You will need to install drivers and basic equipment for access to MetaCentrum resources for proper token utilization. The drivers are supplied on CD by the producer, the content of this CD can also downloaded. Applications that we have prepared for access to MetaCentrum can be downloaded too.
Instalation step by step:
Complete list of installer screenshots
Do not plug in token into USB port before finish of the installation! Administrator rights are required for installation of this driver.
Use file start.exe for driver installation. From displayed menu select "Installation of SafeSign for iKey 3000".
Follow the wizard.
If you select user type of installation following parts are necessary for proper functionality of MetaCentrum Tools: PKCS#11, CSP and it is also recommended to select also Management of tokens.
Unpack distribution package METACentrumTools.zip. Installation can be started by METACentrum\METACentrum Tools\setup.exe.
Installation contains following applications:
PKINIT - application taking care of obtaining Kerberos tickets using a personal certificate stored at the USB token.
GRID_PROXY_INIT - script creating a proxy certificate using the personal certificate stored at the USB token.
META Putty - Terminál for access to UNIX/Linux machines with GSSAPI support. Therefore after successful obtaining of tickets or proxy certificate the user is not required to enter password, the authentication proceeds using the personal certificate. Manual for utilization is available.
META WinSCP - Windows SCP client (program for secure access to files at UNIX/Linux machines), again with GSSAPI support. Manual for setting is available.
Notes for those of you interested in all settings that are set by the installer.
Values that the application set in variables of user's environment (HKEY_CURRENT_USER)
Command line utilization.
The utilization of command from Start menu is the same as for the command line commands with the one and only exception: there is only pkinit in Start menu that has the same functionality as pkinit_gui.
Note: If we want pkinit and pkinit_gui to use always one same login then we can change files {METACentrum Tools installation directory}\bin\pkinit.bat a pkinit_gui.bat according to following example. Both programs use implicitly login as a parameter or the gui version will ask for it.
pkinit.bat
ukázka změněného souboru:
@echo off
rem Pokud chcete používat konkrétní login, odstraňte z následujících dvou řádků "rem" a místo <login>dejte požadovaný login
kinit -C ENGINE:CERT=slot_0,KEY=slot_0 xnovak
goto end
if "%1"=="" goto description else goto doit
:doit
echo KINIT for %1
kinit -C ENGINE:CERT=slot_0,KEY=slot_0 %1
goto end
:description
echo META Centrum Tools - KINIT
echo.
echo Usage: pkinit username[@realm]
echo.
echo For more infromation: http://meta.cesnet.cz
goto end
:end
pkinit_gui.bat
Ukázka změněného souboru:
@echo off
rem Pokud chceme vždy použít konkrétní login, pak %1 nahradíme loginem, např. kinit_gui -C ENGINE:CERT=slot_0,KEY=slot_0 xnovak
kinit_gui -C ENGINE:CERT=slot_0,KEY=slot_0 xnovak
The only change compared to classical utilization of program Putty is the authentication selection for SSH. We will select either "Kerberos 5" or "Globus GSI" and "Allow credential forwarding in GSSAPI/SSPI (SSH2)" at the page with the SSH authentication setings.
Utilization of Putty and WinSCP requires changes at SSH server side. We are preparing mass upgrade of our SSH servers that will contain required modifications. Until that time it is required for accessing MetaCentrum use machine skirit.ics.muni.cz. These values are entered in menu "Session". Access through GSI can be used at machine skurut4.cesnet.cz.
Using the WinSCP program we have to change authentication settings. At first the option "Advanced option" must be seleted, then the menu "Authentication" at SSH will become available. There we wil select either "Attempt Kerberos 5 GSSAPI" or "Attempt GSI GSSAPI" authentication (SSH2)".
Utilization of Putty and WinSCP requires changes at SSH server side. We are preparing mass upgrade of our SSH servers that will contain required modifications. Until that time it is required for accessing MetaCentrum use machine skirit.ics.muni.cz. These values are entered in menu "Session". Access through GSI can be used at machine skurut4.cesnet.cz.
