SNIC Documentation - User contributions [en]

User:Luis Fazendeiro (C3SE)

2020-02-04T12:40:29Z

Thomas Svedberg (C3SE):

{{application expert info
|first name=Luis
|last name=Fazendeiro
|centre=C3SE
|fields=Parallel programming
|fte=25
|snic ae financing=20
|other ae financing=
|financing=SNIC/PRACE
|general activities=Plasma physics code development, PRACE application support
|other activities=

|office=
|phone=
|is active=no
}}

== Quick facts ==
* Email: [mailto:luisfa@chalmers.se luisfa@chalmers.se]
* Work at Department of Earth and Space Sciences, Chalmers, Transport Theory Group
* Computational Fluid Dynamics background, PhD at UCL, [http://ccs.chem.ucl.ac.uk/ CCS]
* MPhil in Theoretical Physics, Coimbra University [http://fisica.uc.pt/yt/main.php], Portugal
* Research in Image Reconstruction in PET devices, at [http://coimbra.lip.pt/index.php?id=3&prid=31&lg=en LIP-RPC-PET]
* AE related activities includes
** [[project::Improved FFT and I/O for the Pencil code]]

== Expertise ==
* [[expertise::C]]
* [[expertise::MPI]]
* [[expertise::Fortran]]

User:Erik Fransson (C3SE)

2020-02-04T12:38:19Z

Thomas Svedberg (C3SE):

{{application expert info
|first name=Erik
|last name=Fransson
|centre=C3SE
|fields=Computational materials science
|fte=100

|general activities=Various modification and analysis tool development;

|office=Soliden floor 3, Chalmers;Origovägen 6 B, Göteborg
|is active=no
}}

== Quick facts ==
* Email: erikfr at chalmers dot se
* Masters degree in Applied Physics

== Expertise ==
* [[expertise::Python]]
* [[expertise::ASE]]
* [[expertise::C++]]

User:Thomas Svedberg (C3SE)

2015-02-10T09:13:45Z

Thomas Svedberg (C3SE):

{{application expert info
|first name=Thomas
|last name=Svedberg
|centre=C3SE
|fields=Solid Mechanics
|other activities=Director at C3SE;Coordinator SNIC User and Project Repository (SUPR)
|office=Hörsalsvägen 7; 412 96 Göteborg
|phone=(+46)31 772 1522
|fte=
|financing=
|snic ae financing=
|other ae financing=LU
|general activities=
}}

== Projects ==
* [[project::SUPR]]
* [[project::SNIC Emerging Technologies]]

User:Thomas Svedberg (C3SE)

2015-02-10T09:12:57Z

Thomas Svedberg (C3SE):

{{application expert info
|first name=Thomas
|last name=Svedberg
|centre=C3SE
|fields=
|other activities=Director at C3SE;Coordinator SNIC User and Project Repository (SUPR)
|office=Hörsalsvägen 7; 412 96 Göteborg
|phone=(+46)31 772 1522
|fte=
|financing=
|snic ae financing=
|other ae financing=LU
|general activities=
}}

== Projects ==
* [[project::SUPR]]
* [[project::SNIC Emerging Technologies]]

User:Thomas Svedberg (C3SE)

2015-02-10T09:01:08Z

Thomas Svedberg (C3SE): Created page with "== Projects == * project::SUPR * project::SNIC Emerging Technologies"

== Projects ==
* [[project::SUPR]]
* [[project::SNIC Emerging Technologies]]

Swestore-dCache

2012-09-14T07:45:38Z

Thomas Svedberg (C3SE): /* Download and upload data */

[[Category:Storage]]
[[Category:SweStore]]
SNIC is building a storage infrastructure to complement the computational resources.

Many forms of automated measurements can produce large amounts of data. In scientific areas such as high energy physics (the Large Hadron Collider at CERN), climate modeling, bioinformatics, bioimaging etc., the demands for storage are increasing dramatically. To serve these and other user communities, SNIC has appointed a working group to design a storage strategy, taking into account the needs on many levels and creating a unified storage infrastructure, which is now being implemented.

Swestore is in collaboration with [http://www.ecds.se ECDS], [http://snd.gu.se SND], Bioimage Sweden, [http://www.bils.se BILS], [http://www.uppnex.uu.se UPPNEX],[http://http://lcg.web.cern.ch/lcg/public/ WLCG], [http://www.nrm.se/ NaturHistoriska RiksMuseet].

= National storage =
The aim of the nationally accessible storage is to build a robust, flexible and expandable system that can
be used in most cases where access to large scale storage is needed. To the user it should appear as a single large system,
while it is desirable that some parts of the system are distributed across all SNIC centra to benefit from the advantages
of, among other things, locality and cache effects. The system is intended as a versatile long-term storage system.

==Supported access protocol==
; Today SweStore support this protocols
: srm://, gsiftp://, http:// (ro), https:// (ro), webdav (rw).
; Coming to support this protocols
: NFS4.1, iRODS

== Getting access ==
; Apply for storage
: Please follow instructions [[Apply for storage on SweStore|here]]
; Get a client certificate.
: Follow the instructions [[Grid_certificates#Requesting_a_certificate|here]] to get your client certificate. For Terena certificates, please make sure you also [[Requesting_a_grid_certificate_using_the_Terena_eScience_Portal#Exporting Terena certificate for use with Grid tools|export the certificate for use with grid tools]]. For Nordugrid certificates, please make sure to also [[Requesting_a_grid_certificate_from_the_Nordugrid_CA#Installing_the_certificate_in_your_browser|install your client certificate in your browser]].
; Request membership in the SweGrid VO.
: Follow the instructions [[Grid_certificates#Requesting_membership_in_the_SweGrid_VO|here]] to get added to the SweGrid virtual organisation.

== Download and upload data ==
; Browse and download data
: SweStore is accessible from your web browser, here https://webdav.swegrid.se/. To browse private data you must first install your certificate in your browser (see above). Your data is available at <code><nowiki>https://webdav.swegrid.se/snic/YOUR_PROJECT_NAME</nowiki></code>.
; Upload and delete data
: Use the ARC client. Please see the instructions for [[Accessing SweStore national storage with the ARC client]].
: Use cURL. Please see the instructions for [[Accessing SweStore national storage with the cURL]].
: Use lftp. Please see the instructions for [[Accessing SweStore national storage with lftp]].
: Use globus-url-copy. Please see the instructions for [[Accessing SweStore national storage with globus-url-copy]].

== Examples of storage projects ==
Below are some examples of project that are using SweStore today.

{|border="1" style="text-align:left; border-collapse: collapse; border-width: 1px; border-style: solid; border-color: #000" class="wikitable sortable" valign=top
!Allocation name
!Size in TB
!class="unsortable"|Project full name
|-
|alice
|400
|
|-
|uppnex
|140
|[https://www.uppnex.uu.se UPPmax NExt Generation Sequencing Cluster & Storage]
|-
|brain_protein_atlas
|10
|Mouse brain protein atlas project
|-
| scims2lab
|20
| Identification of novel gene models by matching mass spectrometry data against 6-frame translations of the human genome
|-
|subatom
|
|Low-energy nuclear theory and experiment
|-
|genomics-gu
|10
|Genomics Core Facility, Sahlgrenska academy at University of Gothenburg.
|-
|Chemo
|5TB
|Genetic interaction networks in human deseas
|-
|cesm1_holocene
|30
|Arctic sea ice in warm climates
|}

== More information ==
* [[SweStore introduction]]
* [http://status.swestore.se/munin/monitor/monitor/ Per Project Monitoring of Swestore usage]
* [[Accessing SweStore national storage with the ARC client]]

If you have any issues using SweStore please do not hesitate to contact [mailto:swestore-support@snic.vr.se swestore-support].

== Tools and scripts ==

There exists a number of tools and utilities developed externally that can be useful. Here are some links:

* [https://github.com/samuell/arc_tools ARC_Tools] - Convenience scripts for the arc client (Only a recursive rmdir so far).
* [http://sourceforge.net/projects/arc-gui-clients ARC Graphical Clients] - Contains the ARC Storage Explorer (SweStore supported development).
* Transfer script, [http://snicdocs.nsc.liu.se/wiki/SweStore/swstrans_arc swetrans_arc], provided by Adam Peplinski / Philipp Schlatter
* [http://www.nordugrid.org/documents/SWIG-wrapped-ARC-Python-API.pdf Documentation of the ARC Python API (PDF)]

= Center storage =
Centre storage, as defined by the SNIC storage group, is a storage solution that lives independently of the computational resources and can be accessed from all such resources at a centre. Key features include the ability to access the same filesystem the same way on all computational resources at a centre, and a unified structure and nomenclature for all centra. Unlike cluster storage which is tightly associated with a single cluster, and thus has a limited life-time, centre storage does not require the users to migrate their own data when clusters are decommissioned, not even when the storage hardware itself is being replaced.

== Unified environment ==
To make the usage more transparent for SNIC users, a set of environment variables are available on all SNIC resources:

* <code>SNIC_BACKUP</code> – the user's primary directory at the centre<br>(the part of the centre storage that is backed up)
* <code>SNIC_NOBACKUP</code> – recommended directory for project storage without backup<br>(also on the centre storage)
* <code>SNIC_TMP</code> – recommended directory for best performance during a job<br>(local disk on nodes if applicable)

User:Torben Rasmussen (NSC)/SweGrid old/Grid certificates

2011-04-27T07:37:05Z

Thomas Svedberg (C3SE):

A certificate is the equivalent of a passport in real-life. In the same way you have prove your credentials when you aquire a passport the same is true for a certificate. A Certificate Authority (CA) has to vouch for your identity and sign your certificate.

A certificate consist of 2 parts a private key and a public key. The private is your secret and should be kept as secure as possible. The public key is used to verify signatures are signed with your private key for the receiving part. The public part is also used to verify that the certficate is correct when you have the public part of the CA certificate.

For more information regarding certificates and public key cryptography: [http://en.wikipedia.org/wiki/Public-key_cryptography [http://en.wikipedia.org/wiki/Public-key_cryptography http://en.wikipedia.org/wiki/Public-key_cryptography]] [http://en.wikipedia.org/wiki/Public_key_certificate [http://en.wikipedia.org/wiki/Public_key_certificate http://en.wikipedia.org/wiki/Public_key_certificate]]

= Requesting a certificate with the Terena eScience Gateway =

The Terena eScience Gateway is a joint effort to provide users with a tool for requesting grid-certificate with the credentials from their home-institution or university.

To request a Terena eScience Certificate go to the following URL:

[https://tcs-escience-portal.terena.org [https://tcs-escience-portal.terena.org]]

The procedure is as follows:

1. Click "Login"
2. Click on Sweden in the map.
3. Choose your identity provider in the drop down box.
4. Login using your credentials from your identity provider.

You should now arrive to a "home" page that shown below:

[[File:terena1.png|600px]]

5. Click on the "My certificates" link in the top left side of the page. You should then arrive to a page from which you will create and manage your certificates.

[[File:terena2.png|600px]]

6. To create a new certificate, click on the "New certificate" link and follow the instructions. When the process is completed your certificate will be listed on the same page.

7. Install the signed certificate in your browser by clicking on the "Install in keystore" link. This will install the certificate in the key-store of your browser.

== Exporting Terena certificate for use with Grid tools ==

To use the Terena certificates with the ARC grid client they have to be exported from the browser and converted into a suitable format. To export and convert a certificate installed the following procedure can be used:

1. Export the installed certificate from the browser in the PKCS12 format. In Firefox this is accomplished from the Options/Advanced/Encryption Dialog, shown below:

[[File:browser1.png|400px]]

To show all installed certificate click on the "View Certificates" buttton. This will shown the following dialog:

[[File:browser2.png|400px]]

To backup your newly created certificate select the Terena certificate and click on the "Backup" button in the previous dialog. This brings up a dialog for selecting a filename and location for the certificate. Save your certificate in a good location. The file with be given the extension .p12 indicating that it is a PKCS12 certificate. When the location has been selected another dialog is shown asking for a export password. This password will protect the certificate and private key. As show in the next figure:

[[File:browser3.png|400px]]

Use the password quality meter to choose a strong password for the exported certificate and private key.

2. Converting the PKCS12 certificate to a format suitable for use with grid clients (PEM)

Create a directory, .globus, in your home directory.

Linux / Unix:

<pre>$ cd ~
$ mkdir .globus
$ cd .globus</pre>

In windows

<pre>C:\...\>cd C:\Users\<username>
C:\...\>mkdir .globus
C:\...\>cd .globus</pre>

Using the "openssl" command we now convert the exported certifcate to the correct format. '''Windows users:''' OpenSSL for Windows is available [http://www.openssl.org/related/binaries.html here].

The first step is to convert the private key. The openssl command will first ask for the password chosen when the certificate was exported ("Enter Import Password:"). In the next step the pass phrase for the exported private key is chosen ("Enter PEM pass phrase:"). Please choose a strong passphrase.

<pre>openssl pkcs12 -nocerts -in usercert.p12 -out userkey.pem
Enter Import Password:
MAC verified OK
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:</pre>

In the next step the certificate is converted. In the same way as with the private key we have to specify the export password again ("Enter Import Password:").

<pre>openssl pkcs12 -clcerts -nokeys -in usercert.p12 -out usercert.pem
Enter Import Password:
MAC verified OK</pre>

Before we can use the private key with or client tools the permissions on the private key file (userkey.pem) has to changed to a more restrictive setting (Linux/Unix):

<pre>chmod 400 userkey.pem</pre>

= Requesting a certificate with ARC tools =

The first step in aquiring a certificate is to create a certificate request. This is done using the '''grid-cert-request -int''' command. (The -int options means interactive usage). When issued, the tool will generate a certificate request and a private key. The tool will also ask for a password to protect the private key. Note, if the password is lost a new certificate must be obtained. The process is shown below:

First the private key is generated:

<pre>$ grid-cert-request -int
A certificate request and private key is being created.
You will be asked to enter a PEM pass phrase.
This pass phrase is akin to your account password,
and is used to protect your key file.
If you forget your pass phrase, you will need to
obtain a new certificate.

Using configuration from /etc/grid-security/globus-user-ssl.conf
Generating a 1024 bit RSA private key
.....................................++++++
....................++++++
writing new private key to '/home/jonas/.globus/userkey.pem'</pre>
To protect the private key from unauthorized access it is encrypted using a pass phrase. If this pass phrase is empty, anyone with access to your private key and certificate can gain access to the resources you have been granted. The pass phrase should also be different from your normal login password, so if your local system has been compromised the private key is still protected.:

<pre>-----
You are about to be asked to enter information that will be
incorporated into your certificate request. What you are about to
enter is what is called a Distinguished Name or a DN. There are
quite a few fields but you can leave some blank For some fields
there will be a default value, If you enter '.', the field will be
left blank.
-----
Level 0 Organization Name (do not modify) [Grid]:
Level 1 Organization Name (do not modify) [NorduGrid]:</pre>
The following questions regards your affiliation domain and your email. It is important that your domain and the domain in the email address is the same.:

<pre>Your Domain [example.org]:mydomain.org
Name (e.g., Hans Christian Andersen) []:Joe User
Email address (e.g., h.c.andersen@example.org) []:joe.user@
mydomain.org</pre>
Finally the private key and a certificate request are generated.:

<pre>A private key and a certificate request has been generated with
the subject:

/O=Grid/O=NorduGrid/OU=mydomain.org/CN=Joe User/Email=joe.user@
mydomain.org

If the CN=Joe User/Email=joe.user@mydomain.org is not appropriate,
rerun this script with the -force -cn "Common Name" options.

Your private key is stored in /home/joe/.globus/userkey.pem
Your request is stored in /home/joe/.globus/usercert_request.pem

Please e-mail the request to the NorduGrid Certification Authority
ca@nbi.dk You may use a command similar to the following:

cat /home/jonas/.globus/usercert_request.pem | mail ca@nbi.dk

Only use the above if this machine can send AND receive e-mail. if
not, please mail using some other method.

Your certificate will be mailed to you within two working days. If
you receive no response, contact NorduGrid Certification Authority
at ca@nbi.dk</pre>
The result of the command are 3 files '''userkey.pem''' , '''usercert.pem''' and '''usercert_request.pem''' in a subdirectory called '''.globus''' in the user home directory. The '''userkey.pem''' your private key and should not be world readable. This can be achieved by using '''chmod 400 userkey.pem'''.

The contents of the '''usercert_request.pem''' should be sent by mail to you neareast Registration Authority (RA) by mail. The RA will verify your request and varify your identity. This can involve meeting with the RA and proving your identity with a passport or equivalent documents. The current list of RA:s can be found at the following page:

[http://ca.nordugrid.org/ra.html [http://ca.nordugrid.org/ra.html http://ca.nordugrid.org/ra.html]]

== Installing certificate ==

When the signed certificate is received from the CA it has to be added to the '''usercert.pem''' file in the '''.globus''' directory.

The important parts of the mail are shown below::

<pre>-----BEGIN CERTIFICATE-----
xasdj ...
-----END CERTIFICATE-----</pre>
Copy the part shown above into the file <tt>usercert.pem</tt> in the <tt>.globus</tt> directory in your home directory.

= Verifying the certificate =

To verify that the certificate is correctly installed, issue the following command::

<pre>$ [jonas@localhost ~]$ arcproxy --info
Subject: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=proxy
Identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Time left for proxy: 11 hours 54 minutes 55 seconds
Proxy path: /tmp/x509up_u500
Proxy type: Legacy Globus impersonation proxy</pre>

This should display your Distinguished Name (DN) of the installed certificate.

= Requesting membership in the SweGrid VO =

To be able to use the SweGrid resources a membership in the SweGrid VO and a corresponding group is required. To apply for membership, make sure that your certificate is installed in the browser. Then go to the following URL:

[https://voms.ndgf.org:8443/voms/swegrid.se https://voms.ndgf.org:8443/voms/swegrid.se]

and follow the instructions. In a couple of hours you will be added to the SweGrid VO. To be added to the correct SNIC project send a mail to support@swegrid.se and specify your DN as shown in the Terena portal or from the '''arproxy --info''' command and which SNIC-project to be added to.

= Proxy certificates =

Authentication on the grid is done by using special shortlived proxy certificates, which delegate authentication to specific resources.

== Creating a proxy certificate ==

To create a shortlived proxy that can be used for authentication with grid services, the '''arcproxy''' command can be used. A 12 hour (default) proxy is created in the following example::

<pre>
[jonas@localhost ~]$ arcproxy
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter pass phrase for /home/jonas/.globus/userkey.pem:
.++++++
.....++++++
Proxy generation succeeded
Your proxy is valid until: 2011-03-11 03:00:14
</pre>

The proxy file itself will be created in the '''/tmp''' directory with the format '''x509up_[uid]''', where uid is the userid number for your user account.

In some cases a longer lived proxy will be needed. This is achieved using the '''--constraint''' switch. A 24-hour can be created by issuing the following command:

<pre>
[jonas@localhost ~]$ arcproxy --constraint="validityPeriod=24H"
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter pass phrase for /home/jonas/.globus/userkey.pem:
....++++++
.....++++++
Proxy generation succeeded
Your proxy is valid until: 2011-03-11 15:03:19
</pre>

'''NOTE:''' When using ARC 0.8.x a GSI proxy is required. To generate a GSI proxy, the '''--old''' or '''-O''' switches can be used:

<pre>
[jonas@localhost ~]$ arcproxy -O
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter pass phrase for /home/jonas/.globus/userkey.pem:
................++++++
......++++++
Proxy generation succeeded
Your proxy is valid until: 2011-03-11 03:15:04
</pre>

== Checking proxy lifetime ==

The remaining lifetime of a proxy-certificate can be queried using the '''arcproxy''' command using the '''--info''' switch.

<pre>
$ arcproxy --info
[jonas@localhost ~]$ arcproxy --info
Subject: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=1567862803
Identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Time left for proxy: 11 hours 55 minutes
Proxy path: /tmp/x509up_u500
Proxy type: X.509 Proxy Certificate Profile RFC compliant restricted proxy
</pre>

Which shows that the proxy certificate is valid for 11 hours 59 minutes.

If a GSI proxy was generated the output would be:

<pre>
[jonas@localhost ~]$ arcproxy --info
Subject: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=proxy
Identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Time left for proxy: 11 hours 54 minutes 57 seconds
Proxy path: /tmp/x509up_u500
Proxy type: Legacy Globus impersonation proxy
</pre>

== Destroying a proxy certificate ==

A proxy can be destroyed with the '''-r''' or '''--remove''' switches.

<pre>$ arcproxy -r</pre>

or

<pre>$ arcproxy --remove</pre>

== Creating a proxy certificate (ARC 0.8.x) ==

To create a shortlived proxy that can be used for authentication with grid services, the '''grid-proxy-init''' command can be used. A 12 hour (default) proxy is created in the following example::

<pre>$ grid-proxy-init
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter GRID pass phrase for this identity:
Creating proxy .................................................... Done
Your proxy is valid until: Tue Jan 25 01:22:59 2011</pre>
The proxy file itself will be created in the <tt>/tmp</tt> directory with the format <tt>x509up_[uid]</tt>, where uid is the userid number for your user account.

In some cases a longer lived proxy will be needed. This is achieved using the '''-valid''' switch. A 24-hour can be created by issuing the following command:

<pre>[jonas@localhost ~]$ grid-proxy-init -valid 24:00
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter GRID pass phrase for this identity:
Creating proxy ................................................... Done
Your proxy is valid until: Thu Feb 10 18:48:34 2011 </pre>

== Checking proxy lifetime (ARC 0.8.x) ==

The remaining lifetime of a proxy-certificate can be queried using the '''grid-proxy-info''' command:

<pre>$ grid-proxy-info
subject : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=704530122
issuer : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
identity : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
type : RFC 3820 compliant impersonation proxy
strength : 512 bits
path : /tmp/x509up_u500
timeleft : 0:00:00</pre>
In this case the proxy has expired. Creating a new proxy-certificate with the '''grid-proxy-init''' command produces the following output from '''grid-proxy-info''':

<pre>$ grid-proxy-info
subject : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann/CN=1908712807
issuer : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
identity : /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
type : RFC 3820 compliant impersonation proxy
strength : 512 bits
path : /tmp/x509up_u500
timeleft : 11:59:55</pre>
Which shows that the proxy certificate is valid for 11 hours 59 minutes.

== Destroying a proxy certificate (ARC 0.8.x) ==

A proxy certificate can be destroyed using the '''grid-proxy-destroy''' command. This command will essentially just delete the temporary proxy file created with '''grid-proxy-init'''

= VOMS certificates =

To use the SweStore national storage resources a membership in a virtual organisation, VO, is required. When accessing the storage resources a special grid proxy certificate is required which indicates VO membership. The special proxy certificate requires that it is signed by the virtual organisation management server, VOMS. To enable this signing process, configuration files have to be added to the system. First a '''$HOME/.voms/vomses''' file with the following contents must be added:

<pre>"swegrid.se" "voms.ndgf.org" "15009" "/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org" "swegrid.se"</pre>

Next the file '''/etc/grid-security/vomsdir/swegrid.se/voms.ndgf.org.lsc''' with the following contents:

<pre>/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org
/O=Grid/O=NorduGrid/CN=NorduGrid Certification Authority</pre>

== Creating a VOMS proxy (ARC 0.8.x) ==

To create a proxy certificate the, '''voms-proxy-init''', command is used. In the following example a voms proxy certificate is created with membership in the '''ops''' group.

<pre>
[jonas@localhost ~]$ voms-proxy-init -voms swegrid.se:/swegrid.se/ops

Enter GRID pass phrase:
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Creating temporary proxy ............................................................. Done
Contacting voms.ndgf.org:15009 [/O=Grid/O=NorduGrid/CN=host/voms.ndgf.org] "swegrid.se" Done
Creating proxy .......................................................... Done
Your proxy is valid until Thu Mar 10 23:14:57 2011
</pre>

== Creating a VOMS proxy (ARC 1.x) ==

VOMS proxies in ARC 1.x can be created using the '''arcproxy''' command and the '''-S''' or '''--voms''' switches as shown in the following example:

<pre>
[jonas@localhost ~]$ arcproxy -S swegrid.se:/swegrid.se/ops
Your identity: /O=Grid/O=NorduGrid/OU=lunarc.lu.se/CN=Jonas Lindemann
Enter pass phrase for /home/jonas/.globus/userkey.pem:
.....++++++
............++++++
Contacting VOMS server (named swegrid.se): voms.ndgf.org on port: 15009
Proxy generation succeeded
Your proxy is valid until: 2011-03-10 23:33:06
</pre>