**Myproxy and related installation guide:**

Getting Started:

-   Obtain the following packages:

-   <ftp://ftp.ncsa.uiuc.edu/aces/myproxy/myproxy-1.16.tar.gz>

-   <http://www-unix.globus.org/ftppub/gt2/2.4/2.4-latest/gpt/gpt-3.0.1-src.tar.gz>

-   Go to: <http://www.globus.org/gt2.4/download.html>, scroll down to
    "Source Download", select "Resource Management" and "Client" and do
    the http download. (File:
    globus-resource-management-client-2.4.3-src_bundle.tar.gz).

Set up the enviroment (using setup on Natasha as an example):

-   mkdir /globus

-   cd /globus

-   mkdir globus-2.4.3 ; mkdir globus-2.4.3/src ; mkdir globus-2.4.3/ALL

-   mkdir gpt ; mkdir gpt/src ; mkdir gpt/GPT-3.0.1

-   place the gpt source tarball in the gpt/src directory.

-   place the globus and myproxy tarballs in the globus-2.4.3/src
    directory.

-   export GPT_LOCATION=/globus/gpt/GPT-3.0.1

-   export GLOBUS_LOCATION=/globus/globus-2.4.3/ALL

-   those environment variables must be set before proceeding!

Build gpt:

-   cd /globus/gpt/src

-   untar the source package.

-   cd into the created directory and run: "./build_gpt".

-   gpt is now built and installed.

Build globus:

-   cd \$GLOBUS_LOCATION

-   \$GPT_LOCATION/sbin/gpt-build --verbose
    ../src/globus-resource....tar.gz gcc32dbg gcc32dbgpthr

-   this build will take a while, but the --verbose flag will allow one
    to observe the progress of the build.

-   After the build is complete, it's most likely a good time to: source
    \$GLOBUS_LOCATION/etc/globus-user-env.sh just to be sure that your
    environment is complete.

Build myproxy:

-   stay where you are in \$GLOBUS_LOCATION

-   \$GPT_LOCATION/sbin/gpt-build --verbose ../src/myproxy....tar.gz
    gcc32dbg

-   myproxy will be installed in the \$GLOBUS_LOCATION hierarchy with
    the config file being placed in /etc, the server and administration
    utilities in /sbin, and the user utilities in /bin.

Setting up/starting up myproxy server:

-   Decide which user will run the myproxy server process, create an
    account if necessary, create /var/myproxy, chown it to that user and
    chmod it to 700.

-   Edit \$GLOBUS_LOCATION/etc/myproxy-server.config as necessary. I
    believe that we are currently using an unedited default version.

-   Edit the init script that is placed in /etc/rc.d (or whatever it's
    corollary is on the system you installed it on). This will involve
    several things:

-   At the top of the init script before anything else, add in and set
    the environment variables X509_USER_CERT and X509_USER_KEY to point
    to the cert/key files that the server will be using. This may also
    be set up as a standard ephemeral env var in the user shell, but
    adding it to the script is most likely the best thing to do.
    Similarly, if the appropriate files are found in /etc/grid-security,
    this is probably not necessary as they will most likely be picked up
    automatically, but no harm in being explicit. This is not a
    "commented out variable" that is already part of the script, so it
    must be added.

-   Find where GLOBUS_LOCATION is set in the script and provide the
    appropriate path.

-   Find where the commented-out variables STORE and CONFIG are located
    an provide the appropriate values (STORE would be the repository and
    CONFIG the path to the config file). You can set PORT as well while
    you're here if desired.

-   If the myproxy server is **not** to be run as root, then search for
    the string "Starting up MyProxy" and change the following startup
    line to: su -c \"\$MYPROXY \$PORT \$CONFIG \$STORE \$VERBOSE\" fgcm
    (where fgcm would be changed to the username that is going to run
    the process).

-   **BUG ALERT:** I encountered the following problem when I recently
    installed globus/myproxy. Right after the line "export
    GLOBUS_LOCATION" the init script attempts to source
    \$GLOBUS_LOCATION/libexec/globus-script-initializer and after that,
    globus-sh-tools.sh in the same directory. For whatever reason, these
    utility scripts seem to not be included in the bundle we are
    installing. But as they are simple shell scripts, grab them from one
    of the lab installs of this and copy them to the
    \$GLOBUS_LOCATION/libexec directory.

-   At this point, the myproxy server should start up after all of these
    changes have been made. Simply run ./myproxy start. Even if it is
    being run as non-root user, it will still log to /var/log/messages
    with the line "myproxy-server" in the appropriate log lines (for
    string searching).

Installing Cyrus SASL:

> ***Note:** PAM authentication can be used to support one-time-password
> authentication when retrieving a proxy certificate from MyProxy. The
> rest of this document describes how we installed sasl to talk to a pam
> module.*

-   Obtain the Cyrus SASL package:

-   http://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.20.tar.gz

-   I performed a non-default installation so we can control our own
    install and to use it in case the system installed sasl libraries
    did not suit our needs (for example, on my test machine, there were
    no sasl header files). Plus, globus sets up the \$SASL_PATH variable
    when it initializes the environment, and this can compete with a
    default install.

-   So, copy the library tarfile to where the rest of the globus/myproxy
    sources are (ie: \$GLOBUS_LOCATION/../src), untar it and configure
    it thusly:

-   ./configure --prefix=\$GLOBUS_LOCATION --disable-cram
    --disable-digest \--enable-login (the two disable flags are probably
    optional, but the install docs suggested disabling whatever you did
    not need).

-   Then make ; make install. This will place the sasl binaries
    (saslauthd and some password utils) in \$GLOBUS_LOCATION/bin, the
    main sasl shared libararies will be placed in \$GLOBUS_LOCATION/lib
    and the sasl "plug-ins" will be placed in
    \$GLOBUS_LOCATION/lib/sasl2.

-   **Of Note:** when the globus environment is set up it will set the
    environment variable \$SASL_PATH to \$GLOBUS_LOCATION/lib/sasl (not
    sasl2). So at this point it is appropriate to cd to
    \$GLOBUS_LOCATION/lib and: ln --s sasl2 sasl.

-   **Of Further Note:** the aforementioned env var \$SASL_PATH
    overrides the sasl package's natural tendency to search in
    /usr/lib/sasl2 for it's plugins and application specific
    configuration files. So this must be set not only in the
    environment/shell that the myproxy-server is being run under, but
    any client applications (such as myproxy-get-delegation) must not
    only see a valid sasl plugin/install, but must see one configured
    for myproxy. This is another good reason as I see it to eschew a
    standard install and install with the globus stuff because
    ostensibly anyone using globus/myproxy utils will have the globus
    environment setup and this allows globus to do it for the user
    rather than any further action required on the user's part.

-   This will now necessitate a recompile of myproxy:

-   ./configure \--with-flavor=gcc32dbg \--with-sasl2=\$GLOBUS_LOCATION
    ; make ; make install. This will freshen up the myproxy binaries and
    correctly install them in the globus tree.

-   At this point, the directions for pam configuration found on the
    myproxy site: <http://grid.ncsa.uiuc.edu/myproxy/sasl.html> are
    prety much right on the money.

-   The application specific conf file will go in
    \$SASL_PATH/myproxy.conf. For simple pam unix-password configuration
    I used their sample myproxy.conf file using the "plain" mechanism
    and saslauthd for pwcheck_method.

-   Since we'll be cooking up more extensive pam recipes, I deviated
    from their example pam conf file (/etc/pam.d/myproxy) and went with
    this for my first stab:

> **account required pam_unix.so**
>
> **auth requisite pam_nologin.so**
>
> **auth required pam_unix.so**
>
> **session required pam_unix.so**

-   This is a no-frills version of the standard unix login module. Other
    pam plugins (such as the one that enforces strong passwords) can be
    added into the stack as necessary.

-   Next is starting up saslauthd. First mkdir /var/state/saslauthd and
    make sure it's writable by the owning process. I'm just running it
    as root. Non-root run processes are able to talk to it. The daemon
    is started thusly:

-   \$GLOBUS_LOCATION/sbin/saslauthd --a pam -- I just doctored up my
    myproxy init script to invoke this before the myproxy-server starts
    and kill it (via "killall") when the myproxy-server is stopped. The
    sasl daemon can also just be started via another system init script
    if desired. But it must be running with the --a pam flag for us to
    link into the pam module framework.

-   Then get some delegated credentials. It will first prompt for the
    myproxy cred password as per usual, and then prompt for the user's
    system password. If it is delivered, then the proxy is handed out.

-   This is one step in an evolutionary install process. For anyone
    following this document, getting this running (simple password auth)
    before plugging in any more auth mechanisms (OTP, RADUIS, etc) is
    probably wise to make sure that the installation and environment is
    set up correctly.