Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

hardening/77_tls_support #78

Merged
merged 4 commits into from
Sep 29, 2015
Merged

hardening/77_tls_support #78

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b7ee4e2
ADD TLS support to the cosmos gui
frbattid Sep 28, 2015
0c41de2
FIX the cosmos gui port in the configuration template
frbattid Sep 28, 2015
76f0893
Merge branch 'develop' into hardening/77_tls_support
frbattid Sep 29, 2015
6c6563e
FIX issues raised during code review
frbattid Sep 29, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGES_NEXT_RELEASE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,5 @@
- [cosmos-gui] [HARDENING] Allow the storage and computing clusters to be the same (#61)
- [cosmos] [HARDENING] Add a User and Programmer Manual (#69)
- [cosmos] [HARDENING] Add a Administration and Configuration Manual (#70)
- [cosmos-gui] [HARDENING] Add TLS support (#77)
- [cosmos-gui] [BUG] The new_password route uses the stored username instead of the email-based one (#65)
32 changes: 18 additions & 14 deletions cosmos-gui/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ As seen, the storage cluster is always shared, and depending on the chosen flavo

In addition, the cosmos-gui can be used as a centralized dashboard where a user can explore its HDFS space and run [predefined MapReduce](https://github.com/telefonicaid/fiware-tidoop/tree/develop/tidoop-mr-lib-api) jobs, once his/her Cosmos account has been provisioned.

[Transport Layer Security](https://en.wikipedia.org/wiki/Transport_Layer_Security) (TLS) is used to provide communications security through asymetric cryptography (public/private encryption keys).

[Top](#top)

##<a name="maininstall"></a>Installation
Expand Down Expand Up @@ -156,7 +158,9 @@ To be done.
cosmos-gui is configured through `conf/cosmos-gui.json`. There you will find a JSON document with six main *sections*:

* **gui**:
* **port**: specifies the listening port for the application. By default it is 80, but can be changed if such a port is being used in your deployment.
* **port**: Specifies the listening port for the application. By default it is 80, but can be changed if such a port is being used in your deployment.
* **private\_key\_file**: File name containing the private key used to encrypt the communications with the clients.
* **certificate\_file**: File name containing the self-signed X509 certificate used by the server to send the clients the public counterpart of the above private key.
* **clusters**:
* **storage**
* **endpoint**: IP address or FQDN of the Namenode/HttpFS server of the storage cluster.
Expand All @@ -165,26 +169,26 @@ cosmos-gui is configured through `conf/cosmos-gui.json`. There you will find a J
* **computing**
* **endpoint**: IP address or FQDN of the Namenode/HttpFS server of the computing cluster.
* **user**: Unix user within the Namenode/HttpFS server having sudo permissions.
* **private_key**: user's private key used to ssh into the Namenode/HttpFS server.
* **private_key**: User's private key used to ssh into the Namenode/HttpFS server.
* **hdfs**:
* **quota**: measured in gigabytes, defines the size of the HDFS space assigned to each Cosmos user.
* **quota**: Measured in gigabytes, defines the size of the HDFS space assigned to each Cosmos user.
* **superuser**: HDFS superuser, typically `hdfs`.
* **oauth2**:
* **idmURL**: URL where the FIWARE Identity Manager runs. If using the global instance at FIWARE LAB, it is `https://account.lab.fiware.org`.
* **client_id**: this is given by the Identity Manager once the cosmos-gui has been registered.
* **client_secre**t: this is given by the Identity Manager once the cosmos-gui has been registered.
* **client_id**: This is given by the Identity Manager once the cosmos-gui has been registered.
* **client_secret**: This is given by the Identity Manager once the cosmos-gui has been registered.
* **callbackURL**: URL used by the Identity Manager to return the control to the GUI once the delegated authentication step has finished. This must be `http://localhost:<listening_port>/auth`.
* **response_type**: must be `code`.
* **response_type**: Must be `code`.
* **mysql**:
* **host**: IP or FQDN of the host running the MySQL server.
* **port**: port the MySQL server is listening for new incoming connections. Typically 3306.
* **user**: a valid user in the MySQL server with permissions to insert into the `cosmos_user` table.
* **password**: password for the above user in MySQL.
* **database**: must be `cosmos`.
* **users_blacklist**: an array of strings not allowed to be a username.
* **port**: Port the MySQL server is listening for new incoming connections. Typically 3306.
* **user**: A valid user in the MySQL server with permissions to insert into the `cosmos_user` table.
* **password**: Password for the above user in MySQL.
* **database**: Must be `cosmos`.
* **users_blacklist**: An array of strings not allowed to be a username.
* **log**:
* **file_name**: path of the file where the log traces will be saved in a daily rotation basis. This file must be within the logging folder owned by the the user `cosmos-gui`.
* **date_pattern**: data pattern to be appended to the log file name when the log file is rotated.
* **file_name**: Path of the file where the log traces will be saved in a daily rotation basis. This file must be within the logging folder owned by the the user `cosmos-gui`.
* **date_pattern**: Data pattern to be appended to the log file name when the log file is rotated.

[Top](#top)

Expand All @@ -205,7 +209,7 @@ If everything goes well, you should be able to see in a web browser the login pa

![](doc/images/cosmos_gui__init.png)

cosmos-gui typically listens in the TCP/80 port, but you can change it by editing `conf/cosmos-gui.conf`.
cosmos-gui typically listens in the TCP/443 port (TLS encryption), but you can change it by editing `conf/cosmos-gui.conf`.

[Top](#top)

Expand Down
4 changes: 3 additions & 1 deletion cosmos-gui/conf/cosmos-gui.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
{
"gui": {
"port": 80
"port": 443,
"private_key_file": "",
"certificate_file": ""
},
"clusters": {
"storage": {
Expand Down
8 changes: 7 additions & 1 deletion cosmos-gui/src/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@

// Module dependencies
var express = require('express');
var https = require('https');
var fs = require('fs');
var boom = require('boom');
var stylus = require('stylus');
var nib = require('nib');
Expand All @@ -49,6 +51,10 @@ var scEndpoint = config.clusters.storage.endpoint;
var ccPrivKey = config.clusters.computing.private_key;
var ccUser = config.clusters.computing.user;
var ccEndpoint = config.clusters.computing.endpoint;
var httpsOptions = {
key: fs.readFileSync(config.private_ley_filekey),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there's a typo here: private_ley_filekey -> private_key_file :) Apart from this, I may have asked this before :p but have you confirmed that this works if config.private_ley_filekey and certificate_file are blank ('') as in the default configuration? :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, there is a typo, I'll fix it.

Regarding the parameters check, I have a tech debt issue about it... that I think I will implement in the second release :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 6c6563e

cert: fs.readFileSync(config.certificate_file)
}

// Express configuration
var app = express();
Expand Down Expand Up @@ -209,6 +215,6 @@ mysqlDriver.connect(function(error, result) {
} else {
// Start the application, listening at the configured port
logger.info("cosmos-gui running at http://localhost:" + port);
app.listen(port);
https.createServer(httpsOptions, app).listen(port);
} // if else
});