Data Transfer To/From Fermilab
The preferred way to transfer a substantial amount of data to and from fulla is to use GlobusOnline service. It can achieve up to 10 times higher transfer rates than a regular scp.
To use GlobusOnline, you need to create an account there. You can also use GlobusConnect to transfer files between any GO endpoint and any other machine. Our endpoint is fulla#cc3.
Unfortunately, Fermilab does not allow MyProxy connections, so the process of activating that endpoint is a bit involved.
Using Globus Online with Open Science Grid Certificate
As a Fermilab user, you are entitled to get an Open Science Grid certificate (follow these instructions).
After you have obtained a certificate, you need to install it on cc3. Please follow the instructions in the email from the OSG website on how to import your certificate into your browser and then export your cetificate in PEM format.
To enable the proper mapping of your OSG grid certificate to local linux user account on cc3, you will need to email the DN of your certificate and your Fermilab Kerberos account username to: . The DN of your OSG grid certificate can be found using the command:
openssl x509 -in $HOME/.globus/usercert.pem -subject
In order to authenticate to fulla from GlobusOnline, you will need to add your certificate to your GO account following the link: My Profile -> Manage Identities -> ADD X.509 Certificate. In the above web page you will need to include everything in between the BEGIN CERTIFICATE/END CERTIFICATE lines (including those 2 lines) from your .globus/usercert.pem file:
[cc3 ~]$ cat .globus/usercert.pem
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
Using Globus online with KCA certificate
Alternatively, you can use a KCA certificate for authentication as well. More details about KCA certificate can be found at: http://computing.fnal.gov/xms/Services/Getting_Services/Certificates.
Please email us your fermilab kerberos username to and request it to be added to the grid security file on cc3. In order to authenticate to fulla from GlobusOnline using the KCA certificate, you will need to add the KCA certificate to your GO account following the link: My Profile -> Manage Identities -> ADD X.509 Certificate. In the above web page you will need to include everything in between the BEGIN CERTIFICATE/END CERTIFICATE lines (including those 2 lines):
[cc3 ~]$ kinit -r 7d <username>@FNAL.GOV
[cc3 ~]$ kx509
[cc3 ~]$ cat /tmp/x509up_u<uid>
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
Do not upload your private key section of the above file!
Activating the endpoint
After your certificate is properly imported, you should be able to activate fulla#cc3 endpoint by using GO command-line interface from cc3:
# Do a grid proxy init for your OSG grid certificate (if you are using a OSG certificate)
[cc3 ~]$ grid-proxy-init
# If you are using a KCA certificate, you will need to do the following:
[cc3 ~]$ kinit -r 7d <username>@FNAL.GOV
[cc3 ~]$ kx509
Note: "kxlist -p" doesn't need to be executed to obtain a valid X509 ceritificate anymore.
# SSH to the command line interface
[cc3 ~]$ gsissh <username>@cli.globusonline.org
# Activate the fulla#cc3 Endpoint
$ endpoint-activate -g fulla#cc3
At this point you can login to the GO website and schedule your transfers.
|
