1. www.epikh.eu The EPIKH Project (Exchange Programme to advance e-Infrastructure Know-How) gLite VOMS Installation and Configuration Riccardo Bruno (riccardo.bruno@ct.infn.it)riccardo.bruno@ct.infn.it INFN Dept. of Catania Joint EPIKH/EUMEDGRID-Support Event in Algeria Algiers, 27.06.2010

2. Virtual Organization Membership Service (VOMS) –Account Database  Serving information in a special format (VOMS credentials)  Can be administered via command line & via web interface –Provides information on the user’s relationship with his/her Virtual Organization (VO)  VO - Membership  Group membership  Roles of user VOMS Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 2

3. With YUM it is possible to exploit its package caching mechanism to speed up the installation process –Download cached files with:  –Install cached packages: The installed packages will avoid YUM to download files from the network before to install them YUM cache  tar xvfz http://wn03.grid.arn.dz/yumcache/yum_cache_VOMS.tar.gzhttp://wn03.grid.arn.dz/yumcache/yum_cache_VOMS.tar.gz  tar xvfz http://wn03.grid.arn.dz/yumcache/yum_cache_VOMS.tar.gzhttp://wn03.grid.arn.dz/yumcache/yum_cache_VOMS.tar.gz  tar xvfz UI_yum_cache.tar.gz –C /var/cache/yum Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 3

4. jpackage Provide a coherent set of Java software packages –Remote Site installations using your own Machines Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 4 jpackage official repository is currently broken and not usable Use It’s mirror at GARR cat > /etc/yum.repos.d/jpackage.repo <<EOF # # JPackage repositories # [jpackage5_generic_free] name = JPackage 5 (generic free) baseurl =http://gridsrv2-4.dir.garr.it/mrepo/jpackage5_generic-noarch/RPMS.free/ gpgkey = http://www.jpackage.org/jpackage.asc gpgcheck = 1 enabled = 1 protect = 1 [jpackage5_generic_non-free] name = JPackage 5 (generic non-free) baseurl =http://gridsrv2-4.dir.garr.it/mrepo/jpackage5_generic-noarch/RPMS.non-free/ gpgkey = http://www.jpackage.org/jpackage.asc gpgcheck = 1 enabled = 0 protect = 1 EOF Use It’s mirror at GARR cat > /etc/yum.repos.d/jpackage.repo <<EOF # # JPackage repositories # [jpackage5_generic_free] name = JPackage 5 (generic free) baseurl =http://gridsrv2-4.dir.garr.it/mrepo/jpackage5_generic-noarch/RPMS.free/ gpgkey = http://www.jpackage.org/jpackage.asc gpgcheck = 1 enabled = 1 protect = 1 [jpackage5_generic_non-free] name = JPackage 5 (generic non-free) baseurl =http://gridsrv2-4.dir.garr.it/mrepo/jpackage5_generic-noarch/RPMS.non-free/ gpgkey = http://www.jpackage.org/jpackage.asc gpgcheck = 1 enabled = 0 protect = 1 EOF

5. LCG-CA Install the LCG-CA packages Install the GILDA CA VOMS will only recognize subscriptions made by people having certificates delivered by these CAs Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 5  cd /etc/yum.repos.d  wget http://grid-deployment.web.cern.ch/grid- deployment/glite/repos/3.1/lcg-CA.repo -O /etc/yum.repos.d/lcg-CA.repohttp://grid-deployment.web.cern.ch/grid- deployment/glite/repos/3.1/lcg-CA.repo  yum install -y lcg-CA  cd /etc/yum.repos.d  wget http://grid-deployment.web.cern.ch/grid- deployment/glite/repos/3.1/lcg-CA.repo -O /etc/yum.repos.d/lcg-CA.repohttp://grid-deployment.web.cern.ch/grid- deployment/glite/repos/3.1/lcg-CA.repo  yum install -y lcg-CA wget https://dist.eugridpma.org/distribution/igtf/ current/worthless/RPMS/ca_GILDA-CA-1.36- 1.noarch.rpm --no-check-certificate rpm -ivh ca_GILDA-CA-1.36-1.noarch.rpm wget https://dist.eugridpma.org/distribution/igtf/ current/worthless/RPMS/ca_GILDA-CA-1.36- 1.noarch.rpm --no-check-certificate rpm -ivh ca_GILDA-CA-1.36-1.noarch.rpm

6. VOMS Packages and Installations  cd /etc/yum.repos.d  wget http://grid- it.cnaf.infn.it/mrepo/repos/glite-generic.repo  wget http://grid- it.cnaf.infn.it/mrepo/repos/glite-voms_mysql.repo  yum install glite-VOMS_mysql --enablerepo=dag  cd /etc/yum.repos.d  wget http://grid- it.cnaf.infn.it/mrepo/repos/glite-generic.repo  wget http://grid- it.cnaf.infn.it/mrepo/repos/glite-voms_mysql.repo  yum install glite-VOMS_mysql --enablerepo=dag Dependency error glite-security-voms-api-noglobus  wget http://glitesoft.cern.ch/EGEE/gLite/R3.1/glite- VOMS_mysql/sl4/i386/RPMS.release/glite-security- voms-api-noglobus-1.8.8-2.slc4.i386.rpm rpm -ivh glite-security-voms-api-noglobus-1.8.8- 2.slc4.i386.rpm yum install gliteVOMS_mysql --enablerepo=dag  wget http://glitesoft.cern.ch/EGEE/gLite/R3.1/glite- VOMS_mysql/sl4/i386/RPMS.release/glite-security- voms-api-noglobus-1.8.8-2.slc4.i386.rpm rpm -ivh glite-security-voms-api-noglobus-1.8.8- 2.slc4.i386.rpm yum install gliteVOMS_mysql --enablerepo=dag Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 6

7. MySQL Server Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 7  yum install mysql-server  service mysqld start  chkconfig mysqld on  yum install mysql-server  service mysqld start  chkconfig mysqld on  /usr/bin/mysqladmin -u root -h localhost password 'secure' Install MySQL Server Setup the MySQL root password

8. Mail Server/NTP Install Mail server ‘sendmail’ Install NTP server Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 8  service sendmail start  chkconfig sendmail on  service sendmail start  chkconfig sendmail on  yum install ntp  cat /etc/ntp.conf  server ntp-1.infn.it  EOF  service ntpd start  Chkconfig ntpd on  yum install ntp  cat /etc/ntp.conf  server ntp-1.infn.it  EOF  service ntpd start  Chkconfig ntpd on

9. Configuration VOMS configuration does not uses YAIM, manual XML configuration is required as old gLite installations –Copy Certificates in: /etc/grid-security Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 9  wget http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-cert.pem - O /etc/grid-security/hostcert.pem http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-cert.pem - O /etc/grid-security/hostcert.pem  wget http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-key.pem -O /etc/grid-security/hostkey.pem http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-key.pem -O /etc/grid-security/hostkey.pem  chmod 644 /etc/grid-security/hostcert.pem  chmod 400 /etc/grid-security/hostkey.pem  wget http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-cert.pem - O /etc/grid-security/hostcert.pem http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-cert.pem - O /etc/grid-security/hostcert.pem  wget http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-key.pem -O /etc/grid-security/hostkey.pem http://wn03.grid.arn.dz/cert/ALGIERS_host_certs/ce rist02.grid.arn.dz/ceristXX.grid.arn.dz-key.pem -O /etc/grid-security/hostkey.pem  chmod 644 /etc/grid-security/hostcert.pem  chmod 400 /etc/grid-security/hostkey.pem

10. Configuration Make a copy of template XML files Values to change are flagged by value ”changeme“ Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 10  cd /opt/glite/etc/config/templates  cp *.xml..  cd..  cd /opt/glite/etc/config/templates  cp *.xml..  cd..

11. glite-global.cfg.xml Open configuration file with a text editor ( vi, nano,… ) JAVA_HOME - value="/usr/java/jdk1.6.0_20" ! PLEASE VERIFY THE Java VERSION /usr/java/jdk… Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 11

12. glite-security-utils.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 12 cron.mailto  value=" "

13. glite-voms-server.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 13 This XML seems corrupted, AT THE TOP it should look like: <!-- =================================================================== VO instances All VO parameters are defined in separate VO instances. The VOMS Server instances are created here by iterating along the list of defined VOs. If custom VOMS instances have to be created, then they must be manually defined here by assigning a unique name and removing the iterate attribute =================================================================== --> <!-- =================================================================== VO instances All VO parameters are defined in separate VO instances. The VOMS Server instances are created here by iterating along the list of defined VOs. If custom VOMS instances have to be created, then they must be manually defined here by assigning a unique name and removing the iterate attribute =================================================================== -->

14. glite-voms-server.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 14 Other values to customize … voms.db.type - value="mysql" voms.db.host - value="localhost" voms.admin.smtp.host - value="localhost" voms.mysql.admin.password - value="secure" voms.db.type - value="mysql" voms.db.host - value="localhost" voms.admin.smtp.host - value="localhost" voms.mysql.admin.password - value="secure"

15. vo-list.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 15 Other values to customize … Go back to terminal and get server Certificate suject: vo.name - value="cerist" voms.hostname - value="ceristXX.grid.arn.dz" port.number - value="15000" voms.cert.url - value="" vo - value="voname" vo.name - value="voname" voms.cert.url - value=” " vo.name - value="cerist" voms.hostname - value="ceristXX.grid.arn.dz" port.number - value="15000" voms.cert.url - value="" vo - value="voname" vo.name - value="voname" voms.cert.url - value=” " openssl x509 -in /etc/grid- security/hostcert.pem -subject -noout

16. vo-list.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 16 Complete with other values to customize … voms.cert.subj - value=” " voms.db.name - value="vomsdb" voms.db.user.name - value="vomsusr" voms.db.user.password - value="vomsusrpwd" vo.sgm.vo.role - value="LCGAdmin" pool.account.basename - value="" pool.account.group - value="" pool.account.number - value="1" pool.lsfgid - value="" voms.db.host - value="localhost" voms.admin.smtp.host - value="localhost" voms.admin.notification.e-mail - value=" " voms.cert.subj - value=” " voms.db.name - value="vomsdb" voms.db.user.name - value="vomsusr" voms.db.user.password - value="vomsusrpwd" vo.sgm.vo.role - value="LCGAdmin" pool.account.basename - value="" pool.account.group - value="" pool.account.number - value="1" pool.lsfgid - value="" voms.db.host - value="localhost" voms.admin.smtp.host - value="localhost" voms.admin.notification.e-mail - value=" "

17. vo-list.cfg.xml Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 17 Get the Admin User Certificate Complete the values … scp algiersXX@glite-tutor.ct.infn.it:.globus/usercert.pem /etc/grid-security/usercert.pem voms.admin.certificate="/etc/grid-security/usercert.pem"

18. VOMS Configuration and Execution Just execute a python configuration script Then execute the VOMS server To check the status To use the built-in command line tools ‘source’ in root’.bashrc file the following file Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 18 scripts/glite-voms-server-config.py --configure scripts/glite-voms-server-config.py --start scripts/glite-voms-server-config.py --configure scripts/glite-voms-server-config.py --start source /etc/glite/profile.d/glite_setenv.sh scripts/glite-voms-server-config.py --status

19. Testing (Admin) Load the Admin User certificate in your Browser Connect with this brower to: – https:// :8443/voms/cerist https:// :8443/voms/cerist –( ceristXX.grid.arn.dz ) The service works if the Admin page appears … Subscribe your VO with ‘Register!’ button Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 19

20. Request confirmation via email Membership request via Web interface VOMS SERVER VO USER VO ADMIN Confirmation of email address Request notification accept / deny via web interface create user (if accepted) Notification of accept/deny Registration procedure Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 20

21. Registration Confirmation Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 21 Acknowledge Approval …

22. Usage and Maintenance People having user certificates delivered by a recognized Cas (LCG-CA) may request to subscribe your VO Requests will be notified via e-mail both for requestor and administrator More than one VO can be created From the Web GUI different Roles may be defined to the users Grid services supporting the new VO must have the specific VO setting properly configured in the site-info.def file Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 22 ############## # VONAME # ############## VO_ _SW_DIR=$VO_SW_DIR/africacert VO_ _DEFAULT_SE=$SE_HOST VO_ _STORAGE_DIR=$CLASSIC_STORAGE_DIR/africacert VO_ _VOMS_SERVERS="'vomss://voms.ct.infn.it:8443/voms/africacert?/africacert'" VO_ _VOMSES="'africacert voms.ct.infn.it 15004 /C=IT/O=INFN/OU=Host/L=Catania/CN=voms.ct.infn.it africacert'" VO_ _VOMS_CA_DN="'/C=IT/O=INFN/CN=INFN CA'" ############## # VONAME # ############## VO_ _SW_DIR=$VO_SW_DIR/africacert VO_ _DEFAULT_SE=$SE_HOST VO_ _STORAGE_DIR=$CLASSIC_STORAGE_DIR/africacert VO_ _VOMS_SERVERS="'vomss://voms.ct.infn.it:8443/voms/africacert?/africacert'" VO_ _VOMSES="'africacert voms.ct.infn.it 15004 /C=IT/O=INFN/OU=Host/L=Catania/CN=voms.ct.infn.it africacert'" VO_ _VOMS_CA_DN="'/C=IT/O=INFN/CN=INFN CA'"

23. Administration GUI Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 23 Users list User details

24. Take VOMSES string from ‘Configuration’ menu on the web GUI Copy it into. glite/vomses file in your UI’s $HOME account; create it if necessary UI Testing (User) voms-proxy-init --voms cerist Enter GRID pass phrase: Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=INFN/CN=Riccardo Bruno Creating temporary proxy..................... Done Contacting cerist02.grid.arn.dz:15000 [/C=IT/O=GILDA/OU=Host/L=ALGIERS/CN=cerist02.grid.arn.dz] "cerist" Failed Creating proxy......................................... Done Your proxy is valid until Tue Jun 29 04:34:45 2010 voms-proxy-init --voms cerist Enter GRID pass phrase: Your identity: /C=IT/O=GILDA/OU=Personal Certificate/L=INFN/CN=Riccardo Bruno Creating temporary proxy..................... Done Contacting cerist02.grid.arn.dz:15000 [/C=IT/O=GILDA/OU=Host/L=ALGIERS/CN=cerist02.grid.arn.dz] "cerist" Failed Creating proxy......................................... Done Your proxy is valid until Tue Jun 29 04:34:45 2010 Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 24

25. Log files can be found in /var/log/messages /var/log/glite/voms. Init scripts can be found in /opt/glite/etc/config/scripts/ Log and scripts Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 25

26. Command Line Interface Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 26 # voms-admin --help voms-admin v. 2.0.10 Usage: voms-admin [OPTIONS] --vo=NAME [--host HOST] [--port PORT] COMMAND PARAM... Options: --help Print this short help message. --list-commands Print a list of available commands. --help-command CMD Print help about command CMD. --help-commands Print help for all available commands. --version Print version string. --verbose Print more messages. --nousercert Don't extract DNs from supplied certificates. # voms-admin --help voms-admin v. 2.0.10 Usage: voms-admin [OPTIONS] --vo=NAME [--host HOST] [--port PORT] COMMAND PARAM... Options: --help Print this short help message. --list-commands Print a list of available commands. --help-command CMD Print help about command CMD. --help-commands Print help for all available commands. --version Print version string. --verbose Print more messages. --nousercert Don't extract DNs from supplied certificates.

27. CLI examples Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 27 # voms-admin --vo cerist get-vo-name /cerist # voms-admin --vo cerist list-users /C=IT/O=GILDA/OU=Personal Certificate/L=INFN/CN=Riccardo Bruno, /C=IT/O=GILDA/CN=GILDA CA - riccardo.bruno@ct.infn.it # voms-admin --vo cerist list-roles Role=VO-Admin #voms-admin --vo cerist create-user Missing X509 cert argument! It is missing the usercert.pem voms-admin --vo cerist create-user usercert.pemf # voms-admin --vo cerist get-vo-name /cerist # voms-admin --vo cerist list-users /C=IT/O=GILDA/OU=Personal Certificate/L=INFN/CN=Riccardo Bruno, /C=IT/O=GILDA/CN=GILDA CA - riccardo.bruno@ct.infn.it # voms-admin --vo cerist list-roles Role=VO-Admin #voms-admin --vo cerist create-user Missing X509 cert argument! It is missing the usercert.pem voms-admin --vo cerist create-user usercert.pemf

28. References VOMS Installation guide –https://edms.cern.ch/file/974982/1/voms-installation- configuration-guide.pdfhttps://edms.cern.ch/file/974982/1/voms-installation- configuration-guide.pdf EUMEDGRID-Support Wiki –http://wiki.eumedgrid.eu/bin/viewhttp://wiki.eumedgrid.eu/bin/view –http://wiki.eumedgrid.eu/twiki/bin/view/InfrastructureStatus/Eume dSiteInstallationhttp://wiki.eumedgrid.eu/twiki/bin/view/InfrastructureStatus/Eume dSiteInstallation EUMEDGRID VOMS@CNAF –https://voms2.cnaf.infn.it:8443/voms/eumed/Login.dohttps://voms2.cnaf.infn.it:8443/voms/eumed/Login.do Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 28

29. Algiers, Joint EPiKH/EUMEDGRID-Support in Algeria, 27.06.2010 29