1. Grid Tech Team
Certificates, Monitoring, &
Firewall
September 15, 2003
Chiang Mai, Thailand
Allan Doyle, NASA
With the help of the entire Grid Tech Team
3. Virtual Organization
Definition
• Grid Virtual Organization (VO)
– Set of resources (computers, storage systems)
– Distributed among participating organizations
– Available for use by a group of users
– Is defined by the grouping of resources plus the
grouping of individuals, brought together for a
common purpose under mutually acceptable
governing rules.
Grid Tech Team 3
September 15, 2003
4. Organizations, Resources, Users,
and Virtual Organizations
U1 U2
OrgA OrgB OrgC
C C C C
C C C
C C C
S S C
S S S
S S
S
S
S
VOX
S Storage Resource
VOY
C Compute Resource
Grid Tech Team 4
September 15, 2003
5. Creating a VO
• Hosts and users must obtain certificates
• Users are then granted access to hosts (by
the owners of the hosts).
• The set of users coupled with the set of hosts
they are allowed onto is what “defines” the
VO U1 U2
OA OB OC
C C C C
C C C
C C C
S S C
S S S
S
S
S
S
S
VOX
S
VOY
C Storage Resource
Compute Resource
Grid Tech Team 5
September 15, 2003
6. CEOS Grid
NASA ADG
Test-II
USGS EDC Test-SGT CNES
Qu i c k Ti m e ™ a n d a TIF F (U n c o m p re s s e d ) d e c o m p r e s s o r a re n e e d e d t o s e e th i s p i c t u re .
ESA ESRIN
NOAA NOMADS GMU
UAH
Colors
Blue - CEOS Certificates
Green - DataGrid Certificates
Black - TBD Grid Tech Team 6
September 15, 2003
7. CEOS Grid - CAs
• CEOS Grid Users will not all have the same
CA
• We want to limit the number of CAs to the
smallest possible set.
– Makes management easier
– Makes policy decisions easier
• European users already have a high-quality
operational CA
• US Users are encouraged to obtain
certificates from NASA IPG
Grid Tech Team 7
September 15, 2003
8. CEOS Certificates from
NASA IPG
• NASA Information Power Grid (IPG) already runs a
high-quality CA that is accepted by most VOs.
• NASA IPG is providing CA resources for the CEOS
Grid.
• Current status
– Certificate request software has been delivered & tested.
– Operating well at 2 test sites (II, SGT) and at GMU.
– Others are encouraged to try it out.
• Availability
http://grid-tech.ceos.org/gridwiki/CeosGridVirtualOrganization
Username ceos-grid, password grid-tech
– Small tar file & quick installation instructions
Grid Tech Team 8
September 15, 2003
13. General Firewall Issues
• Using the Grid means that you have to make new
services accessible to the internet
– System administrators and security people will be
uncomfortable with this
– Some sites have different policies, some are set up to allow
experimentation outside the firewall
• What you can do
1. Familiarity - install & test on a machine outside the firewall,
learn about the Grid
2. Provide information about security issues to people who
need it
3. Develop a relationship with the people you depend on for
access
Grid Tech Team 13
September 15, 2003
14. Firewall
• Tech Team has put together a firewall document
http://grid-tech.ceos.org/gridwiki/FirewallBestCommonPractices
• Contents
– Introductory material
• CEOS Grid overview; Quick primer on Grids; Globus port
numbers
– Site specific sections
• Meant to be filled in by each site with anything you learned that
might help someone else
– Product specific info
• Currently only one - Cisco instructions
– Miscellaneous
• Open Questions; References; To Do
Grid Tech Team 14
September 15, 2003
18. Grid Components we’re
Tracking
• Globus 3.0
• Metadata Catalog Service (MCS) (Current version as
of 8/11/03)
– Open Grid Services Architecture – Data Access &
Integration
• (OGSA DAI 2.5 - http://www.ogsadai.org.uk/)
– Community Authorization Service (CAS) Alpha R2 Release
• OGSA DAI 3.0
– Ported version of MCS – planned
• MCS with Spatial Query capabilities – planned
• Storage Resource Broker/Metadata Catalog
(SRB/MCAT) V. 2.1.2
– Globus Grid Security Infrastructure (GSI)
Grid Tech Team 18
September 15, 2003
19. CEOS Grid Toolkit
• WGISS participants are developing higher-level tools &
components
• GMU
– OGC WCS with GridFTP back end
– OGC WCS with Grid front end
– OGC Catalog wrapper on Grid MCS
– Reprojection service, 13 NASA EOS projections
• ESA
– Grid Engine - multi-Grid job management
– Web Notification - Grid-to-Web events
– Grid Portal - Web control of Grid applications
– Reprojection Service
Grid Tech Team 19
September 15, 2003
20. CEOS Grid Toolkit Catalog
• We need to put some thought into how we
want to describe the components.
• Possible metadata elements (thanks to Stu
Doescher):
–short name –Contact points
–long name •supported and by who
–summary description •used by
–pointer to additional discussion –Technical parts
•Language
–latest version and date
•how to install
–maturity - new, obsolete
•problems
–other parts needed
–recommendations
Grid Tech Team 20
September 15, 2003
21. THANK YOU
Grid Tech Team 21
September 15, 2003
