Archive for the ‘Moonshot’ Category

Moonshot and RDSI

Sunday, April 15th, 2012 by hartmans

Moonshot continues to be busy. Lately we’ve been focusing on finishing our core technical specs, better understanding how Moonshot will be deployed and working on our trust infrastructure. At the same time, we’re beginning to watch organizations evaluate whether Moonshot addresses a need they have. I’m excited by this process because I like to see technology I work on adopted and because the feedback we get is very valuable. This week though, I personally get to participate in such an exercise. Tomorrow I’ll be speaking at the Australian Research Data Storage Initiative’s workshop on Moonshot. I’ll be giving background on the project, talking about community success, and talking about how Moonshot can help Australia. I’m looking forward to that. I’m also very excited about a brainstorming exercise I’ll be participating in today. Several key participants in the RDSI project and I will get together to carefully evaluate their needs and see what it would take for a Moonshot solution. I hope Moonshot does end up being a good fit. Regardless, I enjoy this sort of problem solving session and am happy to have the opportunity to sit down with knowledgeable people and see how we can solve real problems!

Moonshot Introduction

Tuesday, December 6th, 2011 by hartmans

I recently put together a reading list on Project Moonshot for a friend. If you have seen discussions of Moonshot but not known where to get started understanding the technology, here is a fairly good initial list. It’s long, but take a look starting at the beginning and let us know what you think.Take a look at

http://www.project-moonshot.org/.

Specifically,

http://www.project-moonshot.org/sites/default/files/moonshot-feasibility-analysis.pdf

and

http://www.project-moonshot.org/sites/default/files/moonshot-briefing-ietf-78.pdf

That briefing paper contains outdated versions of the technical
specifications.
Please see

http://tools.ietf.org/html/draft-ietf-abfab-arch-00

http://tools.ietf.org/html/draft-ietf-abfab-gss-eap

and http://tools.ietf.org/html/draft-ietf-abfab-gss-eap-naming
and

http://tools.ietf.org/html/draft-ietf-abfab-aaa-saml

O, yeah, and for the totally cool stuff that is still being designed
please see

http://tools.ietf.org/html/draft-mrw-abfab-multihop-fed

and http://tools.ietf.org/html/draft-mrw-abfab-trust-router

Moonshot SSP

Wednesday, October 12th, 2011 by hartmans

It’s been a while since I’ve written about Moonshot. A lot has gone on; we’ve been too busy doing to be busy blogging. However there’s something that’s happened recently that’s so cool I had to take a moment to discuss it. Padl Software, the same people (well person) who brought us LDAP support to replace NIS and the first Active Directory clone, has now produced a GSS-EAP Security Service Provider. That’s software that implements the Moonshot protocol and plugs it into the standard Windows security infrastructure. This is neat because it allows you to use GSS-EAP with unmodified Windows applications like Internet Explorer and Outlook/Exchange. Obviously, this will be great for Moonshot. However, I think the positive affects are more far-reaching than that. Luke has demonstrated that we can evolve the Windows security infrastructure without waiting for Microsoft to lead the way. For those of us working in the enterprise security space, that’s huge. We can innovate and bring our innovation to Windows. In terms of getting acceptance in important user communities, getting funding for work, and making a practical difference, that’s a big deal.

This code is still in the early stages. Padl has not decided how the code will be made available. We don’t know if it will be under an open-source license yet. Luke, naturally wants to get paid for his work. However if this code does get released under an open-source license, it will be very valuable. That will give all of us who are looking for a starting point for security innovations a starting point for bringing our innovations to Windows. Some in the open-source community will argue that we shouldn’t work on improving Windows: if the open-source platforms have features Windows does not, then it may drive people to open-source. Especially for enterprise infrastructure, it tends not to work that way. You need broad cross-platform support to drive new technology. However, it does mean that we can take control of the evolution of our infrastructure; even for Windows there is no requirement that a single vendor controls what is possible.

Moonshooting Jabber

Tuesday, March 15th, 2011 by hartmans

Last fall, Moonshot was steaming forward. We ran into some non-technical obstacles and progress on the implementation was disturbingly quite from the end of October through February. That changed: the code was released February 25.

Since then, the project has picked up the momentum of last fall. There’s a new developers corner with helpful links for participating in the project, obtaining the code, and preparing for our upcoming Second Moonshot Meeting. Standards work in the ABFAB working group has been making steady progress the entire time.

The jabber chat room has been quite active. Developers have been working in three time zones. Whenever In get up there’s likely to be interesting progress awaiting me and new things to work on in the chat logs. Today was no exception. Luke moonshooted jabber. This is exciting: it’s the first tim our code has been used to authenticate some real application instead of a test service. Other discussion from the chat room not reflected in e-mail is equally exciting. He has Moonshot working with OpenSSH in controlled environments. It appears to require some updates to the OpenSSH GSS-API support.

Now is a really great time to get involved in Moonshot. We hope to see you on our lists and in our chat.

With last night’s news, we need to think towards eating our own dogfood and using Moonshot to authenticate to our own Jabber server and to authenticate to our repository for commits. Right now, there are some security issues with the code (lack of EAP channel binding) that might make that undesirable. However in a very small number of weeks or months I expect we will be there!

Implementation Progress

Monday, November 29th, 2010 by hartmans

At the end of September, things were quite exciting as we had our first project meeting. At that meeting those in the room saw a demonstration of the Moonshot GSS EAP mechanism and we discussed a number of open issues and began to plan for our test infrastructure. We’ve made significant progress on the specification front and on explaining Moonshot to important communities since then. However there has been little public progress on the implementation front.

Unfortunately, getting the necessary legal clearance and agreements to release code often takes longer than anyone would like; that is what is happening here. We’re all eagerly awaiting final approval from the lawyers and JANET(UK) management. However, things have been moving behind the scenes. Throughout much of October, Luke Howard and Linus Nordberg were working on their respective parts of the code.

I’ve also been working on putting together the test and build infrastructure. As we discussed at the meeting, we’re going to use Debian and Ubuntu as the basis for our testing. For example, we hope to release virtual machine images for these platforms for the major Moonshot components. Thus the primary build environment for our testing and virtualization will be for Debian. I’ve been putting together that here. Right now, that branch will pull together packages of the SAML infrastructure that we need. I’ve also been looking into virtualized test frameworks and believe I’ve found one that meets our needs. I’ve also put together some primitive build infrastructure that is independent of packaging available here. I’ve set up a buildbot that builds both environments. So, as the code becomes available we’ll be in a good position to start making it available.

Abfab at IETF 79

Monday, November 29th, 2010 by hartmans

The ABFAB working group, which will be standardizing technologies that Moonshot depends on, had its first meeting at IETF 79 in Beijing, China. The meeting was quite productive. Because the meeting was the first of the working group, there were some introductory presentations. A group of authors are putting together a proposed architecture document; we presented the current state of our work. However things have evolved significantly since the working group meeting and I think it will make more sense to wait a couple of weeks to discuss the architecture document.

Most of the time was spent on two presentations. The first was the status of the GSS mechanism. We discussed issues that were discovered while implementing the EAP GSS-API mechanism. Discussion in the room tended to support the proposals made in the slides. A few issues will need to come to the list. We had the most interesting discussion of SAML AAA integration.

Minutes are available.

Moonshot at Kerberos

Thursday, October 28th, 2010 by hartmans

At The MIT Kerberos Consortium‘s 2010 conference, Josh Howlett and Sam Hartman delivered a talk on Moonshot. Slides should be up in a day or so. We reported on status and gave a brief overview.

The new material was apropos for the venue. At the bar BOF back in March at IETF 77, we received several comments on Moonshot’s limitations. It doesn’t work well for services that require rapid authentications for multiple requests. There’s not a good story for use when a Moonshot service needs to contact another service. There isn’t a good standardized mechanism for mapping in domain-specific policy.

We presented a proposal that Luke and Sam developed to optionally provide a Kerberos ticket as part of moonshot authentication. This scales from a service that simply generates its own service tickets all the way through resource domains that have many services and complex policy and provide the client a TGT. Clients can implement the feature in order to achieve better performance. Server can implement the feature in order to get delegation support within a resource domain and to get policy mapping.

Luke has prototyped a version of this service involving a service ticket. We plan on briefly mentioning a desire to have extensible fast reauthentication support at the ABFAB meeting in IETF 79. However in the interest of getting the working group off to a good start we’re going to focus on the well understand parts of the system and formally propose this extension after IETF 79.

ABFAB working group approved

Wednesday, October 13th, 2010 by hartmans

Yesterday, the Application Bridging for Federated Authentication working group was approved in the IETF. This working group’s charter includes the IETF technologies needed by Project Moonshot. The group will meet at IETF 79 in Beijing this November.

Meanwhile, at last month’s Moonshot meeting in Copenhagen, an initial version of the technology was demonstrated. We’re still working through some of the administrative details needed before we can release the code for public review. There have been several exciting discussions both on the Moonshot implementation list and on the ABFAB list over the past few weeks.

Moonshot at TNC2010

Tuesday, June 1st, 2010 by hartmans

Moonshot is being discussed at the TERENA TNC 2010 conference. Our session started at 08:00 UTC (a few minutes ago), but will be going on for around the next hour or so. There is a presentation before Moonshot, but then Josh is up. See here for streaming and the Moonshot web site for our updated specifications. When the session is archived I’ll post a pointer to the video stream.a

Internet2 Moonshot Briefing Paper

Tuesday, May 18th, 2010 by hartmans

Please see here for a briefing paper including snapshots of all our specs as well as an updated use case paper. This paper was presented at the end of April at the Internet2 Spring Members meeting. This is a great snapshot of Project Moonshot at the end of last month.