Accessing Machines on the Grid

1. Accessing Machines on the Grid

Certificates
Logging in: GSI-Enabled OpenSSH (gsissh)

In order to do grid computing, you will need to get a certificate from a trusted Certificate Authority. You will need to find out what Certificate Authorities are trusted by the remote site. The trusted Certificate Authorities for NCSA's production machines are:

AIST (Japan)
DOE Science Grid
Dutch Grid and NIKHEF
INFN (Italy)
National Center for Supercomputing Applications(NCSA)
Pittsburgh Supercomputing Center(PSC)
Purdue University
San Diego Supercomputer Center(SDSC)
Texas Advanced Computing Center(TACC)
UK E-Science
University of Southern California(USC)

All users with accounts on NCSA/TeraGrid HPC systems can obtain a NCSA Certificate. See Getting a NCSA Certificate for instructions.

For NCSA production machines, if you have a certificate from a trusted CA other than the Alliance CA that you would like to use, send an email to consult@ncsa.uiuc.edu. In the body of the message, please include your NCSA login and the output of the following command:

     % grid-cert-info -subject

You do not need to do this if you are going to use an Alliance certificate. Those are handled automatically on NCSA production machines.

If you are not familiar with the basic commands used with your certificate or proxy certificate, please read through Using Your User Certificate before proceeding. This guide talks about how to find out information about your certificate, creating a proxy certificate, using the proxy certificate, and destroying the proxy certificate. It also has instructions on moving your certificate to a different machine if you want to make that machine the starting point for all your grid computing.

1.2 Logging in

If the machine that has your grid certificate has the GSI-Enabled OpenSSH client available (gsissh), you can use this to log into a remote machine. The remote machine must be running the GSI-Enabled OpenSSH server in order to use your proxy for authentication. Otherwise you'll have to enter your password. The GSI-Enabled OpenSSH software is available for download from NCSA.

First, create your proxy credential by running grid-proxy-init from the client machine and enter your passphrase. Then gsissh into the remote machine. If the GSI-enabled server is running on a different port, you will need to specify the port on the command line. This is the case with the NCSA clusters. The server is running on port 222. You should not have to enter a password. Your grid credentials will be forwarded to the remote machine automatically with your login. By default, your proxy credential will be valid for 12 hours, so you will typically need to perform this step once per day.

Example:

   [jdoe@ncsa-box1 ~]$ grid-proxy-init
   Your identity: /C=US/O=National Center for Supercomputing Applications/CN=John Doe
   Enter GRID pass phrase for this identity:
   Creating proxy ................................................... Done
   Your proxy is valid until Thu Sep  5 02:13:42 2006

   [jdoe@ncsa-box1 ~]$ grid-proxy-info
   subject  : /C=US/O=National Center for Supercomputing Applications/CN=John Doe/CN=proxy/CN=proxy
   issuer   : /C=US/O=National Center for Supercomputing Applications/CN=John Doe/CN=proxy
   identity : /C=US/O=National Center for Supercomputing Applications/CN=John Doe
   type     : full
   strength : 512 bits
   timeleft : 10:02:15

   [jdoe@ncsa-box1 ~]$ gsissh tg-login.ncsa.teragrid.org
   Last login: Wed Sep  4 14:02:23 2002 from ncsa-box1.ncsa.uiuc.edu

   [ ... ]

   [jdoe@tg-login3 ~]$ grid-proxy-info
   subject  : /C=US/O=National Center for Supercomputing Applications/CN=John Doe/CN=proxy/CN=proxy
   issuer   : /C=US/O=National Center for Supercomputing Applications/CN=John Doe/CN=proxy
   identity : /C=US/O=National Center for Supercomputing Applications/CN=John Doe
   type     : full
   strength : 512 bits
   timeleft : 10:00:43

NCSA NEWS

1. Accessing Machines on the Grid

1. Access

1.1 Certificates

1.2 Logging in