REVIEW-39: XCI-17 Upgrade GSI-OpenSSH in preparation for OpenSSL 1.1 - Design and Security Review

Review the design and security elements of an upgrade GSI OpenSSH that prepares XSEDE for OpenSSL 1.1

Clarified questions:

• OpenSSH is not compatible (yet) with OpenSSL 1.1.x, so we will not build/test against OpenSSL 1.1.x
• We are only using distro-maintained OpenSSL
• We will release other Globus packages that have the same set of dependencies as this GSI OpenSSH

Revised design elements:

• We will build from OpenSSH 7.3p1, or OpenSSH 7.4p1 if HPN and ISSHD (NERSCmode) patches are available

GSiOpenSSH Design/Security Description:

• XCI-017-GSI-OpenSSH-Design.pdf

Criteria 1: Package versions

• Do the new version of base OpenSSH, HPN, or NERSCmod introduce any risks that need to be mitigated?

Criteria 2: Compatibility

• Will the OpenSSL 1.1.x transition support interoperate as required with older and newer version of (GSI) OpenSSH?

Criteria 3: Usage scenarios

• Are the following server, client, and hub login scenarios supported as required?
  • Scenario 1: User logs into SP from SSO Hub
  • Scenario 2: User logs into SP from another SP
  • Scenario 3: Expert user logs into SP from own machine