Installing GT 6.0

We distribute the Globus Toolkit 6 as a set of RPM and Debian packages for Linux systems, as an installable package for Mac OS X, as a .zip file for Windows and Cygwin, as well as a source installer which can be used on other operating systems. In this quickstart, we will be installing RPM packages. Thus, it is a prerequisite for following this quickstart that you are running a distribution for which we provide RPMs. If you are running a supported Debian or Ubuntu system, the process is very similar, but you’ll need to use the apt-get or similar tools to install the packages. For the source installer, there is more work involved, and you’ll need to consult the full installation guide.

First, we will to set up our system to use the Globus package repository. This repository contains the Globus software packages, signed by our build manager. We provide RPM and Debian packages that contain a source configuration file and the public key which can be used to verify the packages. If your distribution has Globus 6.0 packages within its repository, you can skip to the next section.

The globus toolkit package repo RPM can be downloaded from the repo RPM package on globus.org.

To install binary RPMs, download the globus-toolkit-repo package from the link above and install it with the command:

root# rpm -hUv globus-toolkit-repo-latest.noarch.rpm

The globus toolkit package repo Debian file can be downloaded from the repo Debian package on globus.org.

To install Debian or Ubuntu package, download the globus-toolkit-repo package from the link above and install it with the command:

root# dpkg -i globus-toolkit-repo_latest_all.deb

Once you’ve installed the Globus repository package, you can use your operating system’s packaging tools: yum or apt-get, to install the Globus components.

	Important
	For operating systems based on RHEL (such as Red Hat Enterprise Linux, CentOS, and Scientific Linux), the compatible EPEL repository must be enabled before installing myproxy. For OS versions 5.x, install the EPEL 5 package, and for OS version 6.x, use 6 package. For information about installing these, see the EPEL FAQ. This step is not needed for Fedora, Debian, or Ubuntu systems.

Important

For SUSE Linux Enterprise Server systems which will be using globus-connect-server, a newer version of apache2 must be installed in order for myproxy-oauth to work. This is available by adding the Apache2 and Apache2 Modules for SLES11 repositories from opensuse.org. These can be installed by running these commands: root# zypper ar http://download.opensuse.org/repositories/Apache/SLE_11_SP3/Apache.repo root# zypper ar http://download.opensuse.org/repositories/Apache:/Modules/Apache_SLE_11_SP3/Apache:Modules.repo root# rpm --import http://download.opensuse.org/repositories/Apache/SLE_11_SP3/repodata/repomd.xml.key root# rpm --import http://download.opensuse.org/repositories/Apache:/Modules/Apache_SLE_11_SP3/repodata/repomd.xml.key

The components of the toolkit can be installed separately, or all at once. This section will show how to install various components, on both RPM based and Debian based Linux systems.

For Fedora or Red Hat-based systems, used the yum command to install the Globus components and their dependencies. For SUSE Linux Enterprise Server systems, use zypper. For Debian-based systems, used the apt-get or aptitude commands.

For example, to install the GridFTP client tools, do the following for RPM-based systems:

root# yum install globus-data-management-client

Do the following for Debian-based systems:

root# apt-get install globus-data-management-client

Download the Mac OS X Globus Toolkit Installation Package from the Globus Toolkit web site. Click on globus_toolkit-6.0.pkg, and follow the installation instructions. If you select the "Install for me only" option, your , and follow the installation instructions. If you select the "Install for me only" option, your $HOME/.profile is modified to add the Globus Toolkit components to your path. If you are using a different shell, you may need to incorporate those changes into your shell initialization file. If you install for all users, the global path will be updated. is modified to add the Globus Toolkit components to your path. If you are using a different shell, you may need to incorporate those changes into your shell initialization file. If you install for all users, the global path will be updated.

To uninstall the toolkit, run the globus-uninstall script which will remove the toolkit and revert the PATH changes.

There are four options when installing the Globus Toolkit on Windows: either using cygwin (32- and 64- bit builds) or MingW (32- and 64- bit builds).

The Cygwin installation requires the cygwin runtime (either 32-bit or 64-bit) to be installed: see cygwin.com for details. To use the Globus Toolkit on cygwin, download the globus_toolkit-6.0-x86_64-pc-cygwin.zip or To use the Globus Toolkit on cygwin, download and unzip the globus_toolkit-6.0-i386-pc-cygwin.zip file and in the cygwin root directory. This will create files in /opt/globus

The mingw installtion does not require a special runtime, but some parts of the toolkit do not work with it: (LIST PENDING). To install the MingW packages, download the globus_toolkit-6.0-x86_64-w64-mingw32.zip or To use the Globus Toolkit on cygwin, download and unzip the globus_toolkit-6.0-i386-w64-mingw32.zip file. Add the unzipped directory’s Globus\bin and Globus\sbin paths to your PATH environment to be able to use the Globus Toolkit.

The updates available in the native packages described above are also published as source packages on the updates page. To install update packages, follow their download link, untar them, and then configure them with the same prefix as your original installation.

Your best option is to use an already existing CA. You may have access to one from the company you work for or an organization you are affiliated with. Some universities provide certificates for their members and affiliates. Contact your support organization for details about how to acquire a certificate. You may find your CA listed in the TERENA Repository.

If you already have a CA, you will need to follow their configuration directions. If they include a CA setup package, follow the CAs instruction on how to install the setup package. If they do not, you will need to create an /etc/grid-security/certificates directory and include the CA cert and signing policy in that directory. See directory and include the CA cert and signing policy in that directory. See Configuring a Trusted CA for more details.

This type of certificate is best for service deployment and Grid inter-operation.

SimpleCA provides a wrapper around the OpenSSL CA functionality and is sufficient for simple Grid services. Alternatively, you can use OpenSSL’s CA.sh command on its own. Instructions on how to use the SimpleCA can be found in Installing SimpleCA.

SimpleCA is suitable for testing or when a certificate authority is not available.

If you install the globus-simpleca native package, it will automatically create a CA and host certificate if you don’t have one configured yet. Otherwise, you’ll need to use grid-ca-create to create the CA and grid-default-ca to make that the default for requesting credentials.

To create user credentials, you can run the command grid-cert-request as a user that you want to create a credential for. You can then run the grid-ca-sign command as the simpleca user to sign the certificate.

This section describes the requirements placed on firewalls at sites containing Globus Toolkit clients. Note that often jobs submitted to sites running Globus services will act as clients (e.g. retrieving files needed by the job, spawning subjobs), so server sites will also have client site requirements.

This section describes firewall policy requirements at sites that host Grid services. Sites that host Grid services often host Grid clients, however the policy requirements described in this section are adequate for clients as well.

Controllable ephemeral ports in the Globus Toolkit can be restricted to a given range. setting the environment variable GLOBUS_TCP_PORT_RANGE can restrict ephemeral ports. The value of this variable should be formatted as min,max (a comma separated pair). This will cause the GT libraries (specifically GlobusIO) to select port numbers for controllable ports in that specified range.

% GLOBUS_TCP_PORT_RANGE=40000,40010
% export GLOBUS_TCP_PORT_RANGE
% globus-gass-server
https://globicus.lbl.gov:40000
^C
%

This environment variable is respected by both clients and servers that are started from within the environment in which it is set. There are better ways, however, to configure a globus-job-manager or a GridFTP server to restrict its port range.

The GNU autotools and libtool is no longer distributed with OS X 10.8+. If you are building from git repository, you’ll need to install the latest versions of those tools. If you are building from the source installer, these do not need to be installed.

Configure libtool with the configuration option --program-prefix=g to cause the libtool script to be named glibtool to avoid conflicts with the OS X libtool program which provides different functionality than GNU libtool. Install libtool (and the other tools) into the a common directory. If you do so, you’ll need to set the LIBTOOLIZE environment variable to the path to the glibtoolize program. You’ll need to include the autotools in your path to regenerate the configurable scripts and Makefile.in files for the toolkit.

The Globus Toolki build requires the pkg-config package to be installed. It is available from freedesktop.org. Additionally, you’ll need to set the environment variable PKG_CONFIG_PATH to /usr/lib/pkgconfig prior to running the configure script. prior to running the configure script.