The NorduGrid middleware, also known as the Advanced Resource Connector (ARC) does not impose heavy requirements on hardware. Any 32-bit architecture will do, as well as some 64-bit ones (alpha). CPU frequency from 400 MHz and up has been tested, and RAM of 128 MB and up. Disk space required for the ARC installation is 35 MB, while external software (most notably, Globus Toolkit 2) requires 150 MB. Network connectivity of servers (front-ends, gatekeepres, database servers, storage arrays etc) is required to be both out- and inbound. In case you are behind a firewall, a range of ports will have to be opened. For clusters, the worker nodes can either be on a private or a public network.
A shared file system, such as NFS, is desired (due to simplicity) but not required if the local resource management system provides means for file staging to/from computing nodes or if execution happens on the same machine (like it does with fork). Local non-Unix user authentication is supported through callouts to external executables or functions in dynamically loadable libraries. Actual implementation (e.g., for AFS) requires site-specific modules to be provided.
The NorduGrid ARC middleware is expected to run on any system supported by Globus. At the moment, only GNU/Linux of the following distributions have been tested: RedHat 6.2 through 9, Fedora 1, Mandrake 8.0 and 9.1, SuSE 8.1 through 9.0 and Debian 3.0.
In order for the authentication of a server's host certificate to be successful, the reverse DNS lookup of the IP address of the server must result in the hostname given in the host certificate.
This means that the reverse DNS lookup for a host running a GSI enabled service must be configured properly - a "host not found" result is not acceptable. When a server has several hostnames/aliases the host certificate should be requested with the hostname that is used in the reverse lookup table in the DNS.
This reverse lookup must work for all clients trying to connect to the server, including clients running on the machine itself. Even if the host is a dedicated server and no user interface commands is being run on it, other clients such as uploader and downloader processes run by the Grid Manager require GSI authentication to work.
Since the hostname in the host certificate is fully qualified the reverse lookup must yield the fully qualified hostname. If the /etc/hosts file is used for local lookups instead of DNS make sure that the fully qualified hostname is listed before any shortnames or aliases for the server host.
If e.g. the /etc/hosts file of the server looks like this
1.2.3.4 somename somename.domain.com
any clients running on that machine can NOT contact servers on the machine itself since the result of a reverse lookup will be the unqualified hostname "somename" which will not match the fully qualified hostname in the host certificate. Such an /etc/hosts file should be modified to read
1.2.3.4 somename.domain.com somename
Since authorization on the Grid relies on temporary proxies, it is very important to adjust the clock on your boxes with a reliable time server. If the clock on a cluster is off by 3 hours, the cluster will either reject a newly created user proxy for the first 3 hours of its lifetime and then accept the proxy for 3 hours longer than it is supposed to, or start rejecting the proxy three hours too early, depending on in which direction the clock is off.
Function | Location | Description | Example |
grid area (required) | NFS | the directory which accomodates the session directories of the Grid jobs | /scratch/grid |
cache directory (optional) | NFS | the place where the shared input files of the Grid jobs are kept | /scratch/cache |
runtime environment scripts (optional) | NFS | the place for the initialization scripts of the pre-installed software environments | /SOFTWARE/runtime |
control directory (required) | local to the front-end | the directory for the internal control files of the Grid Manager | /var/spool/nordugrid/jobstatus |
GLOBUS_TCP_PORT_RANGE=9000,9300
in /etc/sysconfig/globus and open that range together with the ports 2135 and 2811. The above ports for MDS and GridFTP services correspond to the recommended default settings which can be modified in nordugrid.conf, globus.conf and /etc/sysconfig/globus.DO NOT use PBS routing queues as grid queues -- they are not supported.
GLOBUS_TCP_PORT_RANGE=9000,9300
in /etc/sysconfig/globus and open that range together with the ports 2135 and 2811. The above ports for MDS and GridFTP services correspond to the recommended default settings which can be modified in nordugrid.conf, globus.conf and /etc/sysconfig/globus. what is the recommended PORT_RANGE?The same basic server software is needed both for cluster and storage resources. The NorduGrid download area contains all the required software including the necessary external packages both as precompiled binaries for many Linux distributions and source distributions. Binaries are available either as relocatable RPMs or as tarballs. RPMs is the preferred way of installation for many distributions; if you are not familiar with it, read our "RPM for everybody" guide.
NorduGrid provides the Globus Toolkit as precompiled binaries (RPMs or tarballs) for a variety of Linux systems, as well as the Globus source distribution, suitable for re-building on a new system.
Unless it is relocated, GPT and Globus are installed under /opt/gpt and /opt/globus respectively. In any case, check that the variables GLOBUS_LOCATION and GPT_LOCATION are set according to your Globus installation.Although you can use any other Globus distribution, we recommend to use the NorduGrid Globus distribution since it contains some critical fixes and allows you to install the NorduGrid ARC middleware from binary packages. The modifications within the NorduGrid Globus distribution are collected and described in Specifics of the NorduGrid release of the Globus Toolkit 2. Furthermore, you may bump into unforseen problems if not using the globus-config configuration used within NorduGrid. If you choose to use another Globus installation, you will need to get the NorduGrid source distribution and recompile it against your Globus installation and also you will have to recourse to the original Globus configuration files and documentation.
The same section contains nightly and unstable development tags. For a stable production site ONLY use releases.
You definitely need the nordugrid-server package, while the nordugrid-client, nordugrid-devel and the nordugrid-doc packages are optional but recommended. It is useful to have the client installed on a server for testing purposes. You may need to install some of the external packages in order to satisfy dependencies. someone, please clean up the download area and check/write this section, what is needed for what, what are the dependencies of the nordugrid-server & nordugrid-client, what should a resource install, when does a site need to install the gacl, gsoap, etc..rpm --rebuild nordugrid-<x.y.z-1>.src.rpm
tar xvzf nordugrid-<x.y.z>.tar.gz
cd nordugrid-<x.y.z>
./configure
make
make install
Read carefuly the following section, as your resource will not be able to function if it has improper or outdated credentials.
The following considerations apply for both clusters and storage elements. You may find useful our certificate mini Howto.
You need the credentials (public key, configuration files etc.) of that CA to which you are going to submit the request.
In case your resource is in a Nordic country, install the certrequest-config package from the NorduGrid Downloads area, "CA certificates" section. This contains the default configuration for generating certificate requests for Nordic-based services and users. If you are located elsewhere, contact your local CA for details. Generate a host certificate request withgrid-cert-request -host <my.host.fqdn>
and a ldap certificate request withgrid-cert-request -service ldap -host <my.host.fqdn>
and send the request(s) by e-mail to the corresponding CA for signing. Upon receipt of the signed certificates, place them into the proper location (by default, /etc/grid-security).Check that the files are owned by root and the private keys are only readable by root and that none of the files has executable permissions.
You need the credentials of all the CAs which certified the services you plan to use and users you plan to accept. For example, if your host certificate is issued by the NorduGrid CA, and your user has a certificate issued by the Estonian CA, and she is going to transfer files between your site and Slovakia, you need the NorduGrid, Estonian and Slovak CA credentials.
You are strongly advised to obtain credentials from each CA by contacting them. To simplify this task, the NorduGrid Downloads area, "CA certificates" section has a non-authoritative collection of most known CA credentials. As soon as you deside on the list of trusted certificate authorities, you simply download and install packages containing their public keys etc.Before installing any CA package, you are advised to check the credibility of the CA and verify its policy!
It is the site (that is, yours) responsibility to check the CRLs regularly and deny access to Grid users presenting a revoked certificate. Outdated CRL will render your site unuseable.
NorduGrid provides an automatic tool for regular CRL check-up. We recommend to install the nordugrid-ca-utils from the NorduGrid Downloads area, "NorduGrid Toolkit" section. The utility periodically keeps track of the CA revocation lists.IMPORTANT: you either maintain the grid mappings by hand editing the /etc/grid-security/grid-mapfile directly, or use the nordugrid-gridmap-utils (nordugridmap script ran through cron) to create and maintain the mappings file for your site. In the latter case, the utility keeps the grid-mapfile synchronized with the central NorduGrid user list. If you install the nordugrid-gridmap-utils you ONLY have to edit the nordugridmap.conf and optionally the local-grid-mapfile: the /etc/grid-security/grid-mapfile is periodically overwritten by the nordugridmap script!
Next step is the configuration of your resource. Some files have to be edited for both the computing cluster and the Storage Element (or for a combined resource of a cluster and SE). The configuration templates serve temporarily as a configuration document with detailed description of the configuration parameters and options. The configuration file consists of dedicated blocks for cluster and SE related services. Not having a certain block means not running the corresponding service on the resource.
With the nordugrid.conf you can configure the basic services and processes like the GridFTP server, the Grid Manager, the job submission interface, Grid storage areas and the information providers.
/etc/init.d/gridftpd start
/etc/init.d/globus-mds start
/etc/init.d/grid-manager start
Please note that enabling debugging results in serious performance losses (especially in the case of the MDS LDAP server), therefore use the default level of debuging in a production system.
ngtest -list-cases
Prior to submitting test jobs, make sure you possess a valid user certificate, have generated a valid Grid proxy and have credentials of all the necessary CAs installed. Consult the User Guide for detailed information on certificates, proxies and CA credentials.
For a quick installation validation, run the default test (number 0) against your resource:ngtest -c <my.host.fqdn> -d 1
This will execute a complex Grid job, including staging of files to the computing resource (downloading input files from several locations and caching), compiling a small binary executable and running test calculation on the resource. We recommend to run at least this default test against a newly installed resource and to fetch the job output by using:ngget -a -d 1
Ssee ngtest description for more details on the test-suite. The gsincftp GridFTP client (comes with the NorduGrid Globus) can be used for testing the Storage Element setup:gsincftp gsiftp://<my.host.fqdn>
This instruction opens an FTP connection using Grid access control methods. You should be able to browse the remote site using usual FTP (as implemented in the ncftp client) instructions.