table of contents
other versions
- wheezy 5.0-2
- wheezy-backports 6.8-1~bpo70+1
- jessie 6.8-1
- testing 6.19-1
- unstable 6.19-1
GRID-PROXY-INIT(1) | Globus Commands | GRID-PROXY-INIT(1) |
NAME¶
grid-proxy-init - Generate a new proxy certificateSYNOPSIS¶
grid-proxy-init
[-help] [-usage] [-version]
grid-proxy-init
[-debug] [-q] [-verify]
[[-valid HOURS:MINUTES] | [-hours HOURS]]
[-cert CERTFILE] [-key KEYFILE]
[-certdir CERTDIR] [-out PROXYPATH]
[-bits BITS]
[-policy POLICYFILE]
[[-pl POLICY-OID] | [-policy-language POLICY-OID]]
[-path-length MAXIMUM] [-pwstdin] [-limited] [-independent]
[[-draft] | [-old] | [-rfc]]
DESCRIPTION¶
The grid-proxy-init program generates X.509 proxy certificates derived from the currently available certificate files. By default, this command generates a RFC 3820[1] Proxy Certificate with a 512 bit key valid for 12 hours in a file named /tmp/x509up_u UID. Command-line options and variables can modify the format, strength, lifetime, and location of the generated proxy certificate. X.509 proxy certificates are short-lived certificates, signed usually by a user´s identity certificate or another proxy certificate. The key associated with a proxy certificate is unencrypted, so applications can authenticate using a proxy identity without providing a passphrase. Proxy certificates provide a convenient alternative to constantly entering passwords, but are also less secure than the user´s normal security credential. Therefore, they should always be user-readable only (this is enforced by the GSI libraries), and should be deleted after they are no longer needed. This version of grid-proxy-init supports three different proxy formats: the old proxy format used in early releases of the Globus Toolkit up to version 2.4.x, an IETF draft version of X.509 Proxy Certificate profile used in Globus Toolkit 3.0.x and 3.2.x, and the RFC 3820 profile used in Globus Toolkit Version 4.0.x and 4.2.x. By default, this version of grid-proxy-init creates an RFC 3820 compliant proxy. To create a proxy compatible with older versions of the Globus Toolkit, use the -old or -draft command-line options. The full set of command-line options to grid-proxy-init are: -help, -usageDisplay the command-line options to
grid-proxy-init.
-version
Display the version number of the
grid-proxy-init command
-debug
Display information about the path to the
certificate and key used to generate the proxy certificate, the path to the
trusted certificate directory, and verbose error messages
-q
Suppress all output from
grid-proxy-init except for passphrase prompts.
-verify
Perform certificate chain validity checks on
the generated proxy.
-valid HOURS:MINUTES, -hours
HOURS
Create a certificate that is valid for
HOURS hours and MINUTES minutes. If not specified, the default
of twelve hours and no minutes is used.
-cert CERTFILE, -key KEYFILE
Create a proxy certificate signed by the
certificate located in CERTFILE using the key located in KEYFILE. If not
specified the default certificate and key will be used. This overrides the
values of environment variables described below.
-certdir CERTDIR
Search CERTDIR for trusted certificates
if verifying the proxy certificate. If not specified, the default trusted
certificate search path is used. This overrides the value of the
X509_CERT_DIR environment variable
-out PROXYPATH
Write the generated proxy certificate file to
PROXYPATH instead of the default path of /tmp/x509up_u
UID.
-bits BITS
When creating the proxy certificate, use a
BITS bit key instead of the default 512 bit keys.
-policy POLICYFILE
Add the certificate policy data described in
POLICYFILE as the ProxyCertInfo X.509 extension to the generated proxy
certificate.
-pl POLICY-OID, -policy-language
POLICY-OID
Set the policy language identifier of the
policy data specified by the -policy command-line option to the oid
specified by the POLICY-OID string.
-path-length MAXIMUM
Set the maximum length of the chain of proxies
that can be created by the generated proxy to MAXIMUM. If not set, the
default of an unlimited proxy chain length is used.
-pwstdin
Read the private key´s passphrase from
stdin instead of reading input from the controlling tty. This is useful when
scripting grid-proxy-init.
-limited
Create a limited proxy. Limited proxies are
generally refused by process-creating services, but may be used to authorize
with other services.
-independent
Create an independent proxy. An independent
proxy is not treated as an impersonation proxy but as a separate identity for
authorization purposes.
-draft
Create a IETF draft proxy instead of the
default RFC 3280-compliant proxy. This type of proxy uses a non-standard proxy
policy identifier. This might be useful for authenticating with older versions
of the Globus Toolkit.
-old
Create a legacy proxy instead of the default
RFC 3280-compliant proxy. This type of proxy uses a non-standard method of
indicating that the certificate is a proxy and whether it is limited. This
might be useful for authenticating with older versions of the Globus
Toolkit.
-rfc
Create an RFC 3820-compliant proxy
certificate. This is the default for this version of
grid-proxy-init.
EXAMPLES¶
To create a proxy with the default lifetime and format, run the grid-proxy-init program with no arguments. For example:% grid-proxy-init Your identity: /DC=org/DC=example/CN=Joe User Enter GRID pass phrase for this identity: Creating proxy .................................. Done Your proxy is valid until: Thu Mar 18 03:48:05 2010
% grid-proxy-init -hours 8 -bits 1024 Your identity: /DC=org/DC=example/CN=Joe User Enter GRID pass phrase for this identity: Creating proxy .................................. Done Your proxy is valid until: Thu Mar 17 23:48:05 2010
ENVIRONMENT VARIABLES¶
The following environment variables affect the execution of grid-proxy-init: X509_USER_CERTPath to the certificate to use as issuer of
the new proxy.
X509_USER_KEY
Path to the key to use to sign the new
proxy.
X509_CERT_DIR
Path to the directory containing trusted
certifiate certificates and signing policies.
FILES¶
The following files affect the execution of grid-proxy-init: $HOME/.globus/usercert.pemDefault path to the certificate to use as
issuer of the new proxy.
$HOME/.globus/userkey.pem
Default path to the key to use to sign the new
proxy.
COMPATIBILITY¶
For more information about proxy certificate types and their compatibility in GT, see http://dev.globus.org/wiki/Security/ProxyCertTypes.SEE ALSO¶
AUTHOR¶
University of ChicagoNOTES¶
- 1.
- RFC 3820
04/25/2011 | Globus Toolkit 5.0.2 |