The APAC Nimrod Service can be made available to approved users of the APAC Grid. Such users are expected to have valid user certificates. Note that the Nimrod Portal may be downloaded by interested parties for use on their own testbeds.
1. Certificates and Getting Aboard the APAC Grid
Our regional APAC authorities, VPAC, provides comprehensive documentation about certificates and the APAC Grid in their TWiki. That same page provides links with which to request for your APAC Grid certificates. In general terms, one must download the APAC Grid CA certificate, apply for one's own personal certificate, wait for approval then dowload the personal certificate. Then those two certificates can be used to access to the APAC Nimrod Service.
2. Accessing the APAC Nimrod Service
Assuming that you have both the CA and your personal certificates ready, there are two ways by which to access the APAC Nimrod Service. You may either use the Nimrod Portal using a web browser or use the command-line Nimrod interface from a UNIX account on the Nimrod server.
2.1 Applying for an Account
First, you must notify us so that a Nimrod account may be prepared for you. Simply email us with your contact details and your personal certificate's subject string, e.g., "/C=AU/O=APACGrid/OU=MyOrg/CN=Joe Somebody", and some background about what you intend to do with Nimrod. Please include details about the size of your experiments and other aspects that you think administrators should know about your applications. We would also appreciate some information about how you were introduced to Nimrod in the first place.
We will then endeavor to quickly set up an account for you and inform you immediately. Please go through this introduction to the portal and be sure to visit the Nimrod pages for all documentations we have about the Nimrod family of parametric modeling tools. The Nimrod Tools page is especially important to have read through at least once, as it contains a tutorial as well as the reference manuals for using Nimrod. You will not need to download Nimrod tools, since you will be accessing the tools remotely from our service instead.
2.2 Browser Access: Using the Nimrod Portal
The Nimrod Portal is accessible via a web browser. The browser must have both the CA and your personal certificate installed. To install the CA certificate, use this link, which should prompt your browser to install the CA certificate (in CRT format). You will normally be asked to confirm that you trust the APAC Grid CA. Once done, the certificate will remain installed on your browser until it is explicitly removed.
To install your personal certificate is a bit tricky. Personal certificates from the APAC can be downloaded in PEM or CRT format, but browsers prefer the PKCS12 (or P12) format. Here are two methods we can recommend to obtain the P12 version of your certificate:
- Try the GRIX inerface tool developed by VPAC (the install page is here). First, make sure that you have a .globus folder in your "home directory" that contains your personal certificate (usercert.pem) and key (userkey.pem). For Windows users, your home directory (for GRIX purposes) is c:\Documents and Settings\\. For Unix users, their home directory is $HOME or the subdirectory they find themsevelves in upon logging in. Next, follow the GRIX links above and download and install it. GRIX is implemented as a Java application, making it functional in both Windows and Unix (or whatever *nix flavor you use). Assuming that GRIX has installed fine, it should be automatically aware of your personal certificate. Click on the left-hand button that says "Export browser certificate" and enter your key passphrase as prompted. It will then create a file usercert.p12 in your .globus folder. Use the instructions for your browser to install this certificate. The GRIX documentation illustrates this for both Mozilla Firefox and Microsoft IE.
- Optionally, you may opt to use OpenSSL from the command-line or from its Windows binary. The command-line facility is very simple, and access to a Unix account where OpenSSL is available is easy enough:
$ openssl pkcs12 -export -in .globus/usercert.pem -inkey .globus/userkey.pem -out .globus/usercert.p12
Once the p12 version has been generated, follow the instructions via the GRID documentation to install the certificate on your browser.
2.3 Command-Line Access: Nimrod via SSH
Other users are comfortable using the command-line interface to Nimrod. They are installed on the Nimrod Portal server and may be accessed via SSH login to your Nimrod account. For this, you must send us a copy via email of your SSH public key, which we prefer to be in DSA rather than RSA. Once we've installed your public key, you should be able to SSH into nimrod.grid.apac.edu.au and access Nimrod's command line interface. The Nimrod Tools page contains documentation about the command line interface.
3. Nimrod and Parameter Sweep Applications
Please visit the Nimrod pages to get a better idea of what Nimrod is. Note that there are several tools in the Nimrod family. Nimrod itself is a parametric modeling tool, originally designed to work on clusters. Nimrod/G is the Grid-enabled version of Nimrod. Nimrod/O allows users to optimize their Nimrod experiments.
4. A Special Note on Browsers and Logging In or Out
The APAC Nimrod Portal allows two modes of browser logins: you may enter your username and password, or simply have the APAC CA certificate and your personal certificate loaded into your browser. The latter is preferred, as you need not keep track of your username and password. However, this is not secure when multiple users will share the same desktop profile or account. In such cases, the user may wish to use the Logout link at the right-hand side of the main page. However, logging out is not enough, since the browser will have your personal certificate installed. The assumption is that other users are allowed to use the same desktop account or profile, and therefore will have access to the same personal certificates installed in the browser. It is more secure to avoid allowing users to share the same account. In cases where this is unavoidable, as in the case of Microsoft Windows 95 or 98, IE will be shared by users without any disctinction among them (as far as IE is concerned). It is recommended for the personal certificate not to be installed, thus requiring all access to the Nimrod Portal via username and password prompts. Alternatively, the Mozilla, Mozilla Firefox or Netscape browsers may instead be used with Profiles activated (using the Profile Manager)
Browsers may react differently when someone logs out on the portal. Firefox and IE will really log you out for the duration of that instance of the browser, requiring that the user enters the username and password to access the Portal. This is not a problem if username-password access is preferred to begin with, but this can be a slight problem for users who rely on their personal certificates that are loaded into the browsers. To resolve this situation, simply quit all instances of the browser in memory -- not just the tab or window you were using -- and start it up again. This may not be necessary on some browsers, but we cannot confirm this at this time.
Nimrod is currently maintained by the team under Prof. David Abramson. We provide users with two email addresses as your first points of contact about Nimrod tools and the APAC Nimrod Service:
This page was written by:
jefferson.tan@infotech.monash.edu.au
Last modified: Mon Jul 24 16:47:00 PST 2006
