myproxy-get-trustroots(1)

💖 myproxy-get-trustroots — the MyProxy manual, bestie edition 💖

okay so you're reading the myproxy-get-trustroots(1) page from the MyProxy manual set, and honestly? it's a good one. let's get into it ✨

🌸 NAME 🌸

myproxy-get-trustroots — go fetch those trustroots from a myproxy-server 🫶

🎀 SYNOPSIS 🎀

myproxy-get-trustroots [ options ]

🦋 DESCRIPTION 🦋

so basically, the myproxy-get-trustroots command goes and retrieves the trusted certificates from myproxy-server(8) and then stores them in whichever location applies, in this order of priority:

• wherever the X509_CERT_DIR environment variable points, if it's set 👑
• otherwise /etc/grid-security/certificates if you're running as root
• otherwise ~/.globus/certificates if you're running as non-root

and listen, if you want this running on a lil schedule to keep X509_CERT_DIR looking fresh, there's an example cron job provided for exactly that at $GLOBUS_LOCATION/share/myproxy/myproxy-get-trustroots.cron. no cap, it's right there. 💅

✨ OPTIONS ✨

• -b, --bootstrap — okay so here's the tea: unless you pass this option, if X509_CERT_DIR already exists and the CA that signed the myproxy-server(8) certificate is not trusted, myproxy-get-trustroots will straight up fail with an error. why? to protect you from man-in-the-middle attacks, bestie. 🚨 but if you do specify this option, it will accept the CA so you can bootstrap trust. use with intention, fr fr.
• -h, --help — shows you the command usage text and dips out. classic.
• -u, --usage — also shows the command usage text and exits. yes it's basically the same vibe as -h, they said what they said. 🙈
• -v, --verbose — turns on verbose debugging output to the terminal. for when you need to see everything. 🔍
• -V, --version — displays version info and exits. short and sweet.
• -s hostname[:port], --pshost hostname[:port] — tells it the hostname(s) of the myproxy-server(s). you can list multiple hostnames in a comma-separated list, and each hostname can optionally have a ':' and port number after it. this option is required if the MYPROXY_SERVER environment variable isn't defined. and if you do specify it, it overrides the MYPROXY_SERVER environment variable. also, if a port number is attached to a hostname, it overrides the -p option and the MYPROXY_SERVER_PORT environment variable — for that host specifically. periodt. 💅
• -p port, --psport port — sets the TCP port number of the myproxy-server(8). default: 7512. 📞
• -q, --quiet — only writes output messages on error. silence is golden, iconic behavior. 🤫

🌈 ENVIRONMENT 🌈

• GLOBUS_GSSAPI_NAME_COMPATIBILITY — by default this client does a reverse-DNS lookup to figure out the FQHN (Fully Qualified Host Name), then uses it to verify the server's identity by checking that FQHN against the CN in the server's certificate. if you set this variable to STRICT_RFC2818, the reverse-DNS lookup will NOT happen and the user-specified name gets used instead. heads up though: this setting gets ignored if MYPROXY_SERVER_DN (explained below, keep reading bestie) is set. ⚠️
• MYPROXY_SERVER — specifies the hostname(s) where the myproxy-server(8) is running. multiple hostnames can go in a comma separated list, each one optionally followed by a ':' and port number. this env var can be used instead of the -s option. 🫶
• MYPROXY_SERVER_PORT — specifies the port where the myproxy-server(8) is running. this env var can be used instead of the -p option. ✨
• MYPROXY_SERVER_DN — specifies the distinguished name (DN) of the myproxy-server(8). all MyProxy client programs authenticate the server's identity, and by default MyProxy servers run with host credentials, so the client programs expect the server to have a DN of "/CN=host/<fqhn>" or "/CN=myproxy/<fqhn>" or "/CN=<fqhn>" (where <fqhn> is the fully-qualified hostname of the server). if the server is running with some other DN, set this env var to tell the MyProxy clients to accept the alternative DN. also peep GLOBUS_GSSAPI_NAME_COMPATIBILITY above. 👀
• MYPROXY_TCP_PORT_RANGE — specifies a range of valid port numbers in the form "min,max" for the client side of the network connection to the server. by default the client binds to any available port. use this env var to restrict the ports to a range your firewall allows. if it's unset, MyProxy will follow the setting of the GLOBUS_TCP_PORT_RANGE environment variable. 🔥
• X509_USER_CERT — specifies a non-standard location for the certificate used for authentication to the myproxy-server(8). 💜
• X509_USER_KEY — specifies a non-standard location for the private key used for authentication to the myproxy-server(8). 🔑
• X509_USER_PROXY — specifies a non-standard location for the proxy credential used for authentication to the myproxy-server(8). 🧚
• X509_CERT_DIR — specifies a non-standard location for the CA certificates directory. 🎀

👑 AUTHORS 👑

the whole MyProxy author list lives over at http://grid.ncsa.illinois.edu/myproxy/about — go give them their flowers. 💐

💀 SEE ALSO 💀

myproxy-change-pass-phrase(1), myproxy-destroy(1), myproxy-info(1), myproxy-init(1), myproxy-logon(1), myproxy-retrieve(1), myproxy-server.config(5), myproxy-store(1), myproxy-admin-adduser(8), myproxy-admin-change-pass(8), myproxy-admin-load-credential(8), myproxy-admin-query(8), myproxy-server(8)

and that's the whole page, bestie 🫶 this was the myproxy-get-trustroots(1) manual page from MyProxy, dated 2009-12-1 — yes she's vintage, and she ate. 💅✨🌸