How to Generate Certificates and Private Keys for Users
To use the CSP-secured system, the user must have access to a user-specific
certificate and private key. The most convenient method of gaining access is to create
a text file identifying the users.
StepsOn the master host, create and save a text file that identifies users. Use the format of the file myusers.txt shown in the
following example. The fields of the file are UNIX_username:Gecos_field:email_address.
eddy:Eddy Smith:eddy@my.org
sarah:Sarah Miller:sarah@my.org
leo:Leo Lion:leo@my.org
|
As root on the master host, type the following command: # sge-root/util/sgeCA/sge_ca -usercert myusers.txt
|
Confirm by typing the following command: # ls -l /var/sgeCA/port536/default/userkeys
|
This directory listing produces output similar to the following example.
dr-x------ 2 eddy staff 512 Mar 5 16:13 eddy
dr-x------ 2 sarah staff 512 Mar 5 16:13 sarah
dr-x------ 2 leo staff 512 Mar 5 16:13 leo
|
Tell each user listed in the file (myusers.txt in the
example) to install the security-related files in their $HOME/.sge directories
by typing the following commands. % source sge-root/default/common/settings.csh
% sge-root/util/sgeCA/sge_ca -copy
|
Users should see the following confirmation (user eddy in
the example).
Certificate and private key for user
eddy have been installed
|
For every grid engine software installation, a subdirectory for the corresponding SGE_QMASTER_PORT number is installed. The following example, based on the myusers.txt file, results from issuing the command preceding the output.
% ls -lR $HOME/.sge
/home/eddy/.sge:
total 2
drwxr-xr-x 3 eddy staff 512 Mar 5 16:20 port536
/home/eddy/.sge/port536:
total 2
drwxr-xr-x 4 eddy staff 512 Mar 5 16:20 default
/home/eddy/.sge/port536/default:
total 4
drwxr-xr-x 2 eddy staff 512 Mar 5 16:20 certs
drwx------ 2 eddy staff 512 Mar 5 16:20 private
/home/eddy/.sge/port536/default/certs:
total 8
-r--r--r-- 1 eddy staff 3859 Mar 5 16:20 cert.pem
/home/eddy/.sge/port536/default/private:
total 6
-r-------- 1 eddy staff 887 Mar 5 16:20 key.pem
-r-------- 1 eddy staff 2048 Mar 5 16:20 rand.seed
|
How to Renew Certificates
StepsChange to $SGE_ROOT and becomeroot on
the master host (assuming that $SGE_CELL is the default): # tcsh
# source $SGE_ROOT/default/settings.csh
|
Edit $SGE_ROOT/util/sgeCA/renew_all_certs.csh, and
change the number of days that the certificates are valid: # extend the validity of the CA certificate by
set CADAYS = 365
# extend the validity of the daemon certificate by
set DAEMONDAYS = 365
# extend the validity of the user certificate by
set USERDAYS = 365
|
Run the changed script (the default for all extension times is 365 days
from the day the script is run). # util/sgeCA/renew_all_certs.csh
|
Replace the old certificates against the new ones on all hosts that installed
them locally (that is, under /var/sgeCA/..., see the
execution daemon installation).
If users have copied certificates and keys to $HOME/.sge,
they have to repeat $SGE_ROOT/util/sgeCA/sge_ca -copy to have access
to the renewed certificates.
Checking Certificates
The following sections provide examples of commands related to certificates,
where arch is your system architecture, as in sol-sparc64. Depending on what you want to do, type one or more of the following
commands.
Display a Certificate
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -in ~/.sge/port536/default/certs/cert.pem -text
|
Check Issuer
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -issuer -in ~/.sge/port536/default/certs/cert.pem -noout
|
Check Subject
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -subject -in ~/.sge/port536/default/certs/cert.pem
-noout
|
Show Email of Certificate
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -email -in ~/.sge/default/port536/certs/cert.pem -noout
|
Show Validity
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -dates -in ~/.sge/default/port536/certs/cert.pem -noout
|
Show Fingerprint
Type the following as one string (the command is too long to fit on one line
in this guide), with a space between the -in and the ~/.sge components.
% sge-root/utilbin/arch/openssl
x509 -fingerprint -in ~/.sge/port536/default/certs/cert.pem -noout
|
|