Proxies on worker nodes are only 1024 bits strong

[ernstpijper]

Hi,

When I run dirac jobs, the proxies on the worker nodes are always 1024 bits in strength. Even when I start out with a 2048 bits proxy on the user interface from where I submit jobs. Somewhere in between, a proxy is created that is only 1024 bits in length.

As a result (at least that is what I think is happening) the jobs cannot contact our dcache webdav server because it doesn't accept proxies with 1024 bit length. A measure taken by our dcache administrates because 1024 bits strength is no longer considered safe.

I noticed that the default bit strength of dirac-proxy-init is also 1024. This should be 2048, shouldn't it?
However, even if I create a proxy with 2048 bit strength on the user interface, I still end up with a 1024 proxy on the worker node. My guess is that on the dirac server, a 1024 bit proxy is created because that seems to be the default for dirac.

Does this seem like an fair assessment of the situation? And if so, how can I have the dirac server create 2048 bit proxies?
Is there some configuration option to have dirac-proxy-init on the UI create 2048 bit proxies without having to use --strength option every time?

Thanks,
Ernst

[fstagni]

Hi Ernst,
please, for these reports, always add which DIRAC version are you using (client, and server).

On this one: if your 1024 bits strength proxy is already uploaded to DIRAC ProxyDB, then the new (locally generated one, 2048 bits strength) won't replace it. You can check what's uploaded downloading it locally using dirac-admin-get-proxy command.

To remove what is uploaded issues a dirac-proxy-destroy -a and then dirac-proxy-init --strength 2048 will uploaded your new one.

Is there some configuration option to have dirac-proxy-init on the UI create 2048 bit proxies without having to use --strength option every time?

not at the moment.

[chaen]

I found a few issues on our side, I will submit a PR soon

[chaen]

Can you try #6043 ?
I think it will not break anything existing 🤞

[chaen]

I forgot to mention that it should be applied on the client side AND on the machine that runs the ProxyManager

[ernstpijper]

I have applied the patches both on the machine that runs the proxy manager and on the client side. I can confirm that the proxies stored in the proxy manager database are now 2048 bits if I use the '-b 2058' option when running dirac-proxy-init. Before the patches they were 1024 bits even if I used the '-b 2048' option. So that's good!

However, when I submit a job and execute the voms-proxy-info command, I still get that the proxy is 1024 bits. Also, if I use dirac-admin-get-proxy command and download a proxy locally on the user interface from where I submit the jobs, I also get 1024 bits.

Also, would it be possible to set the default bit strength to 2048 in the code such that I don't have to use to strength option. 2048 should be the default anyway.

[chaen]

oosp, for some reason I Did not see your reply. Let's bring it to the PR please

[fstagni]

So, this was identified as a bug, issue #6058 and PR #6043 opened.