1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
|
GRID-PROXY-INIT(1)
==================
:doctype: manpage
:man source: Grid Community Toolkit
:man version: 6
:man manual: Grid Community Toolkit Manual
:man software: Grid Community Toolkit
NAME
----
grid-proxy-init - Generate a new proxy certificate
[[grid-proxy-init-SYNOPSIS]]
SYNOPSIS
--------
*grid-proxy-init* -help | -usage | -version
*grid-proxy-init* [OPTIONS]
[[grid-proxy-init-DESCRIPTION]]
DESCRIPTION
-----------
The *grid-proxy-init* program generates X.509 proxy certificates derived from
the currently available certificate files. By default, this command generates
a <ulink url="http://www.ietf.org/rfc/rfc3820.txt">RFC 3820</ulink> Proxy
Certificate with a 2048 bit key, valid for 12 hours, in a file named
+/tmp/x509up_u'UID'+. Command-line options and environment variables can
modify the format, strength, lifetime, and location of the generated proxy
certificate.
X.509 proxy certificates are short-lived certificates, signed usually by a
user's identity certificate or another proxy certificate. The key associated
with a proxy certificate is unencrypted, so applications can authenticate using
a proxy identity without providing a pass phrase.
Proxy certificates provide a convenient alternative to constantly entering
passwords, but are also less secure than the user's normal security credential.
Therefore, they should always be user-readable only (this is enforced by the
GSI libraries), and should be deleted after they are no longer needed.
This version of *grid-proxy-init* supports three different proxy formats: the
old proxy format used in early releases of the Globus Toolkit up to version
2.4.x, an IETF draft version of X.509 Proxy Certificate profile used in Globus
Toolkit 3.0.x and 3.2.x, and the RFC 3820 profile used in Globus Toolkit
Version 4.0.x and 4.2.x. By default, this version of *grid-proxy-init* creates
an RFC 3820 compliant proxy. To create a proxy compatible with older versions
of the Globus Toolkit, use the '-old' or '-draft' command-line options.
[[grid-proxy-init-OPTIONS]]
OPTIONS
-------
The full set of command-line options to *grid-proxy-init* are:
*-help, -usage*::
Display the command-line options to *grid-proxy-init*.
*-version*::
Display the version number of the *grid-proxy-init* command.
*-debug*::
Display information about the path to the certificate and key used to
generate the proxy certificate, the path to the trusted certificate
directory, and verbose error messages.
*-q*::
Suppress all output from *grid-proxy-init* except for pass phrase prompts.
*-verify*::
Perform certificate chain validity checks on the generated proxy.
*-valid 'HOURS:MINUTES', -hours 'HOURS'*::
Create a certificate that is valid for 'HOURS' hours and 'MINUTES' minutes.
If not specified, the default of twelve hours is used.
*-cert 'CERTFILE', -key 'KEYFILE'*::
Create a proxy certificate signed by the certificate located in
'CERTFILE' using the key located in 'KEYFILE'. If not specified the default
certificate and key will be used. This overrides the values of environment
variables described below.
*-certdir 'CERTDIR'*::
Search 'CERTDIR' for trusted certificates if verifying the proxy
certificate. If not specified, the default trusted certificate search path
is used. This overrides the value of the `X509_CERT_DIR`
environment variable.
*-out 'PROXYPATH'*::
Write the generated proxy certificate file to 'PROXYPATH' instead of the
default path of +/tmp/x509up_u'UID'+.
*-bits 'BITS'*::
When creating the proxy certificate, use a 'BITS' bit key instead of the
default 2048-bit keys.
*-policy 'POLICYFILE'*::
Add the certificate policy data described in 'POLICYFILE' as the
ProxyCertInfo X.509 extension to the generated proxy
certificate.
*-pl 'POLICY-OID', -policy-language 'POLICY-OID'*::
Set the policy language identifier of the policy data specified by the
'-policy' command-line option to the OID specified by the 'POLICY-OID'
string.
*-path-length 'MAXIMUM'*::
Set the maximum length of the chain of proxies that can be created by the
generated proxy to 'MAXIMUM'. If not set, the default of an unlimited proxy
chain length is used.
*-pwstdin*::
Read the private key's pass phrase from standard input instead of reading
input from the controlling tty. This is useful when scripting
*grid-proxy-init*.
*-limited*::
Create a limited proxy. Limited proxies are generally refused by
process-creating services, but may be used to authorize with other
services.
*-independent*::
Create an independent proxy. An independent proxy is not treated as an
impersonation proxy but as a separate identity for authorization
purposes.
*-draft*::
Create a IETF draft proxy instead of the default RFC 3280-compliant proxy.
This type of proxy uses a non-standard proxy policy identifier. This might
be useful for authenticating with older versions of the Globus
Toolkit.
*-old*::
Create a legacy proxy instead of the default RFC 3280-compliant proxy. This
type of proxy uses a non-standard method of indicating that the certificate
is a proxy and whether it is limited. This might be useful for
authenticating with older versions of the Globus
Toolkit.
*-rfc*::
Create an RFC 3820-compliant proxy certificate. This is the default for
this version of *grid-proxy-init*.
[[grid-proxy-init-EXAMPLES]]
EXAMPLES
--------
To create a proxy with the default lifetime and format, run the
*grid-proxy-init* program with no arguments. For example:
% grid-proxy-init
Your identity: /DC=org/DC=example/CN=Joe User
Enter GRID pass phrase for this identity: XXXXXXX
Creating proxy .................................. Done
Your proxy is valid until: Thu Mar 18 03:48:05 2010
To create a stronger proxy that lasts for only 8 hours, use the
'-hours' and '-bits' command-line options to *grid-proxy-init*. For example:
% grid-proxy-init -hours 8 -bits 4096
Your identity: /DC=org/DC=example/CN=Joe User
Enter GRID pass phrase for this identity: XXXXXXX
Creating proxy .................................. Done
Your proxy is valid until: Thu Mar 17 23:48:05 2010
[[grid-proxy-init-ENVIRONMENT]]
ENVIRONMENT
-----------
The following environment variables affect the execution of *grid-proxy-init*:
*X509_USER_CERT*::
Path to the certificate to use as issuer of the new proxy.
*X509_USER_KEY*::
Path to the key to use to sign the new proxy.
*X509_CERT_DIR*::
Path to the directory containing trusted certificates and signing
policies.
[[grid-proxy-init-FILES]]
FILES
-----
The following files affect the execution of *grid-proxy-init*:
*$HOME/.globus/usercert.pem*::
Default path to the certificate to use as issuer of the new
proxy.
*$HOME/.globus/userkey.pem*::
Default path to the key to use to sign the new proxy.
[[grid-proxy-init-SEEALSO]]
SEE ALSO
--------
grid-proxy-destroy(1), grid-proxy-info(1)
[[grid-proxy-init-AUTHOR]]
AUTHOR
------
Copyright (C) 1999-2014 University of Chicago
|
