Service Reference Card

Table of contents

• Functional Description
• Daemons Running
• Init scripts and options
• Configuration files location with example or template
• Logfile locations and other useful audit information
• Open ports
• Where is service state held (and can it be rebuilt)
• Cron jobs
• Security information
• Utility scripts
• Location of reference documentation for users and administrators

## Functional description

The Virtual Organization Membership Service (VOMS) is an attribute authority which serves as central repository for VO user authorization information, providing support for sorting users into group hierarchies, keeping track of their roles and other attributes in order to issue trusted attribute certificates and SAML assertions used in the Grid environment for authorization purposes.

VOMS is composed of two main components:

• the VOMS core service, which issues attribute certificates to authenticated clients
• the VOMS Admin service, which is used by VO manager to administer VOs and manage user membership details.

## Daemons running

The following daemons need to be running:

• voms-admin
• vomsd
• mysql (in case of MySQL is running directly on the VOMS server)

## Init scripts and options

/etc/init.d/voms (start|stop|restart)

/etc/init.d/voms-admin (start|stop|restart)

## Configuration files location with example or template

The configuration files for the VOMS service are located in:

• /etc/voms/
• /etc/voms-admin/

## Logfile locations and other useful audit information

The log files for VOMS can be found under */var/log/voms */var/log/voms-admin

## Open ports

A series of configurable ports (typically starting with the default 15000) for the voms and voms-admin server instances.

## Where is service state held (and can it be rebuilt)

The VOMS service state is kept in the VOMS database. Location and access information for the database can be found in the configuration files.

## Cron jobs

VOMS relies only on the fetch-crl cron job being active. There are no other VOMS specific cron jobs.

## Security information

Access control Mechanism description (authentication & authorization)

This node type has two interfaces. One for the administration where VO admins can add/remove users and assign VO Roles and a second one where the middleware applications ask for proxy signature. On both interfaces the authentication part is done via x509 authentication against the trusted CAs that are installed at the node. The authorization part is done via the VO roles that are assigned to the uses's DN.

How to block/ban a user

It is possible to fine tune access rules to the VOMS administrator services using Access Control Lists. See the VOMS Admin user's guide for more information on this. Note that however it is safe to leave read access on to any authenticated client, as this functionality it is still used to create gridmap files for some middleware components. The access to the proxy signature interface is limited to the users that are listed as active members to the VO. Removing a user from the VO, or suspending his membership, will block his/her ability to obtain a valid proxy signature from the VOMS server. See the VOMS Admin user's guide for more information on how to remove and suspend users in a VO.

Network Usage

Three services are running that need network access on this node-type.

• the MySQL server service. The server binds to the 3306/tcp port. Alternatively, Oracle may be used, which is usually run on a different node. Access to this node should be allowed.
• the voms-admin server which binds at one tcp port per VO (usually something like 15010/tcp)
• the vomsd server which binds to one tcp port per VO

Firewall configuration

The proposed firewall configuration is to deny access to anyhost/anyport and allow: 8443/tcp from everywhere (this is used for VO management (via x509 authentication) and gridmapfile creation) Any vomsd server configured port (i.e. 15010/tcp) from everywhere (this is used by users directly (from UIs or WNs) or indirectly (from WMSes)) Any other administration required port for the administration subnet/interface (i.e. 22/tcp (ssh))

Security recommendations

None.

Security incompatibilities

None.

List of externals (packages are NOT maintained by Red Hat)

All packages are present in either EPEL or RedHat repositories

Other security relevant comments

This node-type SHOULD NOT be co-located with any other node-type and should not allow shell access to users. Any connection other than the ones described above should be treated as suspicious.

## Utility scripts

• voms-admin (client & server side)
• voms-proxy-* (client side)
• voms-db-deploy.py (server side)
• voms-admin-configure (server side)

## Location of reference documentation for users and administrators

• VOMS documentation
• VOMS FAQ for service managers