What does the NGS do for Europe?

Quite a lot actually is the answer!

The NGS will be hosting a second seminar series this summer and the theme of the 3 seminar event focuses on the services that we provide for the European Grid Infrastructure (EGI).  As with last time, the seminar series will be held using EVO allowing people from all over the world to participate in the seminar and to quiz the presenters.  The details for this series are -


20th June - Grid Accounting and APEL
This talk will give an overview of how accounting is done on the grid, and what it is used for.  It will cover the NGS accounting system at a high level.  It will then go into more detail about the implementation of APEL, the accounting system for EGI, including the particular challenges involved and the plans for development.

27th June - GOCDB, the NGS and EGI 
This talk will cover a brief overview of the functionality provided by GOCDB, the official repository for storing and presenting EGI topology and resources information. The seminar will explain how it is used within the NGS, recent developments, useful features on the future roadmap and a chance to ask questions about the system. There will also be a short overview of how GOCDB is used in the context of the EGI project.

4th July -  The Training Marketplace
The Training Marketplace is a one-stop shop for training developed by STFC and the EGI InSPIRE project. Here you will find information about classroom-based training courses and online training materials including a repository containing thousands of resources. You can also search for PhD or MSc courses, or for resources for trainers such as a Training CA. The Training Marketplace equally allows you to advertise and a freely available gadget enables you to customise and embed the Training marketplace in your own website. This seminar will talk you through the Training Marketplace and demonstrate how you can embed a customised version of a training calendar, map or repository in your own website.

If you are interested in attending any of these online seminars then please see the webpage for further details and how to join in online.  There are also Facebook event pages available for each seminar series to help you inform interested colleagues and to invite them along.

Secret messages

Listen very carefully, I will say this only once.

This posting is about keeping secrets. As such, information will be provided on a strictly need to know basis.

And what you need to know is that...

We may (or may not) be transferring some data from somewhere that might (or might not) be near Didcot to somewhere else that might (or might not) be Manchester.

Some people might speculate that this is something to do with job accounting data.

While it is true that there are number of GridPP sites that are NGS partners and it is true that these sites will run jobs on behalf of users within the ngs.ac.uk virtual organisation and it is true that the amount of CPU time used by these jobs is recorded in the EGI APEL accounting service - we obviously can neither confirm or deny that APEL data is now sent to the NGS and recorded against users records in the User Account Service.

So, putting aside the cloak and dagger for the moment, what is the big secret?

Like many secrets it is very, very dull. We are indeed passing accounting data around. As far as data protection rules are concerned, accounting records count as personal information so we have to ensure that they are never left sitting around unprotected.

As we are not currently able to directly link the NGS and the APEL accounts database, we needed to find a delivery mechanism that is both secure and which could be automated.

The solution we chose was to encrypt the data and put it somewhere where it can be collected at regular intervals.

The encryption is done with OpenSSL...

  
   export TOP_SECRET="if we told you, then it wouldn't be a secret any more."
   openssl enc -e -blowfish -in secret-data.plain -out secret-data.enc -pass env:TOP_SECRET

and - when the file is transferred, the data can be decrypted with

  export TOP_SECRET="that password in the line above that we are still not telling you"
  openssl enc -d -blowfish -e -in secret-data.enc -out secret-data.plain -pass env:TOP_SECRET

This is symmetric encryption so now that we need to play pass the password.

This where certificates come to the fore as they support asymmetric or public/private key encryption. As long as the password is shorter than the key length, it can be encrypted using this certificate so only the certificate holder can retrieve it. The command is...

  echo $TOP_SECRET | \
    openssl rsautl -encrypt -certin -inkey someones-public-cert.pem \
      -out  password.enc

The password.enc file can be sent to the certificate holder who can unscramble it using something like

  
   openssl rsautl -inkey /path/to/my/userkey.pem -decrypt -in password.enc

This can be used to update the password securely and ensure and all the secrets stay secrets.

That is all. This blog posting will self destruct in 30 seconds...

Joined up thinking in the NGS

Back in June, in the posting on the pitfalls of licensing on a Grid, I said that we were working on a new way of supporting those users who had licenses for applications such Amber, Castep, DL_POLY, GAMESS (US) and PC-GAMESS/Firefly.

It demonstrates how the various services that the NGS and its partner sites provide can be linked together to make using the Grid that little bit simpler.

Those who really don't have the time or inclination to wade though past postings only need to know:

• these applications are made available to existing license holders by various NGS partner sites.
• that the sites all have some kind of access control in place to enforce this.
  
• that we use groups within a virtual organisation (VO) called applications.ngs.ac.uk as a way of recording who has signed up for what- so the access control lists can be kept up to date.

If you have a certificate in your browser, you can visit https://voms.ngs.ac.uk/voms/applications.ngs.ac.uk to see what we think you can do.

Membership information within the applications.ngs.ac.uk VO has so far been managed by pointing and clicking and fiddling in the VO web interface. This is slow and error prone - especially for those of us who still prefer to communicate with computers by typing.

Now - thanks to the efforts of the NGS staff at Manchester - we can update the groups automatically from tags associated with entries in our User Account Service. - the definitive database of who is, and was, an NGS account holder.

For example, all NGS users who we know have signed the academic license for Castep will have the tag application-castep assigned to them. When we turn automatic updating on - hopefully on Monday 5 July - any user with this tag will be granted membership of the Castep group.

If you are an NGS user with a license for one of these applications please let the helpdesk know.