Hi all,

The tarball UI and WN were never distributed with the CAs. This was part of the configuration steps. Check:

https://twiki.cern.ch/twiki/bin/view/LCG/Site-info_configuration_variables#TAR_UI
https://twiki.cern.ch/twiki/bin/view/LCG/Site-info_configuration_variables#TAR_WN

If you let yaim configure the CAs for the tarball installations, be aware of the following known issue:

There is currently a known issue that the new EGI repository for the IGTF/EGI/wLCG trust anchors (http://repository.egi.eu/sw/production/cas/1/current) is not yet set as the default repository. Furthermore, it is not possible to specify the EGI repository by resetting CA_REPOSITORY. This issue is currently being worked on.

This is reported here:

http://glite.cern.ch/glite-UI/known_issues
http://glite.cern.ch/glite-WN/known_issues

We are working together with EGI and David Groep to fix this. Further updates should be followed on:

https://savannah.cern.ch/bugs/?78233
https://savannah.cern.ch/bugs/?78292

Regards,
Maria


> -----Original Message-----
> From: LHC Computer Grid - Rollout [mailto:[log in to unmask]]
> On Behalf Of Chris Curtis
> Sent: 17 February 2011 13:12
> To: [log in to unmask]
> Subject: Re: [LCG-ROLLOUT] lcg-CA package for TarBall WN
> 
> Brill - I'll try that then.
> 
> Chris
> 
> On Thu, 17 Feb 2011, Daniela Bauer wrote:
> 
> > Yes :-) [I just get mine from one of the CEs
> > (/etc/grid-security/certificates), copy them to a central location
> where
> > they get spread by magic and/or puppet to everywhere that can't do a
> yum
> > update. You need to remove/overwrite the old directory first though,
> > otherwise you accumulate out of date certs and the tests don't like
> this.]
> >
> > Daniela
> >
> > On 17 February 2011 11:26, Chris Curtis <[log in to unmask]>
> wrote:
> >>
> >> Hmmmm, ok.  What do I need to include for this to work?  Is it just
> the
> >> contents of
> >>
> >> $GLITE_INSTALLATION/etc/grid-security/certificates
> >>
> >> Cheers,
> >>
> >> Chris
> >>
> >> On Thu, 17 Feb 2011, Daniela Bauer wrote:
> >>
> >>> Hi Chris,
> >>>
> >>> I just copy the certificates directory from one of the updated
> nodes
> >>> across to wherever the X509_CERT_DIR for the WNs is - I've never
> done
> >>> anything else (I can't update the WN code as CMS can't handle it)
> and
> >>> it worked just fine this time around as well.
> >>>
> >>> Daniela
> >>>
> >>> On 17 February 2011 11:01, Chris Curtis <[log in to unmask]>
> wrote:
> >>>>
> >>>> Hi -
> >>>>
> >>>> We have successfully used the EGI Trust anchor repo to upgrade the
> > lcg-CA
> >>>> rpm installed on most of our nodes.
> >>>>
> >>>> Some of our worker nodes however are installed using the tarball
> >>>> releases.
> >>>> How can I make sure that these are also up to date?  We're failing
> > nagios
> >>>> tests, but I can't see any new release of the glite-WN_tarball
> packages.
> >>>>
> >>>> Cheers,
> >>>>
> >>>> Chris
> >>>>
> >>>>
> >>>> On Mon, 14 Feb 2011, Andreas Gellrich wrote:
> >>>>
> >>>>> Hi Thosrten,
> >>>>> We saw the same. Searching the internet showed that you might
> want to
> >>>>> use
> >>>>> another repro:
> >>>>>
> >>>>>  cat /etc/yum.repos.d/lcg-CA.repo
> >>>>> #[CA]
> >>>>> #name=CAs
> >>>>> #baseurl=http://linuxsoft.cern.ch/LCG-CAs/current
> >>>>>
> >>>>>
> >>>>> #gpgkey=
> > https://dist.eugridpma.info/distribution/igtf/current/GPG-KEY-
> EUGridPMA-RPM-3
> >>>>> http://glite.web.cern.ch/glite/glite_key_gd.asc
> >>>>> #gpgcheck=1
> >>>>> #enabled=1
> >>>>>
> >>>>> [EGI-trustanchors]
> >>>>> name=EGI-trustanchors
> >>>>> baseurl=http://repository.egi.eu/sw/production/cas/1/current/
> >>>>>
> >>>>>
> >>>>> gpgkey=
> > http://repository.egi.eu/sw/production/cas/1/GPG-KEY-EUGridPMA-RPM-3
> >>>>> gpgcheck=1
> >>>>> enabled=1
> >>>>>
> >>>>> Cheers
> >>>>> Andreas
> >>>>>
> >>>>> On Mon, 14 Feb 2011, Torsten Harenberg wrote:
> >>>>>
> >>>>>> Dear all,
> >>>>>>
> >>>>>> sorry, I think that has been asked here several times.
> >>>>>>
> >>>>>> The Nagios tests from our ROC throws the following warning since
> 4
> > days
> >>>>>> now:
> >>>>>>
> >>>>>> wn015: CA DIST WARNING - The official version is 1.38. Unable to
> get a
> >>>>>> list of obsolete CA packages. Obsolete CA list check will be
> skipped.
> >>>>>> Using
> >>>>>> BEGrid2008 to get CA distribution version. Old CA distribution
> version
> >>>>>> found
> >>>>>> (1.37), new version is 4 days old.
> >>>>>>
> >>>>>> But lcg-CA repo still contains 1.37. I know this is only a
> warning,
> > but
> >>>>>> if I remember correctly it will get CRITICAL after 7 days, so
> only 3
> >>>>>> days
> >>>>>> left...
> >>>>>>
> >>>>>> Has something changed in the way this is handled?
> >>>>>>
> >>>>>> Cheers,
> >>>>>>
> >>>>>>  Torsten
> >>>>>>
> >>>>>> --
> >>>>>>
> <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
> >>>>>> <>
> <>
> >>>>>> <> Dr. Torsten Harenberg     [log in to unmask]
> <>
> >>>>>> <> Bergische Universitaet
> <>
> >>>>>> <> FB C - Physik             Tel.: +49 (0)202 439-3521
> <>
> >>>>>> <> Gaussstr. 20              Fax : +49 (0)202 439-2811
> <>
> >>>>>> <> 42097 Wuppertal
> <>
> >>>>>> <>
> <>
> >>>>>> <><><><><><><>< Of course it runs NetBSD http://www.netbsd.org
> ><>
> >>>>>>
> >>>>>
> >>>>> ----
> >>>>>  Andreas Gellrich <[log in to unmask]>
> >>>>>  DESY IT / Grid Computing
> >>>>>  http://www.desy.de/~gellrich
> >>>>>
> >>>>
> >>>> --
> >>>> West 326
> >>>> Physics and Astronomy
> >>>> University of Birmingham
> >>>> Edgbaston
> >>>> Birmingham
> >>>> B15 2TT
> >>>>
> >>>> (Office) 0121 414 4700
> >>>> (Mobile) 0798 666 1959
> >>>>
> >>>
> >>>
> >>>
> >>>
> >>
> >> --
> >> West 326
> >> Physics and Astronomy
> >> University of Birmingham
> >> Edgbaston
> >> Birmingham
> >> B15 2TT
> >>
> >> (Office) 0121 414 4700
> >> (Mobile) 0798 666 1959
> >
> >
> >
> >
> 
> --
> West 326
> Physics and Astronomy
> University of Birmingham
> Edgbaston
> Birmingham
> B15 2TT
> 
> (Office) 0121 414 4700
> (Mobile) 0798 666 1959