Changes between Version 4 and Version 5 of installation_GridFTP

Timestamp:

05/16/11 14:58:46 (13 years ago)

Author:

bartek

Comment:

--

installation_GridFTP

@@ -130 +130 @@
 }}}
 }}}
-  it accepts "C=PL/O=GRID/OU=PSNC/CN=Bogdan Ludwiczak", but it rejects "O=GRID/OU=PSNC/CN=Bogdan Ludwiczak". '"*"' pattern accepts all certificates.
+  it accepts "C=PL/O=GRID/OU=PSNC/CN=Bogdan Ludwiczak", but it rejects "O=GRID/OU=PSNC/CN=Bogdan Ludwiczak". "*" pattern accepts all certificates.
 
 * Configure appropriate default values for use by the grid-cert-request command which is used to generate certificates requests. The following files have to be properly configured to enable Globus tools to generate valid certificate requests:
@@ -137 +137 @@
  * `/etc/grid-security/grid-security.conf` - is a main configuration file that contains the name and email address for the given CA.
 
- These files are usually provided by the CA, particularly [[QosCosGrid CA]] or [http://www.man.poznan.pl/plgrid-ca/ PL-Grid] does provides these files. Typically, CA configuration files are placed in <code>/etc/grid-security/certificates/</code> directory with additional extension .CA_hash_name and only appropriate symbolic links are created in /etc/grid-security/. Globus Toolkit provides grid-default-ca command which can be used to automatically create appropriate links.
+ These files are usually provided by the CA, particularly [[!QosCosGrid|CA]] or [[http://www.man.poznan.pl/plgrid-ca/|PL-Grid]] does provides these files. Typically, CA configuration files are placed in `/etc/grid-security/certificates/` directory with additional extension `.CA_hash_name` and only appropriate symbolic links are created in `/etc/grid-security/`. Globus Toolkit provides `grid-default-ca` command which can be used to automatically create appropriate links.
 
 == Requesting host and user X.509 certificates ==
-All Globus service (including GridFTP) require a host (or service) certificate to operate. Also every user needs a user certificate do use Globus services. You can use Globus command <code>grid-cert-request to generate</code> host/users certificate request which should be send to your CA to be signed. Make sure that CA configuration files and certificate are in place before generating requests. This command will create 3 files:
-* an empty (file length is 0) /etc/grid-security/hostcert.pem or ~/.globus/usercert.pem,
-* <code>/etc/grid-security/hostkey.pem</code> or <code>~/.globus/userkey.pem file containig</code> host/user private key which must be kept secret - make sure that the unix access mode is set to 0400 or 0600 at most,
-* <code>/etc/grid-security/hostcert_request.pem</code> or <code>~/.globus/usercert_request.pem</code> file containing acctual request to be send to and signed by CA.
-
-{{Note}} Before you can use grid-cert-request command you have to source Globus configuration script appropriate for your shell, i.e. <code>$GLOBUS_LOCATION/etc/globus-user-env.csh</code> or <code>$GLOBUS_LOCATION/etc/globus-user-env.sh</code>
-
-Send newly generated certificate request (i.e. <code>/etc/grid-security/hostcert_request.pem</code> or <code>~/.globus/usercert_request.pem</code> file) to the appropriate CA and wait for the certificate which should be send in return by your CA. Save the new certificate in <code>hostcert.pem</code> or <code>usercert.pem</code>. Now, request file can be deleted. Host certificate and private key should be owned by root user.
-Specify identity mapping information
-Globus services map distinguished names (retrieved from certificates) to local identities (unix account) by means of <code>grid-mapfile</code>. Mappings have the folowing form:
-"Distinguished Name" local_name
-(every line of the file defines one mapping) To let user in, create an account and add mapping to the site's grid-mapfile. Globus looks for the file in the following locations:
-* the value of <code>GRIDMAP</code> environment variable if it is set,
-* otherwise, if service is run as root then grid map file is <code>/etc/grid-security/grid-mapfile</code>,
-* otherwise, the grid map file is <code>$HOME/.gridmap</code>
-* otherwise, in <code>/etc/grid-security/grid-mapfile</code>.
-
-{{Note}} In the QosCosGrid project there is a possibility to generate a new user X.509 certificate in more [http://node2.qoscosgrid.man.poznan.pl:80/gridsphere/gridsphere/guest/security/r/ user-friendly way]
+All Globus service (including GridFTP) require a host (or service) certificate to operate. Also every user needs a user certificate do use Globus services. You can use Globus command `grid-cert-request` to generate `host/users` certificate request which should be send to your CA to be signed. Make sure that CA configuration files and certificate are in place before generating requests. This command will create 3 files:
+* an empty (file length is 0) `/etc/grid-security/hostcert.pem` or `~/.globus/usercert.pem`,
+* `/etc/grid-security/hostkey.pem` or `~/.globus/userkey.pem` file containing `host/use`r private key which must be kept secret - make sure that the unix access mode is set to 0400 or 0600 at most,
+* `/etc/grid-security/hostcert_request.pem` or `~/.globus/usercert_request.pem` file containing acctual request to be send to and signed by CA.
+
+'''Note:''' Before you can use grid-cert-request command you have to source Globus configuration script appropriate for your shell, i.e. `$GLOBUS_LOCATION/etc/globus-user-env.csh` or `$GLOBUS_LOCATION/etc/globus-user-env.sh`
+
+Send newly generated certificate request (i.e. `/etc/grid-security/hostcert_request.pem` or `~/.globus/usercert_request.pem` file) to the appropriate CA and wait for the certificate which should be send in return by your CA. Save the new certificate in `hostcert.pem` or `usercert.pem`. Now, request file can be deleted. Host certificate and private key should be owned by root user.
+Specify identity mapping information. Globus services map distinguished names (retrieved from certificates) to local identities (unix account) by means of `grid-mapfile`. Mappings have the following form:
+`"Distinguished Name" local_name`
+(every line of the file defines one mapping). To let user in, create an account and add mapping to the site's grid-mapfile. Globus looks for the file in the following locations:
+* the value of `GRIDMAP` environment variable if it is set,
+* otherwise, if service is run as root then grid map file is `/etc/grid-security/grid-mapfile`,
+* otherwise, the grid map file is `$HOME/.gridmap`
+* otherwise, in `/etc/grid-security/grid-mapfile`.
+
+'''Note:''' In the QosCosGrid project there is a possibility to generate a new user X.509 certificate in more [[http://node2.qoscosgrid.man.poznan.pl:80/gridsphere/gridsphere/guest/security/r/|user-friendly way]]
 
 == Firewall configuration ==