Security Guidelines

Introduction

This document is meant as a guide to implement security features for GridServer Manager. The goal is to provide you with information on what can be done and where you can go to find the information necessary to implement the solutions.

As GridServer uses third-party products, what can be done with those products is likely to change over time. Therefore, it is necessary for you to continue to stay educated on the latest features of third-party products.

This document is specific to GridServer 7.1.0. and assumes that the reader has a working knowledge of GridServer components. If not, see the TIBCO GridServer® Introducing TIBCO GridServer® documentation.

Product Connectivity

This section describes the connectivity between GridServer components. For a general explanation of network topography, see the Configure Your Network topic in the TIBCO GridServer® Installation.

Communication

• Director-Broker Communication

  The communication between the Director and Broker uses TCP on port 5635 by default. See the Configure Your Network topic in the TIBCO GridServer® Installation.

• Manager-Driver Communication

  The ports used by the Manager for incoming communication from the Driver are covered in the Configure Server Settings topic in the TIBCO GridServer® Installation.

• Manager-Engine Communication

  The ports used by the Manager for incoming communication from the Engine are the same as the ports used for the Driver. See Director-Broker Communication.

• Driver-Engine Communication

  The Driver and Engine communicate directly when either of them has Direct Data Transfer (DDT) enabled. If the Driver has DDT enabled, then the Engine attempts to download input data directly from the Driver’s file server. If the Engine has DDT enabled, then the Driver attempts to download the output data directly from the Engine’s file server.

  An overview of DDT can be found in the Optimizing the Grid topic in the TIBCO GridServer® Administration. More information is available in the Diagnosing Network Issues topic of the same guide.

• Driver DDT

  Disabling Driver DDT can be found in the Direct Data Transfer section in the Optimizing the Grid topic in the TIBCO GridServer® Administration.

  Driver Cleaner Configuration can be found in the Driver Installation topic in the TIBCO GridServer® Developer's Guide.

• Engine DDT

  Disabling Engine DDT is found in the Direct Data Transfer section in the Optimizing the Grid topic in the TIBCO GridServer® Administration.

  For information about specifying the Engine’s ds.DataDir value, see the Invocation Variables topic in the TIBCO GridServer® Developer's Guide

• DDT KB Articles

  KB Article 000008671: Using static ports in Engine and Driver DDT settings.

SSL

Enabling SSL is covered in the Configuring SSL topic in the TIBCO GridServer® Installation.

SSL KB Articles

• KB Article 000043090: How to configure GridServer to use JSSE SSL implementation instead of OpenSSL

• KB Article 000036224: Steps for creating SSL certificates that can be used on GridServer Manager

• KB Article 000031710: Steps to enable extra logging to debug SSL connection errors

Authentication and Authorization

• Run-As

  There are often cases where Services require specific user permissions to access needed resources. By creating the Engine process as a given user, all Service invocations that are run by the Engine can operate with these permissions.

• Running windows engine as Run-As
  Configuring the Windows engine as Run-As is covered in the Windows Engine Installation topic in the TIBCO GridServer® Installation.

• Running UNIX engine as Run-As
  Configuring the UNIX engine as Run-As is covered in the UNIX Engine Installation topic in the TIBCO GridServer® Installation.

• Running service as Run-As
  Configuring Service as Run-As is covered in the Service Run-As topic in the TIBCO GridServer® Administration.

• NTLM/Kerberos

  Pure Kerberos authentication allows windows managers to enable authentication without requiring a password.
  For more information about Pure Kerberos authentication, see Configuring Pure Kerberos Authentication topic in the TIBCO GridServer® Administration.

• LDAP Authentication and Authorization

  LDAP can be used for:

  • Authentication, where a user name is authenticated against a directory entry;

  • Authorization, where groups assigned to that user map to GridServer roles

• Both authentication and authorization.

For more information about Configuring LDAP, see Using LDAP Authentication and Authorization topic in the TIBCO GridServer® Administration.

• Role-Based Access Control

  GridServer supports a customizable system of role-based access control to provide account security and enable different users to access different areas of the interface. This is covered in the The GridServer Administration Tool topic in the TIBCO GridServer® Administration.

• Engine Daemon Authentication

  Engine Daemon authentication can be enabled during the Engine installation. This is covered in the Enabling Engine Daemon Authentication topic in the TIBCO GridServer® Installation.

• Authentication of Grid Components

  You can choose to enable Authentication between all Grid components. This is covered in the Authentication of Grid Components topic in the TIBCO GridServer® Installation.

Web UI Features

• Single Sign-On

  After logging in once to any Manager, you can use the Grid Single Sign-On (SSO) feature to log in to all Managers on a Grid.
  Configuring web Single Sign-On is covered in the Grid SSO Configuration topic in the TIBCO GridServer® Administration.

• Quarantine Broker

  When the Quarantine Broker is specified, the Director allows individual Engine instances to log in to either production Brokers or the Quarantine Broker. It is based on the value of the quarantine status of the managing Engine Daemon.
  Fore more information about configuring web Single Sign-On, refer to Quarantine Brokers topic in the TIBCO GridServer® Administration.

Updating Third-Party Components

Before updating any third-party components, TIBCO recommends that you contact TIBCO Support to determine if a specific version of a third-party component has been tested with GridServer. While service pack updates generally work, some major or minor version updates can often result in unexpected behavior or exceptions.

• Configuring Security Options

  • Apache Tomcat

    You must be familiar with the many considerations and options related to Tomcat security. Tomcat has its own Security Guide and you are encouraged to review it.

  • XSS Filter

    The XSS Filter on the Manager can be enabled or disabled by modifying the associated property in the GridServer Administration Tool at Admin > Manager Configuration > Security > Miscellaneous.
    To edit the whitelist, open the xss.xml file located at DS_INSTALL/manager/webapps/livecluster/WEB-INF/config/

  • CSRF Filter

    The CSRF Filter on the Manager can be enabled or disabled by modifying the associated property in the GridServer Administration Tool at Admin > Manager Configuration > Security > Miscellaneous.

    To edit the whitelist, open the xss.xml file located at DS_INSTALL/manager/webapps/livecluster/WEB-INF/config/

• Disabling directory traversal on the File Server port

  To disable directory traversal for the Engine file server, update the Engine.xml file with the following code:

  <contexts c="PropertiesBean" n="Context">
   <property n="object" v="DSDataDir" k="data"/>
   <property n="object" v="DSWorkDir" k="work"/>
   <property n="object" v="$DSProfileDir$/logs" k="logs"/>
  </contexts>
  

• Setting up User Authentication - This is covered in the following guides:

  • TIBCO GridServer® Administration - Configuring GridServer for LDAP Authentication or Authorization topic.

  • TIBCO GridServer® Installation - Grid Components Authentication and Enabling Engine Daemon Authentication topics.

Enabling the Encryption of Task Payloads

To secure the data that is being passed between Drivers and Engines, it is possible to enable encryption for the task payload. This is done by editing the Service Type as follows:

1. In the GridServer Administration tool, select the Services menu.

2. Select Service Types.

3. Edit one of the Service Types options.

4. The feature is listed in the Options section for Service Type and it is called encryptionEnabled.