Using an Aladdin eToken PRO to generate grid proxies
Once your grid certificate and private key are safely stored on your eToken, you can generate grid proxies directly from the eToken.
A shell script ( mkproxy script ) was written for this purpose. This script requires quite a few special programs and libraries, which need to be installed before attempting to use the mkproxy script.
Downloading the required files
The required program files and libraries for running the mkproxy script are distributed using a tarball. This tarball also includes the mkproxy script itself so there is no need to download it separately. Due to licensing restrictions we cannot supply the eToken drivers and libraries in this tarball, these need to be downloaded from Aladdin. You can find the required software on the web:
- Windows: http://www.aladdin.ru/bitrix/redirect.php?event1=download&goto=/upload/iblock/2c0/RTE_3.65.zip
- Linux: http://www.aladdin.ru/bitrix/redirect.php?event1=download&goto=/upload/iblock/179/eToken_PKI_Client_for_Linux_v3_65.rar
- MacOS: http://www.aladdin.ru/bitrix/redirect.php?event1=download&goto=/upload/iblock/973/PKI_3_65_Mac.zip
(the files on Aladdin's Russian site do not require a password to unpack them, the ones on the US site do...)
Please read the instructions on Using an Aladdin eToken PRO to store grid certificates to install the eToken RTE software before attempting to use this script.
The script has been tested on
- Windows XP (using cygwin)
- Linux CentOS 4 (rhel4)
- Linux Fedora Core 5 (fc5)
In the near future we hope to test it on MacOS X as well.
Note On Windows, the Cygwin toolkit ( http://www.cygwin.com/ ) needs to be installed before attempting to use the mkproxy script. It does NOT work on Windows using either a command shell or the MingW/MSys shell.
Installing the mkproxy script
To install the myproxy script, download the Mkproxy.tar.gz tarball and unpack it in Your Favorite Directory. Support for all platforms mentioned above is included, so if you only need support for a single platform (e.g. rhel4) you can delete the cygwin and fc5 directories.
mkproxy script usage
If you have installed a single grid certificate on your eToken you can now generate a grid proxy using the command
./mkproxy
Which will return
Starting Aladdin eToken PRO proxy generation (detected platform cygwin) Found X.509 certificate on eToken: label: (eTCAPI) Jan Just Keijser's NIKHEF ID id: 39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30 Your identity: /O=dutchgrid/O=users/O=nikhef/CN=Jan Just Keijser Generating a 512 bit RSA private key ..........++++++++++++ ......++++++++++++ writing new private key to 'proxykey.QjN408' ----- engine "pkcs11" set. Signature ok subject=/O=dutchgrid/O=users/O=nikhef/CN=Jan Just Keijser/CN=proxy Getting CA Private Key PKCS#11 token PIN: Your proxy is valid until: Fri Apr 20 16:51:16 WEST 2007
The default location of your grid proxy is the same as for grid-proxy-init:
- wherever $X509_USER_PROXY is pointing to
otherwise
- /tmp/x509up_u<id>, where <id> is your numeric userid.
mkproxy Command-line options
To see the command-line options for the mkproxy script, type
./mkproxy --help
Which will return
mkproxy version 1.10 This script will generate a X509 grid proxy using a public/private key pair found on an attached Aladdin eToken PRO. Options [--help] Displays usage. [--version] Displays version. [--debug] Enables extra debug output. [--quiet] Quiet mode, minimal output. [--old] Creates a legacy globus proxy (default). [--rfc] Creates a RFC 3820 compliant proxy. [--days=N] Number of days the proxy is valid (default=1). [--path-length=N] Allow a chain of at most N proxies to be generated from this one (default=2). [--bits=N] Number of bits in key (512, 1024, 2048, default=512). [--out=proxyfile] Non-standard location of new proxy cert. [--slot=N] Slot number where eToken is located (default=0). [--label=string] (Part of) label of X509 certificate on eToken. [--id=string] (Part of) ID of X509 certificate on eToken. [--platform=rhel4|fc5|cygwin|guess] Overrule the system platform.
Note Instead of using '--option=value' you can also use '--option value'.
These option resemble the options of the grid-proxy-init command but there are some additions:
--slot=N
specify the slot in which the eToken USB token is insert. If you use only a single token then the default of 0 applies. If you use multiple tokens then increase this number.
--label=string --id=string
By default, the mkproxy script will use the first X509 certificate found on the eToken to generate a proxy. If there are multiple X509 certificates stored on your eToken then you can specify (part of) the label or of the id of a X509 certificate to select a specific X509 certificate. The RSA private key which is used to create the grid proxy is found by matching the 'id ' of the X509 public certificate with that of the private key. For example, to explicitly select a certificate with a specific ID, use
--id=39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30
Fortunately, there is no need to specify the full label or id as found on the eToken to select an X509 certificate. The value passed to the --label option is matched against the X509 certificates on Your Precious eToken using a sed-style regular expression. For example, by specifying
--label=NIKHEF
the mkproxy script will select the first X509 certificate on the token with a label matching 'NIKHEF'.
--platform=rhel4|fc5|cygwin|guess
The mkproxy will try to determine which platform it is running on, in order to select the appropriate libraries for accessing the eToken. You can overrule the platform with this option, where the option --guess tells the mkproxy script to smart-guess where to find the appropriate executables, drivers and libraries.
Note on proxy duration
Grid proxies generated using the mkproxy script have a duration measured in days, with a minimum of 1 day (i.e 24 hours). This is due to missing functionality in the openssl req command, which does not allow you to specify anything more fine-grained, not even a specific end-date.
Advanced mkproxy usage
A more advanced example to use the mkproxy script is
./mkproxy --slot=0 --label=NIK --rfc --bits 1024 Starting Aladdin eToken PRO proxy generation (detected platform fc5) Found X.509 certificate on eToken: label: (eTCAPI) Jan Just Keijser's NIKHEF ID id: 39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30 Your identity: /O=dutchgrid/O=users/O=nikhef/CN=Jan Just Keijser Generating a 1024 bit RSA private key ............................++++++ .........++++++ writing new private key to 'proxykey.Cz3139' ----- engine "pkcs11" set. Signature ok subject=/O=dutchgrid/O=users/O=nikhef/CN=Jan Just Keijser/CN=5815075619841 Getting CA Private Key PKCS#11 token PIN: Your proxy is valid until: Sat Apr 21 14:10:50 CEST 2007
which
- selects the first X509 certificate found in slot 0 matching label NIK
- creates an RFC 3820 compliant proxy
- using a 1024 bit RSA key