2.Modify the /opt/sdn/virgo/bin/dmk.sh script to add the following option to the list of

JMX_OPTS:

-Dsdn.signedJar=none

For example:

cd $KERNEL_HOME; exec $JAVA_EXECUTABLE \ $JAVA_OPTS \

$DEBUG_OPTS \ $JMX_OPTS \

-XX:+HeapDumpOnOutOfMemoryError \

-XX:ErrorFile=$KERNEL_HOME/serviceability/error.log \

-XX:HeapDumpPath=$KERNEL_HOME/serviceability/heap_dump.hprof \

-Dsdn.signedJar=none \

-Djava.security.auth.login.config=$AUTH_LOGIN \

-Dorg.eclipse.virgo.kernel.authentication.file=$AUTH_FILE \

3.Start the SDN Controller:

sudo service sdnc start

To enable jar-signing validation, remove the line containing the -Dsdn.signedJar=noneoption from the /opt/sdn/virgo/bin/dmk.sh script and restart the controller.

5.9 Revoking Trust

5.9.1 Revoking trust via truststore

The controller components rely on the public certificates in the respective truststore to establish trust with a given identity. Therefore, revoking trust from a client with a given public certificate amounts to removing its certificate from the respective truststore. To remove a given certificate from the truststore:

•List the certificates in your truststore:

keytool –list –v -keystore truststore [-storepass password]

•Delete certificate from truststore:

keytool –delete –alias cert-aliastruststore

5.9.2Revoking trust via CRL

For the controller’s REST API, a CRL (Certificate Revocation List) may also be specified to allow blacklisting of certain clients. This is done by modifying the /opt/sdn/virgo/configuration/ tomcat-server.xmlfile to include the CRL file location in the SSL connector:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="../admin/keystore" keystorePass="skyline"

crlFile="location_of_CRL file"/>

For the change to take effect, restart the controller.

5.10 SDN administrative REST API

The main SDN Controller daemon (SDNC) is accompanied by an ancillary daemon process (sdna), which runs under user sdnadmin in order to grant it access to some elevated privileges.

The administrative REST API can be used to securely perform various management functions in a privileged context. It would be undesirable for the main SDN Controller process to possess those privileges as it may be hosting execution of third-party code.

5.9 Revoking Trust 69