Globus Toolkit 3.2: Installation Guide
This section covers required configuration for the Globus Toolkit 3.2. It includes setting up the Grid Security Infrastructure (GSI) and acquiring host and user certificates for very basic purposes such as running a demo or a basic Grid service.
|In order for the system to
know the location of the Globus Toolkit commands you just installed,
you must set an environment variable and source the
As globus, set
This will either be
Your best option is to use an already existing CA. You may have access to one from the company you work for, or an organization you are affiliated with. Some universities provide certificates for their members and affiliates. Contact your support organization for details about how to acquire a certificate. You may find your CA listed in the TERENA Repository.
If you do not have an existing CA, you can set up a
CA for your own use with the Globus SimpleCA package. SimpleCA
provides a wrapper around the openssl CA functionality and is
sufficient for simple Grid services. Alternatively, you can use
You can also use an online certificate service. However, this option should only be used as a last resort because it does not fulfill some of the duties of a real Certificate Authority. If you must use this option, please see the following link for instructions: http://gcs.globus.org:8080/gcs.
Make sure you have the following users on your machine:
|A script was installed to set up a new SimpleCA. You only need to run this script once per grid.|
Run the setup script:
Subject name: This script prompts you for information about the CA you wish to create:
The unique subject name for this CA is: cn=Globus Simple CA, ou=simpleCA-mayed.mcs.anl.gov, ou=GlobusTest, o=Grid Do you want to keep this as the CA subject (y/n) [y]:
The common name (cn) is Globus Simple CA , which identifies this particular certificate as the CA certificate within the GloubusTest/simpleCA-hostname domain.
The organizational unit (ou) is GlobusTest , and the second ou is specific to your hostname. That identifies this CA from other CAs created by SimpleCA by other people.
The organization is Grid.
Email: The next prompt looks like:
Enter the email of the CA (this is the email where certificate requests will be sent to be signed by the CA):
Enter the email address where you intend to receive certificate requests. It should be your real email address that you check, not the address of the globus user.
|Expiration: Then you'll see:
The CA certificate has an expiration date. Keep in mind that once the CA certificate has expired, all the certificates signed by that CA become invalid. A CA should regenerate the CA certificate and start re-issuing ca-setup packages before the actual CA certificate expires. This can be done by re-running this setup script. Enter the number of DAYS the CA certificate should last before it expires. [default: 5 years (1825 days)]:
This is the number of days for which the CA certificate is valid. Once this time expires, the CA certificate will have to be recreated, and all of its certificates regranted.
|7||Accept the default (recommended).|
Generating a 1024 bit RSA private key ........++++++ ................++++++ writing new private key to '/home/globus/.globus/simpleCA//private/cakey.pem' Enter PEM pass phrase:
The passphrase of the CA certificate will
be used only when signing certificates (with
Enter your passphrase.
Important: Your passphrase must not contain any spaces.
Finally you'll see the following:
A self-signed certificate has been generated for the Certificate Authority with the subject: /O=Grid/OU=GlobusTest/OU=simpleCA-mayed.mcs.anl.gov/CN=Globus Simple CA If this is invalid, rerun this script setup/globus/setup-simple-ca and enter the appropriate fields. ------------------------------------------------------------------- The private key of the CA is stored in /home/globus/.globus/simpleCA//private/cak ey.pem The public CA certificate is stored in /home/globus/.globus/simpleCA//cacert.pem The distribution package built for this CA is stored in /home/globus/.globus/simpleCA//globus_simple_ca_68ea3306_setup-0.17.tar.gz
This information will be important for setting up other machines
in your grid. The number
Press any key to acknowledge this screen.
|Your CA setup package
finishes installing and ends the procedure with
the following reminder:
*************************************************************************** Note: To complete setup of the GSI software you need to run the following script as root to configure your security configuration directory: /opt/gt3/setup/globus_simple_ca_68ea3306_setup/setup-gsi For further information on using the setup-gsi script, use the -help option. The -default option sets this security configuration to be the default, and -nonroot can be used on systems where root access is not available. *************************************************************************** setup-ssl-utils: Complete
We'll cover this last step in the next section. For
now, just notice that it refers to your
To finish the setup of GSI, run as root (or, if no root privileges are available, add the -nonroot option to the command line):
The output should look like:
setup-gsi: Configuring GSI security Installing /etc/grid-security/certificates//grid-security.conf.CA_Hash... Running grid-security-config... Installing Globus CA certificate into trusted CA certificate directory... Installing Globus CA signing policy into trusted CA certificate directory... setup-gsi: Complete
You must request and sign a host certificate and then copy it into the appropriate directory for secure services. The certificate must be for a machine which has a consistent name in DNS; you should not run it on a computer using DHCP where a different name could be assigned to your computer.
Request a host certificate: As root, run:
grid-cert-request -host 'hostname'
This creates the following files:
Note: If you are using your own CA, follow their instructions about creating a hostcert (one which has a commonName (CN) of your hostname), then place the cert and key in the /etc/grid-security/ location. You may then proceed to user certificates.
Sign the host certificate: as globus, run:
grid-ca-sign -in hostcert_request.pem -out hostsigned.pem
A signed host certificate, named
When prompted for a passphrase, enter the one you specified in step 8 (for the private key of the CA certificate.)
As root, move the signed host
The certificate should be owned by root, and read-only for other users.
The key should be read-only by root.
|Users also must request user certificates, which you will sign using the globus user.|
Request a user certificate: As your
normal user account (not
After you enter a passphrase, this creates
Email the usercert_request.pem file to the SimpleCA maintainer.
Note: If you are using your own CA, follow their instructions about creating a usercert (one which has a commonName (CN) of your real name), then place the cert and key in the ~USER/.globus/ location. You may then proceed to verifying proxy creation.
Sign the user certificate: as the
grid-ca-sign -in usercert_request.pem -out signed.pem
When prompted for a password, enter the one you specified in step 8 (for the private key of the CA certificate.)
Now send the signed copy (
As your normal user account
The certificate should be owned by the user, and
read-only for other users.
To test that the SimpleCA certificate is installed
user$ grid-proxy-init -debug -verify
After entering your passphrase, successful output looks like:
[bacon@mayed schedulers]$ grid-proxy-init -debug -verify User Cert File: /home/user/.globus/usercert.pem User Key File: /home/user/.globus/userkey.pem Trusted CA Cert Dir: /etc/grid-security/certificates Output File: /tmp/x509up_u1817 Your identity: /O=Grid/OU=GlobusTest/OU=simpleCA-mayed.mcs.anl.gov/OU=mcs.anl.gov/CN=User Name Enter GRID pass phrase for this identity: Creating proxy ..............................++++++++++++ ...............++++++++++++ Done Proxy Verify OK Your proxy is valid until: Sat Mar 20 03:01:46 2004
As root, run:
|Add authorizations for users:|
You need two pieces of information - the subject name of a user, and the account name it should map to.
The syntax is one line per user, with the certificate subject followed by the user account name.
bacon$ grid-cert-info -subject
The corresponding line in the
"/O=Grid/OU=GlobusTest/OU=simpleCA-mayed.mcs.anl.gov/OU=mcs.anl.gov/CN=Charles Bacon" bacon
The quotes around the subject name are important, because it contains spaces.
At this step, you have a single
machine configured. Recall that in Step
8 a CA setup package was created in
$GLOBUS_LOCATION/sbin/gpt-build globus_simple_ca_HASH_setup-0.17.tar.gz gcc32dbg
Then you will have to perform the setup-gsi -default from step 10. If you are going to run services on the second host, it will need a host certificate and a grid-mapfile also. You may re-use your user certificates on the new host. You will need to copy the requests to the host where the SimpleCA was first installed in order to sign them.
Now you are ready to use secure services.
If you only want to test a basic Grid service, you are ready to test your installation.
If you want to use certain services, see the following topics: