Contract SFS-DEV-002

Summary

Contract	Work Item	Scope statement	Solution architecture	High-level design	Implementation	Demonstration	Delivery
SFS-DEV-002.1	UID/GID Mapping	2012-11-20	2013-01-08	2013-02-05
SFS-DEV-002.2	Shared Key Auth	2012-11-20	2013-01-15	2013-02-05

Documentation

• File:OpenSFS Software Contract 6-5-12 article1.pdf
• File:UID GID Scope Statement v2.pdf
• File:UID-GID Solution Architecture.pdf
• File:UID-GID HLD.docx
• File:Shared keys scope v2.pdf
• File:Shared keys architecture.pdf
• File:Shared keys design.pdf

Sample HLD:

• File:HLD of Lustre NRS.docx

Meetings

2013-01-29

Attending: Andreas, Andy, Alex, Josh, Nathan, Ned

Meeting Minutes:

• Key scope: sets of keys are defined per cluster (not per-client)
• These keys are used to generate session keys for Auth and Encrypt
• Root squash - various ideas
  1. EAs on directories describe which clusters are allowed
  2. Squash per-cluster roots to distinct users, use ACLs to provide per-cluster root-like permissions
  3. Use bind-mounting to limit the visibility of the fs to a subtree
  • suggestion to add root fid/path to cluster definition for future use
  • Current plan: root is not treated specially - per-cluster roots may be mapped to the actual fs root user, or not.
• Object (OSS) security against untrusted client - out of scope
• MGS primacy
  • "MGS up before before other servers" may be a requirement for the mapping or shared key features
  • but this requirement must be relaxed if the uid/shared key feature has not been enabled

Actions:

• Nathan to send HLD example template (done)
• Nathan to propose OpenSFS contract doc templates
• Andy/Josh update HLD with detail

Milestones Under Review:

• UID HLD
• Shared Keys HLD

Next Meeting:

• I will be travelling for the next two meetings (Feb 5, 12). Can someone else host the meeting?
• 12:00pm PST Feb 5 2013
• Intercall (866) 203-7023
• Conference code: 5093670258

2013-01-22

Attending: Nathan, Josh, Andrew, Steve

Meeting Minutes:

• Comments on Shared Keys HLD

1. independence of auth and encrypt keys
2. encrypt-then-MAC
3. HLD should address multiple simultaneuous keys
4. interaction between shared keys and mappings
   • original assumption was key-per-client; key-per-cluster seems to make more sense for a few reasons (large-cluster manageability, shared-root clients). A hash of the keys could be added to a cluster definition. A "null" cluster could be defined for a single-cluster environment.

• Ended meeting early; we need more meeting attendees to discuss these issues.

Actions:

• Review Security HLD to provide timely feedback.

Milestones Under Review:

• UID HLD
• Shared Keys HLD

Next Meeting:

• 12:00pm PST Jan 29 2013
• Intercall (866) 203-7023
• Conference code: 5093670258

2013-01-15

Attending: Nathan, Ned, Josh, Andrew, Steve, Alex, Andreas, John

Meeting Minutes:

• UID/GID HLD Review
  • Comments by Nathan, Andreas, Ned returned via Word doc

Define/update cluster definition via complete file vs. incrementally

Josh: file-based cluster def changes requires walking export tree

Done rarely, probably ok

There may be security implications at the transition when redefining cluster defs

When a NID is removed from a def it should use the default mapping

Define/update UID/GID mappings via complete file vs. incrementally

incremental uid/gid mapping in order to prevent fs access blocking during replacement.

Andreas suggested atomically swap in new mapping once received/set up.

Behaviour during setup and recovery

Don't use default mapping while waiting for definitions; FS should block access to all files until mappings and cluster defs have been set up.

Need a clear signal when an update is finished/complete.

Servers currently cache the MGS Lustre config locally

May be undesirable for OSD

Perhaps this behaviour should be changed: stop caching, require MGS for server startup.

• Shared Key HLD distributed
  • Comments should be returned quickly for HLD revision next week.

Actions:

• Review Shared Key HLD to provide timely feedback.

Milestones Under Review:

• UID HLD
• Shared Keys HLD

Milestones Completed:

• Shared Key Scope Statement APPROVED 2013-01-15

Next Meeting:

• 12:00pm PST Jan 22 2013
• Intercall (866) 203-7023
• Conference code: 5093670258

2013-01-08

Attending: Nathan, Ned, Josh, Andrew, Steve, Dave, Alex

Meeting Minutes:

• Clarifying current documents:
  • Latest Shared Keys doc: arch doc. HLD expected this week.
  • Latest UID-GID doc: HLD.
• We need reviewers for both HLDs.
  • UID-GID:
    • Nathan has already sent comments
    • Ned volunteers
    • I'd like to volunteer Andreas in absentia
  • Shared Keys:
    • Not out yet; any eager volunteers?
• Document types: I think the consensus going forward is Google Docs for easier collaboration/feedback.

Actions:

• Andrew to deliver HLD be the end of this week (hopefully)
• Reviews to provide timely feedback.

Milestones Under Review:

• UID HLD
• Shared Keys Solution Arch

Milestones Completed:

• UID/GID Scope Statement APPROVED 2013-01-08

Next Meeting:

• 12:00pm PST Jan 15 2013
• Intercall (866) 203-7023
• Conference code: 5093670258

2012-12-11

Attending: Nathan, Andreas, Josh, Simms, Cory, Alex, Andrew Meeting Minutes:

• Josh and Andrew updated the arch docs with improved use cases, test plan, and acceptance criteria
• Several PAC members commented on the updates
• Alex noted we neglected to address previous discussions on allowing multiple simultaneous keys:
  • should we allow key updates on a live system, or connect-time only?
  • is there any upper limit on total keys?
  • should keys be restricted to particular nid range?

Actions:

• PAC members review docs for final approval by next week.
• The above multiple-key use case should be added to the arch doc.
• In the meantime HLD design can begin

Milestones Under Review:

• UID Solution Arch
• Shared Key Solution Arch

Next Meeting:

• 12:00pm PST Dec 18 2012
• Intercall (866) 203-7023
• Conference code: 5093670258

No meetings on Dec 25 or Jan 1.

2012-12-04

Attending: Nathan, Ned, Josh, Simms, Carrier Meeting Minutes:

• Solution Architecture document review. More detail requested in
  • Practical use case (UID)
  • Specific functional requirements (shared key)
  • Detailed, specific acceptance criteria (e.g. "Any single user on up to 100(?) separate clusters has Unix UID/GID-controlled access to his files on shared Lustre file system.", "Unknown users can be squashed to a particular UID." etc.)

Actions:

• Josh and Andrew to revise Solution Architecture docs with more detail.

Milestones Under Review:

• UID Solution Arch
• Shared Keys Solution Arch

Next Meeting:

• 12:00pm PST Dec 11 2012
• Intercall (866) 203-7023
• Conference code: 5093670258

2012-11-20

Attending: Nathan, Alex, Andreas, Steve, Cory

Meeting Minutes:

• Simms requested approval of the two scope statements as presented in email 2012-11-10. No objections were raised, and the scope statements were approved.

Actions:

• Simms et all will begin work on the Solution Architecture.

Milestones Under Review:

• none

Milestones Completed:

• UID/GID Scope Statement APPROVED 2012-11-20
• Shared Key Scope Statement APPROVED 2012-11-20

Next Meeting:

• 12:00pm PST Nov 27 2012
• Intercall (866) 203-7023
• Conference code: 5093670258