EMI Hydra Service Reference Card

Service Reference Card (Hydra Service 3.2.1 for EMI-2)

• Functional description: Stores encryption key fragments over many services.
• Services running:
  • Java application org.glite.data.hydra.helpers.HydraContextListener
• Init scripts and options:
  • service tomcat5 {start|stop|status|restart}
• Configuration files location with example:
  • Config directory: /etc/hydra-service/
  • Template: hydra example configuration file
  • Logging directory: /var/log/tomcat5/
    • Logging configuration: = XXX =
• Open ports:
  • Service port: *:8443
• Possible unit test of the service: None
• Where is service state held (and can it be rebuilt): mysql database. User name and password has been specified in the YAIM configuration file already.
• Cron jobs: None
• Security information
  • Access control mechanism (authentication & authorization):
    • Authentication: SSL/TLS client authentication on the service port
    • Authorization: Configured in the configuration file (subject DN and/or VOMS attributes)
  • How to block/ban a user
    • Not supported, except via certificate revocation
  • Network Usage
    • TCP traffic to the service port, outgoing TCP traffic to the online CA, attribute authority and possibly audit database.
  • Firewall configuration
    • The service port should be open for TCP traffic.
  • Security recommendations
  • Security incompatibilities
  • List of externals (packages are NOT maintained by Red Hat)
  • Other security relevant comments
• Utility scripts: None
• Location of reference documentation for users:
  • Configuration: https://twiki.cern.ch/twiki/bin/view/EMI/HydraClientConfiguration
  • User Guide: https://twiki.cern.ch/twiki/bin/view/EGEE/DMEDS
• Location of reference documentation for administrators:
  • Configuration: https://twiki.cern.ch/twiki/bin/view/EMI/HydraServerConfiguration
  • Operation: https://twiki.cern.ch/twiki/bin/view/EMI/HydraServerOperation

-- JohnWhite - 06-Jul-2012