How to ban users with quattor

Unfortunately, there is no universal method to ban grid users from using gLite services. Enter Quattor, and via a single list of banned users we can manage the ban lists on the various node types.

How to add a user to the ban list? The template $L/cfg/sites/ndpf/site/banlist.tpl define a Pan variable GLOBAL_BANNED_USER_LIST, which is a list() containing the certificate DNs that should be banned. Adding a user to this list is simply a matter of adding one line with the DN (enclosed in double quotes and a comma after the second quote):

variable GLOBAL_BANNED_USER_LIST ?= list(
 "/O=banned users/O=grid/CN=Evil User",
 # this is a comment line
 # use comments to relate the banned user DN to a date and reason
 "/O=some other org/O=whatever/CN=Compromised Account",
);

Don't forget to give the date and reason for banning the user!

Below is the summary of services and the method of banning as background information:

• lcg-CE, classic-SE: the banned user DNs need to be stored in /opt/edg/etc/lcas/ban_users.db and /opt/glite/etc/lcas/ban_users.db.

• WMS: the banned used DNs have to be present in the file /opt/glite/etc/glite_wms_wmproxy.gacl.

• DPM: the banned user DNs need to be mapped to a non-existing Unix account in /opt/lcg/etc/lcgdm-mapfile-local.

• MyProxy (PX): To be completed