Certificates and VOs - Revision history

ROMAIN ROUGNY rrougny@vub.ac.be: /* BEapps */

2015-12-18T13:08:57Z

BEapps

← Older revision		Revision as of 13:08, 18 December 2015
Line 69:		Line 69:
	*For all people that want to have their application running in BEgrid on a production level.		*For all people that want to have their application running in BEgrid on a production level.
	*You must have your browser certificate loaded.		*You must have your browser certificate loaded.
	*Go to: [https://~~voms01~~.begrid.be:8443/voms/beapps/~~StartRegistration.do~~ VO BEapps registration]		*Go to: [https://voms.begrid.be:8443/voms/beapps/ VO BEapps registration]

	==== BEtest ====		==== BEtest ====
	*Not needed if you are in CMS		*Not needed if you are in CMS

Shkelzen Rugovac: /* CMS */

2015-09-23T15:01:42Z

CMS

← Older revision		Revision as of 15:01, 23 September 2015
Line 43:		Line 43:
	For all people that are in the CMS collaboration and that need access to something.		For all people that are in the CMS collaboration and that need access to something.
	*You need to have your browsercertificate loaded.		*You need to have your browsercertificate loaded.
	*Go to: [https://~~lcg-voms~~.cern.ch:8443/vo/cms/~~vomrs~~ VO CMS registration]		*Go to: [https://voms2.cern.ch:8443/voms/cms/user/home.action VO CMS registration]
	**[https://voms2.cern.ch:8443/voms/cms/user/home.action Phase I]		**[https://voms2.cern.ch:8443/voms/cms/user/home.action Phase I]
	**fill in a valid email address		**fill in a valid email address

Romain Rougny: /* First registration: Outline of registration procedure */

2015-09-21T12:47:41Z

First registration: Outline of registration procedure

← Older revision		Revision as of 12:47, 21 September 2015
Line 22:		Line 22:
	*A summary of the steps you should take is given here:		*A summary of the steps you should take is given here:
	**VO CMS :		**VO CMS :
	**VO CMS registration		**# VO CMS registration
	**~~Send a email to the T2B grid-admins (grid_adminNOSPAM@listserv.vub.ac.be) to introduce yourself~~		**#Become a member of the group /cms/becms
	**Become a member of the group /cms/becms
	**VO BEAPPS :		**VO BEAPPS :
	**VO BEAPPS registration		**#VO BEAPPS registration
	**VO BETEST :		**VO BETEST :
	**VO BETEST registration		**#VO BETEST registration

	*If you join the CMS VO you still need to do following steps as described in section ''Mailing-list and access to Mx-machines''		*If you join the CMS VO you still need to do following steps as described in section ''Mailing-list and access to Mx-machines''
Line 37:		Line 36:
	**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]		**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]
	**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]		**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]
	**Register to T2B mailing-list
	**Finally you should send your SSH key to grid_adminNOSPAM@listserv.vub.ac.be to get acces to the tier2

	==== Virtual Organisation ====		==== Virtual Organisation ====
Line 79:		Line 76:
	*Go to: [https://voms01.begrid.be:8443/voms/betest/StartRegistration.do VO BEtest registration]		*Go to: [https://voms01.begrid.be:8443/voms/betest/StartRegistration.do VO BEtest registration]

	==== ~~Mailing-list~~ ====		==== Hypernews & SiteDb ====

	*HN account		*HN account

Romain Rougny: /* Getting access the IIHE T2B */

2015-09-21T12:43:43Z

Getting access the IIHE T2B

← Older revision		Revision as of 12:43, 21 September 2015
Line 4:		Line 4:
	*In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the User Interfaces of the IIHE.		*In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the User Interfaces of the IIHE.
	*BEgrid certificates are managed by [http://www.begrid.be/ BELNET]		*BEgrid certificates are managed by [http://www.begrid.be/ BELNET]
	*The access to the IIHE UI's, called the Mx machines (x representing a number) is explained ~~below, it is~~ [~~#Mailing-listandaccesstoUIs part~~] ~~of the ''First registration'' procedure.~~		*The access to the IIHE UI's, called the Mx machines (x representing a number) is explained [[First_access_to_t2b\|here]]
	*'''First registration''': The registration procedure consist of several steps outlined below in the section [#Firstregistration:Outlineofregistrationprocedure First registration]		*'''First registration''': The registration procedure consist of several steps outlined below in the section [#Firstregistration:Outlineofregistrationprocedure First registration]
	*'''Certificate Renewal''': The procedure to renew your certificate is described in section [#Certificaterenewal:Updatecertificate Certificate Renewal]		*'''Certificate Renewal''': The procedure to renew your certificate is described in section [#Certificaterenewal:Updatecertificate Certificate Renewal]

Romain Rougny: /* Getting access the IIHE T2B */

2015-09-21T12:42:20Z

Getting access the IIHE T2B

← Older revision		Revision as of 12:42, 21 September 2015
Line 1:		Line 1:

	== Getting access the IIHE T2B ==		== Getting access the IIHE T2B ==
	~~[[PageOutline]]~~

	*In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the User Interfaces of the IIHE.		*In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the User Interfaces of the IIHE.

Romain Rougny: /* Mailing-list and access to UI's */

2015-09-21T12:40:01Z

Mailing-list and access to UI's

← Older revision		Revision as of 12:40, 21 September 2015
Line 80:		Line 80:
	*Go to: [https://voms01.begrid.be:8443/voms/betest/StartRegistration.do VO BEtest registration]		*Go to: [https://voms01.begrid.be:8443/voms/betest/StartRegistration.do VO BEtest registration]

	==== Mailing-list ~~and access to UI's~~ ====		==== Mailing-list ====

	*HN account		*HN account
Line 91:		Line 91:
	**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]		**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]
	**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]		**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]
	*You need to register to the t2b user mailinglist
	**Go to the [https://e-groups.cern.ch/e-groups/EgroupsManageOwnerAdmin.do request page]
	**search for the list beginning with '''belgian-t2-users'''
	**then hit the button subscribe
	**If any of this fails, ask someone to contact the mailinglist admins (or ask them to send a mail to this list with your request)
	*Once all this is completed, send an email to the admins [ grid_admin[AT]listserv.vub.ac.be ] with your public ssh keys. We can then grant you access to the Mx machines (for SLC4: x=0,1 while for SLC5: x=2,3,6,7,8,9).
	**do this by the following procedure:
	~~<pre>~~
	~~in a shell type:~~
	~~ssh-keygen~~
	~~and follow the instructions. The defaults suggested are fine. Just choose a password.~~

	~~this will create 2 files in~~ the ~~following directory~~: ~~<home dir>~~/.~~ssh~~		*Once you have access to the UIs, you need to install your certificate on these machines. This procedure is described [http://quattor.begrid.be/trac/centralised-begrid-v5/wiki/Access_to_BEgrid here] under the section ''Install your certificate in your new Unix account''
	~~The files are:~~
	~~id_rsa~~
	~~id_rsa~~.~~pub~~

	~~You need to send us the id_rsa.pub, which contains your public key. The other is your private key and should never be shared.~~
	~~</pre>~~
	*Once you have access, you need to install your certificate on these machines. This procedure is described [http://quattor.begrid.be/trac/centralised-begrid-v5/wiki/Access_to_BEgrid here] under the section ''Install your certificate in your new Unix account''
	*On these machines, a [https://mon.iihe.ac.be/trac/t2b/wiki/Backup backup scheme] is present, please read the page to familiarize yourself.
	*Also, a quorum of 490G is applied to these disks. If you need more user space, please contact the admins.

	----		----

Maintenance script: Created page with " == Getting access the IIHE T2B == PageOutline *In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the Use..."

2015-08-26T12:28:19Z

Created page with " == Getting access the IIHE T2B == PageOutline *In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the Use..."

New page

== Getting access the IIHE T2B ==
[[PageOutline]]

*In order to get access to grid and the Tier2 at the IIHE you need obtain a BEgrid Certificate and get access to the User Interfaces of the IIHE.
*BEgrid certificates are managed by [http://www.begrid.be/ BELNET]
*The access to the IIHE UI's, called the Mx machines (x representing a number) is explained below, it is [#Mailing-listandaccesstoUIs part] of the ''First registration'' procedure.
*'''First registration''': The registration procedure consist of several steps outlined below in the section [#Firstregistration:Outlineofregistrationprocedure First registration]
*'''Certificate Renewal''': The procedure to renew your certificate is described in section [#Certificaterenewal:Updatecertificate Certificate Renewal]

==== Password advice ====
In the registration procedure that is described here, a number of passwords will be requested from you. Please choose good ones and don't share them with other people (or write them on post-its ;).

----
=== First registration: Outline of registration procedure ===

*First, a very important preliminary remark before going into the steps of the certificate request procedure : you can use Firefox or IE, but please DON'T USE CHROME and KEEP THE SAME BROWSER AND LAPTOP/PC DURING ALL THE PROCEDURE.
*If you request a certificate for the very first time, you can follow the procedure [http://quattor.begrid.be/trac/centralised-begrid-v5/wiki/Access_to_BEgrid here]. The section ''Get a BEgrid Certificate'' should provide you with a BEgrid certificate and should allow you to prepare your browser
**Get a BEgrid certificate
**Browser preparation

*The next step is to Join a Virtual organisation ''VO'' as described further on this page in the section ''Virtual Organisation''. You can make several choices. If you intend to use the CMS grid infrastructure your VO is CMS. For BEgrid applications join beapps or betest.
*A summary of the steps you should take is given here:
**VO CMS :
**VO CMS registration
**Send a email to the T2B grid-admins (grid_adminNOSPAM@listserv.vub.ac.be) to introduce yourself
**Become a member of the group /cms/becms
**VO BEAPPS :
**VO BEAPPS registration
**VO BETEST :
**VO BETEST registration

*If you join the CMS VO you still need to do following steps as described in section ''Mailing-list and access to Mx-machines''
**Create your Hypernews account
**Register your DN in SiteDB
**Else CRAB will not work.
**First, make a public certificate [https://ca.cern.ch/ca/Help/?kbid=023010 Instructions]
**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]
**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]
**Register to T2B mailing-list
**Finally you should send your SSH key to grid_adminNOSPAM@listserv.vub.ac.be to get acces to the tier2

==== Virtual Organisation ====
What VO should I join?
*Depending on your experiment or type of application, you have to choose a corresponding VO. If you have no clue which it is, ask your contact person. Unless you really know what your doing (but why are you reading this page?), don't join <tt>dteam</tt> or <tt>ops</tt>.
==== CMS ====
For all people that are in the CMS collaboration and that need access to something.
*You need to have your browsercertificate loaded.
*Go to: [https://lcg-voms.cern.ch:8443/vo/cms/vomrs VO CMS registration]
**[https://voms2.cern.ch:8443/voms/cms/user/home.action Phase I]
**fill in a valid email address
***the email address must be known in the CERN database and in the CMS database (normally this is the address used when registering with CMS for the first time)
***in case you have problems, try the [http://consult.cern.ch/xwho CERN xwho database] to find your known email address
**select ''Marti Pimia'' as representative
**fill in your first name and last name
**wait for an email to go to Phase II
**click on the link in the email. It will take you to the Phase II registration page.
**fill in your personal information
**pick any additional roles (if really needed). the default should be ok for lost people.
**on the bottom: read the ''GRID Acceptable Use Policy'' and select ok
**click to register
**'''Also send an email to the admins''' [ grid_admin[AT]listserv.vub.ac.be ] to tell them who you are. Also put your team leader in CC, in this way we know that you are part of the Belgian collaborators (it is impossible for us to know all new members)
**you now have to wait for approval of your request. this can take some time and you will notified by email.
**at latest one day after this approval you will be able to use the CMS grid resources.
*After you are member of the VO cms, you need to join the group <tt>/cms/becms</tt>
**Goto the [https://voms2.cern.ch:8443/voms/cms/user/home.action Select Groups & Group Roles]
**Select the group <tt>/cms/becms</tt>
**Press <tt>Submit</tt> at the bottom of the page
**[[Image(cms-groups-becms.png, 50%)]]

==== BEapps ====
*Not needed if you are in CMS
*For all people that want to have their application running in BEgrid on a production level.
*You must have your browser certificate loaded.
*Go to: [https://voms01.begrid.be:8443/voms/beapps/StartRegistration.do VO BEapps registration]
==== BEtest ====
*Not needed if you are in CMS
*For all people that want to test their application running in BEgrid.
*You must have your browser certificate loaded.
*Go to: [https://voms01.begrid.be:8443/voms/betest/StartRegistration.do VO BEtest registration]

==== Mailing-list and access to UI's ====

*HN account
**[https://hypernews.cern.ch/HyperNews/CMS/add-member.pl New member info]
**If you have a lxplus account, you can register yourself
**If not, you need to send an email to the cms hn admin.
**Register HN account in SiteDB ([https://twiki.cern.ch/twiki/bin/view/CMS/SiteDBForCRAB instructions])
**Else CRAB will not work.
**First, make a public certificate [https://ca.cern.ch/ca/Help/?kbid=023010 Instructions]
**Next, upload this public certificate in this [https://accountmap.web.cern.ch/accountmap/Mapping/Certificates.aspx page]
**After ~15 minutes, the changes should be reflected on [https://cmsweb.cern.ch/sitedb/dev/people this page]
*You need to register to the t2b user mailinglist
**Go to the [https://e-groups.cern.ch/e-groups/EgroupsManageOwnerAdmin.do request page]
**search for the list beginning with '''belgian-t2-users'''
**then hit the button subscribe
**If any of this fails, ask someone to contact the mailinglist admins (or ask them to send a mail to this list with your request)
*Once all this is completed, send an email to the admins [ grid_admin[AT]listserv.vub.ac.be ] with your public ssh keys. We can then grant you access to the Mx machines (for SLC4: x=0,1 while for SLC5: x=2,3,6,7,8,9).
**do this by the following procedure:
<pre>
in a shell type:
ssh-keygen
and follow the instructions. The defaults suggested are fine. Just choose a password.

this will create 2 files in the following directory: <home dir>/.ssh
The files are:
id_rsa
id_rsa.pub

You need to send us the id_rsa.pub, which contains your public key. The other is your private key and should never be shared.
</pre>
*Once you have access, you need to install your certificate on these machines. This procedure is described [http://quattor.begrid.be/trac/centralised-begrid-v5/wiki/Access_to_BEgrid here] under the section ''Install your certificate in your new Unix account''
*On these machines, a [https://mon.iihe.ac.be/trac/t2b/wiki/Backup backup scheme] is present, please read the page to familiarize yourself.
*Also, a quorum of 490G is applied to these disks. If you need more user space, please contact the admins.

----

=== Certificate renewal: Update certificate ===
<pre>
#comment
As the CA changed, users with a certificate made before November 2008 should ask for a new certificate. This is because the certificate authority changed.
*Certificate renewal for certificates delivered BEFORE November 2008
**First follow the procedure as detailed in "Requesting a certificate for the very first time"
**Install your newly received certificate in a directory other than .globus, as you will use the old one while waiting for the new one to be approved by cms
**Then go to https://lcg-voms.cern.ch:8443/vo/cms/vomrs?path=/RootNode/MemberAction/MemberDNs/AddDN&action=execute&do=select
**Fill in your new Dn (you can obtain this by running the following command:
</pre>
<pre>
#comment
openssl x509 -in usercert.pem -subject
</pre>
<pre>
#comment
**Your new DN starts with /C=BE
**Make sure when you copy, not to add any whitespace before or after the DN
**also change the CA (dropdown box) to : /C=BE/OU=BEGRID/O=BELNET/CN=BEgrid CA
***note that a similar one exists with an email address. Do NOT use the one with the email address.
**In the reasons box, fill in: "Change of CA"
**Wait until the new certificate is approved and then ...
**contact the admins to have your dcache acces mapped to your new DN (send us the DN via email)
**also change your DN into siteDB (https://twiki.cern.ch/twiki/bin/view/CMS/SiteDBForCRAB)
</pre>

*Certificate renewal
**Please DON'T USE CHROME and KEEP THE SAME BROWSER AND LAPTOP/PC DURING ALL THE PROCEDURE !
**Go to the belnet site https://gridra.belnet.be/pub/
**Go to request a new certificate based on an existing certificate (the renew function does not work on their site)
**You can install your new certificate directly in your browser with the "Integrate" button (recommended) or download it as a file.
**then, install your new certificate in your Unix account:
**The certificate has to be copied on the User Interface server (and saved in a different format ...)
***Export the certificate from your browser, into a 'p12' - file
***for Firefox: Select Edit/Preferences->Advanced->Manage Certificates; Select the Certificate Click "Backup" give the requested password, then Save with file name "cert" (Will create file cert.p12)
***for Internet Explorer Select Tools/Internet Options Select Content Select Certificates Select Personal Select the Certificate Click "Export" On Certificate Manager Export Wizard Select Next Select 'Yes, export the private key'
***For MAC:
####Open the Keychain Access utility (Applications -> Utilities)
2. Select your certificate or key from the Certificates or Keys category, and do one of the following:
#####Choose File -> Export items ...
b. Right-click, and choose Export [your name]'s ID ...
3. In the Save As field, enter cert.12 for the exported item, and click Save. You will be prompted to enter a new export password for the item.
**Select Personal Information Exchange PKCS#12 (.PFX) give the requested password, then Save with file name "cert".( will save cert.pfx, rename this to cert.p12 )
***scp the file cert.p12 on the User Interface server.
***login on the userinterface-server; The file cert.p12 should be in your homedirectory now. Execute fillowing commands (to transform the certificate and private key from the PFX-format into PEM format; they will ask for the passphrase you put on cert.p12 in order to read it, and will ask you for a new passphrase to put on the private key userkey.pem; You can take the same passphrase ... !)

<pre>
mkdir ~/.globus
openssl pkcs12 -nocerts -in cert.p12 -out ~/.globus/userkey.pem
openssl pkcs12 -clcerts -nokeys -in cert.p12 -out ~/.globus/usercert.pem
chmod 400 ~/.globus/userkey.pem
chmod 644 ~/.globus/usercert.pem
</pre>

----
=== Questions and Remarks ===
==== Who is my local BEgrid contact person? ====
Good question. If you really don't know or you can't ask anybody else, you may always contact rosette.vandenbroucke@vub.ac.be with this question.

==== Some links ====
*[http://www.alw.nih.gov/Security/Docs/passwd.html www.alw.nih.gov]
*[http://www.auscert.org.au/render.html?it=2260 www.auscert.org.au]
*[http://en.wikipedia.org/wiki/Passwords en.wikipedia.org]
*pisa.belnet.be [http://pisa.belnet.be/pisa/nl/password.htm (dutch)], [http://pisa.belnet.be/pisa/fr/password.htm (french)]

==== Extra ====
Useful link for all detailed commands on certificates:
*http://goc.eu-eela.org/operations/certification-authority-and-virtual-organisation-operations/certificate-manipulation/

==== Problems ====
==== No certificate matches private key ====
When the conversion to <tt>.p12</tt> fails with this message, a number of things might be wrong:
*Make sure that the request-key is the one matching the certificate (ie the download.cer file).
*Check the public modulus:
**<tt>openssl rsa -noout -text -in <request_key></tt>
**<tt>openssl req -noout -text -in <newcert_request.pem></tt>
**<tt>openssl x509 -noout -text -in <download.cer></tt>
*They should all have the same modulus, eg
<pre>
Modulus (2048 bit):
00:a8:7d:e0:ec:c6:ba:0b:39:87:92:87:2e:1d:03:
</pre>
*If this is not the case, something went wrong somewhere. You should contact gridcaNOSPAM@belnet.be and explain them your problem.
==== Troubleshooting check-list ====
This section gives a summary of the different steps of the registration procedure detailed on this page. You can use it as a check-list, e.g. to verify that you don't have missed a step.
- Browser preparation
- Get a BEgrid certificate
- Join a VO (CMS or BEAPPS or BETEST) :
**VO CMS :
**VO CMS registration
**Send a email to the T2B grid-admins (grid_adminNOSPAM@listserv.vub.ac.be) to introduce yourself
**Become a member of the group /cms/becms
**Create your Hypernews account
**Register your DN in SiteDB
**Register to T2B mailing-list
**VO BEAPPS :
**VO BEAPPS registration
**VO BETEST :
**VO BETEST registration
- Send your SSH key to grid_adminNOSPAM@listserv.vub.ac.be

=== Certificates ===
BEgrid certificates are managed by BELNET
*[https://gridra.belnet.be/pub/ Homepage of the BELNET CA]
*Email your questions or remarks to gridcaNOSPAM@belnet.be

==== Browser preparation ====
==== Everybody has to do this at least once : ====
*Load the certificate authenticating the BEgrid CA by clicking on the appropriate link at https://gridra.belnet.be/
**This may bring up a so-called <tt>Software Security Device</tt> that will manage your certifiactes in your browser.
When this is the first time you use it, you'll need to configure it first.
Most probably this means setting a password to protect the device.
**If nothing happens automagically, download the certificate from the above link and import it yourself
**Mozilla/firefox/etc : Edit -> Preferences -> Advanced -> Manage certificates -> authorities -> import
*If your CA is CERN, to load the CA certificate go to [https://ca.cern.ch/ca/ the CERN CA homepage], and in the section ''Download CA certificates and CRLs'' click on both [https://ca.cern.ch/ca/CRL/CERN%20Root%20CA.crt CERN Root CA certificate] and [https://ca.cern.ch/ca/CRL/CERN%20Trusted%20Certification%20Authority.crt CERN Trusted Certification Authority Certificate]

==== If your certificate is no longer in your browser : ====
This can happen if you have changed from laptop or if you have reinstalled everything from scratch on your laptop ''without having restored a backup of your browser environment''. In this case, if you still have access to our UIs, you can recreate the PKCS12 (*.p12) certificate from the usercert.pem and userkey.pem files located in your ~/.globus. Here is the procedure :
<pre>
On a UI :
cd ~/.globus
openssl pkcs12 -export -out cert.p12 -inkey userkey.pem -in usercert.pem
</pre>
It will prompt you to type the password of your userkey.pem, it is the one you use to submit crab jobs. To export the p12 use the same password. So just type 3 times the same password it is easier like that.

After that, copy the cert.p12 file back to your computer. Then you just have to import the certificate on your browser.

Example for Mozilla Firefox: Go to Preferences > Advanced > Encryption > View Certificates >Your certificates > Import

There you just have to choose the cert.p12 and it will ask you for the password you used before.

{{TracNotice|{{PAGENAME}}}}