GLEXEC and ARGUS Deployment

WARNING: This page is obsolete.

WLCG is pushing Tier-2s to install GLEXEC and ARGUS. This page supplements the instructions on how to deploy GLEXEC and ARGUS server, and list the status of the GLEXEC and ARGUS deployment at our T2s.

GLEXEC Installation and Configuration

• You can install GLEXEC on worker nodes by "yum install emi-glexec_wn" from EMI repository or UMD repository if you install glite middleware through RPM packages. Most of you are using tarball WN. However there is not a tarball for GLEXEC available yet as far as I knew. Possibly you can install it by yum on a clean node and create the tarball by yourself.
• Configured it by YAIM with command: "/opt/glite/yaim/bin/yaim -c -s /opt/glite/yaim/etc/siteinfo/site-info.def -n emi-WN -n emi-GLEXEC_wn". Every time when you configure it with YAIM, you need to configure "glite-WN" node type at the same time too, otherwise some ENVs in grid-env.sh will be overwritten. You need to define some variable in site-info.def like:
  
  ARGUS_HOST=<ARGUS server>
  GLEXEC_WN_ARGUS_ENABLED="yes"
  GLEXEC_WN_OPMODE="setuid"
  GLEXEC_WN_LOG_DESTINATION=syslog
  GLEXEC_EXTRA_WHITELIST="<if there are>"
  ARGUS_PEPD_ENDPOINTS=" https://<ARGUS server>:8154/authz"
  PAP_ADMIN_DN="admin's DN"

• Of course, you can configure it manually (in the case of tarball, the path is different):
  
  a) The owner and permission of /sbin/glexec is:
  ---s--s--x 1 root glexec 147456 May 16 2012 /usr/sbin/glexec
  
  b) The owner and permission of /etc/glexec.conf is:
  -rw-r----- 1 root glexec 896 Mar 2 21:15 /etc/glexec.conf
  Please find an example of glexec.conf in attachment.
  
  c) Create /opt/glite/etc/lcmaps/lcmaps-glexec.db, you can find the example in attachment.

ARGUS Installation and Configuration

• ARGUS server needs the web server host certificate, thus the regular host certificate with string "host/" doesn't work with it. You can get the web server certificate from grid Canada web, choose 'Request a Certificate', and then choose 'User Request', in the name field, type in the fully qualified domain name of your ARGUS server, for Role (the default is 'User' choose 'Web Server'. The DN would be like '/C=CA/O=Grid/OU=triumf.ca/CN=ttas.triumf.ca'.
• ARGUS server doesn't need too much resources, 1 GB memory and 10 GB disk should be enough. We are currently running it on a XEN VM.
• Install ARGUS server by "yum install emi-argus" from EMI or UMD repository
• Configure it by "/opt/glite/yaim/bin/yaim -c -s /opt/glite/yaim/etc/siteinfo/site-info.def -n emi-ARGUS_server". The variables in site-info.def are the same as GLEXEC
• Create the local policy. Attached is my example. Suggest you create the policy in a file and add it into ARGUS by: "pap-admin add-policies-from-file policy.txt", and the reload the policy by "/etc/init.d/argus-pdp reloadpolicy" and "/etc/init.d/argus-pepd clearcache". In that policy rule. If you want to ban some users, you can do 'pap-admin ban subject "DN"' and unban it by 'pap-admin unban subject "DN"'.
• There are three daemons for ARGUS server, /etc/init.d/argus-pap, /etc/init.d/argus-pepd and /etc/init.d/argus-pdp, but the daemon scripts are bad coded.
• With current EMI-2 argus server, sometime I had to restart those daemons after applying policy or the machine rebooted, otherwise, the client failed to contact the server.

Test GLEXEC and ARGUS

You can do the following simple test on your work nodes to verify GLEXEC and ARGUS:

export GLEXEC_CLIENT_CERT=<proxy to be switch>

export X509_USER_PROXY=<proxy pre-swicth>

/sbin/glexec /usr/bin/id

Status of GLEXEC and ARGUS deployment at T1/T2

References

• Argus server deployment for EMI
• YAIM version 4 guide for system admin
• WLCG wiki for deployment glexec on WNs

• gLexec wiki from NIKHEF
• Description of ARGUS Authorization Framework