The gateway software is provided for Member States' remote access to ECMWF computing and archiving facilities. Throughout the guide, the terms "gateway" and "ECaccess gateway" are used interchangeably. Gateways include a model for the management of "plugin" services. A plugin is a piece of code that handles requests/responses flowing through the gateway. Currently, there are plugins for incoming FTP, HTTP/S, X11, SSH and Telnet (MSgateways only) requests to ECMWF. Additional plugins are planned. On top of the SSH plugin the NX application can be used for interactive access to ECMWF. The ECMWF ECaccess gateway (hereafter referred to as "ECgateway") can be used on its own. Nevertheless, using a Member State ECaccess gateway (hereafter referred to "MSgateway") instead offers the following features and advantages over using the ECgateway on its own:
...
gateways uses two built-in security mechanisms to control access to ECMWF:
- Interactive authentication for SFTP/FTP: users will be prompted for their ECMWF user identifier and the PASSCODE (obtained by entering their PIN number into the security token or from their TOTP device).
- Batch authentication: users need to create an ECaccess certificate before they access ECMWF facilities. This method allows Member State users to automate authentication within scripts. The HTTP/S and SSH plugins support only the first method. The FTP plugin supports both.
The ECaccess certificate is a standard X509 digital certificate saved on the user's computer as a file. It identifies a user to the gateway. The ECaccess Certification Authority (ECCA) signs each certificate. Therefore, when a user provides his certificate to the gateway, its signature is checked using the ECCA public key for verification. A certificate can be created:
- Using the "ecaccess-certificate-create" command: this is described in Certificate management
- Using the Web interface: login to the Web server (providing an ECMWF user identifier and token PASSCODE) and in the menu click the "Get Certificate" option to download the new Certificate, see The Web server.
The ECaccess certificate is valid for 7 days for all services
...
.