Dynamic Firewalls and Service Deployment Models for Grid

Dynamic Firewalls and Service Deployment Models for Grid Environments Gian Luca Volpato, Christian Grimm RRZN – Leibniz Universität Hannover Cracow Grid Workshop 2006 (CGW 2006) 15 th-18 th October 2006

Overview Dynamic Firewall n General concepts n Dyna-Fire n Cooperative On-Demand Opening (CODO) n Limitations Globus Toolkit deployment model n Services at the Resource Provider n Use of existing computing infrastructure n Minimal number of connections through the site firewall Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 2

Firewall A Firewall is a piece of hardware and/or software which functions in a network environment to prevent some communications forbidden by the security policy. * Good: it blocks unwanted and malicious traffic. Bad: it might be not flexible enough to allow seamless execution of Grid applications. * Wikipedia Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 3

Dynamic Firewall Goal Protect a network so that it appears completely inaccessible from external systems but still responds to trusted clients, i. e. allow external connections on-demand. Current solutions Signaling protocol to add/remove filtering rules: § “Off-path”: communication between applications and firewalls § “In-path”: communication between application peers intercepted by intermediate firewalls Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 4

Dyna-Fire & Cooperative On-Demand Opening One daemon runs on the same host of the firewall to: n monitor all connection requests n add/remove filtering rules in the firewall A connection is allowed when the client request is successfully authenticated and authorized. Signaling protocol: n Dyna-Fire ==> messages carried by Port Knocking n CODO ==> messages carried over SSL channel Client Application 2 Server Application Daemon Library 1 Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 5 Intranet

Limitations of dynamic firewalls No mechanism to discover automatically the firewalls along the path n Signaling before connection establishment? n Static routing table configuration Dyna-Fire and Port Knocking n CPU overhead for monitoring of connection attempts n Exclusive reservation of some ports n Unidirectional protocol exposed to reply and man-in-the-middle attacks CODO n Applications (client and server!) must be recompiled/relinked with a special socket library n Authorization policy is coarse-grained and not flexible Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 6

Deployment model for Globus Toolkit 4 GRAM Server Batch System Master Local MDS-Index Batch System Nodes Grid. FTP Server Intranet RFT Server User Interface DMZ Constraints n Use existing batch computing resources n GT 4 services must be reachable from the Internet Goals n Avoid any connection between: ohosts in the Intranet and hosts in the external Internet n Identify, analyze and reduce the connections between: ohosts in the Intranet and GT services in the DMZ Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 7

Batch system GRAM Server Batch Sys. Login Node Batch System Master Batch System Nodes Intranet DMZ n Install Globus GRAM on a host that can submit jobs to the Batch System n Either: n Enable shared file system between this node and the Batch System n Modify GRAM scripts in order to use Batch System functions for file stage-in and file stage-out Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 8

Grid. FTP option 1 Grid. FTP Server Batch System Master Batch System Nodes Intranet DMZ n Grid. FTP server and Batch System have a shared file system n Input files are transferred to the local Grid. FTP server before jobs are submitted to the local GRAM server n Output files are stored in the local Grid. FTP server Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 9

Grid. FTP option 2 Grid. FTP Server Batch System Master Batch System Nodes Intranet DMZ n System nodes have direct access to the local Grid. FTP server n Input files are transferred to the local Grid. FTP server before jobs are submitted to the local GRAM server n Output files are uploaded to the local Grid. FTP server Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 10

Reliable File Transfer RFT Server GRAM Server Batch Sys. Login Node Batch System Master Batch System Nodes Grid. FTP Server Intranet DMZ n RFT server is installed on the same host where the GRAM server runs n Connections are established: n within the DMZ n between the DMZ and the external Internet Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 11

MDS RFT Server GRAM Server Batch Sys. Login Node Batch System Master Batch System Nodes Local MDS-Index Grid. FTP Server Intranet DMZ n Deploy one MDS-Index that collects monitoring information from all local GRAM and RFT servers (in future also Grid. FTP servers) n Connections are established: n within the DMZ n between the DMZ and the external Internet n Batch System Master and GRAM server (Ganglia, Nagios, etc. ) Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 12

User Interface RFT Server GRAM Server Batch Sys. Login Node Batch System Master Batch System Nodes Local MDS-Index Grid. FTP Server User Interface Intranet DMZ n The User Interface is used to submit/monitor/manage Grid jobs n Connections are established: n within the DMZ n between the DMZ and the external Internet Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 13

Full model RFT Server GRAM Server Batch Sys. Login Node Batch System Master Batch System Nodes Local MDS-Index Grid. FTP Server User Interface DMZ Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 14 Intranet Batch System Shared File System GRAM Grid. FTP RFT MDS User Interface

Summary Dynamic Firewall n General concepts n Dyna-Fire n Cooperative on Demand Opening (CODO) n Limitations Globus Toolkit deployment model n GT 4 services in DMZ n Use of existing computing infrastructure n Minimal number of connections through the firewall Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 15

Thank you! Questions? Regional Computing Centre for Lower Saxony Gian Luca Volpato | 16 -10 -2006 | Slide 16