PHINMS Certificates in Globus

Thanks to Vaughn McMullin, we were able to come up with a repeatable process for installing existing PHINMS user certificates on Globus nodes. The following is a high level description of the process:

1.Export your PHINMS certificate with Internet Explorer using the Personal Information Exchange PKCS12 option.

2.Check the, “Include all certificates and certificate paths” box. NOTE: This should be the only option checked.

3.Upload the exported certificates to the Globus node. (Root, Intermediate, and Private)

4.Use Portecle to view the exported certificates. Portcle is started using the following command: java -jar portecle.jar

5.Use the PEM Encoding option in Portecle to generate a PEM file that Globus can understand.

6.Create a hash name for the PEM file that was created using the following command: openssl x509 -in yourfile.pem -noout -hash

7.Rename the file to the hash number displayed in the following format: hash.0

8.Manually create a signing policy named (hash.signing_policy) Use the following link as a guide to create a signing policy for PHINMS certificates: http://labserv.nesc.gla.ac.uk/projects/etf/gt4howto/gt4localca.html

9.Copy the new files to /etc/grid-security/certificates

10.Verify proper installation by running the following command: openssl verify -verbose -CApath /opt/vdt/globus/TRUSTED_CA -purpose sslclient /home/your_user/your.pem

NLP & Ramp-Up Progressing

I completed the installation of Ubuntu on my laptop last night and I have installed Globus locally. I installed the Simple CA client to keep everything self contained. I will continue to install the other components in the installation guide before the end of the week.

I have access to both the GridMedLee and Zip Code project on my local box. I will begin writing the GridMedLee client in the morning. Both of the above projects were created using the Introduce tool which produces atuo-generated code client code. My intentions are producing a client outside of the Introduce framework.

Got the time form working

I cleaned up the spatial series test form and moved the code over to make a time series test form. I also talked with Jeremy a bit about his installations of globus and ogsadai.

Tonight I block out the changes for the admin screen and start coding it tomorrow.

Progress on SRGM and call with GridFTP guys

We had a productive call with the GridFTP guys (Raj, to be specific) and they were extremely helpful and prompt in responding. The couple of questions posed to them were
1) Was there any way they were achieving encryption for the payload before putting it on the transport layer. Raj told us about Globus XIO Driver which can extended to do so. However since it not an inbuilt feature, we have decided to go with the same encryption used by PHINMS, with the help of Vaughn, since that algorithm is already approved by CDC standards. This will help us satisfy the test case 4G and 4I

2) Raj also provided us a transactional flow diagram for RFT to which some more details need to be added. I will be calling Raj to get more of that information

Also, it came to light that the version of Globus installed and our nodes is 4.0.5 whereas they have already rolled out 4.2. Now 4.2 already contains inbuilt persistent storage which can maintain the state of files being transferred through RFT. Dan mentioned that an upgrade of the toolkit version is on the agenda which will definitely help our case.

Right now the test case left, which Vaughn and Dan are working on, entails installation of PHINMS digital certificate on the node and then doing file transfer, details of which are in the blog post below.

Installing a PHINMS Certificate on Globus

I worked with Vaughn on getting an existing PHINMS digital certificate to work with Globus services. The digital certificate was extracted using Portecle 1.3 and installed on lab 1001. The first attempt was not successful. We will continue the installation in the morning.

When we attempted to verify the certificate, the system was unable to recognize the issuer of the certificate. We are currently troubleshooting the problem.

• Verification Command: openssl verify -CApath /etc/grid-security/certificates -purpose sslclient /some-directory/cert.pem
• Error Generated: error 20 at 0 depth lookup: unable to get local issuer certificate

Form is coming along

I have managed to get the spatial series test JSP form updated so now dynamic inputs can be entered and different servers (that were stored in the properties file) can be picked from a drop down.

The next step is to replicate the changes for a time-series form, and then I will start modifying RODSAdai to have some administration classes that allow for editing of the server lists and the like using the properties files.

Therapeutics Research and Infectious Disease Epidemiology

Tom, Ken and I had a productive call with Jeff Brown, Richard Platt, Roseanne Kue and Suzan Mitchell from the Harvard CoE regarding using grid technology and the research grid with their current process for running SAS code against various SAS data sets.

Currently, SAS programs are emailed to data sources who modify the SAS code, run it and email back the results. The idea is to use grid to send jobs using Globus that will run a SAS script on a Globus node and return the results. This is a big benefit to public health by immediately simplifying the workflow to take out email and manual modification of SAS using Glbus. The real big benefit is that it allows for remote analysis of data sets across remote data sets. No more copying over data sets to epis so they can use the data for research.

Some specific points we covered is that Harvard's timeline is to demonstrate at least 4 nodes running a script and returning the results by January, 2009.

VL-e Toolkit installed (Vbrowser)

The VL-e Toolkit version 0.8.0 has been installed on lab 1001. The VL-e toolkit is a front end GUI for Globus grid services. I'm currently testing the features of the Vbrowser included with the toolkit. Based on initial tests, Vbrowser can flawlessly create and destroy proxies, configure RFT, GridFTP and SRB servers. I will continue to evaluate and test the features and functionality of the software.

Now that a web client accessing Ogsa-Dai is working, now what?

Today I spent a lot of time re-firing-up the development machine and slightly expanding my test to make sure that thethe time series was working in addition to the spatial series. Yesterday, Air Conditioner installation ousted me from the lab for a good portion of the day, so I was planning what I would do once things got running and running them by Jeremy, I am going ahead and posting a copy of that list here:

1. Shorter Term, Higher priority:
1. Expansion of the RODSAdai and RODSAdai-web projects so that instead of just an index and a page that loads a fixed spatial series… you get some pages that let you try different queries, different data-resources (selectable from a list generated from the properties file), and an admin screen for adding, removing, and modifying properties. (shorter term, higher priority)
   
2. (anticipating) Work with Jeremy to set up finals of RODSAdai environment, in the meantime set up different RODS environments (3 computers, each with a subset of data) in the CDC lab that can connect to each other across the local globus network.
   
3. Look into creating a local, database based security manager that uses encrypted user information within a database instead of a “logins.txt” file for OGSA-DAI database authentication/authorization.
   
2. Shorter term, Lower Priority:
   
   1. Brush up documentation of RODS/Adai.
      
   2. Outline and fill as best possible, the “Should Peter walk into the path of a greyhound dream liner” document.
      
   3. See if insecure tomcat’s OGSA-DAI project can be moved into JBoss, if not, find a way for coexistence, or plan out having one insecure tomcat OGSA-DAI instance somewhere accessible for build stations.
      
3. Longer term, Higher Priority:
   
   1. (anticipating) Discuss and document finer layers of authorization in addition to the authentication and encryption afforded by Globus and OGSA-DAI
      
   2. Work on a security management subsystem that allows one to check the validity of a proxy certificate and/or create them as needed, and find ways to work that into the rods portal. The idea being that if the User authenticates, a proxy certificate should be issued for however long they are logged in. This may mean user-specific proxy certificates and integration of things like PURSe and MyProxy.
      
4. Longer term, Lower Priority:
   
   1. Continue researching security policies for Tomcat.

Many of these things are subject to change, but that is where I am right now, I also have a particular interest in integrating RODS and RODSAdai for the conference. I feel like the end goal is to have RODS with two different data sets on two machines and both have the ability to see the others data.

GridFTP Secure Test

We had a successful test of secure GridFTP and the data checksum functionality. This test insures that the data payload is encrypted during transfer and all files are received intact without modification from a 3rd Party. Below is an excerpt from the Admin Guide describing the functionality tested:

-dcsafe | -data-channel-safe Sets data channel protection mode to SAFE.
Otherwise known as integrity or checksumming. Guarantees that the data channel has not been altered, though a malicious party may have observed the data. Rarely used as there is a substantial performance penalty.

-dcpriv | -data-channel-private Sets data channel protection mode to PRIVATE.
The data channel is encrypted and checksummed. Guarantees that the data channel has not been altered and, if observed, it won't be understandable. VERY rarely used due to the VERY substantial performance penalty.