# Presentation: 434809

## Lecture 2Basic Grid Skills

- Presenter Name
- Presenter Institution
- Presenter email address
-                  Grid Summer Workshop
-                        June 21-25, 2004

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Credit Where Credit Is Due

- A few of these slides were copied, in whole or in part, from past Globus presentations.
- http://www.globus.org/about/presentations/
- One slide was copied from Miron Livny

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## What is a Grid?

- 1969, Len Kleinrock:
- “We will probably see the spread of ‘computer utilities’, which, like present electric and telephone utilities, will service individual homes and offices across the country.”
- 1998, Kesselman & Foster:
- “A computational grid is a hardware and software infrastructure that provides dependable, consistent, pervasive, and inexpensive access to high-end computational capabilities.”
- 2000, Kesselman, Foster, Tuecke:
- “...coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organizations.”

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Ian Foster’s Grid Checklist (2002)

- A Grid is a system that:
- Coordinates resources that are not subject to centralized control
- Uses standard, open, general-purpose protocols and interfaces
- Delivers non-trivial qualities of service

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Bill Johnston’s Definition (2002)

- A Grid is an environment that provides access and management for the whole range of computing resources needed to solve complex computing and data handling problems... a Grid is a well understood and standardized set of services that provide uniform access to a large number of diverse and distributed resources, together with several critical auxiliary services for resource discovery and secure communication based on authenticated, global identity.
- Resource discovery
- Resource scheduling
- Uniform computing access
- Uniform data access
- Asynchronous information sources
- Authentication, delegation, and secure communication
- Identify certificate management
- System management and access

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Our Definition of a Grid

- A distributed computing environment that coordinates:
- Computational jobs
- Data placement
- Information management
- Scales from one computer to thousands
- Capable of working across many administrative domains

*That is: Get lots of work done, securely*

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## How Do You Build a Grid?

- Method 1: First buy 1,000 computers...
- Method 2:
- Start small. Build a grid of one computer, then a grid of ten computers, then expand...

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Expanding Your Grid

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Example Grid: Grid2003

- Built by iVDGL (one of the sponsors of this school)
- At its peak:
- Spanned 27 grid sites across the US and Korea
- Included 2000+ CPUs
- Ran 7 different scientific applications
- 100 users had access to Grid2003
- Users were divided into distinct virtual organizations
- Ran up to 500-700 concurrent jobs, with 75% efficiency

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Grid2003

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## USCMS Running Jobs On Grid3

- Each colored line is a different site
- Nov. 21, 2003 to May 28, 2003
- Grid2003 really worked!

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Grid With a Grid

- Recall this morning’s grid without a grid
- Security infrastructure: 	ssh/https
- Running jobs: 			ssh
- Transferring data:		FTP, HTTP, scp
- Discovering information: 	Google, LDAP
- How does this change with grid technology?

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Which Grid Technology?

- There are lots of grid technologies
- Globus
- Condor
- Unicore
- We will focus on Globus, Condor, and related software.

- Avaki
- NorduGrid
- SETI@home

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Grid with a Grid

- Now we will use:
- Security infrastructure: 	GSI
- Running jobs: 			GRAM/Condor-G
- Transferring data:		GridFTP & friends
- Discovering information: 	MDS

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Terminology

- Authentication: Establishing identity
- Authorization: Establishing rights
- Message protection
- Message integrity
- Message confidentiality
- Non-repudiation
- Digital signature
- Accounting
- Delegation

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Why Grid Security is Hard

- Resources may be valuable & the problems being solved sensitive
- Resources are often located in distinct administrative domains
- Each resource has own policies, procedures, security mechanisms, etc.
- Implementation must be broadly available & applicable
- Standard, well-tested, well-understood protocols; integrated with wide variety of tools

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Features

- Users:
- Easy to use
- Single sign-on: only type your password once
- Delegate proxies
- Administrators
- Can specify local access controls
- Have accounting

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: How Do We Get These Features?

- From the Public Key Infrastructure: PKI
- PKI allows you to know that a given key belongs to a given user
- PKI builds off of asymmetric encryption:
- Each entity has two keys: public and private
- Data encrypted with one key can only be decrypted with other
- The public key is public
- The private key is known only to the entity
- The public key is given to the world encapsulated in a X.509 certificate

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: What is a Certificate?

- Similar to passport or driver’s license: Identity signed by a trusted party

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Certificates

- By checking the signature, one can determine that a public key belongs to a given user

- Hash

- Hash

- Hash

**=?**

- Decrypt

- Public Key from
- Issuer

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Certificate Authorities (CAs)

- A small set of trusted entities known as Certificate Authorities (CAs) are established to sign certificates
- A Certificate Authority is an entity that exists only to sign user certificates
- The CA signs it’s own certificate which is distributed in a trusted manner

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Certificate Authorities

- The public key from the CA certificate can then be used to verify other certificates

- Hash

- Hash

- Hash

**=?**

- Decrypt

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: How Do You Get a Certificate?

- Private Key encrypted on local disk

- CertRequest
- Public Key

- Certificate
- Authority

- Cert

- User generatespublic/privatekey pair

- User send public key to CA along with proof of identity

- CA confirms identity, signs certificate and sends back to user

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Proxies

- It’s a bad idea to use your certificate as identification
- What if someone successfully steals it? They can impersonate you until the certificate expires
- Certificates usually last about a year
- Using your certificate, GSI can create a proxy certificate.
- This represents you in the same way.
- It has a short life-time: usually 12 hours, but configurable

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: How Does Single Sign-on Work?

- Look at your certificate subject name
- grid-cert-info –subject
- /DC=org/DC=doegrids/OU=People/CN=Alain Roy 424511
- Tell people that wish to accept you what your subject name is—they put it into an authorization file
- From your certificate, create a proxy
- grid-proxy-init
- grid-proxy-info –subject: note the “/CN=proxy”
- Each person that likes you will accept your proxy: you only have to create it once
- Well, until it expires anyway

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Your Certificates

- Sometimes it can take a few days to get a certificate from a CA, because it takes time to verify your identity
- We have gotten generic certificates from you using the Globus Certification Service
- These are low-quality: there is no identify verification
- http://gcs.globus.org:8080/gcs/index.html
- What does your certificate look like?
- grid-cert-info

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: OpenSSH

- OpenSSH has been modified to use GSI
- This means that you can use ssh like you are used to, but you don’t have to type your password: just use your proxy
- We’ll try it out during the exercises: gsissh

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: What Else Uses It?

- All of Globus uses GSI, so you’ll use it for:
- Submitting jobs
- Transferring data
- Querying information services (maybe)
- It’s often turned off.
- Condor uses GSI
- Lots of other software uses GSI:
- GSI OpenSSH
- MyProxy
- ...

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Certificate Details

- User certificates are stored in your .globus directory:
- % ls –l .globus
- -rw-r-----    1 roy roy 1317 Sep 24  2003 usercert.pem
- -r--------    1 roy roy 1209 Sep 24  2003 userkey.pem
- Usercert.pem is the public key and is not private
- 	-----BEGIN CERTIFICATE-----
- 	MIIDHjCCAgagAwIBAgICAe8wDQYJKoZIhvcNAQEFBJomT8ixk
- 	...
- 	-----END CERTIFICATE-----
- Userkey.pem is the private key, and it private

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Proxy Details

- Create a proxy with grid-proxy-init [-hours N]
- A proxy is marked with a “not valid before” timestamp
- If your clocks are not synchronized, you may experience security failures!
- Your proxy is stored in /tmp/x509up_uNNNN
- NNNN is your numeric user ID
- You can store it elsewhere, if you need to.
- Destroy a local proxy: grid-proxy-destroy

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: Proxy Delegation

- When you submit a job or transfer data, your proxy travels over the network to that computer
- The remote computer actually gets a *limited* proxy
- Not all services accept a limited proxy. This is another layer of safety
- Grid-proxy-destroy does not remove proxies that have been transferred.

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: /etc/grid-security

- /etc/grid-security is the default location to store GSI information for a host: hosts have certificates too
- Job authorization happens in /etc/grid-security/grid-mapfile. This maps certificates to users:
- “/DC=org/DC=doegrids/OU=People/CN=Alain Roy 424511” roy
- “/DC=org/DC=doegrids/OU=People/CN=Mike Wilde 326321” wilde

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GSI: The Gory Details

- GSI works great...
- Until there is a problem—then GSI gives ugly, hard-to-interpret error messages.
- We love GSI
- We hate GSI

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: What is it?

- Given a job specification:
- Create an environment for a job
- Stage files to/from the environment
- Submit a job to a local scheduler
- Monitor a job
- Send job state change notifications
- Stream a job’s stdout/err during execution

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: Some Terminology

- We speak loosely most of the time, but:
- Globus Job Management Service
- Starts up and monitors jobs
- Stages data in and out
- GRAM
- Protocol to communicate with the job management service
- We often say “GRAM” as a shorthand for either of these

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: How Does it Work?

- Gatekeeper
- (Authenticates
- &
- Authorizes)

- Client

-  Head Node
- a.k.a “Gatekeeper”

- Job Manager
- (Submits job
- &
- Monitors job)

-  Compute Resource

- GRAM

- Results

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: What is a “Local Resource Manager?”

- It’s usually a batch system that allows you to run jobs across a cluster of computers
- Examples:
- Condor
- PBS
- LSF
- Sun Grid Engine
- Most systems allow you to access “fork”
- It’s the default
- It runs on the gatekeeper: a bad idea in general, but okay for testing

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: RSL

- The client describes the job with the Resource Specification Language (RSL)
- 	& (executable = a.out)
- 	  (directory = /home/nobody )
- 	  (arguments = arg1 "arg 2")
- You don’t usually need to specify RSL directly, unless you have special needs.
- http://www.globus.org/gram/rsl_spec1.html

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: Security

- GRAM uses GSI for security
- Submitting a job requires a full proxy
- The remote system & your job will get a limited proxy
- The job will run—you had a full proxy when you submitted
- But your job cannot submit other jobs

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: Basic Usage

- grid-proxy-init
- You need your proxy first
- globus-job-run hostX /bin/hostname
- This runs /bin/hostname on hostX
- It expects /bin/hostname to already be there
- globusrun -o  -r hostX '&(executable = /bin/echo) (arguments = Hello Grid) '
- This is the RSL.
- We could specify lots of things here, but we didn’t.
- These just ran with the *fork* job manager, not an “interesting” batch system

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: Running on a Batch System

- Append the batch system to the hostname:
- globus-job-run **hostX/condor** /bin/hostname
- You will do this for most real work
- The batch system can handle many more jobs
- Batch systems are reliable and track your jobs
- Fork is not reliable, and your job may be lost

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: The Gory Details

- GRAM works pretty well
- It doesn’t scale too well
- Each job has a job manager.
- Each job manager polls the local batch system every few seconds to get job status
- After a couple hundred jobs, everything slows down
- You may lose jobs if you use these command-line tools
- What happens when you type control-C after globus-job-run?
- Where is your job?
- Will it ever finish?
- How will you get the output?
- There are no good answers

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GRAM: The Future

- If you use Condor-G today:
- It will keep track of your jobs for you and recover from errors, unlike the Globus command-line tools
- Condor-G has some tricks up its sleeve to improve job management scalability significantly
- We’ll learn more about Condor-G soon
- The Globus Alliance is making the job management more scalable for tomorrow

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GridFTP: What is it?

- A secure, robust, fast, efficient, standards based, widely accepted data transfer protocol
- An implementation:
- Globus provides a server
- Globus provides a client: globus-url-copy
- Other people provide clients: uberftp

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GridFTP: Features

- Security through GSI
- Note that GSI can provide encryption in addition to authentication and authorization
- Reliability by restarting failed transfers
- Fast
- Can set TCP buffers for optimal performance
- Parallel transfers
- Striping (multiple endpoints)
- Not all features easily accessible from basic client

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## GridFTP: Basic Use

- globus-url-copy file:fullpath/file gsiftp://host/path/file
- The file: url refers to a local file
- The gsiftp url refers to a remote file, accessed with GridFTP
- You can specify two gsiftp URLs to do third-party transfers
- You can specify other URLs, including http & https

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: What is it?

- MDS is a grid information service
- It provides:
- Uniform, flexible access to information
- Scalable, efficient access to dynamic data
- Access to multiple information sources
- Decentralized maintenance
- Based on LDAP

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: Architecture

- Resources run a standard information service (GRIS) which speaks LDAP and provides information about the resource (no searching).
- GIIS provides a “caching” service much like a web search engine.  Resources register with GIIS and GIIS pulls information from them when requested by a client and the cache as expired.
- GIIS provides the collective-level indexing/searching function.

**GIIS**
- Cache contains info from A and B

- GIIS requests information from
- GRIS services as needed.

- Client 1

- Client 2

- Client 3

- Clients 1 and 2 request infodirectly from resources.

- Client 3 uses GIIS for searching
- collective information.

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: Implementation

- Grid Information Service (GRIS)
- Provides resource description
- Modular content gateway
- Grid Index Information Service (GIIS)
- Provides aggregate directory
- Hierarchical groups of resources
- Lightweight Dir. Access Protocol (LDAP)
- Standard with many client implementations
- Used for GRIP (and GRRP currently)

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: Security

- Security is optional. Not everyone uses it. Perhaps they should
- When security is used, it is with GSI

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: What can you Learn From It?

- Globus provides *schema* which describe the way information is presented
- Globus comes with *information providers,* which fill in the information
- You can find out information about hosts, disk, etc...

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: Example Information

*OS *

*OS *

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: More Schemas

- Not everyone agrees on what schema should be provided
- Grid2003 & LCG (in Europe) use the GLUE Schema.
- It provides similar information to the Globus schema
- The details of the schema are completely different
- Grid2003 adds extra schema for information they need
- MDS should be dynamic and match your needs

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## MDS: Client Tools

- Globus Toolkit includes 2 command line client tools for querying MDS services
- grid-info-search: General purpose client
- grid-info-search –h <host> -p <port> -b <base> \    -T <timeout> [<filter>] [<attributes>]
- -x: Anonymous access
- grid-info-host-search: Same as grid-info-search, but defaults to GRIS standard port
- E.g. grid-info-host-search –h localhost
- Example:
- 	grid-info-search -x -h lhc.uits.indiana.edu -p 2170
- 	-b "Mds-vo-name=grid3,o=grid"
- Both clients can search for specific system information and filter results
- You can use other LDAP tools, if you like.

- Lecture2: Basic Grid Skills

- June 21-25, 2004

## Schema, or the Lack Thereof

- There is debate on schema: should we define one or not? You can make up your own mind, but note:
- It took many months of discussion to develop the GLUE Schema
- People always wish to extend the schema
- I propose:
- Don’t enforce your schema too carefully
- Allow people to easily add information that’s not in the official schema
- Allow for a more organic, communal approach to developing a schema: see what you need before setting a committee down for several months

- Lecture2: Basic Grid Skills

- June 21-25, 2004