Virtual Laboratory for e-Science
HOWTO: Start using the grid, a quickstart tutorial

by Silvia D. Olabarriaga (silvia@science.uva.nl) and Dennis H. van Dok (dennisvd@nikhef.nl)

Last Update: $Date: 2009-01-30 10:00:56 $

Introduction

This HOWTO document outlines the necessary steps to get access to the grid resources offered by the VL-e Proof-Of-Concept environment. Although it is somewhat tailored for vlemed, it is generally applicable for all wannabee grid users. Please help us keep this guide useful by sending your comments, corrections, updates, etc., to the P4 mailing list ( vle-pfour-team@lists.vl-e.nl ).

If you need more information on which resources are actually available within VL-e, consult the VL-e Resource Guide.

This is a step-by-step guide to get pole position on the grid. You can follow this guide blindly, which will be the fastest way to get started. If you get confused and/or need more details, you can always select "Show more info" to get in-depth background information, explanations, and references to relevant websites.

NOTE: some of the steps can take a few days, since they require manual processing.

The steps outlined below should be followed in linear order, except steps 2a, 2b, and 2c, which can be done in parallel.

1. Obtain a grid certificate
2. 1. Get an SRB account
   2. Register with the VleMed organisation
   3. Get an account at the SARA User interface
3. Configure account at the UI
4. Run your first job on the grid.
5. Where to go from here.

Step 1: Obtain a grid certificate

A grid certificate is a "passport" for using grid resources.

Get a grid certificate from the DutchGrid certificate authority, by going to http://www.dutchgrid.nl/ca/request/ and filling out the web form:

• Ask for a "Users (personal certificates)" certificate;
• Choose
  • Organization: vu, Unit: vumc or
  • Organisation: uva, Unit: amc
  from the select boxes.
• Select Certification level: "Medium security".

You'll will be asked to follow a sequence of steps including

• downloading and running a script on your machine. You should create a new directory for that and call it .globus.

  This script automates the creation of your key and the certificate request to send to the CA. We advice to create a clean directory to run this script. You should also remember the location of this directory for future use. In the end, this directory will contain your private key.

• filling in a paper form which you then need to have signed by the indicated person.

  Note that the CA will not sign the certificate until this paper form is received. The person that should sign the form is the Registration Authority (RA) subsidiary to the CA.

• choosing a passphrase. Remember this well, since this is the password that you'll have to type every single time that you'll access grid resources (for example, to access data or run jobs).

  IMPORTANT: choose a strong passphrase!

  Strong passphrases consist of a combination of letters, digits and other symbols and are at least 12 characters long. Avoid using common words. Since spaces are allowed, some example passphrases are:

  !Doct0r Jone$$ likes 2 cut ### patients
  X-raying 34% of the 20+ PEOPLE? (...)
  

  but I'm sure you can think of something better. Just mind that you should be able to memorize it, because writing it down on a sticky note makes the whole thing pointless.

IMPORTANT: your private key will be stored by the script in the file "userkey.pem". There are three golden rules:

• DON'T lose this file, or your certificate becomes worthless.
• DON'T forget your passphrase, for the same reason.
• NEVER give this file to anyone, or make it readable for anyone. You risk identity theft.

After your request has been processed, you'll receive a message from the CA. Simply follow the instructions in the message, and save it into a file usercert.pem in the same directory as userkey.pem. You can also see your Distinguished Name (DN) and the validity of your grid certificate in this message, which will look like this:

Subject:    O=dutchgrid, O=users, O=uva, OU=wins, CN=Silvia Delgado Olabarriaga 
Valid till: Feb 14 16:37:19 2007 GMT

Finally, you have to "install" your certificate in all computers used to access the grid. This means that the directory where the files mentioned above were stored must be copied into your HOME directory in all the computers you'll be using to access grid resources. Configuraton of your environment becomes easier if this directory is named ".globus".

$ ls -la ~/.globus/user*
-rw-r--r--    1 silvia   silvia       6659 Feb 15 11:53 usercert.pem
-r--------    1 silvia   silvia        963 Feb 13 14:37 userkey.pem

Step 2a: Obtain an account on SRB

To get an SRB account, send an e-mail to grid.support@sara.nl.

• indicate that you belong to VL-e Medical (SP 1.3)
• add in the e-mail your Distingui'shed Name (DN)

The request will be processed manually and confirmed via e-mail. You'll get an e-mail containing your user name and a password.

Step 2b: Register with the VleMedical VO

This is necessary to associate your certificate to one "virtual organization" (= group of people that have access to shared grid resources).

To do this, you need to load your certificate into your browser. Here is a page explaining how.

To register, follow the instructions on https://voms.grid.sara.nl:8443/vomses.
Choose vlemed and follow New User Registration.

You'll get back an e-mail confirming your registration to the grid and VO.

Step 2c: Obtain account at SARA user interface

• Send an e-mail to grid.support@sara.nl asking for an account at the "UI" machine
• You'll get back an e-mail containing your user name and a password. You can later change the password with a command-line utility (passwd). See also below Configuring your account at the UI

Step 3: Configuring your account at the UI

• login at the Sara UI ui.grid.sara.nl

  • on Windows, use your favourite SSH client (e.g. PuTTY) but remember to turn on X-forwarding.

  • on linux/UNIX, use ssh -Y or ssh -X

    The distinction is that since ssh 3.8, X forwarding has become more secure; however, some applications can not deal with this and crash. If you suffer from crashing X11 applications (possible with BadWindow error codes), use -Y.

    • You need an X Server running on your machine, with X-tunnelling enabled.
    • You need the DISPLAY variable properly configured on your local machine.

      export DISPLAY=:0
      

• first change your password on the UI machine (utility passwd)
• now install your grid certificates:
  • copy your .globus directory from your desktop into your home (see above, at the end of step 1).
• install SRB configuration files:

  • Get and extract the srb-userenv.tar.gz file in your home directory. This will create a directory .srb.

    Typically with commands like these:

    cd
    tar xvfz srb-userenv.tar.gz
    

  • edit the file $HOME/.srb/.MdasEnv and replace all occurences of YOUR-SRB-USERNAME by your real SRB username obtained in step 2a.
• try out your certificate (create grid proxy):

  • run voms-proxy-init --voms vlemed to create a grid proxy. You'll be asked to type your certificate passprase selected in step 1.

    A proxy is like a certificate, only shorter-lived. Also, it is not signed by a CA, but by your own private key. This is called delegation of your credentials. This way grid jobs can act on your behalf, without having access to your private key: there is a verifiable chain of signatures leading back to a trusted party: the CA.

    Grid proxies do carry temporary private keys, and anyone getting a hold of your proxy can act in your name. Although this is a security risk, it is limited by the fact that the signature on the proxy gives it a limited validity of only 12 hours.

    You can run voms-proxy-info -all to see the status of your proxy, and voms-proxy-destroy to remove it from the system.

    A proxy is just a file in the /tmp directory. So it will remain on the system even when you logout.

• try out your SRB configuration:
  • Create a grid proxy.
  • run module load srb to set up the environment for running SRB tools.
  • Run Sinit.
  • Run Sls (this should show the list of files in your home directory at the SRB, which should be empty).
  • Run Sput .bashrc (this will copy a file into your home directory at the SRB).
  • Run Sls again.
  • Your can also change the password (Spasswd).
  • This SRB session will remain open until you logout. You can close it with Sexit.

Step 4: Running your first job on the grid

Goal: run a job that writes Hello vlemed user! into a file.

Get hello.jdl into your home directory.

Delegate your VOMS proxy to the WMS:

glite-wms-job-delegate-proxy -d dennis1234

This will return a delegation identifier, which will look this this:

Connecting to the service https://graszode.nikhef.nl:7443/glite_wms_wmproxy_server

================== glite-wms-job-delegate-proxy Success ==================

Your proxy has been successfully delegated to the WMProxy:
https://graszode.nikhef.nl:7443/glite_wms_wmproxy_server

with the delegation identifier: dennis1234

==========================================================================

Submit job to queue:

glite-wms-job-submit -d dennis1234 hello.jdl

This will display the job identifier (jobid), which will look like this:

https://grasveld.nikhef.nl:9000/eD7ha_9J7iuU7jnmyqVM_Q

This jobid should be used to check the job status and retrieve the generated files.

Get job status:

glite-wms-job-status https://grasveld.nikhef.nl:9000/eD7ha_9J7iuU7jnmyqVM_Q

Once the job is in state "Done", it is possible to obtain the generated files:

glite-wms-job-get-output -dir . \
  https://grasveld.nikhef.nl:9000/eD7ha_9J7iuU7jnmyqVM_Q

The output files (std.err, environmentOnNode.txt) will be stored in the given directory.

To see the output:

cat silvia_tWoc6ZfjIwU-c0ifAWowAg/environmentOnNode.txt

Another example: getenv_job.tar.gz. Retrieve and unpack the tar file.

glite-wms-job-submit -d dennis1234 getEnvironment.jdl

This will dump the environment on the computing node into the "environmentOnNode.txt" file. To be used as an illustration only.

Where to go from here.

If you followed all the steps in this 'quick start' tutorial, congratulations! You have taken the first difficult hurdles on the grid and you are now ready for the next challenge: to make optimal use of the available resources and to embed them seamlessly in your workflow.

Unfortunately, there is no easy, step-by-step guide to help you there, nor would it be possible to write such a guide. Every user has specific needs which cannot be addressed by generic solutions. So you have to gather bits and pieces of information from colleagues, websites, presentations and other sources to build up your knowledge and learn your way around.

Another unfortunate fact is that the available information – however plentyful – is scattered and sometimes hard to find. And when you do find it, it is often outdated because the grid is rapipdly maturing.

The VL-e Resource Guide could be a useful starting point when you are looking for information.