WikiPrint - from Polar Technologies

This installation guide will provide instructions about how to install an ESGF data/compute node. In order to do it, the VM should have 1 core, 2GB of RAM memory and 20GB of Hard Disk.

For the installation process, it is highly recommendable to provide more than 1 core


TCP and UDP ?ports firewall configuration

Corporate Firewall

Port Direction Type Application Description
80 in tcp Tomcat Web server access
443 in tcp Tomcat SSL - Secure Web Server Access.
5432 in tcp Postgres Postgres Access. (not external: by default bound ONLY TO LOCAL INTERFACE)
2811 in tcp GridFTP user-configured GridFTP Server control channel
(60000-61000) in/out tcp GridFTP user-configured GridFTP Server data channel (or as defined in the global variable GLOBUS_TCP_PORT_RANGE)
2812 in tcp GridFTP BDM-configured GridFTP Server control channel. May run together with the user-configured one though not recommended - system resource intensive!
(60000-61000) in/out tcp GridFTP BDM-configured GridFTP Server data channel. May run together with the user-configured one though not recommended - system resource intensive!
7512 out tcp MyProxy MyProxy client access to the certificate repository
8984 - tcp esgf-search (Tomcat)local connection to the Solr master instance (not external!)
8983 in/out tcp esgf-search (Tomcat) Connection to remotes Solr slave instance. Used in distributed search (shard).
80 out tcp esg-publisher Local connection to THREDDS server (e.g., to check catalogs) and other nodes (node-manager)
443 out tcp esg-publisher Local secure connection to THREDDS server (e.g., to restart the application) and to the idp

IPTables configuration

Add the rules below to the IPTables configuration file, i.e. /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 2811 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 2812 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8984 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8983 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 60000:61000 -j ACCEPT

then, restart the IPTables services

$ services iptables restart

Install RPM packages

First, install the sourceforge RPM repository for the *ExtUtils* packages:

$ rpm -iv

If epel repository doesn't exist in /etc/yum.repos.d then:

$ wget
$ rpm -Uvh epel-release-6-8.noarch.rpm

Now you can list out the installed repositories using command:

$ yum repolist

For making sure epel repository is enabled and rpmforge is disabled, run):

yum --disablerepo=rpmforge --enablerepo=epel install autoconf automake bison file flex gcc gcc-c++ gettext-devel libtool uuid-devel libuuid-devel libxml2 libxml2-devel libxslt libxslt-devel lsof make openssl-devel pam-devel pax readline-devel tk-devel wget zlib-devel perl-Archive-Tar perl-XML-Parser libX11-devel libtool-ltdl-devel e2fsprogs-devel.x86_64 gcc-gfortran libicu-devel.x86_64 libgtextutils-devel.x86_64 *ExtUtils*

Please make sure that the ntp package is installed $ rpm -qa | grep ntp, otherwise instal it $ yum install ntp

Install the ESGF data/compute node

Before running the ESGF Installer script, it is recommended that some directories are backed up. Backup your node before installation: ?

The instructions have been provided by the ESGF1.

First, download and Execute the Bootstrap Script

$ cd /usr/local/bin
$ wget -O esg-bootstrap --no-check-certificate
$ chmod 555 esg-bootstrap
$ esg-bootstrap

Second, check installer script version, with:

$ esg-node --version

The output:

Version: v1.7.0-phoenix-release-master
Release: phoenix
Earth Systems Grid Federation (
ESGF Node Installation Script

In our case, we are going to configure only data, compute and index types:

$ script -a -c "esg-node --type data compute index --install" /tmp/esgf_install.log

You must continue and yes in answers. Then during the installation, you will have to fill in several questionnaires:

Welcome to the ESGF Node installation program! :-)

What is the fully qualified domain name of this node? []:  
What is the admin password to use for this installation? (alpha-numeric only) []: 
Please re-enter password: 
What is the name of your organization? [unican]: 
Please give this node a "short" name: []: data-unican
Please give this node a more descriptive "long" name []: data-unican
What is the namespace to use for this node? (set to your reverse fqdn - Ex: "gov.llnl") [es.unican.meteo]: 
What peer group(s) will this node participate in? (if not sure, use default) [esgf-test]: #important that use "esgf-test"
What is the default peer to this node? []:
What is the hostname of the node do you plan to publish to? []: #important
What email address should notifications be sent as? []:
Is the database external to this node? [y/N]: #yes
Please enter the database connection string...
 (form: postgresql://[username]@[host]:[port]/esgcet)
What is the database connection string? [postgresql://dbsuper@localhost:5432/esgcet]: postgresql://
entered: postgresql://dbsuper@localhost:5432/esgcet
What is the (low priv) db account for publisher? [esgcet]: 
What is the pass of db account?:
Finished processing dependencies for esgcet==2.12.1
Would you like a "system" or "user" publisher configuration: 
	*[1] : System
	 [2] : User
	 [C] : (Custom)
select [1] >  

You have selected: 1
Publisher configuration file -> [/esg/config/esgcet/esg.ini]

Is this correct? [Y/n] 

Looking for keystore [/esg/config/tomcat/keystore-tomcat]... (don't see one)... 
Keystore setup: 
Launching Java's keytool:
store_password = ******
Would you like to use the DN: (OU=ESGF.ORG, O=ESGF) ? [Y/n]: 
Using keystore DN =, OU=ESGF.ORG, O=ESGF
Enter key password for <my_esgf_node>
	(RETURN if same as keystore password):  
Re-enter new password: 
Do you wish to generate a Certificate Signing Request at this time? [Y/n] 

Please enter the password for this keystore   : 
Please re-enter the password for this keystore: 

Create user credentials
Please enter username for tomcat [dnode_user]:  
Please enter password for user, "dnode_user" [********]:   73769edbd97410aacfb3560ebb817f882d141517
Would you like to add another user? [y/N]: 

Please Enter the IP address of this host []:> 

Using IP:
Please select the IDP Peer for this node: 
        *[1] : ESGF-PCMDI-9 ->
         [2] : ESGF-PCMDI   ->
         [3] : ESGF-JPL     ->
         [4] : ESGF-ORNL    ->
         [5] : ESGF-BADC    ->
         [6] : ESGF-DKRZ    ->
         [7] : ESGF-PNNL    ->
         [8] : ESGF-ANL     ->
         [9] : ESGF-PCMDI-TEST3 ->
         [C] : (Manual Entry)
select [1] > C
Please enter the IDP Peer's name [ESGF-PCMDI-9] ESGF-TEST
Please enter the IDP Peer's hostname []

You have selected: (Manual Entry)

Is this correct? [Y/n] Y

Creating directory /esg/content/thredds/esgcet
INFO       2013-08-02 16:48:46,144 Writing THREDDS ESG master catalog /esg/content/thredds/esgcet/catalog.xml
INFO       2013-08-02 16:48:46,173 Writing THREDDS root catalog /esg/content/thredds/catalog.xml
THREDDS dataset root directories (option=thredds_dataset_roots)
Each entry has the form 'path_identifier | absolute_directory_path':
Current value is: 

esg_dataroot | /esg/data

Enter lines, or <RETURN> to end
Add new line: 

# ESGF cronjob BEGIN ###
35 0,12 * * * ESG_USAGE_PARSER_CONF=/esg/config/gridftp/esg-bdm-usage-gridftp.conf /esg/tools/esg_usage_parser 
# ESGF cronjob END ###
Is this ok ? [Y/n]Y
# ESGF cronjob BEGIN ###
35 0,12 * * * ESG_USAGE_PARSER_CONF=/esg/config/gridftp/esg-bdm-usage-gridftp.conf /esg/tools/esg_usage_parser 
5 0,12 * * * ESG_USAGE_PARSER_CONF=/esg/config/gridftp/esg-server-usage-gridftp.conf /esg/tools/esg_usage_parser 
# ESGF cronjob END ###
Is this ok ? [Y/n]Y

Server sent 2 certificate(s):

 1 Subject,, OU=GlobusTest, O=Grid
   Issuer  CN=Globus Simple CA,, OU=GlobusTest, O=Grid
   sha1    cf f9 20 2b ce a6 bc b0 5d b4 a7 bb 0c 08 18 99 14 47 a6 86 
   md5     bd 6d ab cb 0b 75 58 fb 54 52 89 60 8e 1b 44 b8 

 2 Subject CN=Globus Simple CA,, OU=GlobusTest, O=Grid
   Issuer  CN=Globus Simple CA,, OU=GlobusTest, O=Grid
   sha1    06 09 9b cc b6 70 6f 3e 59 00 34 b9 fa 0a ba 87 0b f1 16 10 
   md5     0b b0 a3 56 f6 a7 c7 32 7e 35 b5 b9 e3 bb cd 26 

Enter certificate to add to trusted keystore or 'q' to quit: [1] > 1

After that, you should restart the esg-node:

$esg-node restart

If you want to re-install it, you have to use the force option :

$ ./esg-node --type data compute --install --force

Generating CSR certificate

based in: ?

1) Make a directory named workdir in /etc/grid-security and copy hostkey.pem of tomcat in this directory

$ mkdir /etc/grid-security/workdir
$ cp /esg/config/tomcat/hostkey.pem /etc/grid-security/workdir 

2) In workdir generate the CSR with this configuration file localopenssl.cnf?

$ cd /etc/grid-security/workdir
$ openssl req -config localopenssl.cnf -new -subj /O=Grid/OU=GlobusTest/ -multivalue-rdn -key  hostkey.pem -out

3)Check if CSR is well generated

$ openssl req -text -noout -in 

Index peer configuration

In order to configure the host certificate and CA public key, you have to send the csr file located under /esg/config/tomcat/ directory to the CA.


Then you should put the signed csr under the /etc/grid-security/ directory.

$ /etc/grid-security/

And, if the tomcat key is not in /etc/grid-security directory, copy it inside:

$ cd /etc/grid-security
$ cp /esg/conf/tomcat/hostkey.pem ./

Install the key pair in tomcat. You will be prompted to enter the cacert file; enter the url to the index node cacert.pem:

$ cd /usr/local/bin
$ ./esg-node --install-keypair hostkey.pem
Please enter your Certificate Athority's certificate chain file(s): 
 [enter each cert file/url press return, press return with blank entry when done]

Predeterminates password of esg-truststore.ts is 'changeit'. For list the entrys in truststore:

 $ /usr/local/java/bin/keytool -v -list -keystore /esg/config/tomcat/esg-truststore.ts -storepass changeit

Set auto fetch certs false, otherwise /etc/grid-security/certificates/* will be overwritten by esgf-prod peer groups certificates

$ cd /usr/local/bin
$ ./esg-node --set-auto-fetch-certs false
$ ./esg-node restart

Register connects to desired node, fetches and stores their certificate to enable ingress SSL connections

$ ./esg-node --register
$ cd /etc/grid-security/certificates/
$ grep *
373bd876.signing_policy: access_id_CA      X509         '/O=ESGF/OU=ESGF.ORG/ CA'
373bd876.signing_policy: cond_subjects     globus       '"/O=ESGF/OU=ESGF.ORG/*"'

This process should fetch the CA cert to /etc/grid-security/certificates, If this process don't work you need to manually copy the CA cert. You can get them from ? or generate the certificates from esg-truststore.ts, for more see here: Generating Certs From Truststore

Then rebuild the Tomcat's trustsore

$ cd /usr/local/bin
$ ./esg-node --rebuild-truststore

Finally, you have to update some files as this manual said, which is available here: ?

Install TERENA certificate

  1. Check if checksum are coincident. The two checksum must match.
    $ openssl x509 -noout -modulus -in <pub_cer>| openssl md5
    $ openssl rsa -noout -modulus -in <priv_key> | openssl md5
  1. Install it in the esgf node. (password: the same as in THREDDS, certfile:chain.pem?)
    $ esg-node --install-ssl-keypair <pub_cert> <priv_key>
    Please enter your Certificate Athoritys certificate chain file(s):
    certfile> chain.pem

You can check if the chain file is complete with this command:

openssl verify -verbose -purpose sslserver -CAfile <full path to chain file> <full path to host cert file>

The output should only be the name of the file followed by 'OK'

  1. Restart esgf node
    $ esg-node --restart
  1. Test it
    $ openssl s_client -connect </dev/null 2>/dev/null |openssl x509 -noout -subject -issuer_hash -issuer -dates
    subject= /OU=Domain Control Validated/
    notBefore=Jun 12 00:00:00 2014 GMT
    notAfter=Jun 11 23:59:59 2017 GMT

See Also