Accessing the NW-GRID (from Linux)

Accessing the NW-GRID(from Linux) John Kewley Grid Technology Group E-Science Centre CCLRC Daresbury Laboratory j.kewley@dl.ac.uk

Talk outline • Requirements for using the NW-GRID • GROWL Scripts • Installing client middleware (for Linux) • Certificate manipulation • Problems with firewalls • Registering for NW-GRID

Requirements for access To access the NW-Grid, you will need: • Client-side middleware on the accessing computer (unless you intend using only browser/portal technology) • An e-science certificate in an appropriate format • No firewalls "in the way" between your client and the grid resource • The Distinguished Name (DN) from your certificate registered with the NW-Grid machine GROWL can help with the first two of these

GROWL Scripts GROWL tries to address the three barriers that newcomers find when using the Grid for the first time: • Setting up the client-side middleware • Handling of certificates • Job submission in the presence of firewalls We will only concern ourselves with the first 2 of these for now.

Client Middleware: Problems • Typically need to be root to install • Software must be downloaded from various locations (unless software stacks such as OMII / VDT is used) • There are many choices for type of installation (too many options?)

Installing Grid middleware GROWL scripts provide an alternative way of installing Grid middleware on your client Linux machine to that given on the NGS website: Advantages: • Don't need to be a privileged user • Will download client middleware packages for your system (assuming it is supported) • Minimal setup/configuration • About 10–15 mins (if all goes well !)

VDT The Virtual Data Toolkit (VDT) is an easy to install and configure ensemble of grid middleware. http://vdt.cs.wisc.edu GROWL Scripts installs the globus client from VDT, as well as gsi-enabled openssl and all well-trusted CA certificates.

Installing Grid middleware • Download GROWL Scripts cd wget http://www.growl.org.uk/Growl.tar.gz • Install into home directory tar -zxvf Growl.tar.gz • Build VDT client (a software distribution that includes globus) cd Growl; make VDT • Before using any GROWL Scripts, use source ~/Growl/setup.sh

Certificate installation • Download certificate into your browser • Export certificate as .p12 (on Linux) or .pfx (on Windows) format and move to the Grid client machine (Linux for now) • Convert certificate to correct format using openssl, change file permissions and install into correct directory

GROWL Scripts + Certificates Certificate manipulation • Hard to remember openssl commands are wrapped for you • Fewer passwords to be entered • Correct file and directory permissions are applied

$ openssl pkcs12 –in \ mykey.p12 \ -clcerts –nokeys \ -out usercert.pem <Pass1> <Pass2> <Pass2> [confirm] $ openssl pkcs12 –in \ mykey.p12 –nocerts \ -out userkey.pem <Pass1> $ chmod 444 usercert.pem $ chmod 400 userkey.pem $ mv userkey.pem ~/.globus $ mv usercert.pem ~/.globus $ chmod 700 ~/.globus $ mk-cert mykey.p12 <Pass1> [<Pass2>] Use of mk-cert

Globus + Firewalls Client Grid Resource globus-job-run jobmanager Results globus-job-run gsiscp sshd gsissh /gsissh-term

Registering to use NW-GRID There is a web registration form for NW-GRID. This will : • give you a common username (e.g. nwdljk) • register your DN /C=UK/O=eScience/OU=CLRC/L=DL/CN=john kewley • open firewalls for your client machine(s) to access the NW-GRID nodes. http://www.nw-grid.ac.uk/?q=nwguser/regForm

Requirements for access - Summary To access the NW-Grid, you will need: • Client-side middleware on the accessing computer (unless you intend using only browser/portal technology) • An e-science certificate in an appropriate format • No firewalls "in the way" between your client and the grid resource • The Distinguished Name (DN) from your certificate registered with the NW-Grid machine GROWL can help with the first two of these

Accessing the NW-GRID (from Linux)