Changes between Version 2 and Version 3 of installation_GridFTP

Timestamp:

05/16/11 14:37:24 (13 years ago)

Author:

bartek

Comment:

--

installation_GridFTP

@@ -58 +58 @@
 }}}
 }}}
-* GT4 unlike other software packages is made directly to target location (<code>$GLOBUS_LOCATION</code>)
-* If you omit <code>gridftp</code> for <code>make</code> the entire Globus Toolkit will be build what can take several hours to complete.
-* during <code>make install</code> phase Globus configuration will be initialized
-* You can also choose to build GridFTP server or client tools be specifying <code>globus_gridftp_server</code> or <code>globus-data-management-client</code> respectively.
+* GT4 unlike other software packages is made directly to target location (`$GLOBUS_LOCATION`)
+* If you omit `gridftp` for `make` the entire Globus Toolkit will be build what can take several hours to complete.
+* during `make install` phase Globus configuration will be initialized
+* You can also choose to build GridFTP server or client tools be specifying `globus_gridftp_server` or `globus-data-management-client` respectively.
 
 The belowe steps completes Globus Toolkit/GridFTP installation. The following figure summarizes shell commands used during typical installation process:
+{{{
+#!div style="font-size: 90%"
+{{{#!sh
   bogdanl@cress ~ $ su -
   cress ~ # useradd -m globus 
@@ -79 +82 @@
   Your build completed successfully.  Please run make install.
   globus@cress ~/gt4.2.1-all-source-installer $ make install
-
-=Globus Toolkit/GridFTP - basic configuration=
-
-==Security==
+}}}
+}}}
+
+= Globus Toolkit/GridFTP - basic configuration =
+
+== Security ==
 After Globus Toolkit installation, but before starting Globus services several aspects of GSI security need to be configured:
-*configure Globus (and thus GridFTP daemon) to trust a particular set of CAs (Certificate Authorities), i.e. place certificates of trusted CAs into designated directory - CA is trusted only if its CA certificate exists with the appropriate name in an appropriate directory. Moreover, for pre-ws services (including GridFTP), signing policy file must exist in the same location as CA certificate. In other words, one needs two files to trust given CA:
-:* <code>cert_hash.0</code> - the trusted CA certificate and
-:* <code>cert_hash.signing_policy</code> - the signing policy.
-:Globus services and tools looks for that directory in following locations:
-:* the value of <code>$X509_CERT_DIR</code> environment variable if it is set and the directory exists,
-:* otherwise, in <code>$HOME/.globus/certificates</code> if it exists,
-:* otherwise, in <code>/etc/grid-security/certificates</code> if it exists,
-:* otherwise, in <code>$GLOBUS_LOCATION/share/certificates</code> if it exists.
-
-{{Note}} We suggest to use <code>/etc/grid-security/certificates</code> as system wide trusted CAs directory, but remember that <code>$X509_CERT_DIR</code> and <code>$HOME/.globus/certificates</code> have higher priority. 
-
-The "cert_hash.0", i.e. certificate of the CA, is provided by CA, usually with appropriate hash name. Hash name consists of 8 hex-digits and suffix ".0" (<code>e. g. 8a661490.0 </code>). Valid hash can be obtained with following command (available in <code>$GLOBUS_LOCATION/bin/)</code>:
-
+* configure Globus (and thus GridFTP daemon) to trust a particular set of CAs (Certificate Authorities), i.e. place certificates of trusted CAs into designated directory - CA is trusted only if its CA certificate exists with the appropriate name in an appropriate directory. Moreover, for pre-ws services (including GridFTP), signing policy file must exist in the same location as CA certificate. In other words, one needs two files to trust given CA:
+ * `cert_hash.0` - the trusted CA certificate and
+ * `cert_hash.signing_policy` - the signing policy.
+ Globus services and tools looks for that directory in following locations:
+ * the value of `$X509_CERT_DIR` environment variable if it is set and the directory exists,
+ * otherwise, in `$HOME/.globus/certificates` if it exists,
+ * otherwise, in `/etc/grid-security/certificates` if it exists,
+ * otherwise, in `$GLOBUS_LOCATION/share/certificates` if it exists.
+
+'''Note:''' We suggest to use `/etc/grid-security/certificates` as system wide trusted CAs directory, remember that `$X509_CERT_DIR` and `$HOME/.globus/certificates` have higher priority. 
+
+The `cert_hash.0`, i.e. certificate of the CA, is provided by CA, usually with appropriate hash name. Hash name consists of 8 hex-digits and suffix ".0" (e.g. `8a661490.0`). Valid hash can be obtained with following command (available in `$GLOBUS_LOCATION/bin/`):
+{{{
+#!div style="font-size: 90%"
+{{{#!sh
   openssl x509 -hash -noout -in ca_certificate
-
+}}}
+}}}
 * cert_hash.signing_policy usually is also provided by CA, but it can be constructed manually. The signing policy file has the following format:
+{{{
+#!div style="font-size: 90%"
+{{{#!default
   access_id_CA X509 'CA Distinguished Name'
   pos_rights globus CA:sign
   cond_subjects globus '"Name Pattern1" "Name Pattern2" ...'
-
-: to get 'CA Distinguished Name' execute:
-
+}}}
+}}}
+ to get 'CA Distinguished Name' execute:
+{{{
+#!div style="font-size: 90%"
+{{{#!sh
   openssl x509 -subject -noout -in cert_hash.0
-
+}}}
+}}}
 * "name pattern" is a string used to match the distinguished names of certificates granted by the given CA. Usually, it is a CA name with common name replaced by wild card '*', e.g.: