gLite Security Utilities

1. Release Description

This release contains the gLite Security Utilities module v. 1.0.0. The following sections provide additional information about the release content, the module dependencies, the know bugs and issues and a list of bugs closed since the previous release. For information about installing and using the gLite Security Utilities please refer to the gLite Installation and User Guides.

2. Changes In This Release

In this release introduces the following changes:

• Two additional advanced configuration parameters have been defined to allow configuration of the cron jobs installed by this module. The parameters are called respectively fetch-crl.cron.tab and mkgridmap.cron.tab
• The fetch-clr package has been updated to the latest version offered by EU GridPMA. This version fixes some security concerns reported by the CERN Linux Security team. Please note that as of this release, the fetch-crl package is not maintained by gLite and it’s been moved to the module external dependencies list

3. Release contents

The gLite Security Utilities v. 1.0.0 is composed of the following gLite components:

Component name	Version	File
org.glite.deployment.security-utils	1.0.0	../../../../../../../glite-web/egee/packages/R1.0/R20050331/installers/glite-security-utils_installer.sh ../../../../../../../glite-web/egee/packages/R1.0/R20050331/bin/rhel30/noarch/RPMS/glite-security-utils-config-1.0.0-1.noarch.rpm
org.glite.deployment.config	1.0.0	../../../../../../../glite-web/egee/packages/R1.0/R20050331/bin/rhel30/noarch/RPMS/glite-config-1.0.0-1.noarch.rpm
glite-security-mkgridmap	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-2.1.1-1.noarch.rpm
glite-security-mkgridmap-conf	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-conf-2.1.1-3.noarch.rpm

4. Dependencies

The gLite Security Utilities v. 1.0.0 has the following external dependencies (the dependencies are distributed with the installer script):

Component name	Version	RPM file name
CA Certificates	Automatic	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/ca_*-xxx-1.noarch.rpm
fetch-crl	2.0	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/fetch-crl-2.0-1.noarch.rpm
perl-IO-Socket-SSL	0.94	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-IO-Socket-SSL-0.94-0.dag.rhel3.noarch.rpm
perl-Net-LDAP	0.2701	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-LDAP-0.2701-0.dag.rhel3.noarch.rpm
perl-Net-SSLeay	1.23	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-SSLeay-1.23-0.dag.rhel3.i386.rpm
perl-Term-ReadKey	2.20	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Term-ReadKey-2.20-12.i386.rpm
perl-Convert-ASN1	0.18	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Convert-ASN1-0.18-0.dag.rhel3.noarch.rpm

5. Known bugs and issues

This release has the following known bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw .

Bug number	Description
#5891	glite-mkgridmap script tries to source a non-existent configuration file
#6326	Security Utilities installation script: Perl RPMs failed dependencies
#6336	glite-security-utils_installer.sh fails when there are newer rpms already installed

The following bugs have been fixed in this or previous releases, but they have not been officially tested yet:

Bug number	Description
#5816	wrong dependency in security rpm
#5839	hard-coded relative path in glite-security-utils config script
#5969	Docs on installation of security-utils may conflict with subsequent installation of a CE
#5980	glite-security-utils-config.py crashes if given unknown option
#5981	glite-security-utils-config scripts says "succesful" even if hostcerts are not there and had given an error for that
#6323	CA RPMs are hard coded into the installation script.
#6324	Security Utilities installation script: Reports success when it has failed.
#6348	The deployment security-utils module should not check for a host certificate
#6629	Wrong RPM name in glite-security-utils_installer.sh coming from N20050204
#6642	The Security Utilities modules should run the fetch-crl script
#6643	The Security Utilities module doesn't "activate" the cron jobs

No removal procedure is provided with this release apart from the removal of the RPMS. Any account, group or other resource created during the module configuration must be manually cleaned.

If the mkgridmap cron job is installed, it periodically contacts the servers listed in the glite-mkgridmap.conf files to update the grid-mapfile file. Any custom entry found in the old file is added back to the new file by comparing the old and the new file. However, this also causes obsolete entries to be added back after the updates. This issue will be solved in a future release.

6. Bugs closed since last release

This release fixes the following bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw

Bug number	Description
#6432	glite security utils:documentation refers to old installer script
#7192	Security: Wrong link to the installer

7. Previous Releases

7.1. Release 0.6.1

7.1.1. Release Description

This release contains the gLite Security Utilities module v. 0.6.1. The following sections provide additional information about the release content, the module dependencies, the know bugs and issues and a list of bugs closed since the previous release. For information about installing and using the gLite Security Utilities please refer to the gLite Installation and User Guides.

7.1.2. Changes In This Release

In this release introduces the following changes:

• An internal command line switch has been added to the configuration script to ease utilization of this module from within other modules. By running the script with the --subservice switch most of the standard boilerplates are suppressed

7.1.3. Release contents

The gLite Security Utilities v. 0.6.1 is composed of the following gLite components:

Component name	Version	File
org.glite.deployment.security-utils	0.6.1	../../../../../../../glite-web/egee/packages/I20050218/installers/glite-security-utils_installer.sh ../../../../../../../glite-web/egee/packages/I20050218/bin/rhel30/noarch/RPMS/glite-security-utils-config-0.6.1-1.noarch.rpm
org.glite.deployment.config	0.7.4	../../../../../../../glite-web/egee/packages/I20050218/bin/rhel30/noarch/RPMS/glite-config-0.7.4-1.noarch.rpm
glite-security-mkgridmap	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-2.1.1-1.noarch.rpm
glite-security-mkgridmap-conf	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-conf-2.1.1-3.noarch.rpm
glite-security-fetch-crl	1.0.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-fetch-crl-1.0.1-1.noarch.rpm

7.1.4. Dependencies

The gLite Security Utilities v. 0.6.1 has the following external dependencies (the dependencies are distributed with the installer script):

Component name	Version	RPM file name
CA Certificates	Automatic	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/ca_*-xxx-1.noarch.rpm
perl-IO-Socket-SSL	0.94	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-IO-Socket-SSL-0.94-0.dag.rhel3.noarch.rpm
perl-Net-LDAP	0.2701	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-LDAP-0.2701-0.dag.rhel3.noarch.rpm
perl-Net-SSLeay	1.23	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-SSLeay-1.23-0.dag.rhel3.i386.rpm
perl-Term-ReadKey	2.20	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Term-ReadKey-2.20-12.i386.rpm
perl-Convert-ASN1	0.18	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Convert-ASN1-0.18-0.dag.rhel3.noarch.rpm

7.1.5. Known bugs and issues

This release has the following known bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw .

Bug number	Description	Fixed in this or previous releases, but not yet tested
#5816	wrong dependency in security rpm	X
#5839	hard-coded relative path in glite-security-utils config script	X
#5891	glite-mkgridmap script tries to source a non-existent configuration file
#5969	Docs on installation of security-utils may conflict with subsequent installation of a CE
#5980	glite-security-utils-config.py crashes if given unknown option	X
#5981	glite-security-utils-config scripts says "succesful" even if hostcerts are not there and had given an error for that	X
#6324	Security Utilities installation script: Reports success when it has failed.	X
#6326	Security Utilities installation script: Perl RPMs failed dependencies
#6336	glite-security-utils_installer.sh fails when there are newer rpms already installed
#6348	The deployment security-utils module should not check for a host certificate	X
#6464	security-utils: existing mkgridmap.conf overwritten during upgrade	X
#6629	Wrong RPM name in glite-security-utils_installer.sh coming from N20050204	X
#6642	The Security Utilities modules should run the fetch-crl script	X
#6643	The Security Utilities module doesn't "activate" the cron jobs	X
#6839	There is no test suite for the Security Utils in gLite v1.0.6 RC1 (Integration Build I20050204)	X
#6841	There are no test reports provided for the Security Utils in gLite v1.0.6 RC1 (Integration Build I20050204)	X

No removal procedure is provided with this release apart from the removal of the RPMS. Any account, group or other resource created during the module configuration must be manually cleaned.

If the mkgridmap cron job is installed, it periodically contacts the servers listed in the glite-mkgridmap.conf files to update the grid-mapfile file. Any custom entry found in the old file is added back to the new file by comparing the old and the new file. However, this also causes obsolete entries to be added back after the updates. This issue will be solved in a future release.

7.1.6. Bugs closed since last release

This release fixes the following bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw

Bug number	Description
#6350	glite-mkgridmap script does not create the grid-mapfile
#6691	the grid-mapfile on the CE is wrongly generated by the postinstall script

7.2. Release 0.6.0

7.2.1. Release Description

This release contains the gLite Security Utilities module v. 0.6.0. The following sections provide additional information about the release content, the module dependencies, the know bugs and issues and a list of bugs closed since the previous release. For information about installing and using the gLite Security Utilities please refer to the gLite Installation and User Guides.

7.2.2. Changes In This Release

In this release introduces the following changes:

• The script to update the CRLs (glite-fetch-crl) is now executed once during the module configuration
• The cron jobs are now automatically activated after installation by touching the cron daemon spool directory as specified in the cron.d manual
• The module has been updated to use the remote site configuration feature (see the gLite Installation Guide for more details)

7.2.3. Release contents

The gLite Security Utilities v. 0.6.0 is composed of the following gLite components:

Component name	Version	File
org.glite.deployment.security-utils	0.6.0	../../../../../../../glite-web/egee/packages/I20050204/installers/glite-security-utils_installer.sh ../../../../../../../glite-web/egee/packages/I20050204/bin/rhel30/noarch/RPMS/glite-security-utils-config-0.6.0-1.noarch.rpm
org.glite.deployment.config	0.7.2	../../../../../../../glite-web/egee/packages/I20050204/bin/rhel30/noarch/RPMS/glite-config-0.7.2-1.noarch.rpm
glite-security-mkgridmap	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-2.1.1-1.noarch.rpm
glite-security-mkgridmap-conf	2.1.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-mkgridmap-conf-2.1.1-3.noarch.rpm
glite-security-fetch-crl	1.0.1	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/glite-security-fetch-crl-1.0.1-1.noarch.rpm

7.2.4. Dependencies

The gLite Security Utilities v. 0.6.0 has the following external dependencies (the dependencies are distributed with the installer script):

Component name	Version	RPM file name
CA Certificates	Automatic	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/ca_*-xxx-1.noarch.rpm
perl-IO-Socket-SSL	0.94	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-IO-Socket-SSL-0.94-0.dag.rhel3.noarch.rpm
perl-Net-LDAP	0.2701	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-LDAP-0.2701-0.dag.rhel3.noarch.rpm
perl-Net-SSLeay	1.23	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Net-SSLeay-1.23-0.dag.rhel3.i386.rpm
perl-Term-ReadKey	2.20	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Term-ReadKey-2.20-12.i386.rpm
perl-Convert-ASN1	0.18	../../../../../../../glite-web/egee/packages/externals/bin/rhel30/RPMS/perl-Convert-ASN1-0.18-0.dag.rhel3.noarch.rpm

7.2.5. Known bugs and issues

This release has the following known bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw .

Bug number	Description	Fixed in this or previous releases, but not yet tested
#5816	wrong dependency in security rpm	X
#5839	hard-coded relative path in glite-security-utils config script	X
#5891	glite-mkgridmap script tries to source a non-existent configuration file
#5969	Docs on installation of security-utils may conflict with subsequent installation of a CE
#5980	glite-security-utils-config.py crashes if given unknown option	X
#5981	glite-security-utils-config scripts says "succesful" even if hostcerts are not there and had given an error for that	X
#6323	CA RPMs are hard coded into the installation script.	X
#6324	Security Utilities installation script: Reports success when it has failed.	X
#6326	Security Utilities installation script: Perl RPMs failed dependencies
#6336	glite-security-utils_installer.sh fails when there are newer rpms already installed
#6348	The deployment security-utils module should not check for a host certificate	X
#6432	glite security utils:documentation refers to old installer script	X
#6464	security-utils: existing mkgridmap.conf overwritten during upgrade	X
#6629	Wrong RPM name in glite-security-utils_installer.sh coming from N20050204
#6642	The Security Utilities modules should run the fetch-crl script	X
#6643	The Security Utilities module doesn't "activate" the cron jobs	X

No removal procedure is provided with this release apart from the removal of the RPMS. Any account, group or other resource created during the module configuration must be manually cleaned.

If the mkgridmap cron job is installed, it periodically contacts the servers listed in the glite-mkgridmap.conf files to update the grid-mapfile file. Any custom entry found in the old file is added back to the new file by comparing the old and the new file. However, this also causes obsolete entries to be added back after the updates. This issue will be solved in a future release.

7.2.6. Bugs closed since last release

This release fixes the following bugs and issues. Bug numbers refer to the gLite Bug Tracking system database hosted on the CERN Savannah system at https://savannah.cern.ch/bugs/?group=jra1mdw

Bug number

Description