7
Security
7.1
Authentication and Authorization
Urika-GX authentication and authorization are based on a number of mechanisms that are described in this
section.
Standard Linux Login and Security Policies
Linux login mechanisms, such as SSH, provide the first layer of authentication that prevents user impersonation
and providing the basic Linux user attributes used for standard access controls and so forth.
The standard Linux login mechanism relies on user configuration either within the Urika-GX local LDAP directory
(provided by default at installation time) or within a site configured user directory. Setting up users in either of
these places and configuring the Urika-GX to use a site configured directory is beyond the scope of this
publication.
The standard Linux security policies ensure basic security on individual nodes of the cluster. These policies
include file access control, process protection, memory protection, etc. Standard Linux security is also beyond the
scope of this publication.
Urika-GX Authorized User List
The Urika-GX authorized user list further regulates access to different aspects of the Urika-GX system, such as
deciding:
●
whether a user who has been identified by the Linux login mechanism is actually permitted to use Urika-GX
●
whether a user is restricted to tenant access only, or has access to Urika-GX physical nodes, and which
tenant(s) the user is authorized to access
The authorized user list defines the various modes of user authorization within the Urika-GX cluster. A user must
have an entry in this list to be granted access to either a tenant environment or a physical node within the Urika-
GX. A user without an entry, even if that user can pass the standard Linux authentication checks, will not be
permitted to log into a Urika-GX. One mode of access defined within the Urika-GX authorized user list is access to
tenant VMs. Users authorized to log into a tenant VM are specifically granted access to that tenant within the
Urika-GX authorized user list. In addition to logging into tenant VMs, users may also be permitted to log on to
physical Urika-GX nodes, such as login node. This mode of access is also defined within the Urika-GX authorized
user list.
How the
crayTenant
and
CrayLoginShell
Attributes Control User Access
In addition to Mesos secrets and Kerberos keytabs, the following authorization attributes are specific to Urika-GX:
Security
S3016
175
