Paralelno i distribuirano računarstvo – primena u praksi Beograd jun Grid - korisnicki pristup i razvoj aplikacija Branko Marović RCUB

A E G I S Beograd jun AEGIS Certification Authority Primljen u EUGridPMA na skupu u Istanbulu AEGIS CA Certificate Policy and Certification Practice Statement RAs  Faculty of Electronic Engineering  Institute of Physics  CSASA University of Kragujevac  University u Priština (Kosovska Mitorvica)

A E G I S Beograd jun AEGIS Certification Authority Names  Issuer: C=RS, O=AEGIS, CN=AEGIS-CA  Subject: C=RS, O=AEGIS, OU=XXX, CN=Subject-name  Country: Must be “RS”  Organization: Must be “AEGIS”  OrganizationUnit: Must be the name of the subject's institute  CommonName: First name and last name of the subject for user certificates, DNS FQDN for server or service certificates End Entity Certificates  Maximum lifetime: 1 year  Key length: at least 1024 bits Person requesting a certificate  Presentation in person of valid official identification document Server/Host/Service certificate  Can be only requested by the administrator of the particular host  The administrator must already have a valid AEGIS certificate

A E G I S Beograd jun Izdavanje prvog sertifikata Instrukcije na Formirati PKCS#10 zahtev na nekom od AEGIS UI računara Poslati zahtev i lične podatke (ime i prezime, , institucija, adresa) preko AEGIS CA web interfejsa ili na Generiše se slučajni 10-ocifreni broj i šalje automatski e- mail odgovor gde se korisnik obaveštava  Da je vreme procesiranja sertifikata 3 radna dana  Da je potrebno da se lično pojavi u kancelariji AEGIS CA ili RA radi potvrde identiteta  O adresi i brojevima telefona AEGIS CA/RA  O procesu autentifikacije korisnikovog -a: generisani broj se deli na dva dela. U odgovoru se nalazi prvih 5 cifara, dok drugih 5 korisnik dobija kada se pojavi radi autentifikacije. Korisnik dolazi kod AEGIS CA ili RA sa validnim dokumentom za ličnu identifikaciju i dokazom veze sa institucijom navedenom u zahtevu. Šalje AEGIS CA/RA 10 cifara sa prijavljene adrese Na ovako potvrđenu adresu se dostavlja potpisan sertifikat  Korisnik se obaveštava da treba da u roku od 5 dana pošalje potpisan dobijenim sertifikatom kojim prihvata svoj novi sertifikat i CP/CPS dokumenat Korisnik svoj sertifikat može koristiti za pristup Grid-u, za potpisivanje -ova, autentifikaciju preko Web-a i enkripciju podataka. Može sertifikat koristiti kroz AEGIS i SEE-GRID VOMS server

A E G I S Beograd jun Izdavanje prvog sertifikata Instrukcije na ca.rcub.bg.ac.yu/ ca.rcub.bg.ac.yu/ Formirati PKCS#10 zahtev na nekom od AEGIS UI računara Osoba se vezuje za sertifikat kroz par e- mail interakcija, pojavljivanje kod AEGIS CA ili RA sa validnim dokumentom za ličnu identifikaciju i dokazom veze sa institucijom navedenom u zahtevu. Korisnik treba da u roku od 5 dana pošalje potpisan dobijenim sertifikatom kojim prihvata svoj novi sertifikat i CP/CPS dokumenat Korisnik svoj sertifikat može koristiti za pristup Grid-u, za potpisivanje -ova, autentifikaciju preko Web-a i enkripciju podataka. Može sertifikat koristiti kroz AEGIS i SEE-GRID VOMS server Objašnjenje ključnih koncepata  unix.globus.org/toolkit/docs/4.0/security/ key-index.html

A E G I S Beograd jun AEGIS CA Root sertifikat za IE/Outlook (Express) Otvoriti link za sertifikat u CRT formatu i odabrati “Open” Izabrati opciju “Install certificate” Slediti instrukcije u “Certificate Import Wizard”

A E G I S Beograd jun Ubacivanje korisničkog sertifikata u Outlook Express Konvertovati korisnički sertifikat u pkcs#12 format U Outlook Express-u u “Tools / Security” odabrati “Security” tab, kliknuti na “Digital IDs…”, kliknuti na “Import…” Slediti instrukcije u “Certificate Import Wizard”

A E G I S Beograd jun Ubacivanje korisničkog sertifikata u Internet Explorer U ranijim koracima je Root sertifikat već importovan, a korisnički sertifikat konvertovan u pkcs#12 format U Internet Explorer-u u “File / Open” otvoriti pkcs#12 sertifikat Slediti instrukcije u “Certificate Import Wizard”

A E G I S Beograd jun Registracija na VOMS serveru Instrukcije na Za registraciju je neophodno da sertifikat prethodno bude uvežen u browser: Otvoriti Web stranu VOMS servera  AEGIS VO:  SEEGRID VO: / / Nudi se izbor sertifikata/ključa za pristup i potpisivanje

A E G I S Beograd jun Registracija na VOMS serveru Posle utvrđenog identiteta potrebno je popuniti web formular sa podacima za kontakt i o ustanovi Slediti dalje instrukcije putem -a, koje treba izvršiti u roku od 24 sata – može se tražiti provera veze sa institucijom članicom VO ako se ne vidi na osnovu sertifikata

A E G I S Beograd jun Izdavanje narednih sertifikata Zahtevi za re-key sertifikata koji su potpisani važećim sertifikatom izdatim od CA akreditovanim od EUGridPMA će biti potpisani bez prethodne procedure jer je identitet korisnika već utvrđen. Korišćeni sertifikat i zahtev treba da se odnose na istu osobu, i instituciju. CA/RA i dalje mora da proveri da li osoba ima vezu sa institucijom navedenom u zahtevu – dovoljno je da je institucionalni.

A E G I S Beograd jun Generisanje sertifikata i sigurnost Sertifikati i ključevi Rooot AEGIS-CA sertifikat se čuva na više prenosivih medijuma na sigurnoj lokaciji Koriste se lozinke od bar 15 karaktera. CA manager i CA operater jedini znaju root password. Sertifikati se generišu na izolovanom računaru, u kancelariji sa ograničenim pristupom. Čuva se lista generisanih sertifikata. CA računar Na računaru je instaliran CentOS operativni sistem sa minimumom servisa - apliciraju se sve security zakrpe. Jedina korisnička aplikacija CSP (Cryptographic Service Provider) softver Vrši se nadyor i praćene eventualnih modifikacija softvera. Računar ima CD-RW uređaj i USB konektore za backup. Hard disk se stavlja u HDD rack, čuva se na sigurnoj lokaciji. Vrši se backup na CD-ROM i USB flash-u koji se takođe čuvaju sigurnoj lokaciji. Postojaće i off-site backup. CA Sajt Na CA sajtu je omogućena isključivo pretraga (ne i listanje) izdatih sertifikata. Kada se sertifikat povuče, obnavlja se CRL, koja se odmah objavljuje na CA sajtu. CRL se takodje obnavlja na svakih 30 dana, bez obzira da li je bilo povučenih sertifikata.

A E G I S Beograd jun Events Recorded events  Certification requests  Issued certificates  Requests for revocation  Issued CRL’s  Login/logout/reboot of the signing machine Archived events  Certification requests  Issued certificates  Requests for revocation  Issued CRL’s  All messages of correspondence between RA and CA

A E G I S Beograd jun Certificate Revocation Certificate Revocation List  Minimum/maximum lifetime: 7/30 days  CRL is updated immediately after every certificate revocation  CRL is issued at least 7 days before expiration Circumstances for revocation  Subscriber has ceased to be a member of, or associated with AEGIS related institution, program or activity  Subscriber key is lost or suspected to be compromised  Information in certificate is suspected to be inaccurate  Subscriber violated his/her obligations  Subscriber does not need the certificate any more

A E G I S Beograd jun CA Kontakt University of Belgrade Computer Center Kumanovska bb Beograd Serbia Phone: , Fax: Dušan Radovanović

A E G I S Beograd jun RA Kontakt Beograd Antun Balaž Institut za Fiziku Scientific Computing Lab Pregrevica 118 Beograd Phone: Fax: Zaharije Radivojević Faculty of Electrinic Engineering Bulevar Kralja Aleksandra 73 Beograd Phone: Kragujevac Miloš Ivanović CSASA University of Kragujevac Jovana Cvijića b.b Kragujevac Phone:

UI: local machine on which the user defines his jobs. All commands to the grid are issued from a UI RB: the heart of the grid. Sends the jobs on the grid and keeps track of them LB: a SQL database in which each changing of status of a job is registered CE: the server of a LRMS (LSF, PBS, Torque…) WN: CPUs that actually execute the jobs BDII: LDAP database with info on LCG resources SE: output files are written on storage resources throughout the grid LFC: files stored on a SE are registered in the catalog gLite Job Workflow

A E G I S Beograd jun gLite Job Workflow The user defines his job on his User Interface by writing a JDL. The JDL is submitted to the Resource Broker. From now on, the RB notifies the L&B about every change in status of the job. The RB parses the JDL and queries the BDII in order to find the best CE matching the job requirements. The RB sends the job to the Computing Element proposed by the BDII. The CE submits the job and sends it to one of the underlying Worker Nodes. Usually, at the end a job writes its output files to a Storage Element and, if the operation is successful, it registers them in the LFC catalog, so that they’ll be available to all grid users. The log files are usually sent back to the RB and then to the UI, so that the user can check that the job has really run as expected.

A E G I S Beograd jun WMProxy commands glite-wms-job-list-match  Lists resources matching a job description  Performs the matchmaking without submitting the job glite-wms-job-submit  Submits a job for execution glite-wms-job-cancel  Cancels the given job glite-wms-job-status  Displays the status of the job glite-wms-job-output  Returns the job-output (the OutputSandbox files) to the user glite-wms-job-logging-info  Displays logging information about submitted jobs (all the events “pushed” by the various components of the WMS)  Very useful for debug purposes

A E G I S Beograd jun Getting proxy certificate branko]$ voms-proxy-init -voms seegrid:/seegrid/RS/App/VIVE Your identity: /C=RS/O=AEGIS/OU=UOB/CN=Branko Marovic Enter GRID pass phrase: Creating temporary proxy Done Contacting voms.grid.auth.gr:15040 [/C=GR/O=HellasGrid/OU=auth.gr/CN=voms.grid.auth.gr] "seegrid" Done Creating proxy Done Your proxy is valid until Wed Mar 26 04:57: branko]$ glite-wms-job-delegate-proxy --noint -d VIVE_delegate Connecting to the service Your proxy has been successfully delegated to the WMProxy: with the delegation identifier: VIVE_delegate

A E G I S Beograd jun Job description language branko]$ cat test.jdl Executable = "test_program"; Arguments = "Argument value"; StdOutput = "std.out"; StdError = "std.err"; InputSandbox = {"test_program", "test_data"}; OutputSandbox = {"std.out", "std.err"}; branko]$ cat test_program date ls -l cat test_data

A E G I S Beograd jun Site matching branko]$ glite-wms-job-list-match -d VIVE_delegate test.jdl Connecting to the service COMPUTING ELEMENT IDs LIST The following CE(s) matching your job requirements have been found: *CEId* - c01.grid.etfbl.net:2119/jobmanager-pbs-seegrid - ce.grid.pmf.unsa.ba:2119/jobmanager-pbs-seegrid - ce.seegridtest.sci.am:2119/jobmanager-pbs-seegrid - ce.ulakbim.gov.tr:2119/jobmanager-lcgpbs-seegrid - ce001.fmi.uni-sofia.bg:2119/jobmanager-lcgpbs-seegrid - ce002.ipp.acad.bg:2119/jobmanager-lcgpbs-seegrid - ce01.isabella.grnet.gr:2119/jobmanager-pbs-seegrid - cluster1.csk.kg.ac.yu:2119/jobmanager-pbs-seegrid - cox01.grid.metu.edu.tr:2119/jobmanager-lcgpbs-seegrid - grid-ce.feit.ukim.edu.mk:2119/jobmanager-lcgpbs-seegrid - grid01.rcub.bg.ac.yu:2119/jobmanager-pbs-seegrid - gw01.seegrid.grid.pub.ro:2119/jobmanager-lcgpbs-seegrid - sn0.hpcc.sztaki.hu:2119/jobmanager-lcgpbs-seegrid - tbit01.nipne.ro:2119/jobmanager-lcgpbs-seegrid - testbed001.grid.ici.ro:2119/jobmanager-pbs-seegrid - ce001.grid.uni-sofia.bg:2119/jobmanager-lcgpbs-seegrid - grid01.elfak.ni.ac.yu:2119/jobmanager-pbs-seegrid - ce01.afroditi.hellasgrid.gr:2119/jobmanager-pbs-seegrid - grid1.irb.hr:2119/jobmanager-pbs-grid - ce001.imbm.bas.bg:2119/jobmanager-lcgpbs-seegrid - yildirim.grid.boun.edu.tr:2119/jobmanager-lcgpbs-seegrid - ce.phy.bg.ac.yu:2119/jobmanager-pbs-seegrid - ce.grid.tuiasi.ro:2119/jobmanager-lcgpbs-seegrid - ce01.grid.renam.md:2119/jobmanager-lcgpbs-seegrid - rti29.etf.bg.ac.yu:2119/jobmanager-pbs-seegrid - ce01.mosigrid.utcluj.ro:2119/jobmanager-pbs-seegrid - ce64.phy.bg.ac.yu:2119/jobmanager-pbs-seegrid - grid-ce.ii.edu.mk:2119/jobmanager-pbs-seegrid - grid01.cg.ac.yu:2119/jobmanager-pbs-seegrid

A E G I S Beograd jun Job submission branko]$ glite-wms-job-submit -d VIVE_delegate -o ID - r ce01.isabella.grnet.gr:2119/jobmanager-pbs-seegrid test.jdl Connecting to the service The job has been successfully submitted to the WMProxy Your job identifier is: The job identifier has been saved in the following file: /home/branko/ID Job Statuses Submitted: job is entered by the user to the UI but not yet transferred to NS or WMP Waiting: job has been accepted by the NS or WMP but not yet processed Ready: job has been processed (matchmaking) but not yet transferred to the CE Scheduled: job is waiting in the queue of the CE Running: job is running on a WN Done: job exited or it’s considered in a terminal state by CondorC Aborted: job processing was aborted by WMS Canceled: job has been canceled on user request Cleared: output of the job has been retrieved after job successful conclusion

A E G I S Beograd jun Job status check branko]$ glite-wms-job-status -i ID BOOKKEEPING INFORMATION: Status info for the Job : Current Status: Submitted Submitted: Tue Mar 25 17:43: CET branko]$ glite-wms-job-status -i ID BOOKKEEPING INFORMATION: Status info for the Job : Current Status: Running Status Reason: Job successfully submitted to Globus Destination: ce01.isabella.grnet.gr:2119/jobmanager-pbs-seegrid Submitted: Tue Mar 25 17:43: CET branko]$ glite-wms-job-status -i ID BOOKKEEPING INFORMATION: Status info for the Job : Current Status: Done (Success) Exit code: 0 Status Reason: Job terminated successfully Destination: ce01.isabella.grnet.gr:2119/jobmanager-pbs-seegrid Submitted: Tue Mar 25 17:43: CET

A E G I S Beograd jun Result retrieval branko]$ glite-wms-job-output -i ID Connecting to the service JOB GET OUTPUT OUTCOME Output sandbox files for the job: have been successfully retrieved and stored in the directory: /tmp/glite/glite-ui/branko_vjTIoKdEp27xtXRyA2Wgow

A E G I S Beograd jun Result viewing branko]$ cat /tmp/glite/glite- ui/branko_vjTIoKdEp27xtXRyA2Wgow/std.out Tue Mar 25 18:44:18 EET 2008 total 16 -rw sgmsegri006 seegridsgm 196 Mar 25 18:44 https_3a_2f_2fwms.phy.bg.ac.yu_3a9000_2fvjTIoKdEp27xtXRyA2Wgow.output -rw-r--r-- 1 sgmsegri006 seegridsgm 0 Mar 25 18:44 std.err -rw-r--r-- 1 sgmsegri006 seegridsgm 29 Mar 25 18:44 std.out -rw-r--r-- 1 sgmsegri006 seegridsgm 19 Mar 25 18:44 test_data -rwxr-xr-x 1 sgmsegri006 seegridsgm 25 Mar 25 18:44 test_program -rw sgmsegri006 seegridsgm 0 Mar 25 18:44 tmp.yAlPV31197 This is test file.

A E G I S Beograd jun Final job status branko]$ glite-wms-job-status -i ID BOOKKEEPING INFORMATION: Status info for the Job : Current Status: Cleared Status Reason: user retrieved output sandbox Destination: ce01.isabella.grnet.gr:2119/jobmanager-pbs-seegrid Submitted: Tue Mar 25 17:43: CET branko]$ glite-wms-job-logging-info -i ID -v 2... Event: RegJob - arrived = Tue Mar 25 17:43: CET - host = wms.phy.bg.ac.yu - ns = - nsubjobs = 0 - source = NetworkServer - src_instance = - timestamp = Tue Mar 25 17:43: CET - user = /C=RS/O=AEGIS/OU=UOB/CN=Branko Marovic... Event: Done - arrived = Tue Mar 25 17:49: CET - exit_code = 0 - host = wms.phy.bg.ac.yu - reason = Job terminated successfully... Event: Clear - arrived = Tue Mar 25 17:58: CET - host = wms.phy.bg.ac.yu - reason = USER branko]$ edg-job-cancel -i ID

A E G I S Beograd jun Submission to several servers branko]$./submit_job test.jdl Submiting to ce.ulakbim.gov.tr:2119/jobmanager-lcgpbs-seegrid Submiting to grid-ce.feit.ukim.edu.mk:2119/jobmanager-lcgpbs-seegrid Submiting to ce002.ipp.acad.bg:2119/jobmanager-lcgpbs-seegrid Submiting to grid01.rcub.bg.ac.yu:2119/jobmanager-pbs-seegrid branko]$ glite-wms-job-status -i test.jdl.jobs.list : 2 : 3 : 4 : a : all q : quit Choose one or more jobId(s) in the list - [1-4]all:2 BOOKKEEPING INFORMATION: Status info for the Job : Current Status: Ready Status Reason: unavailable Destination: grid-ce.feit.ukim.edu.mk:2119/jobmanager-lcgpbs-seegrid Submitted: Tue Mar 25 18:34: CET *************************************************************