---
name: "globus-gatekeeper"
section: "8"
platform: "linux"
package: "globus-gatekeeper"
version: "11.4-3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/globus-gatekeeper"
---

# globus-gatekeeper(8)

Authorize and execute a grid service on behalf of a user

## NAME

globus-gatekeeper - Authorize and execute a grid service on behalf of a user

## SYNOPSIS

**globus-gatekeeper** \[-help\]

**globus-gatekeeper** -conf *PARAMETER\_FILE* \[-test\] \[-d \| -debug\] \[-inetd \| -f\] \[-p *PORT* \| -port *PORT*\] \[-l *LOGFILE* \| -logfile *LOGFILE*\] \[-lf *LOG\_FACILITY*\] \[-acctfile *ACCTFILE*\] \[-e *LIBEXECDIR*\] \[-launch\_method { *fork\_and\_exit* \| *fork\_and\_wait* \| *dont\_fork* }\] \[-grid\_services *SERVICEDIR*\] \[-globusid *GLOBUSID*\] \[-gridmap *GRIDMAP*\] \[-x509\_cert\_dir *TRUSTED\_CERT\_DIR*\] \[-x509\_cert\_file *TRUSTED\_CERT\_FILE*\] \[-x509\_user\_cert *CERT\_PATH*\] \[-x509\_user\_key *KEY\_PATH*\] \[-x509\_user\_proxy *PROXY\_PATH*\] \[-k\] \[-globuskmap *KMAP*\] \[-pidfile *PIDFILE*\]

## DESCRIPTION

The **globus-gatekeeper** program is a meta-server similar to **inetd** or\*xinetd\* that starts other services after authenticating a TCP connection using GSSAPI and mapping the client’s credential to a local account.

The most common use for the **globus-gatekeeper** program is to start instances of the [**globus-job-manager**(8)](/globus-job-manager/8.md) service. A single **globus-gatekeeper** deployment can handle multiple different service configurations by having entries in the /etc/grid-services/ directory.

Typically, users interact with the **globus-gatekeeper** program via client applications such as [**globusrun**(1)](/globusrun/1.md), [**globus-job-submit**(1)](/globus-job-submit/1.md), or tools such as CoG jglobus or Condor-G.

The full set of command-line options to **globus-gatekeeper** consists of:

- **-help**

  Display a help message to standard error and exit

- **-conf** *PARAMETER\_FILE*

  Load configuration parameters from *PARAMETER\_FILE*. The parameters in that file are treated as additional command-line options.

- **-test**

  Parse the configuration file and print out the POSIX user id of the **globus-gatekeeper** process, service home directory, service execution directory, and X.509 subject name and then exits.

- **-d, -debug**

  Run the **globus-gatekeeper** process in the foreground.

- **-inetd**

  Flag to indicate that the **globus-gatekeeper** process was started via **inetd** or a similar super-server. If this flag is set and the **globus-gatekeeper** was not started via inetd, a warning will be printed in the gatekeeper log.

- **-f**

  Flag to indicate that the **globus-gatekeeper** process should run in the foreground. This flag has no effect when the **globus-gatekeeper** is started via inetd.

- **-p** *PORT***, -port** *PORT*

  Listen for connections on the TCP/IP port *PORT*. This option has no effect if the **globus-gatekeeper** is started via inetd or a similar service. If not specified and the gatekeeper is running as root, the default of 2119 is used. Otherwise, the gatekeeper defaults to an ephemeral port.

- **-home** *PATH*

  Sets the gatekeeper deployment directory to *PATH*. This is used to interpret relative paths for accounting files, libexecdir, certificate paths, and also to set the GLOBUS\_LOCATION environment variable in the service environment. If not specified, the gatekeeper looks for service executables in /usr/sbin, configuration in /etc, and writes logs and accounting files to /var/log.

- **-l** *LOGFILE***, -logfile** *LOGFILE*

  Write log entries to *LOGFILE*. If *LOGFILE* is equal to logoff or LOGOFF, then logging will be disabled, both to file and to syslog.

- **-lf** *LOG\_FACILITY*

  Open syslog using the *LOG\_FACILITY*. If not specified, LOG\_DAEMON will be used as the default when using syslog.

**\<option\>-acctfile** *ACCTFILE***\</option\>**

Set the path to write accounting records to *ACCTFILE*. If not set, records will be written to the log file.

- **-e** *LIBEXECDIR*

  Look for service executables in *LIBEXECDIR*. If not specified, the sbin subdirectory of the parameter to *-home* is used, or /usr/sbin if that is not set.

**-launch\_method fork\_and\_exit \| fork\_and\_wait \| dont\_fork**

Determine how to launch services. The method may be either fork\_and\_exit (the service runs completely independently of the gatekeeper, which exits after creating the new service process), fork\_and\_wait (the service is run in a separate process from the gatekeeper but the gatekeeper does not exit until the service terminates), or dont\_fork, where the gatekeeper process becomes the service process via the **exec**() system call.

- **-grid\_services** *SERVICEDIR*

  Look for service descriptions in *SERVICEDIR*.

- **-globusid** *GLOBUSID*

  Sets the GLOBUSID environment variable to *GLOBUSID*. This variable is used to construct the gatekeeper contact string if it can not be parsed from the service credential.

- **-gridmap** *GRIDMAP*

  Use the file at *GRIDMAP* to map GSSAPI names to POSIX user names.

- **-x509\_cert\_dir** *TRUSTED\_CERT\_DIR*

  Use the directory *TRUSTED\_CERT\_DIR* to locate trusted CA X.509 certificates. The gatekeeper sets the environment variable X509\_CERT\_DIR to this value.

- **-x509\_user\_cert** *CERT\_PATH*

  Read the service X.509 certificate from *CERT\_PATH*. The gatekeeper sets the X509\_USER\_CERT environment variable to this value.

- **-x509\_user\_key** *KEY\_PATH*

  Read the private key for the service from *KEY\_PATH*. The gatekeeper sets the X509\_USER\_KEY environment variable to this value.

- **-x509\_user\_proxy** *PROXY\_PATH*

  Read the X.509 proxy certificate from *PROXY\_PATH*. The gatekeeper sets the X509\_USER\_PROXY environment variable to this value.

- **-k**

  Use the \<command\>globus-k5\</command\> command to acquire Kerberos 5 credentials before starting the service.

- **-globuskmap** *KMAP*

  Use *KMAP* as the path to the Grid credential to kerberos initialization mapping file.

- **-pidfile** *PIDFILE*

  Write the process id of the **globus-gatekeeper** to the file named by *PIDFILE*.

## ENVIRONMENT

The following environment variables affect the execution of **globus-gatekeeper**:

**X509\_CERT\_DIR**

Directory containing X.509 trust anchors and signing policy files.

**X509\_USER\_PROXY**

Path to file containing an X.509 proxy.

**X509\_USER\_CERT**

Path to file containing an X.509 user certificate.

**X509\_USER\_KEY**

Path to file containing an X.509 user key.

**GLOBUS\_LOCATION**

Default path to gatekeeper service files.

## FILES

The following files affect the execution of **globus-gatekeeper**:

**/etc/grid-services/***SERVICENAME*

Service configuration for *SERVICENAME*.

**/etc/grid-security/grid-mapfile**

Default file mapping Grid identities to POSIX identities.

**/etc/globuskmap**

Default file mapping Grid identities to Kerberos 5 principals.

**/etc/globus-nologin**

File to disable the **globus-gatekeeper** program.

**/var/log/globus-gatekeeper.log**

Default gatekeeper log.

## SEE ALSO

[**globus-k5**(8)](/globus-k5/8.md), [**globusrun**(1)](/globusrun/1.md), [**globus-job-manager**(8)](/globus-job-manager/8.md)

## AUTHOR

Copyright © 1999-2016 University of Chicago