GCT 6 Quickstart

Install packages:

This will install the GridFTP, GRAM, and MyProxy services, as well as set up a basic SimpleCA so that you can issue security credentials for users to run the GCT services.

The Grid Community Toolkit uses X.509 certificates and proxy certificates to authenticate and authorize grid users. For this quickstart, we use the GCT SimpleCA tools to manage our own Certificate Authority, so that we don’t need to rely on any external entitty to authorize our grid users.

When the globus-simple-ca package is installed, it will automatically create a new Certificate Authority and deploy its public certificate into the globus trusted certificate directory. It will also create a host certificate and key, so that the GCT services will be able to run.

We’ll also need to copy the host certificate and key into place so that the myproxy service can use it as well.

We are going to create a MyProxy server on elephant, following the instructions at http://grid.ncsa.illinois.edu/myproxy/fromscratch.html#server. This will be used to store our user’s certificates. In order to enable myproxy to use the SimpleCA, modify the /etc/myproxy-server.config file, by uncommenting every line in the section file, by uncommenting every line in the section Complete Sample Policy #1 such that section looks like this myproxy configuration:

We’ll next add the myproxy user to the simpleca group so that the myproxy server can create certificates.

Start the myproxy server:

Check that it is running:

The important thing to see in the above is that the process is in the active (running) state. [NOTE]

As a final sanity check, we’ll make sure the myproxy TCP port 7512 is in use via the netstat command:

Now that we have our host and user credentials in place, we can start a globus service. This set up comes from the GridFTP Admin Guide.

Start the GridFTP server:

Check that the GridFTP server is running and listening on the gridftp port:

Now the GridFTP server is waiting for a request, so we’ll generate a proxy from the myproxy service by using myproxy-logon and then copy a file from the GridFTP server with the globus-url-copy command. We’ll use the passphrase used to create the myproxy credential for quser.

At this point, we’ve configured the myproxy and GridFTP services and verified that we can create a security credential and transfer a file. If you had trouble, check the security troubleshooting section in the Security Admin Guide. Now we can move on to setting up GRAM5 resource management.

Now that we have security and GridFTP set up, we can set up GRAM for resource management. There are several different Local Resource Managers (LRMs) that one could configure GRAM to use, but this guide will explain the simple case of setting up a "fork" jobmanager, without auditing. For details on all other configuration options, and for reference, you can see the GRAM5 Admin Guide. The GRAM service will use the same host credential as the GridFTP service, and is configured by default to use the fork manager, so all we need to do now is start the service.

Start the GRAM gatekeeper:

We can now verify that the service is running and listening on the GRAM5 port:

The gatekeeper is set up to run, and is ready to authorize job submissions and pass them on to the fork job manager. We can now run a couple of test jobs:

If you had trouble, check the security troubleshooting section in the Security Admin Guide. To learn more about using GRAM 5, take a look at the GRAM User’s Guide.

See Prereqs.

Install packages as before:

Now let’s get security set up on the second machine. We’re going to trust the original simpleCA to this new machine; there’s no need to create a new one. First, we’ll bootstrap trust of the SimpleCA running on elephant:

This allows clients and services on donkey to trust certificates which are signed by the CA on elephant machine. If we weren’t going to run any GCT services on donkey, then we could stop here. Users on donkey could acquire credentials using the myproxy-logon command and perform file transfers and execute jobs using the globus-url-copy and globus-job-run commands. However, we’ll continue to configure the GridFTP and GRAM5 services on donkey as well.

We’re going to create the host certificate for donkey, but we create it on elephant, so that we don’t have to copy the certificate request between machines. The myproxy-admin-addservice command will prompt for a passphrase for this credential. We will use this passphrase to retrieve the credential on donkey.

Next we’ll retrieve the credential on donkey as the root user.

At this point, we no longer need to have donkey's host certificate on elephant's myproxy server, so we’ll delete it.

And as a final setup, we’ll add quser’s credential to the grid-mapfile on donkey, so that the quser account can access services there as well.

At this point, we have set up security on donkey to trust the CA on elephant. We have created a host certificate for donkey so that we can run GCT services on donkey, and we have enabled the quser account to use services on donkey. The last thing to do is to turn on the GCT services on donkey.

GridFTP set up on the second machine is identical to the first. I’ll just list the commands here; see Setting up GridFTP for additional information.

Now we can test it.

First, we’ll retrieve a proxy credential from the myproxy server so that the user on donkey can interact with the GCT services. Here we’ll use the same passphrase as we used to create the quser credential.

Next we’ll transfer a file between the gridftp servers on donkey and elephant:

That was a slightly more complicated test than we ran on elephant earlier. In this case, we did a third-party transfer between two GridFTP servers. It worked, so I have the local and remote security configured correctly.

If you run into problems, perhaps you have a firewall between the two machines? GridFTP needs to communicate on data ports, not just port 2811. The error for this condition looks like:

You can set up a range of ports to be open on the firewall and configure GridFTP to use them. See the GridFTP admin firewall doc.

Now we can submit a staging job. This job will copy the /bin/echo program from donkey to a file called /tmp/my_echo. Then it runs it with some arguments, and captures the stderr/stdout. Finally, it will clean up the . Then it runs it with some arguments, and captures the stderr/stdout. Finally, it will clean up the my_echo file when execution is done. file when execution is done.

This example staged in a file, had an executable act on that file, and cleaned up the file afterward.

You can get other examples of GRAM files from GRAM usage scenarios.