|
|
| (115 intermediate revisions by 9 users not shown) |
| Line 1: |
Line 1: |
| − | [[Category:Grid computing]] | + | #REDIRECT[[Swestore Documentation Moved]] |
| − | [[Category:SweGrid user guide]]
| |
| − | [[Category:SweStore]]
| |
| − | [[Category:SweStore user guide]]
| |
| − | | |
| − | [[Getting started with SweGrid|< Getting started with SweGrid]]<br>
| |
| − | [[SweStore|< SweStore]]
| |
| − | | |
| − | In order to get access to computer and storage resources on the grid, you must have a valid grid certificate. This certificate is used instead of a regular password as the authentication mechanism when accessing the resource.
| |
| − | | |
| − | A certificate is the similar to a passport in real-life. In the same way you have prove your credentials when you acquire a passport the same is true for a certificate. A Certificate Authority (CA) has to vouch for your identity and sign your certificate.
| |
| − | | |
| − | =Introduction to certificates=
| |
| − | | |
| − | A certificate consist of 2 parts a private key and a public key. The private is your secret and should be kept as secure as possible. The public key is used to verify signatures are signed with your private key for the receiving part. The public part is also used to verify that the certficate is correct when you have the public part of the CA certificate.
| |
| − | | |
| − | For more information regarding certificates and public key cryptography:
| |
| − | | |
| − | [http://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography]
| |
| − | | |
| − | [http://en.wikipedia.org/wiki/Public_key_certificate http://en.wikipedia.org/wiki/Public_key_certificate]
| |
| − | | |
| − | [http://www.nordugrid.org/documents/certificate_howto.html http://www.nordugrid.org/documents/certificate_howto.html]
| |
| − | | |
| − | ==IMPORTANT==
| |
| − | | |
| − | * The grid certificate and the private key are stored in your web browser or located in ~/.globus at the host(s) from where you will be accessing grid resources:
| |
| − | usercert.pem
| |
| − | userkey.pem
| |
| − | * The certificate is personal contains your public RSA key, your name and organization. It is does not contain a user name.
| |
| − | * The certificate is valid for 13 month and should be renewed yearly.
| |
| − | * The private key is encrypted using a passphrase. Anyone that can decrypt this private key will be able to authenticate as you wherever this grid certificate is used as authentication (the public key, on the other hand, is public, and may be readable by others).
| |
| − | * The private key should be handled with great care. It should only be readable by you (i.e. ``chmod 400 userkey.pem''). Store the key on trusted computers and transfer the key between computers using encryption (using for example scp).
| |
| − | * You must choose a strong passphrase for the private key. This passphrase must not be used anywhere else. You must never ever give away the passphrase to somebody else.
| |
| − | * You should not share the certificate with someone. It's personal.
| |
| − | | |
| − | For more information regarding certificates and public key cryptography:
| |
| − | | |
| − | [http://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography]
| |
| − | [http://en.wikipedia.org/wiki/Public_key_certificate http://en.wikipedia.org/wiki/Public_key_certificate]
| |
| − | | |
| − | = Requesting a certificate =
| |
| − | | |
| − | Certificates are issued by a Certificate Authority or CA. For swedish users there are two relevant CA:s that can issue certificates, Terena and Nordugrid. The Terena CA is preferred if available for your university or research group, but many sites has not enabled this service yet. The Nordugrid CA can also be used but requires more manual work by all parties.
| |
| − | | |
| − | [[Requesting a grid certificate using the Terena eScience Portal]]
| |
| − | | |
| − | [[Requesting a grid_certificate from the Nordugrid CA]]
| |
| − | | |
| − | = Requesting membership in the SweGrid VO =
| |
| − | | |
| − | To be able to use the SweGrid or Swestore resources a membership in the SweGrid VO and a corresponding group is required. To apply for membership, make sure that your certificate is installed in the browser. Then go to the following URL:
| |
| − | | |
| − | [https://voms.ndgf.org:8443/voms/swegrid.se https://voms.ndgf.org:8443/voms/swegrid.se]
| |
| − | | |
| − | and follow the instructions. In a couple of hours you will be added to the SweGrid VO.
| |
| − | | |
| − | To be added to the correct SNIC project send a mail to [mailto:support@swegrid.se support@swegrid.se] and specify your DN as shown in the Terena portal or from the '''arproxy --info''' command and which SNIC-project to be added to.
| |
| − | | |
| − | To be added to the correct Swestore allocation send a mail to [mailto:swestore-support@snic.vr.se swestore-support@snic.vr.se] and specify your DN as shown in the Terena portal or from the '''arproxy --info''' command and which Swestore allocation to be added to.
| |
| − | | |
| − | = Proxy certificates =
| |
| − | | |
| − | Authentication on the grid is done by using special shortlived proxy certificates, which delegate authentication to specific resources. There are serveral tools available for creating, checking and destroying these proxy certificates.
| |
| − | == ARC 1.0.x ==
| |
| − | === Creating a proxy certificate ===
| |
| − | | |
| − | To create a shortlived proxy that can be used for authentication with grid services, the '''arcproxy''' command can be used. A 12 hour (default) proxy is created in the following example::
| |
| − | | |
| − | $ arcproxy
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter pass phrase for /home/jonas/.globus/userkey.pem:
| |
| − | .++++++
| |
| − | .....++++++
| |
| − | Proxy generation succeeded
| |
| − | Your proxy is valid until: 2011-03-11 03:00:14
| |
| − | | |
| − | The proxy file itself will be created in the '''/tmp''' directory with the format '''x509up_[uid]''', where uid is the userid number for your user account.
| |
| − | | |
| − | In some cases a longer lived proxy will be needed. This is achieved using the '''--constraint''' switch. A 24-hour can be created by issuing the following command:
| |
| − | | |
| − | $ arcproxy --constraint="validityPeriod=24H"
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter pass phrase for /home/jonas/.globus/userkey.pem:
| |
| − | ....++++++
| |
| − | .....++++++
| |
| − | Proxy generation succeeded
| |
| − | Your proxy is valid until: 2011-03-11 15:03:19
| |
| − | | |
| − | $ arcproxy
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter pass phrase for /home/jonas/.globus/userkey.pem:
| |
| − | ................++++++
| |
| − | ......++++++
| |
| − | Proxy generation succeeded
| |
| − | Your proxy is valid until: 2011-03-11 03:15:04
| |
| − | | |
| − | === Checking proxy lifetime ===
| |
| − | | |
| − | The remaining lifetime of a proxy-certificate can be queried using the '''arcproxy''' command using the '''--info''' switch.
| |
| − | | |
| − | $ arcproxy --info
| |
| − | Subject: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=1567862803
| |
| − | Identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Time left for proxy: 11 hours 55 minutes
| |
| − | Proxy path: /tmp/x509up_u500
| |
| − | Proxy type: X.509 Proxy Certificate Profile RFC compliant restricted proxy
| |
| − | | |
| − | Which shows that the proxy certificate is valid for 11 hours 59 minutes.
| |
| − | | |
| − | If a GSI proxy was generated the output would be:
| |
| − | | |
| − | $ arcproxy --info
| |
| − | Subject: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=proxy
| |
| − | Identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Time left for proxy: 11 hours 54 minutes 57 seconds
| |
| − | Proxy path: /tmp/x509up_u500
| |
| − | Proxy type: Legacy Globus impersonation proxy
| |
| − | | |
| − | === Destroying a proxy certificate ===
| |
| − | | |
| − | A proxy can be destroyed with the '''-r''' or '''--remove''' switches.
| |
| − | | |
| − | $ arcproxy -r
| |
| − | | |
| − | or
| |
| − | | |
| − | $ arcproxy --remove
| |
| − | | |
| − | == ARC 0.8.x ==
| |
| − | === Creating a proxy certificate ===
| |
| − | | |
| − | To create a shortlived proxy that can be used for authentication with grid services, the '''grid-proxy-init''' command can be used. A 12 hour (default) proxy is created in the following example::
| |
| − | | |
| − | $ grid-proxy-init
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter GRID pass phrase for this identity:
| |
| − | Creating proxy .................................................... Done
| |
| − | Your proxy is valid until: Tue Jan 25 01:22:59 2011
| |
| − | | |
| − | The proxy file itself will be created in the <tt>/tmp</tt> directory with the format <tt>x509up_[uid]</tt>, where uid is the userid number for your user account.
| |
| − | | |
| − | In some cases a longer lived proxy will be needed. This is achieved using the '''-valid''' switch. A 24-hour can be created by issuing the following command:
| |
| − | | |
| − | $ grid-proxy-init -valid 24:00
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter GRID pass phrase for this identity:
| |
| − | Creating proxy ................................................... Done
| |
| − | Your proxy is valid until: Thu Feb 10 18:48:34 2011
| |
| − | | |
| − | === Checking proxy lifetime ===
| |
| − | | |
| − | The remaining lifetime of a proxy-certificate can be queried using the '''grid-proxy-info''' command:
| |
| − | | |
| − | $ grid-proxy-info
| |
| − | subject : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=704530122
| |
| − | issuer : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | identity : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | type : RFC 3820 compliant impersonation proxy
| |
| − | strength : 512 bits
| |
| − | path : /tmp/x509up_u500
| |
| − | timeleft : 0:00:00
| |
| − | | |
| − | In this case the proxy has expired. Creating a new proxy-certificate with the '''grid-proxy-init''' command produces the following output from '''grid-proxy-info''':
| |
| − | | |
| − | $ grid-proxy-info
| |
| − | subject : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=1908712807
| |
| − | issuer : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | identity : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | type : RFC 3820 compliant impersonation proxy
| |
| − | strength : 512 bits
| |
| − | path : /tmp/x509up_u500
| |
| − | timeleft : 11:59:55
| |
| − | | |
| − | Which shows that the proxy certificate is valid for 11 hours 59 minutes.
| |
| − | | |
| − | === Destroying a proxy certificate ===
| |
| − | | |
| − | A proxy certificate can be destroyed using the '''grid-proxy-destroy''' command. This command will essentially just delete the temporary proxy file created with '''grid-proxy-init'''
| |
| − | | |
| − | = VOMS certificates =
| |
| − | | |
| − | To use the SweStore national storage resources a membership in a virtual organisation, VO, is required. When accessing the storage resources a special grid proxy certificate is required which indicates VO membership. The special proxy certificate requires that it is signed by the virtual organisation management server, VOMS. To enable this signing process, configuration files have to be added to the system. First a '''$HOME/.voms/vomses''' file with the following contents must be added:
| |
| − | | |
| − | <pre>"swegrid.se" "voms.ndgf.org" "15009" "/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org" "swegrid.se"</pre>
| |
| − | | |
| − | Next the file '''/etc/grid-security/vomsdir/swegrid.se/voms.ndgf.org.lsc''' with the following contents:
| |
| − | | |
| − | <pre>/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org
| |
| − | /O=Grid/O=NorduGrid/CN=NorduGrid Certification Authority</pre>
| |
| − | | |
| − | == Creating a VOMS proxy (ARC 0.8.x) ==
| |
| − | | |
| − | To create a proxy certificate the, '''voms-proxy-init''', command is used. In the following example a voms proxy certificate is created with membership in the '''ops''' group.
| |
| − | | |
| − | $ voms-proxy-init -voms swegrid.se:/swegrid.se/ops
| |
| − |
| |
| − | Enter GRID pass phrase:
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Creating temporary proxy ............................................................. Done
| |
| − | Contacting voms.ndgf.org:15009 [/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org] "swegrid.se" Done
| |
| − | Creating proxy .......................................................... Done
| |
| − | Your proxy is valid until Thu Mar 10 23:14:57 2011
| |
| − | | |
| − | == Creating a VOMS proxy (ARC 1.x) ==
| |
| − | | |
| − | VOMS proxies in ARC 1.x can be created using the '''arcproxy''' command and the '''-S''' or '''--voms''' switches as shown in the following example:
| |
| − | | |
| − | $ arcproxy -S swegrid.se:/swegrid.se/ops
| |
| − | Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
| |
| − | Enter pass phrase for /home/jonas/.globus/userkey.pem:
| |
| − | .....++++++
| |
| − | ............++++++
| |
| − | Contacting VOMS server (named swegrid.se): voms.ndgf.org on port: 15009
| |
| − | Proxy generation succeeded
| |
| − | Your proxy is valid until: 2011-03-10 23:33:06
| |
