SNIC Documentation - User contributions [en]

Setting your Swestore password

2021-01-15T13:00:55Z

Janos Nagy (NSC):

[[Category:Storage]]
[[Category:Swestore]]
[[Category:Swestore user guide]]

This page describes how to find your Swestore username and how to set your password.

* First, open a new web browser tab/window and log in to the SUPR portal at https://supr.snic.se/

* Click '''Accounts''' in the left hand menu to show the ''Accounts'' page.
[[File:Swestore-pass-1.png|border|center]]

* Note your ''Username'' for the Swestore resource.
* To initiate the password change/reset process, click '''Reset Password'''
[[File:Swestore-pass-2.png|border|center]]

* You are now presented with the ''Prove Your Identity to Swestore'' page.
* Click '''Prove My Identity to Swestore'''
[[File:Swestore-pass-3.png|border|center]]

* You are now redirected to the ''Swestore password change'' page.
* Choose a new password unique to Swestore.
** '''NEVER''' use the same password for multiple resources!
** It's better to use a long password that you are comfortable typing than a short password with lots of weird special characters that you get wrong.
* Please be patient as it might take some time to move on to the next screen.
* Enter the new password in the '''Password''' and '''Verification''' text entry boxes and click '''Set'''.
[[File:Swestore-pass-4.png|border|center]]

* The page will reload and display if the password change was successful or not.
** If the text ''Password change was successful'' is displayed you have completed the password change procedure, close the web browser tab/window.
** If an error message is displayed, note if there is any specific complaints (ie. password length), correct and retry.
** The password should be at least 8 characters long.
** Note that there is a waiting period of one hour between subsequent password changes.
[[File:Swestore-pass-5.png|border|center]]

[[Swestore|< Back to the main Swestore documentation page]]

Swestore-iRODS

2020-12-09T09:47:06Z

Janos Nagy (NSC): /* From the command line */

= Swestore iRODS =
Swestore iRODS is distributed across two SNIC centres NSC and PDC. Data is stored in two copies with each copy at a different SNIC centre. This enables the system to cope with a multitude of issues ranging from a simple crash of a storage element to losing an entire site while still providing access to the stored data.

= Using Swestore iRODS =

== Basic information ==

For basic information on how to apply for storage or how to become a member of an existing project, please check the main [[Swestore]] page.

== Download and upload data==

=== From the command line ===
There are several command line tools capable of using the protocols provided by Swestore iRODS. For interactive usage on SNIC clusters we recommend using the iCommands which should be installed on all SNIC resources. There are too many commands to document fully here.

* Please check full and updated documentation at iRODS official [https://docs.irods.org/master/icommands/user/ Documentation].
* For the command line client, iRODS iCommands, please check iRODS [https://irods.org/download/ Download] page.
** Please check "Binary Distributions" and instructions for configuring your package manager to include irods APT, YUM or ZYPPER repository at [https://packages.irods.org Repository of iRODS packages ].
*** You can check here an example of [[iRODS iCommands installation on CentOS 7]] from repository.
*** You can check here an example of [[iRODS iCommands installation on Ubuntu 16.04]] from repository.

* Configuration of the icommands requires a file called irods_environment.json to be placed in a subdirectory .irods/ of your home directory (e.g. ~/.irods/irods_environment.json).
You must edit this with a text editor (not MS word, but notepad for Windows, textEdit for Mac or any Unix editor) and put your SNIC username in the place for <YOUR_SNIC_USER_NAME>.:

{
"irods_host": "irods-login.swestore.se",
"irods_port": 2432,
"irods_default_resource": "pdc-gpfs",
"irods_home": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_cwd": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_user_name": "<YOUR_SNIC_USER_NAME>",
"irods_zone_name": "snic.se",
"irods_client_server_negotiation": "request_server_negotiation",
"irods_client_server_policy": "CS_NEG_REFUSE",
"irods_encryption_key_size": 32,
"irods_encryption_salt_size": 8,
"irods_encryption_num_hash_rounds": 16,
"irods_encryption_algorithm": "AES-256-CBC",
"irods_default_hash_scheme": "SHA256",
"irods_match_hash_policy": "compatible",
"irods_authentication_scheme": "PAM"
}

First issue
iinit
which will ask for your iRODS password. You can specify a longer time limit
for the session using the <code>--ttl</code> option, <code>iinit -h --ttl</code>
will print help using this. The default generally will suffice.

Use
ils
just to check if you can access your home directory. Please use the project
directory to store files, which will be a subdirectory under
<code>//snic.se/projects/<SNIC_PROJECT_NAME></code>.

To transfer data you can use
<code>irsync</code> like:
irsync -v -r -K local_directory i:irods_directory
where
-v for verbose.
-r for recursive copy of the whole directory tree.
-K to compute and check checksums. This involves higher CPU usage
but gives confidence for the integrity of the data stored.
i.e.:
irsync -r -K mydir i:/snic.se/projects/projectdir
If, for whatever reason the transfer had been interrupted the second
invocation of the command with the same arguments should pick up and
continue from that point.

The <code>ihelp</code> command will print a short description of the iRODS
commands.

=== From GUI client ===
Graphical User Interface (GUI) clients are known to work on some operating systems.

==== Access using WebDAV (map a network drive) ====
[https://en.wikipedia.org/wiki/WebDAV WebDAV] endpoint for Windows 10, Linux and OS X is https://snic-irods-webdav.pdc.kth.se:8443/snic.se/

===== Mac OS X =====
{| class="wikitable"
!Accessing Swestore-iRODS via WebDAV on Mac OS X
|- style="text-align:center;"

| WebDAV is a method for remotely managing files over the internet. With WebDAV, you can access files stored in Swestore iRODS project by using the same interface as you do with your local files.
Once you connect via WebDAV, and you authenticate, you can view and manage the folders and files stored in your project area. You can perform same actions – drag and drop, rename, delete – that you would on files and folders stored on your own computer.

|-
| This is OS standard WebDAV connection · "Connect to server" function in Finder :
To access Swestore iRODS via WebDAV you'll need to authenticate with your username and password.
1.Click the 'Finder' icon
[[File:MacOSX Finder.png |none|250px]]
2.In 'Finder', locate the menu bar at the top and then navigate to Go > Connect to Server.
[[File:ConnectToServer.png |none|250px]]
3.In the 'Connect to Server' dialog box, enter the URL to Swestore iRODS WebDAV endpoint, in the 'Server Address' field.

4.Click Connect.

Once the connection is made, you are prompted for your WebDAV username/password.

Once you’ve connected, the WebDAV directory is mounted in your 'Finder' and on your desktop.

You can now start adding, editing, deleting files in this directory from the comfort of your computer.

[[File:Mounted webdav GUI.png |none|350px]]

|-

| This is an example how to mount with iRODS resource via "mount_webdav" command in your terminal
If you prefer to access your Swestore iRODS files via command line, you can mount the WebDAV-enabled server directory via '''mount_webdav''' command
[[File:MacOSX Terminal WebDAV mount.png |none|350px]]

|}

===== Windows =====

{| class="wikitable"
!Accessing Swestore-iRODS via WebDAV on Windows
|- style="text-align:center;"

| WebDAV is a method for remotely managing files over the internet. With WebDAV, you can access files stored in Swestore iRODS project by using the same interface as you do with your local files.
Once you connect via WebDAV, and you authenticate, you can view and manage the folders and files stored in your project area. You can perform same actions – drag and drop, rename, delete – that you would on files and folders stored on your own computer.

|-
| How to map the Swestore iRODS to a Windows computer
1. You should have received an email telling you about your Swestore iRODS username

2. We’ll use "'''s_user'''" for example

3. We'll assume that you have set your password at SNIC SUPR for the Swestore iRODS account

4. Open “File Explorer”

5. Right-click “Network”

[[File:Screenshot 2020-12-08 at 09.55.18.png |250px]]

6. Click “Map network drive”

7. Click the hyperlinked "Connect to a Web site that you can use to store your documents and pictures."

8. Click "Next" two times (while choosing "Choose a custom network location")

9. On "Specify the location of your website" enter https://snic-irods-webdav.pdc.kth.se:8443

[[File:Screenshot 2020-12-08 at 10.03.52.png |250px]]

10. Enter username and password, e.g. s_user and password

[[File:Screenshot 2020-12-08 at 10.04.36.png |250px]]

11. You can choose to name your new network drive with something meaningful

11. You should now see the folder mapped to File Explorer!

[[File:Screenshot 2020-12-08 at 10.08.15.png |250px]]

|}

=== From a web browser ===

{| class="wikitable"
!colspan="6"|Davrods is an Apache WebDAV interface to iRODS
|-
|rowspan="3"|[https://github.com/UtrechtUniversity/davrods Davrods]
|Projects
|https://snic-irods-webdav.pdc.kth.se:8443/snic.se/projects/
| To browse private data you'll need to authenticate with your username and password.
|rowspan="3"|This interface is intended as '''simple directory index''' interface. It's purpose is to list, view, download, publish, share data. It is NOT intended to upload data.
[[File:Swestore-iRODS simple webdav dir listing.png |center |thumb|350px]]
|-
|Home
|https://snic-irods-webdav.pdc.kth.se:8443/snic.se/home/
| To browse private data you'll need to authenticate with your username and password.
|-
|Public
|http://snic-irods-webdav.pdc.kth.se:8888/snic.se/home/public/
| This web interface is used to publish data with "world" and no authentication is required. <pre style="color: red">NOTE: different port 8888 </pre>

|-
| [https://github.com/irods-contrib/metalnx-web Metalnx]
| Login
| https://snic-irods-web.pdc.kth.se/emc-metalnx-web/login/
|To access SNIC iRODS Zone you'll need to authenticate with your username and password.
| Metalnx is a web application designed to work alongside iRODS. It is a graphical user interface and serves as a client that authenticates to an existing iRODS Zone.
[[File:Screenshot 2020-03-04 at 14.09.10.png |center |thumb|350px]]

|}

= Using Swestore iRODS at PDC =

* [https://www.pdc.kth.se/support/documents/data_management/swestore.html PDC Support pages for Swestore (iRODS)]
* [https://www.pdc.kth.se/support/documents/data_management/file_transfer_swestore.html PDC Support pages about Swestore (iRODS) client on PDC transfer node]

= Using Swestore iRODS at NSC =

[https://snicdocs.nsc.liu.se/wiki/Swestore-iRODS-at-NSC Here you can read more about the NSC specific aspects]

Swestore-iRODS-at-NSC

2020-12-09T09:41:33Z

Janos Nagy (NSC): /* Accessing iRODS from the compute cluster */

= Swestore iRODS at NSC =

iRODS is a distributed storage management system which enables the user to
control the access to his/her data via policies which are expressed as rules.
Swestore iRODS is hosted on servers at PDC and NSC. We are running version 4.2.6.
Basic information about how to store and access data had been described above.
Additional information about iRODS can be found at [http://www.irods.org the iRODS web site].

== iRODS system at NSC ==

At NSC we host a replica metadata server and two storage server nodes at the moment.
All data stored is replicated between PDC and NSC.

== Accessing iRODS from the compute cluster ==

Data stored in iRODS is accessible from <code>tetralith</code>.
We have got the command line client installed on the cluster,
iCommands should work from the login node and also from the batch
nodes.

You should have the client configuration files in place under
the <code>~/.irods</code> directory as it has been described under
the introductory pages.

Under your home directory you should create a directory called
<code>.irods</code> which will contain the iRODS client configuration
file. That file is <code>irods_environment.json</code>. It should
look like:
{
"irods_host": "irods-login.swestore.se",
"irods_port": 2432,
"irods_default_resource": "pdc-gpfs",
"irods_home": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_cwd": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_user_name": "<YOUR_SNIC_USER_NAME>",
"irods_zone_name": "snic.se",
"irods_client_server_negotiation": "request_server_negotiation",
"irods_client_server_policy": "CS_NEG_REFUSE",
"irods_encryption_key_size": 32,
"irods_encryption_salt_size": 8,
"irods_encryption_num_hash_rounds": 16,
"irods_encryption_algorithm": "AES-256-CBC",
"irods_default_hash_scheme": "SHA256",
"irods_match_hash_policy": "compatible",
"irods_authentication_scheme": "PAM"
}
where the token <code><YOUR_SNIC_USER_NAME></code> should be replaced
with your SNIC user name.

Issue:
module load irods-client/4.2.6
after which you should authenticate using <code>iinit</code> and then the iCommands like
<code>iget</code>, <code>iput</code>, <code>ils</code> should work as expected.
The <code>ihelp</code> command will print a short description of the irods commands.

First issue
iinit
which will ask for your iRODS password. You can specify a longer time limit
for the session using the <code>--ttl</code> option, <code>iinit -h --ttl</code>
will print help using this. The default generally will suffice.

Use
ils
just to check if you can access your home directory. Please use the project
directory to store files, which will be a subdirectory under
<code>//snic.se/projects/<SNIC_PROJECT_NAME></code>.

To transfer data from the cluster directory it is a good idea to use
<code>irsync</code> like:
irsync -v -r -K local_directory i:irods_directory
where
-v for verbose.
-r for recursive copy of the whole directory tree.
-K to compute and check checksums. This involves higher CPU usage
but gives confidence for the integrity of the data stored.
i.e.:
irsync -r -K mydir i:/snic.se/projects/projectdir
If, for whatever reason the transfer had been interrupted the second
invocation of the command with the same arguments should pick up and
continue from that point.

Detailed description of the command line client can be found at
[https://docs.irods.org/master/icommands/user/ documentation at the iRODS site].

Swestore-iRODS-at-NSC

2020-12-09T09:28:35Z

Janos Nagy (NSC):

= Swestore iRODS at NSC =

iRODS is a distributed storage management system which enables the user to
control the access to his/her data via policies which are expressed as rules.
Swestore iRODS is hosted on servers at PDC and NSC. We are running version 4.2.6.
Basic information about how to store and access data had been described above.
Additional information about iRODS can be found at [http://www.irods.org the iRODS web site].

== iRODS system at NSC ==

At NSC we host a replica metadata server and two storage server nodes at the moment.
All data stored is replicated between PDC and NSC.

== Accessing iRODS from the compute cluster ==

Data stored in iRODS is accessible from <code>tetralith</code>.
We have got the command line client installed on the cluster,
iCommands should work from the login node and also from the batch
nodes.

You should have the client configuration files in place under
the <code>.irods</code> directory as it has been described under
the introductory pages.

Under your home directory you should create a directory called
<code>.irods</code> which contains the iRODS client configuration
file. That file is <code>irods_environment.json</code>. It should
look like:
{
"irods_host": "irods-login.swestore.se",
"irods_port": 2432,
"irods_default_resource": "pdc-gpfs",
"irods_home": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_cwd": "/snic.se/home/<YOUR_SNIC_USER_NAME>",
"irods_user_name": "<YOUR_SNIC_USER_NAME>",
"irods_zone_name": "snic.se",
"irods_client_server_negotiation": "request_server_negotiation",
"irods_client_server_policy": "CS_NEG_REFUSE",
"irods_encryption_key_size": 32,
"irods_encryption_salt_size": 8,
"irods_encryption_num_hash_rounds": 16,
"irods_encryption_algorithm": "AES-256-CBC",
"irods_default_hash_scheme": "SHA256",
"irods_match_hash_policy": "compatible",
"irods_authentication_scheme": "PAM"
}
where the token <code><YOUR_SNIC_USER_NAME></code> should be replaced
with your SNIC user name.

Issue:
module load irods-client/4.2.6
after which you should authenticate using <code>iinit</code> and then the iCommands like
<code>iget</code>, <code>iput</code>, <code>ils</code> should work as expected.
The <code>ihelp</code> command will print a short description of the irods commands.

First issue
iinit
which will ask for your iRODS password. You can specify a longer time limit
for the session using the <code>--ttl</code> option, <code>iinit -h --ttl</code>
will print help using this. The default generally will suffice.

Use
ils
just to check if you can access your home directory. Please use the project
directory to store files, which will be a subdirectory under
<code>//snic.se/projects/<SNIC_PROJECT_NAME></code>.

To transfer data from the cluster directory it is a good idea to use
<code>irsync</code> like:
irsync -r -K local_directory i:irods_directory
where
-r for recursive copy of the whole directory tree
-K to compute and check checksums
i.e.:
irsync -r -K mydir i:/snic.se/projects/projectdir
If, for whatever reason the transfer had been interrupted the second
invocation of the command with the same arguments should pick up and
continue from that point.

Detailed description of the command line client can be found at
[https://docs.irods.org/master/icommands/user/ documentation at the iRODS site].

Swestore-iRODS-at-NSC

2020-06-01T10:24:15Z

Janos Nagy (NSC): /* Accessing iRODS from the compute cluster */

Swestore-iRODS-at-NSC

2020-06-01T10:22:32Z

Janos Nagy (NSC):

2013-11-19T18:06:04Z

Janos Nagy (NSC): /* SweStore iRODS usage documentation */

Swestore-irods

2013-11-04T09:32:04Z

Janos Nagy (NSC): /* Supported clients */

Swestore-irods

2013-11-04T08:47:27Z

Janos Nagy (NSC): /* National storage */

Swestore-irods

2013-11-01T21:36:51Z

Janos Nagy (NSC): /* iRODS */

[[Category:Storage]]
[[Category:SweStore]]

'''This is not official yet'''

SNIC is building a storage infrastructure to complement the computational resources.

Many forms of automated measurements can produce large amounts of data. In scientific areas such as high energy physics (the Large Hadron Collider at CERN), climate modeling, bioinformatics, bioimaging etc., the demands for storage are increasing dramatically. To serve these and other user communities, SNIC has appointed a working group to design a storage strategy, taking into account the needs on many levels and creating a unified storage infrastructure, which is now being implemented.

Swestore is in collaboration with [http://www.ecds.se/ ECDS], [http://snd.gu.se/ SND], Bioimage Sweden, [http://www.bils.se/ BILS], [http://www.uppnex.uu.se/ UPPNEX],[http://wlcg.web.cern.ch/ WLCG], [http://www.nrm.se/ NaturHistoriska RiksMuseet].

= National storage =
The Swestore Nationally Accessible Storage, commonly called just Swestore, is a robust, flexible and expandable long term storage system aimed at storing large amounts of data produced by various Swedish research projects. It is based on the [http://www.dcache.org dCache] and [http://www.irods.org iRODS]
storage systems.

Swestore is distributed across the SNIC centres [http://www.c3se.chalmers.se/ C3SE], [http://www.hpc2n.umu.se/ HPC2N], [http://www.lunarc.lu.se/ Lunarc], [http://www.nsc.liu.se/ NSC], [http://www.pdc.kth.se PDC] and [http://www.uppmax.uu.se Uppmax]. Data is stored in two copies with each copy at a different SNIC centre. This enables the system to cope with a multitude of issues ranging from a simple crash of a storage element to losing an entire site while still providing access to the stored data.

One of the major advantages to the distributed nature of dCache and iRODS is the excellent aggregated transfer rates possible. This is achieved by bypassing a central node and having transfers going directly to/from the storage elements if the protocol allows it. The Swestore Nationally Accessible Storage system can achieve aggregated transfer rates in excess of 100 Gigabit per second, but in practice this is limited by connectivity to each University (usually 10 Gbit/s) or a limited number of files (typically
max 1 Gbit/s per file/connection).

To protect against silent data corruption the dCache storage system checksums all stored data and periodically verifies the data using this checksum.

The dCache system does NOT yet provide protection against user errors like inadvertent file deletions and so on. The iRODS system provides this protection. Deleted files are moved to a trashcan.

== Getting access ==
; Apply for storage
: Please follow the instructions on the [[Apply for storage on SweStore]] page.

;Difference between dCache and iRODS user authentication
:SweStore's dCache system uses eScience client certificates.
:SweStore's iRODS system uses [http://www.yubico.com/products/yubikey-hardware/yubikey/ Yubikey] one-time passwords (OTP). With a simple touch of a button, a 44 character one-time password is generated and sent to the system.

; dCache usage - How to acquire an eScience client certificate
: Follow the instructions on [[Grid_certificates#Requesting_a_certificate|Requesting a certificate]] to get your client certificate. This step can be performed while waiting for the storage application to be approved and processed. Of course, if you already have a valid eScience certificate you don't need to acquire another one.
:; For Terena certificates
:: If intending to access SweStore from a SNIC resource, please make sure you also [[Exporting_a_client_certificate|export the certificate]], transfer it to the intended SNIC resource and [[Preparing_a_client_certificate|prepare it for use with grid tools]] (not necessarily needed with ARC 3.x, see [[Grid_certificates#Creating_a_proxy_certificate_using_the_Firefox.2FThunderbird_credential_store|proxy certificates using Firefox credential store]]).
:; For Nordugrid certificates
:: Please make sure to also [[Requesting_a_grid_certificate_from_the_Nordugrid_CA#Installing_the_certificate_in_your_browser|install your client certificate in your browser]].
:; Request membership in the SweGrid VO
:: Follow the instructions on [[Grid_certificates#Requesting_membership_in_the_SweGrid_VO|Requesting membership in the SweGrid VO]] to get added to the SweGrid Virtual Organisation (VO) and request membership to your allocated storage project.

; iRODS usage - How to acquire a SweStore YubiKey

To apply for a SweStore yubikey, please send an email to [mailto:support@swestore.se?subject=Yubikey support@swestore.se] and provide a shipping address to where the yubikey should be sent.

== Support ==

If you have any issues using SweStore please do not hesitate to contact [mailto:support@swestore.se support@swestore.se].

== dCache ==

=== Access protocols ===
; Currently supported protocols
: GridFTP - gsiftp://gsiftp.swestore.se/
: Storage Resource Manager - srm://srm.swegrid.se/
: Hypertext Transfer Protocol (read-only), Web Distributed Authoring and Versioning - http://webdav.swestore.se/ (unauthenticated), https://webdav.swestore.se/
: NFS4.1

For authentication eScience certificates are used, which provides a higher level of security than legacy username/password schemes.

=== Download and upload data ===
; Interactive browsing and manipulation of single files
: SweStore is accessible in your web browser in two ways, as a directory index interface at https://webdav.swestore.se/ and with an interactive file manager at https://webdav.swestore.se/browser/. '''Note''' that the interactive file manager has a lot of features and functions not supported in SweStore, only the basic file transfer features are supported.
: To browse private data you need to have your certificate installed in your browser (default with Terena certificates, see above). Projects are organized under the <code>/snic</code> directory as <code><nowiki>https://webdav.swestore.se/snic/YOUR_PROJECT_NAME/</nowiki></code>.
; Upload and delete data interactively or with automation
There are several tools that are capable of using the protocols provided by SweStore national storage.
For interactive usage on SNIC clusters we recommend using the ARC tools which should be installed on all SNIC resources.
As an integration point for building scripts and automated systems we suggest using the curl program and library.
: Use the ARC client. Please see the instructions for [[Accessing SweStore national storage with the ARC client]]. '''Recommended''' method when logged in on SNIC resources.
: Use lftp. Please see the instructions for [[Accessing SweStore national storage with lftp]].
: Use cURL. Please see the instructions for [[Accessing SweStore national storage with cURL]].
: Use globus-url-copy. Please see the instructions for [[Accessing SweStore national storage with globus-url-copy]].

=== Tools and scripts ===

There exists a number of tools and utilities developed externally that can be useful. Here are some links:

* [https://github.com/samuell/arc_tools ARC_Tools] - Convenience scripts for the arc client (Only a recursive rmdir so far).
* [http://sourceforge.net/projects/arc-gui-clients ARC Graphical Clients] - Contains the ARC Storage Explorer (SweStore supported development).
* Transfer script, [[SweStore/swetrans_arc|swetrans_arc]], provided by Adam Peplinski / Philipp Schlatter
* [http://www.nordugrid.org/documents/SWIG-wrapped-ARC-Python-API.pdf Documentation of the ARC Python API (PDF)]

=== Slides and more ===

[http://docs.snic.se/wiki/Swestore/Lund_Seminar_Apr18 Slides and material from seminar for Lund users on April 18th]

=== Usage monitoring ===
* [http://status.swestore.se/munin/monitor/monitor/ Per Project Monitoring of Swestore usage]

== iRODS ==

== Build and install the SNIC iCAT server ==

=== Build postgres ===

We use postgres version 9.4 with unixodbc and build it from
source.

The binaries will be built under <code>/usr/postgres</code>
since the e-irods install script expects the postgres directory
tree to be under <code>/usr</code>. The userid <code>postgres</code>
will own the directory tree.

Data will be owned by the <code>postgres</code> userid and under
<code>/postgres</code> since that is necessary for the peaceful
co-existence with unixodbc. We will use xfs for the database file system.
The file system is created as a RAID6 slice on an array with
10 x 3TB spindles. We plan to obtain a mirrored pair of disks
for the online logs to have them separate.

An account and a group called postgres is created. In it's home
directory there is an install subdirectory with the command line
history and the two scripts, <code>postgres-build.sh</code>
and <code>unixodbc-build.sh</code> which are used to build the software.
There is a tarball of the result of make install and to be used
on the iCAT hosts.
Use:
cd
cd src
tar -xf ../tar/postgresql-9.2.4.tar.gz
cd postgresql-9.2.4
cp ~/install/scripts/postgres-build.sh .
./postgres-build.sh 2>&1 | tee -a postgres-build.log
cd
cd src
tar -xf ../tar/unixODBC-2.3.1.tar.gz
cd unixODBC-2.3.1
./unixodbc-build.sh 2>&1 | tee -a unixodbc-build.log
This should create everything under <code>/usr/postgres</code>.
A tarball is manually created under <code>~postgres/install/tar</code>
as <code>postgres-9.4-snic-build.tar.gz</code>.

The database will run on snic-irods, so the
<code>/usr/postgres</code> tree is taken and transplanted
from snic-irods-mgmt using the tarball.

=== Running postgres on the iCAT server ===

The userid <code>postgres</code> is added to the puppet manfiests.

Puppet manifests will also need to be amended with mount options
for the <code>/postgres</code> file system.

Create the data file system manually as:
mkfs.xfs -b size=4096 -d su=64k,sw=8 -l size=64m,su=64k \
-i maxpct=1 -L /pgsql /dev/xvdc

Logged as:
<pre>
meta-data=/dev/xvdc isize=256 agcount=32, agsize=8388592 blks
= sectsz=512 attr=2, projid32bit=0
data = bsize=4096 blocks=268434944, imaxpct=1
= sunit=16 swidth=128 blks
naming =version 2 bsize=4096 ascii-ci=0
log =internal log bsize=4096 blocks=16384, version=2
= sectsz=512 sunit=16 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0
</pre>

Mount the file system with the options:
logbufs=8,logbsize=256k,largeio,inode64
so update <code>/etc/fstab</code> accordingly.

Mount it:
mkdir /postgres
mount -a
chown postgres.postgres /postgres
chmod g+w /postgres
chmod g+s /postgres

The default umask for unkown reason is 002.
Might be changed to 022. Create profile for
postgres user as:

<pre>
# Add postgres stuff.
export PATH=$PATH:/usr/postgres/bin
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/postgres/lib
export MANPATH=/usr/share/man:/usr/postgres/share/man

# Fix umask.
umask 022

# Simple prompt.
PS1="$ "
export PS1

# Colourless and odorless.
alias ls='ls --color=never'
</pre>

Change limits in /etc/security/limits.conf as:
<pre>
postgres - core unlimited
postgres - data unlimited
postgres - fsize unlimited
postgres - memlock unlimited
postgres - nofile 8192
postgres - rss unlimited
postgres - stack unlimited
postgres - cpu unlimited
postgres - nproc 2048
postgres - as unlimited
postgres - msgqueue unlimited

eirods - core unlimited
eirods - data unlimited
eirods - fsize unlimited
eirods - memlock unlimited
eirods - nofile 8192
eirods - rss unlimited
eirods - stack unlimited
eirods - cpu unlimited
eirods - nproc 2048
eirods - as unlimited
eirods - msgqueue unlimited
</pre>

=== Change file for authd ===

Change <code>/etc/xinetd.d/auth</code> as:
<pre>
service auth
{
disable = no
socket_type = stream
wait = no
user = ident
cps = 4096 10
instances = UNLIMITED
server = /usr/sbin/in.authd
server_args = -t60 --xerror --os
}
</pre>

=== Create the database ===

Make sure the locale is set to UTF8.
Use:
/bin/su - postgres
mkdir /postgres/icats01 /postgres/icats01/data /postgres/icats01/log
chmod g+w /postgres/icats01 /postgres/icats01/data /postgres/icats01/log
initdb -D /postgres/icats01/data -X /postgres/icats01/log \
-E UTF8 --locale=UTF8 -U postgres

Get the startup script as:
cp ~postgres/install/postgresql /etc/init.d/postresql

As root:
/etc/init.d/postgresql start

=== Changes relative to e-iRODS 3.0 ===

A git repository of the original tree for e-iRODS 3.0 had been created
by Andreas. It is accessible as
<code>ssh://datil.nsc.liu.se/srv/git/e-irods.git</code>.
It is accessed via <code>ssh</code> so first on the computer which
has the ssh keys:
ssh-add
ssh -A snic-irods-mgmt
Then
git clone ssh://datil.nsc.liu.se/srv/git/e-irods.git

In <code>./iRODS/config/config.mk</code> various options changed.
Actually this is generated, it is config.mk.in to be
changed.
vi ./iRODS/config/config.mk.in

Define <code>POSTGRES_HOME</code> here as it seems to be an option here
as well:

Enable syslog logging (will also switch of file logging).
<pre>
IRODS_SYSLOG = 1
</pre>

PAM authentication. This is now default, no need to change.
<pre>
PAM_AUTH = 1
</pre>

Location of the executable, should be read only for iRODS.
<pre>
PAM_AUTH_CHECK_PROG=/usr/sbin/PamAuthCheck
</pre>

To get unique .irodsA credential tokens per session with a
TTL defaulting to 8 hrs instead of two weeks, making it
more difficult for an attacker to use a stolen .irodsA file.
Change in platform.mk to add CFLAG for previous define
<pre>
PAM_AUTH_NO_EXTEND = 1
</pre>

For the encryption of communication channel between
client/server when sending PAM password). Now on as default.
<pre>
USE_SSL = 1
</pre>

Suggestion from Pontus.
<pre>
UNI_CODE = 1
</pre>

Update the version number. In file ./packaging/VERSION.
Like:
<pre>
EIRODSVERSION=3.0.1b1-snic2
</pre>
vi ./packaging/VERSION
git commit -m "Customized local version" ./packaging/VERSION

git commit -m "Our config changes" config.mk.in

We leave this since reviewing the source we believe this is fixed.
But it's not. Replace in the function definition startIrods.
In the script <code>eirods_setup.pl</code> the call to the function "run" to
run a script to start irods gets stuck. The call is to be replaced
with the "system" call (does not return diagnostics output but works).
vi ./iRODS/scripts/perl/eirods_setup.pl
git commit -m "Startup changed in function startIrods" ./iRODS/scripts/perl/eirods_setup.pl

In <code>./iRODS/server/core/include/rodsServer.h</code>
raise the number of connections MAX_SVR_SVR_CONNECT_CNT to some
number above a hundred at least.
Also, raise <code>NUM_READ_WORKER_THR</code>.
vi ./iRODS/server/core/include/rodsServer.h
git commit -m "Raising resource limits" ./iRODS/server/core/include/rodsServer.h

In <pre>./iRODS/scripts/perl/irodsctl.pl.orig</pre> iRODS server is changed
to start up always in the background.
vi ./iRODS/scripts/perl/irodsctl.pl
git commit -m "Start always in the background and wait" ./iRODS/scripts/perl/irodsctl.pl

More extensive changes in <pre>./packaging/postinstall.sh</pre>.
vi ./packaging/postinstall.sh
Running a command with su requires - to pick up the environment of that
user. Put cd inside the -c command string.
:%s/su --shell/\/bin\/su - --shell/
git commit -m "Run su with -" ./packaging/postinstall.s

In <pre>./packaging/build.sh</pre> find Postgresql installed under
<pre>/usr/postgres</pre>.
vi ./packaging/build.sh
git commit -m "Find Postgresql under /usr" ./packaging/build.sh

In the template listing of package files add profile with postgres
access. Can also take the copy of the Postgres profile.
The profile content is:
<pre>
export PATH=$PATH:/usr/postgres/bin
export LD_LIBRARY_PATH=$PATH:/usr/postgres/lib
export MANPATH=/usr/share/man:/usr/postgres/share/man
umask 022
</pre>

Add the file itself like:
cat >packaging/eirods-dot-profile
git add ./packaging/eirods-dot-profile
git commit -m "New file profile" ./packaging/eirods-dot-profile
vi ./packaging/eirods.list.template
git commit -m "Profile addedd" ./packaging/eirods.list.template

Startup script is broken, fix it.
vi ./packaging/eirods
git commit -m "Startup script fixed" ./packaging/eirods

Finish.
git commit
git push

=== Bulding the packages ===

An additional dependency is:
yum install fuse-devel

Run the build shell script to build the iCAT server package.
cd
rm -rf rpmbuild
cd src/e-irods
cd packaging
./build.sh icat postgres 2>&1 | tee -a eirods-build.log

For the resource server package:
cd
cd src/e-irods
cd packaging
./build.sh resource 2>&1 | tee -a eirods-build.log

Packages are created in:
cd build

=== To uninstall ===

Run:
rpm -e eirods-3.0.1b1-0.x86_64
/bin/su - postgres -c 'dropdb EICAT; dropuser eirods;'
/usr/sbin/userdel eirods

=== Install the eirods packages ===

As root run rpm -i --nodeps to install the package which was
built on the management node.

Get the environment for postgres since the install script
does not do /bin/su - to run .profile.
. ~postgres/.profile
export PS1='# '

Install the package.
cd /root/kits/eirods-3.0.1b1/rpm
rpm -vv -i --nodeps eirods-3.0.1b1-snic2-64bit-icat-postgres-centos6.rpm
rom -vv -i eirods-dev-3.0.1b1-snic2-64bit-centos6.rpm

Check the output because finishes even when inside the postinstall
script fails.

Check the log:
view /var/lib/eirods/iRODS/installLogs/eirods_setup.log

If the postinstall script fails to re-run it like:
/var/lib/eirods/packaging/postinstall.sh /var/lib/eirods eirods icat post
gres postgres EICAT localhost 5432 eirods lly2YOjjPEHkM0p

=== Modify the default zone and set password ===

Run:
/bin/su - eirods
iadmin modzone tempZone name snicZone

Confirm local zone change.

Change the iRODS environment file accordingly.
vi .irods/.irodsEnv
Replace tempZone with snicZone everywhere.

Modify password:
iadmin moduser rods password password
iexit full
iinit

=== Client install ===

The client will have prerequisits as:
yum -y install openssl098e
yum -y install postgresql-odbc
yum -y install fuse fuse-libs

Install the package:
rpm -vv -i kits/eirods-3.0.1b1/eirods-3.0.1b1-snic2-64bit-resource-centos6.rpm

Run setup:
/bin/su - eirods
./packaging/setup_resource.sh
snic-irods.nsc.liu.se
1247
snicZone
rods
password

=== Create resources ===

Create directories from admin workstation:

ssh root@snic-sr-001 mkdir /snic-sr-001/Vault
ssh root@snic-sr-002 mkdir /snic-sr-002/Vault
ssh root@snic-sr-003 mkdir /snic-sr-003/Vault
ssh root@snic-sr-004 mkdir /snic-sr-004/Vault

ssh root@snic-sr-001 chown eirods.eirods /snic-sr-001/Vault
ssh root@snic-sr-002 chown eirods.eirods /snic-sr-002/Vault
ssh root@snic-sr-003 chown eirods.eirods /snic-sr-003/Vault
ssh root@snic-sr-004 chown eirods.eirods /snic-sr-004/Vault

Create resources on the iCAT server:

iadmin mkresc snic-sr-001-lfs01 "unix file system" snic-sr-001.nsc.liu.se:/snic-sr-001/Vault
iadmin mkresc snic-sr-002-lfs01 "unix file system" snic-sr-002.nsc.liu.se:/snic-sr-002/Vault
iadmin mkresc snic-sr-003-lfs01 "unix file system" snic-sr-003.nsc.liu.se:/snic-sr-003/Vault
iadmin mkresc snic-sr-004-lfs01 "unix file system" snic-sr-004.nsc.liu.se:/snic-sr-004/Vault

Create directories from the admin workstation:

irods-do ssh "/bin/su - eirods -c \"mkdir /swestore/eirods\""
irods-do ssh "/bin/su - eirods -c \"mkdir /swestore/eirods/Vault\""

Create nfs resources:

iadmin mkresc snic-sr-001-nfs01 "unix file system" snic-sr-001.nsc.liu.se:/swestore/eirods/Vault
iadmin mkresc snic-sr-002-nfs01 "unix file system" snic-sr-002.nsc.liu.se:/swestore/eirods/Vault
iadmin mkresc snic-sr-003-nfs01 "unix file system" snic-sr-003.nsc.liu.se:/swestore/eirods/Vault
iadmin mkresc snic-sr-004-nfs01 "unix file system" snic-sr-004.nsc.liu.se:/swestore/eirods/Vault

=== Test composable resource replication ===

Create composable test resource:
iadmin mkresc tmp1 replication
iadmin mkresc tmp11 "unix file system" snic-sr-001.nsc.liu.se:/tmp/Vault1
iadmin mkresc tmp12 "unix file system" snic-sr-002.nsc.liu.se:/tmp/Vault2
iadmin addchildtoresc tmp1 tmp11
iadmin addchildtoresc tmp1 tmp12

=== Create default resource ===

/bin/su - eirods
iadmin mkresc snicdefResc "unix file system" snic-sr-001.nsc.liu.se:/swes
tore/eirods/snicdefResc/Vault

=== Accessing files as another user ===

Set environment variable:
export clientUserName=user

Then you can run icommands as user.

=== Setting up project hierarchy ===

As eirods user run:
imkdir /snicZone/proj/p1
iadmin mkgroup p1
iadmin atg p1 u1
ichmod -r read p1 /snicZone/proj/p1
ichmod -r write p1 /snicZone/proj/p1
ichmod -r inherit /snicZone/proj/p1
Any member of p1 should able to read/write
everything under the project group directory
tree.

==== Security efix ===

Do:
/bin/su - eirods
cd
cd iRODS/server/bin/cmd
mkdir -p /var/lib/eirods/save/cmd-removed
mv hello test_execstream.py univMSSInterface.sh /var/lib/eirods/save/cmd-removed/

== Supported clients ==

: iDrop web - Point your Web browser to [https://iweb.swestore.se iweb.swestore.se]
: E-iRODS iCommands - Command line client [http://eirods.org/download/ Download E-iRODS icommands]

SweStore iRODS uses PAM authentication and SweStore yubikeys. With a simple touch of a button, a 44 character one-time password is generated and sent to the system.

The community iRODS client also should work, with PAM authentication e.g.
the following changes to the Makefile iRODS/config/config.mk and a recompile:
<pre>
PAM_AUTH = 1
PAM_AUTH_NO_EXTEND = 1
USE_SSL = 1
</pre>

=== SweStore iRODS usage documentation ===

To use the system you need to have the E-iRODS command line client installed or using iDROP web.

==== Command line client ====

For Linux systems the iRODS commandline client is available as an installable package for various
Linux platforms from the e-iRODS website downloads section.

The command line client is natural to use for Unix users.
There are versions of the usual ls, rm, mv, mkdir, pwd, rsync
commands prefixed with an i for iRODS, i.e. irm, imv, imkdir etc.

As expected iput and iget move files to and from the irods system.
All these commands print short help when using the -h option.

===== iCommands environment file =====

There is an environment file .irodsEnv in the .irods subdirectory
of the home directory ($HOME/.irods/.irodsEnv) which contains information where and how
to access the iRODS metadata (iCAT) server.

It looks like (placeholders are in <>):
<pre>
irodsHost 'irods.swestore.se'
irodsPort 1247
irodsDefResource 'snicdefResc'
irodsHome '/snicZone/home/<email address>'
irodsCwd '/snicZone/home/<email address>'
irodsUserName '<email address>'
irodsZone 'snicZone'
irodsAuthScheme 'PAM'
</pre>

The iCAT server is irods.swestore.se.
The default irods zone name is snicZone.
The default resource is snicdefResc.

With the corrent environment file all we need is a Yubikey and we can run the iinit command to authenticate to the iCAT server. After that we can use the usual iCommands for 8 hours.

More details on the iCommands are available at
https://www.irods.org/index.php/icommands

===== Using iCommands on SNIC HPC clusters =====

On SNIC-clusters the icommands command line tools are either available in the PATH or by adding the irods module, e.g.
: module load irods
We also need to setup the iCommands environment file $HOME/.irods/.irodsEnv

==== iDROP web client ====

The web client is accessible via the URL https://iweb.swestore.se/.
A login screen will be presented first and your Yubikey should
be used to log in.

==== Upstream documentation ====
Detailed documentation, papers and resources are available from
the [http://www.eirods.org E-iRODS web site]

[http://www.irods.org Community iRODS]

[https://groups.google.com/d/forum/irod-chat‎ User forum]

= Center storage =
Centre storage, as defined by the SNIC storage group, is a storage solution that lives independently of the computational resources and can be accessed from all such resources at a centre. Key features include the ability to access the same filesystem the same way on all computational resources at a centre, and a unified structure and nomenclature for all centra. Unlike cluster storage which is tightly associated with a single cluster, and thus has a limited life-time, centre storage does not require the users to migrate their own data when clusters are decommissioned, not even when the storage hardware itself is being replaced.

== Unified environment ==
To make the usage more transparent for SNIC users, a set of environment variables are available on all SNIC resources:

* <code>SNIC_BACKUP</code> – the user's primary directory at the centre (the part of the centre storage that is backed up)
* <code>SNIC_NOBACKUP</code> – recommended directory for project storage without backup (also on the centre storage)
* <code>SNIC_TMP</code> – recommended directory for best performance during a job (local disk on nodes if applicable)

Swestore-irods

2013-10-31T12:19:28Z

Janos Nagy (NSC): /* iRODS */