Changes between Version 4 and Version 5 of AccountManagement
- Timestamp:
- Oct 10, 2007, 5:37:31 PM (17 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
AccountManagement
v4 v5 33 33 5. The BOINC client does an RPC to the account manager, obtaining a list of accounts. It then attaches to these accounts and proceeds. 34 34 35 RPCs to create, look up, and modify accounts are described [WebRpc here].35 There are [WebRpc web RPCs] to create, look up, and modify accounts. 36 36 37 37 == Security == … … 39 39 If hackers break into an account manager server, they could potentially cause the account manager to instruct all its clients to attach to malicious a BOINC project that runs a malicious application. To prevent this type of attack, the URLs distributed by an account manager are digitally signed. Each AM has its own signing key pair. The public key is distributed with the AM's configuration file and in all RPC replies. The private key should be stored only on a physically secure, non-connected host that is used to sign URLs. 40 40 41 To sign URLs, compile [KeySetup crypt_prog], BOINC's encryption utility program. (Instructions for downloading and compiling code are [ServerIntro here].)Generate a key pair and generate signatures for your URLs. At some point you'll need to commit to a permanent key pair, at which point you should move the private key to the signing machine (disconnected). Make a copy or two on CD-ROM also, and/or print it out on paper; keep these in a safe place. Delete all other copies of the private key.41 To sign URLs, compile [KeySetup crypt_prog], BOINC's encryption utility program. Generate a key pair and generate signatures for your URLs. At some point you'll need to commit to a permanent key pair, at which point you should move the private key to the signing machine (disconnected). Make a copy or two on CD-ROM also, and/or print it out on paper; keep these in a safe place. Delete all other copies of the private key. 42 42 43 43 == Farm managers ==