Scalla: Extended Features Supplement

Authentication & Access Control

Configuration Reference

Gerardo Ganis, CERN

Andrew Hanushevsky, SLAC

8-January-2008

Scalla: Structured Cluster Architecture for Low Latency Access

©2005-2008 by the Board of Trustees of the Leland Stanford, Jr., University

All Rights Reserved

Produced under contract DE-AC02-76-SFO0515 with the Department of Energy

This code is available under a BSD-style license allowing minimally restricted use.

1 Introduction. 5

1.1 Client/Server Authentication. 6

1.2 Server Authorization. 7

2 Authentication Configuration. 9

2.1 protbind. 9

2.2 protocol 11

2.2.1 protocol (gsi) 13

2.2.1.1 Configuring GSI Security. 16

2.2.1.2 xrdgsiproxy. 19

2.2.2 protocol (host) 21

2.2.3 protocol (krb4) 23

2.2.3.1 Configuring Kerberos IV Security. 24

2.2.4 protocol (krb5) 25

2.2.4.1 Configuring Kerberos V Security. 26

2.2.5 protocol (pwd) 27

2.2.5.1 Configuring pwd Security. 30

2.2.5.2 xrdpwdadmin. 33

2.2.6 protocol (unix) 36

2.3 protparm.. 37

3 Default Authorization Configuration. 39

3.1 audit 39

3.2 authdb. 40

3.3 authrefresh. 41

3.4 gidlifetime. 42

3.5 gidretran. 43

3.6 nisdomain. 44

3.7 pgo. 45

4 Authorization Database File. 47

4.1 Default Authorization Database Record. 48

4.1.1 Default Privileges. 50

4.1.2 User Fungible Capabilities. 50