PRACE User Support

User Guide to create a digital certification request with openssl

This paragraph gives a short overview about how to require a digital certificate from NIIF CA for users using openssl with the PKCS#10 format.The latest version of the openssl program can be downloaded from: Windows, Linux.

1. Download the openssl configuration file

To generate the CSR, there is a prewritten niif_ca_user_openssl.cnf file on the NIIF CA website.

The following modifications must be done in the config:

#purpose of the certificate
1.organizationalUnitName	= Organizational Unit Name 1.organizationalUnitName_default = GRID # Ezek lehetnek: GRID, HBONE, General Purpose 2.organizationalUnitName = Second Organizational Unit Name 2.organizationalUnitName_default = NIIF # Például: BME, ELTE, SZFKI, SZTAKI, NIIF, ... commonName = Common Name (YOUR name) # A felhasználó neve ékezet nélkül. commonName_max = 64A

PKCS#10 kérés elkészítéseMég nincs titkos kulcsFutassuk le aopenssl req -newkey rsa:1024 -config ./niif_ca_user_openssl.cnf -out new_csr.pemparancsot és értelemszerűen válaszoljunk a prompt-nál feltett kérdésekre. A szervezet (NIIF CA) és ország (HU) adatokat ne változtassuk meg, mert ebben az esetben érvénytelen lesz a kérésünk.A tanusítvány kérésünk a new_csr.pem és a hozzátartozo privátkulcs a privkey.pem file-ban lesz eltárolva. A privát kulcs-hoz a generálás során megadott "pass phrase" jelszóval tudunk hozzáférni. Ha ezt jelszót elfelejtjük, akkor a tanusítványunk használhatatlan lesz.Már van korábbról titkos kulcs (hosszabbítás)Ha már rendelkezünk korábban generált titkos kulccsal (legalább 1024 bites RSA kulcs legyen!), ami az old_key.pem file-ban található, akkor az alábbi paranccsal készíthetjük el a CSR-t openssl req -new -key ./old_key.pem -config ./niif_ca_user_openssl.cnf -out new_csr.pemA PKCS#10 eljuttatása CA hozKövessük a Felhasználói digitális tanúsítvány kérelem benyújtása leírás PKCS#10 formátúnú tanúsítványról szóló részét.

Access with GSI-SSH

A user can access to the supercomputers by using the GSI-SSH protocol.

It requires a machine with a Globus installation that provides the gsissh client.

The needed credentials (these mean the private and public keys) must be created before entering the machine with the

   grid-proxy-init

or

   arcproxy

commands.

By default, the proxies are valid for 12 hours. It is possible to modify this default value with the following commands:

   arcproxy -c validityPeriod=86400

or

   grid-proxy-init -hours 24

Both of the previous commands set the validation of the proxies to 24 hours. Using the arcproxy, the validation time must be given is seconds.

To enter the site, the

   gsissh -p 2222 login.budapest.hpc.niif.hu

command has to be used.

GridFTP file transfer

In order to use GridFTP for file transfer, one needs a GridFTP client program that provides the interface between the user and a remote GridFTP server. There are several clients available for GridFTP, one of which is globus-url-copy, a command line tool which can transfer files using the GridFTP protocol as well as other protocols such as http and ftp. globus-url-copy is distributed with the Globus Toolkit and usually available on machines that have the Globus Toolkit installed.

Syntax

   globus-url-copy [options] sourceURL destinationURL

• [options] The optional command line switches as described later.

• sourceURL The URL of the file(s) to be copied. If it is a directory, it must end with a slash (/), and all files within that directory will be copied.

• destURL The URL to which to copy the file(s). To copy several files to one destination URL, destURL must be a directory and be terminated with a slash (/).

Globus-url-copy supports multiple protocols, so the format of the source and destination URLs can be either

   file://path 

when you refer to a local file or directory or

   protocol://host[:port]/path

when you refer to a remote file or directory.

globus-url-copy is supporting other protocols such as http, https, ftp and gsiftp as well.

• Example:

   globus-url-copy file://task/myfile.c gsiftp://login.budapest.hpc.hu/home/task/myfile.c 

This command uploads the myfile.c file from the locak task folder to the remote machine's home/task folder.

Command line options for globus-url-copy [options]

• -help Prints usage information for the globus-url-copy program.
• -version Prints the version of the globus-url-copy program.
• -vb During the transfer, displays: (1) number of bytes transferred (2) performance since the last update (every 5 seconds) (3) average performance for the whole transfer

The following table lists parameters which you can set to optimize the performance of your data transfer:

• -tcp-bs <size>Specifies the size (in bytes) of the TCP buffer to be used by the underlying GridFTP data channels.
• -p <number of parallel streams> Specifies the number of parallel streams to be used in the GridFTP transfer.
• -stripe Use this parameter to initiate a “striped” GridFTP transfer that uses more than one node at the source and destination. As multiple nodes contribute to the transfer, each using its own network interface, a larger amount of the network bandwidth can be consumed than with a single system. Thus, at least for “big” (> 100 MB) files, striping can considerably improve performance.