618
M. Delfino
14.3.1 Authentication and User Identification
The machinery behind authentication and user identification is often poorly understood by users, which leads to usage and security problems. It is important to gain
an understanding of the basic concepts, especially as more complex distributed
environments, such as Grids and Clouds (see sections below), have come into
widespread use.
A number of Information servers are deployed to integrate individual computers
to form a cluster. 15 The most crucial ones are the ones that generate a single,
coherent, security domain. 16 Security under Linux and most other operating systems
is based on the concept of an “account” which, ideally, is used exclusively by a
single trusted individual. An account is represented externally by an alphanumeric
string (the “username”) and internally by a numeric code (the userid or uid).
Although modern operating systems allow very long usernames, local restrictions
may apply in order to maintain compatibility with older system software and utilities
(the most common restriction is a maximum length of eight characters). Each
account is associated to specific directives (called “rights” or “privileges”) to allow
or disallow access to operating system services, and can also be used to control
access to files and other resources directly or via Access Control Lists (“ACL”).
Since people often work in teams, it is useful to associate an account with a “group”
named by an alphanumeric string and represented internally by a numeric code (the
groupid or gid). Certain rights and, very importantly, file access control can thus be
quickly managed for all accounts belonging to a group.
The process of authentication involves an exchange of credentials which establishes the identity of the user wanting to access a system which results in the
creation of a process running under the corresponding uid. Authentication has been
traditionally accomplished by a “password”, an alphanumeric string which, ideally,
is known only to the individual owner of an account. Password related issues are
major contributors to computer security problems. Practically all computers are
nowadays connected directly or indirectly to the Internet. An inherent weakness
of a cluster (which is more than compensated by the gained functionality) is that
having a single security domain means that gaining access to any component of
the cluster grants access to all of it. The components of clusters directly connected
to the Internet are under constant attacks, the most common being automated
attempts to guess passwords (usernames are easily obtained from public information
sources, such as Web pages listing email addresses). Attacks from within the
cluster must also be considered, especially in clusters with many accounts. A
15 The term Information server is used in a broad manner. For example, Domain Name Service
(DNS) servers which translate alphabetic Internet addresses to numerical, and Network Time
servers which ensure all cluster elements have their clocks synchronized, are considered Information servers.
16 The actual implementation is a highly technical matter, using NIS, ldap, Microsoft Active
Directory or other secure database sharing schemes.
M. Delfino
14.3.1 Authentication and User Identification
The machinery behind authentication and user identification is often poorly understood by users, which leads to usage and security problems. It is important to gain
an understanding of the basic concepts, especially as more complex distributed
environments, such as Grids and Clouds (see sections below), have come into
widespread use.
A number of Information servers are deployed to integrate individual computers
to form a cluster. 15 The most crucial ones are the ones that generate a single,
coherent, security domain. 16 Security under Linux and most other operating systems
is based on the concept of an “account” which, ideally, is used exclusively by a
single trusted individual. An account is represented externally by an alphanumeric
string (the “username”) and internally by a numeric code (the userid or uid).
Although modern operating systems allow very long usernames, local restrictions
may apply in order to maintain compatibility with older system software and utilities
(the most common restriction is a maximum length of eight characters). Each
account is associated to specific directives (called “rights” or “privileges”) to allow
or disallow access to operating system services, and can also be used to control
access to files and other resources directly or via Access Control Lists (“ACL”).
Since people often work in teams, it is useful to associate an account with a “group”
named by an alphanumeric string and represented internally by a numeric code (the
groupid or gid). Certain rights and, very importantly, file access control can thus be
quickly managed for all accounts belonging to a group.
The process of authentication involves an exchange of credentials which establishes the identity of the user wanting to access a system which results in the
creation of a process running under the corresponding uid. Authentication has been
traditionally accomplished by a “password”, an alphanumeric string which, ideally,
is known only to the individual owner of an account. Password related issues are
major contributors to computer security problems. Practically all computers are
nowadays connected directly or indirectly to the Internet. An inherent weakness
of a cluster (which is more than compensated by the gained functionality) is that
having a single security domain means that gaining access to any component of
the cluster grants access to all of it. The components of clusters directly connected
to the Internet are under constant attacks, the most common being automated
attempts to guess passwords (usernames are easily obtained from public information
sources, such as Web pages listing email addresses). Attacks from within the
cluster must also be considered, especially in clusters with many accounts. A
15 The term Information server is used in a broad manner. For example, Domain Name Service
(DNS) servers which translate alphabetic Internet addresses to numerical, and Network Time
servers which ensure all cluster elements have their clocks synchronized, are considered Information servers.
16 The actual implementation is a highly technical matter, using NIS, ldap, Microsoft Active
Directory or other secure database sharing schemes.