DES will still be enabled at the upgrade, to minimise the number
of things being changed all at once. It'll be phased out as soon as
possible afterwards.
- Propagation from the master to the slaves currently takes a couple of
minutes or so. This doesn't really matter for EASE as most things are
actually done through the cosign servers which can be told to prefer
the master. It might make sense to adjust the DNS entries.
- Kenny has a patch to allow wildcards in principals in ACLs.
- Service and host principals will be devolved to Schools. It's
unlikely that any control over user principals would be devolved.
- Restarting kadmind is necessary when ACLs change. Current-EASE changes
these infrequently. It may be necesary to change them more often
with a devolved regime. Principals of the form "*/admin.inf" may be used
to reduce number of changes to ACLs.
- There are still some operational details to be worked out to do with
promoting slaves.
- Multi-factor user authentication is in the plan.
- Kenny will be talking about kdcregister at the
ITPF
UNIX day.
- Issues for Informatics
- It's unlikely that control over user principals will be devolved.
This would mean changes in the way some user-support tasks are organised.
It would also affect prometheus, which currently assumes it has full
access to these to create, modify, set policy or lock them out.
- User principals are actually created on the fly by a "registration"
web page, rather than being created automatically.
- Prometheus enumerates the user principals held by the KDCs, to compare
against its own (definitive) list. How this would work in the presence of
(lots of!) non-Informatics users and on-the-fly creation would need some
thought.
- Urgent user-admin tasks would still have to go through IS's
usual procedures.
- How would alternative-instance user principals work? We have a
number of these, for things like long-running jobs.
- How would our cosign interact?
- How does iFriend fit in? We have a separate FRIEND realm, so can
use it for non-web things. EASE friend uses the traditional (web-only)
back-end database.
- It should be possible to run AFS against a realm with a different
name. A total re-key might be needed though.
- We would need to reassess all AFS ACLs.
- KDCs would be off-site. It's most unlikely we would be given
one on-site KDC, let alone the one-per-site we have now.
- We could run INF as a separate realm on the EASE KDCs, but it's not
obvious what this would gain.
- This is likely not a complete list! We would want to try to
refine the list of pros and cons before coming to any conclusion.
- lcfg component
- General agreement that the existing component should really be split
into separate client-only and server components. Maybe as part of the
SL7 work??
- ... but beware of krb5.conf vs kdc.conf mixing.
- Kenny has several patches, which he'll pass on to Toby.
- George noted that
Russ Allbery's
krb5-strength module would need a "[plugins]" stanza to be added to
kdc.conf, along with the more general ability to decouple block and entry
names from the lcfg tag-list tags.
- We would probably freeze the Informatics component and schema
versions and resources, to allow Kenny's changes to go through without
the risk of things breaking for us.
- Toby will build and distribute RPMs with additional features, even
if Informatics don't actually use them for now.
Followup comments from Graeme
Some followup comments from Graeme:
"'Service-levels are still to be defined.'
is not true. The service levels are the same as now and are 24x7
continuous operation with 1st line support 24x7 and 2nd line support 9
to 5 on working days.
"Alternative instance principals could be provided using a web-form
registration process allowing anyone to create instances for their own
principal. This is on a to do list of mine but wasn't part of this
project but we can add it on as a deliverable or add it to a future
project e.g. FRIEND.EASE realm.
"KDCs are off their local LAN but not off-site. They are in the same
sites that Informatics currently have theirs as far as I am aware.
"I don't think I would be happy hosting their realm on our
infrastructure. I don't think that is much of a win for them and
doesn't gain us anything except an additional headache of having to
consult them every time we wanted to patch/update/redevelop or whatever.
"We should probably look at the krb5-strength module but we would need to
be careful that it was matching the guidance on the password change
pages."
$Id: 2014-02-26.html,v 1.17 2014/03/03 11:28:56 gdmr Exp $