Simple security and file copying/moving

[marcelkuri]

I want to apply the Simple (Unix) Security on my xrootd installation:
https://twiki.grid.iu.edu/bin/view/Documentation/Release3/InstallXrootd#Security_Option_1_Adding_Simple

But the users created folders that is not their username.
For example: the user johnsmith created a folder /data/xrootdfs/testfolder and copied some files to that folder.

If I apply the security the user johnsmith will not have access to that folder or files.

Questions: can the user create a folder with his username (/data/xrootdfs/johnsmith) and move the folder testfolder to it and preserve the ownership?
He can just use the 'mv' command?
Or he must copy the folder and just delete the original one?

Thanks in advance
Marcel

[abh3]

Hi Marcel,

All files and directories are owned by the xrootd process (i.e. the uid of that process). In order to provide access control you need to enable authorization and create an authorization file as described in the documentation you have referred to. Is the issue triggered because you want to use xrootd via a FUSE mount?

[marcelkuri]

I made a test with some spare machines.

I created the authorization file and give full permission to a user called xrootdadmin.

But xrootdadmin cannot move or delete the files in /data/xrootdfs/testfolder.

xrootdadmin can, however, copy the files.

We have some Terabytes of data and we want to apply the security without troubles.

Marcel.

[xrootd-dev]

You can have sort of 'standard' POSIX behaviour using this plug-in:

https://github.com/cern-eos/xrootd-auth-change-uid

This works on Linux and makes xrootd behave like an NFS server e.g. every
file system command behind the xrootd server is executed with the uid/gid
of the authenticated client.

To use it you have to use either UNIX, KRB5 or GSI authentication.

It can also be combined with the default AUTH library.

Cheers Andreas.

On Thu, Apr 23, 2015 at 8:19 PM, Marcel Kuriyama notifications@github.com
wrote:

I want to apply the Simple (Unix) Security on my xrootd installation:

https://twiki.grid.iu.edu/bin/view/Documentation/Release3/InstallXrootd#Security_Option_1_Adding_Simple

But the users created folders that is not their username.
For example: the user johnsmith created a folder /data/xrootdfs/testfolder
and copied some files to that folder.

If I apply the security the user johnsmith will not have access to that
folder or files.

Questions: can the user create a folder with his username
(/data/xrootdfs/johnsmith) and move the folder testfolder to it and
preserve the ownership?
He can just use the 'mv' command?
Or he must copy the folder and just delete the original one?

Thanks in advance
Marcel

—
Reply to this email directly or view it on GitHub
#230.

---

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1

[marcelkuri]

Andreas,

How to I get/install the file libAuthChangeFsUid.so? I don't know how to use the *.cmake file.

Thanks

Marcel

[xrootd-dev]

For XRootd 4.1. and Redhat6 you can download an RPM here:

http://eos.cern.ch/rpms/eos-diamond/slc-6-x86_64/xrootd-auth-change-uid-0.2.0-1.x86_64.rpm

Otherwise you have to get the source and compile.

You probably need the 'xrootd-devel' and 'xrootd-private-devel' RPM
installed or a full installation of XROOTD with 'make;make install'

git clone https://github.com/cern-eos/xrootd-auth-change-uid.git
cd xrootd-auth-change-uid
mkdir build
cd build
cmake ../ -DCMAKE_BUILD_TYPE=Debug
make
make install

Cheers Andreas.

On Fri, Apr 24, 2015 at 12:21 PM, Marcel Kuriyama notifications@github.com
wrote:

Andreas,

How to I get/install the file libAuthChangeFsUid.so?

Thanks

Marcel

—
Reply to this email directly or view it on GitHub
#230 (comment).

---

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1

[marcelkuri]

Thanks.
I get the rpm file and installed it.

I will do some tests now.

Marcel.

[marcelkuri]

Is there a 32 bits version of libAuthChangeFsUid.so?

The test machines are 32 bits.

Marcel

[xrootd-dev]

I just have built them:

http://eos.cern.ch/rpms/eos-diamond/slc-6-i386/xrootd-auth-change-uid-0.2.0-1.i686.rpm

Cheers Andreas.

On Fri, Apr 24, 2015 at 2:03 PM, Marcel Kuriyama notifications@github.com
wrote:

Is there a 32 bits version of libAuthChangeFsUid.so?

The test machines are 32 bits.

Marcel

—
Reply to this email directly or view it on GitHub
#230 (comment).

---

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1

[marcelkuri]

Andreas

The last rpm installed libAuthChangeFsUid.so on /usr/lib64, but the default place of a 32 bit machine is /usr/lib.

May I just copy/move this file from /usr/lib64 to /usr/lib?
Or I can use it where it is, just pointing to that folder?
[Edited] : I used the file but the xrootd didn't start, copying or pointing to lib64.

xrootd-clustered.cfg:
# ENABLE_SECURITY_BEGIN
xrootd.seclib /usr/lib/libAuthChangeFsUid.so

this specify that we use the 'unix' authentication module, additional one can be specified.

sec.protocol /usr/lib unix

this is the authorization file

acc.authdb /etc/xrootd/auth_file
ofs.authorize 1

ENABLE_SECURITY_END

Marcel

[xrootd-dev]

Ah sorry,
yes you can, we actually don't use 32bit platform anymore and I didn't
modify the spec file.

Cheers Andreas.

On Fri, Apr 24, 2015 at 2:22 PM, Marcel Kuriyama notifications@github.com
wrote:

Andreas

The last rpm installed libAuthChangeFsUid.so on /usr/lib64, but the
default place of a 32 bit machine is /usr/lib.

May I just copy/move this file from /usr/lib64 to /usr/lib?
Or I can use it where it is, just pointing to that folder?

Marcel

—
Reply to this email directly or view it on GitHub
#230 (comment).

---

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1

[marcelkuri]

I used the file but the xrootd didn't start.
My xrootd-clustered.cfg :

xrootd.seclib /usr/lib/libAuthChangeFsUid.so
sec.protocol /usr/lib unix
acc.authdb /etc/xrootd/auth_file
ofs.authorize 1

Marcel

[apeters1971]

You need this:

xrootd.seclib libXrdSec.so
ofs.authlib /usr/lib/libAuthChangeFsUid.so
sec.protocol /usr/lib unix
ofs.authorize 1

[marcelkuri]

Xrootd still don't start.

[apeters1971]

Can you post the log file of xrootd ...

[marcelkuri]

++++++ xrootd protocol initialization started.
=====> all.export /data/xrootdfs
=====> xrootd.seclib /usr/lib/libXrdSec-4.so
=====> all.pidpath /var/run/xrootd
Config exporting /data/xrootdfs
Plugin No such file or directory loading seclib /usr/lib/libXrdSec-4-4.so
Config Falling back to using /usr/lib/libXrdSec-4.so
Plugin loaded
++++++ Authentication system initialization started.
Plugin loaded
=====> sec.protocol /usr/lib unix
Config 1 authentication directives processed in /etc/xrootd/xrootd-clustered.cfg
------ Authentication system initialization completed.
Config Routing for rootserver1: local pub4 prv4
Config Route all4: rootserver1 Dest=[::143.107.130.70]:1094
++++++ File system initialization started.
=====> all.role server
=====> ofs.authlib /usr/lib/libAuthChangeFsUid.so
=====> ofs.authorize
++++++ Storage system initialization started.
=====> all.export /data/xrootdfs
=====> oss.localroot /data/xrootdfs
Config effective /etc/xrootd/xrootd-clustered.cfg oss configuration:
oss.alloc 0 0 0
oss.cachescan 600
oss.fdlimit 32768 65536
oss.maxsize 0
oss.localroot /data/xrootdfs
oss.trace 0
oss.xfr 1 deny 10800 keep 1200
oss.memfile off max 992954368
oss.defaults r/w nocheck nodread nomig norcreate nopurge nostage xattr
oss.path /data/xrootdfs r/w nocheck nodread nomig norcreate nopurge nostage xattr
------ Storage system initialization completed.
Plugin No such file or directory loading authlib /usr/lib/libAuthChangeFsUid-4.so
Config Falling back to using /usr/lib/libAuthChangeFsUid.so
Plugin No such file or directory loading authlib /usr/lib/libAuthChangeFsUid.so
Config Unable to load authlib plugin /usr/lib/libAuthChangeFsUid.so
++++++ Configuring server role. . .
=====> all.manager testnode3:1213
=====> all.adminpath /var/spool/xrootd
------ File system server initialization failed.
150424 10:55:23 4040 XrootdConfig: Unable to load file system.
------ xrootd protocol initialization failed.
150424 10:55:23 4040 XrdProtocol: Protocol xrootd could not be loaded
150424 10:55:23 4052 cms_Finder: Connected to cmsd via /var/spool/xrootd/.olb/olbd.admin
------ xrootd anon@rootserver1:-1 initialization failed.

[apeters1971]

It says:
Plugin No such file or directory loading authlib /usr/lib/libAuthChangeFsUid.so

Did you copy the library there?
If yes, run
ldd /usr/lib/libAuthChangeFsUid.so

Cheers Andreas.

[marcelkuri]

[root@xrootserver1 ~]# ldd /usr/lib/libAuthChangeFsUid.so
ldd: /usr/lib/libAuthChangeFsUid.so: No such file or directory

[root@xrootserver1 ~]# ls -l /usr/lib/libAuthchangeFsUid.so
-rwxr-xr-x 1 root root 18896 Apr 24 09:26 /usr/lib/libAuthchangeFsUid.so

As you can see, ls command show the file in the folder

[apeters1971]

Look:
/usr/lib/libAuthChangeFsUid.so
vs
/usr/lib/libAuthchangeFsUid.so

You have named it with lower case "change" ...

Cheers Andreas.

[marcelkuri]

Oh, that is it!
Strange. I just made a cp with autocompletion.

Well, it is working now. I will do some tests.

Thanks.

Marcel

[marcelkuri]

The primary tests are ok!

[ Before security implementation ]:
I logged as johnsmith user and created a folder testfolder, and a test file inside it.
After it I created a folder called johnsmith and moved the testfolder to the johnsmith folder.

[ After security implementation ]:
The user johnsmith could copy, move and delete the files and folders inside the johnsmith folder.

Thank you very much for the libAuthChangeFsUid.so suggestion.

Marcel

[marcelkuri]

Ops, other users can move and delete the files and folders inside the johnsmith folder.
It is not acceptable!
I want that only the owner of the folder has full permission over the files and folders inside the owner folder.

But, without the libAuthChangeFsUid.so neither the owner can delete his own files or folders.

[apeters1971]

Hmmm,
can you just show with "ls -l" the permissions in the folder you create and after you place a file there.

If you create a file with "johnsmith" ... is the file owned by johnsmith?
I just did a mini test and it works as expected, user A can not delete files of user B aso...

Cheers Andreas.

[marcelkuri]

ls -l
-rw-rw-rw- 1 xrootd xrootd 67 Apr 24 12:28 johntest1.txt
drwxrwxrwx 1 xrootd xrootd 4096 Apr 24 12:43 testefolder3
drwxrwxrwx 1 xrootd xrootd 4096 Apr 24 12:30 testpasta2
drwxrwxrwx 1 xrootd xrootd 4096 Apr 24 13:13 testpasta3

[marcelkuri]

All folders and files has ownership of xrootd user and group.
All users are in the "xrootd' group, if it matters.

[apeters1971]

Ah sorry,
I forgot something important .. it is the way the XROOTD startup script runs ... if you start XROOTD in this way it will work as expected:

xrootd -Rxrootd -c /etc/xrootd/xrootd-clustered.cfg -d

I have to dig out on one of my setups how to do this with the XROOTD start up script ... I will send you on Monday the instructions.

Cheers Andreas.

[apeters1971]

Ahh ... I found it ....
in /etc/sysconfig/xrootd
set
XROOTD_USER=root
XROOTD_GROUP=root

and
add "-Rxrootd" to a line like this:
XROOTD_DEFAULT_OPTIONS="-l /var/log/xrootd/xrootd.log -c /etc/xrootd/xrootd-clustered.cfg -k fifo -Rxrootd"

That should do it!

[apeters1971]

One important comment,
if you don't enforce something like krb5 but you want to allow unix from remote (which is sort of very unsafe) you have to add the authdb mechanism and forbid root access from remote machines, otherwise everybody can act as root. I will add a rootsquash to the library (on monday) by default if it is remote access. It was actually not forseen for 'unix' authentication but kerberos or x509 where you don't really have a 'root' principal as you have in unix.

[marcelkuri]

I made the changes and...

service xrootd restart
Shutting down xrootd (xrootd, default): [ OK ]
/var/spool/xrootd has wrong user ownership: "xrootd" instead of "root"
Starting xrootd (xrootd, default): [ OK ]

And.. no, We don´t use krb5. We rely more on LDAP authentication.

[marcelkuri]

Xrootd is still the owner of all files and folders.
And any user can create and delete files in any user folder.

Maybe I must remove all users from the xrootd group.

[apeters1971]

I have added already the root squash by default if you pick now version 0.2.1 ...

http://eos.cern.ch/rpms/eos-diamond/slc-6-i386/xrootd-auth-change-uid-0.2.1-1.i686.rpm

Cheers Andreas

[marcelkuri]

Remove user from xrootd group didn't work too.

And, the last rpm file gave this error:

rpm -ivh xrootd-auth-change-uid-0.2.1-1.i686.rpm
Preparing... ########################################### [100%]
file /usr/lib64/libAuthChangeFsUid.so from install of xrootd-auth-change-uid-0.2.1-1.i686 conflicts with file from package xrootd-auth-change-uid-0.2.0-1.i686

[marcelkuri]

Solved last problem:
rpm -e xrootd-auth-change-uid-0.2.0-1.i686

rpm -ivh xrootd-auth-change-uid-0.2.1-1.i686.rpm

Restarted xrootd service, but still with permission problems.
Every user can delete files from other users.

Maybe the 64 bit version is good. But I cannot install it because the machines are in use and I don't want to mess with them.

[xrootd-dev]

I don't know the reason for that but maybe you are better of using the
native XROOTD way e.g. all files are owned by xrootd in the back you
define the access restrictions via the auth DB file.
(our auth library has some security implications one must be aware of!)

In your auth db you can just define rules by users like:

every use has a private directory

u foo /data/foo/ a
u bar /data/bar/ a

all the xrootd group members share read permission

g xrootd /data/ r

and that should give exactly the behaviour you were describing ...

But maybe I don't understand fully your use case. You want to change files
only via XROOTD or also on the back on the file system via some other
mechanism?

Cheers Andreas.

On Fri, Apr 24, 2015 at 9:26 PM, Marcel Kuriyama notifications@github.com
wrote:

Xrootd is still the owner of all files and folders.
And any user can create and delete files in any user folder.

Maybe I must remove all users from the xrootd group.

—
Reply to this email directly or view it on GitHub
#230 (comment).

---

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1

[marcelkuri]

I just want that each user has full controll only on its own folder and files.
And each user has only read permission on other users files.
Just to avoid wrong file deletions.

Marcel.

[abh3]

Hi Marcel,

Is this still an issue for you? If not, I will close this ticket.

Andy

[abh3]

I am closing this ticket as we have not heard of any additional problems regarding this issue.