Skip to content

Commit 8320c9d

Browse files
author
kasemir
committed
Secure PVA: Update to ongoing pvxs developments
1 parent 18457db commit 8320c9d

File tree

2 files changed

+138
-6
lines changed

2 files changed

+138
-6
lines changed

‎core/pva/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ To debug connection issues on Linux, it can be helpful to disable the firewall:
9292

9393
To enable access to the first PVA server on a Linux host and list resulting settings:
9494

95+
# Depending on Linux release, similar to this..
96+
sudo firewall-cmd --add-port=5075/tcp
97+
sudo firewall-cmd --add-port=5076/udp
98+
99+
# .. or this
95100
sudo firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m udp -p udp --dport 5076 -j ACCEPT
96101
sudo firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 5075 -j ACCEPT
97102
sudo firewall-cmd --direct --get-rules ipv4 filter IN_public_allow

‎core/pva/TLS.md‎

Lines changed: 133 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,139 @@
11
Secure Socket Support
22
=====================
33

4-
By default, the server and client will use plain TCP sockets to communicate.
5-
By configuring a keystore for the server and a truststore for the client,
6-
the communication can be switched to secure (TLS) sockets.
7-
The sockets are encrypted, and clients will only communicate with trusted servers.
8-
The following describes a minimal setup for initial tests,
9-
followed by a more elaborate setup later in this document.
4+
By default, the PV Access server and client will use plain TCP sockets to communicate.
5+
Secure PV Access uses encrypted Transport Layer Security (TLD) sockets.
6+
Clients will only communicate with trusted servers, and servers can
7+
determine the identity of their clients in a trusted way.
8+
9+
TLS relies on private and public encryption key pairs, where public keys are
10+
exchanged in the form of certificates.
11+
In a secure EPICS environment, the PV Access Certificate Management Service (pvacms)
12+
issues certificates for servers and clients and allows online checks of their
13+
validity.
14+
15+
16+
PV Access Certificate Management Service (pvacms)
17+
=================================================
18+
19+
An EPICS administrator needs to deploy pvacms as a service and maintain
20+
certificates for servers (IOCs) and clients (users running CS-Studio).
21+
This is an example recipe for getting started.
22+
23+
1) Build EPICS base and pvxs as described on
24+
https://george-mcintyre.github.io/pvxs/spvaqstart.html
25+
26+
2) Start `pvacms -v`. It will create several files, including
27+
28+
* `~/.config/pva/1.3/admin.p12`: Certificate for the `admin` user
29+
30+
3) Request a server (IOC) certificate, note its "Certificate identifier":
31+
32+
```
33+
$ authnstd --name ioc --cert-usage hybrid
34+
Keychain file created : /home/user/.config/pva/1.3/server.p12
35+
Certificate identifier : e53ed409:15273288300286014953
36+
```
37+
38+
As `admin`, accept that certificate:
39+
40+
```
41+
$ EPICS_PVA_TLS_KEYCHAIN=~/.config/pva/1.3/admin.p12 \
42+
pvxcert --approve e53ed409:15273288300286014953
43+
Approve ==> CERT:STATUS:e53ed409:15273288300286014953 ==> Completed Successfully
44+
```
45+
46+
* `~/.config/pva/1.3/server.p12`: Our server (IOC) certificate
47+
48+
4) Request a client certificate, note its identifier:
49+
50+
```
51+
$ authnstd
52+
Keychain file created : /home/user/.config/pva/1.3/client.p12
53+
Certificate identifier : e53ed409:11521018863975115478
54+
```
55+
56+
Accept that certificate:
57+
58+
```
59+
$ EPICS_PVA_TLS_KEYCHAIN=~/.config/pva/1.3/admin.p12 \
60+
pvxcert --approve e53ed409:11521018863975115478
61+
Approve ==> CERT:STATUS:e53ed409:11521018863975115478 ==> Completed Successfully
62+
```
63+
64+
* `~/.config/pva/1.3/client.p12`: Our client (user) certificate
65+
66+
67+
You now have a server and client certificate.
68+
To check the status:
69+
70+
```
71+
$ pvxcert -f ~/.config/pva/1.3/client.p12
72+
...
73+
Subject : CN=fred, C=US, O=host.site.org
74+
...
75+
Cert Expires : Wed Apr 16 18:08:58 2025 UTC
76+
...
77+
Certificate ID : e53ed409:11521018863975115478
78+
Status : VALID
79+
...
80+
```
81+
82+
To list certificate details:
83+
```
84+
keytool -list -v -keystore ~/.config/pva/1.3/client.p12 -storepass ""
85+
```
86+
87+
88+
For a test setup, all the above can be executed by a single user on one host.
89+
In a production setup, however, human user clients should only have a client.p12 file.
90+
Pseudo-users running IOCs would have a server.p12 file,
91+
and only an admin user on a designated host would have the remaining pvacms files.
92+
93+
94+
Secure IOC
95+
==========
96+
97+
Example for running a secure IOC:
98+
99+
```
100+
$ EPICS_PVAS_TLS_KEYCHAIN=~/.config/pva/1.3/server.p12 \
101+
softIocPVX -m user=fred -d pvxs/test/testioc.db
102+
```
103+
104+
The command `pvxsr 10` will list all connected clients
105+
with their connection credentials.
106+
107+
108+
Secure Java PVA Client
109+
======================
110+
111+
Example for running Java PVA client command line tool:
112+
113+
```
114+
$ export EPICS_PVA_TLS_KEYCHAIN=~/.config/pva/1.3/client.p12
115+
$ pvaclient monitor -v 5 fred:aiExample
116+
```
117+
118+
Example for running CS-Studio:
119+
120+
```
121+
$ export EPICS_PVA_TLS_KEYCHAIN=~/.config/pva/1.3/client.p12
122+
$ phoebus.sh
123+
```
124+
125+
126+
127+
--------------------------------------------------------
128+
129+
130+
Manually creating certificates
131+
==============================
132+
133+
In this section we describe an earlier approach to creating certificates.
134+
It is left for reference, the preferred method is now pvacms.
135+
136+
We start with a minimal setup for initial tests.
10137

11138
Step 1: Create a server KEYSTORE that contains a public and private key.
12139
-------

0 commit comments

Comments
 (0)