The Project List   ProjectNorton/AfsOnNetBSD UserPreferences
 
HelpContents FindPage Diffs Info Edit Subscribe XML Print View Up
 The Project List   FrontPage   RecentChanges   TitleIndex   WordIndex   SiteNavigation   HelpContents   moin.sf.net 

Background

Use OpenAFS for the server side, and for the various afs commands: fs, vos, bos, etc. The OpenAFS client stuff (afsd), however, does not (currently) work, so use Arla for afsd and friends.

Caveats

While I use afs heavily at work, I do little of what you would consider administrative stuff. At best, I'm a talented amateur, at worse, several terabytes of data go wondering off into the aether. Some of the stuff here may seem goofy to seasoned AFS administrators. In particular, I've done no work on making the Arla and OpenAFS trees of installed programs be in some sane merged binary --- things are all off in completely separate trees here (no --with-transarc-paths here ....)

You have been warned....

Compiling OpenAFS

Download openafs-1.3.77 (later versions will probably work, but this is what I used). These are the compile options I used:

XXX Put explanations of config flags here.

Do the make and make install dance.

Compiling Arla

Download arla-0.38rc1 (again, later versions will probably work, but this is what I used). Here are the compile options I used:

XXX Put explanations of config flags here

Note: You will need to have the NetBSD system src wherever --with-sys points to.

Setting up server side

Essentially, you will be following the "Unix Quickstart Guide" available on the OpenAFS web site, with some changes: skip over the kaserver stuff, since you will be using the heimdal kdc to get kerberos tickets and various other things to munge those into AFS tokens.

ntp

I don't use AFS' built in ntp stuff, so I've set up my machines to all sync to a common time source. You will want to do this, or use the AFS ntp stuff, because kerberos requires times on machines to be within a certain range to work (typically 5 minutes). -- XXX actually startup afsd without ntp service

Kerberos Stuff

This assumes that you have the heimdal kdc (or some other kdc, your choice) up and running and get use it to create principals.

You will need to create two principals: one for the AFS server itself, and at least one for someone who will have administrative rights in AFS.

My kerberos realm is TPROA.NET. Replace accordingly.

Creating an administrative principal

You will need to pick at least one principal in kerberos to have administrative rights in AFS. Typically, you would use some instance of your normal principal, i.e. user/admin or user/afs. I'm using tkula/afs@TPROA.NET since I'm using tkula/admin@TPROA.NET for kerberos stuff only (and this is what we do at work). You can do as you like. Remember that AFS is still based on v4 kerberos, so to it, your instance will look like tkula.afs (i.e. replace the / with a . -- XXX Is this still true?).

Creating the AFS principal

Current best practice is to create an AFS kerberos principal with the form afs/<cell name>@TPROA.NET, i.e. afs/tproa.net@TPROA.NET for the cell tproa.net. This way you can have multiple cells use the same kerberos realm (i.e. you could create a afs/test.tproa.net@TPROA.NET for the cell test.tproa.net).

See [WWW]http://grand.central.org/twiki/bin/view/AFSLore?topic=KerberosAFSInstall for details:

No idea what the lifetimes should be, I'm just guessing here. Also note that I did not delete any of the keytypes --- it seems to work fine.

Convert the key:

Now, I had to make the file /usr/afs/etc/ThisCell contain my cell name. Someone else I know doesn't have to do this, so I suspect that some knob in krb5.conf configures this (or it looks for some other file location I have yet to find) but I am not sure which one.

Make the directory /usr/local/openafs/etc/openafs/server and drop /tmp/KeyFile there, chmod it to 700.

Creating the first server

Start the Basic OverSeer process (bos)

bos manages all other AFS processes. Start it:

The bosserver will background and start up some other process to actually run, so you will see something like:

but if you ps and look for the bosserver it will be running.

Set the cell name

The -localauth flag bypasses the normal bos authentication stuff, and says "just read from KeyFile and use it", so as long as you are logged in as root on that machine and can read KeyFile, you should be able to run commands.

Start the database server processes

This is where we skip making kaserver:

This creates the backup, protection and volume location servers on our first machine.

Skipping creating admin accounts

Here we skip the steps in the IBM Quick Start guide that creates the afs key, and admin entries, since we did that above and are not using the kaserver in AFS. You can verify that bos can list the keys, however:

Create pts entries for your administrative account

This is where you tell the pt server about your administrative account. The pts command, however, does not have a -localauth flag, and while you could use pt_util to munch the prdb file manually, I couldn't get pt_util to work, nor could I find any real explanation of what I shove to it. So, stop everything, kill bosserver, and restart it, temporarily, with -noauth:

Create the pts entries:

Note that I used tkula.afs, not tkula/afs

Shutdown everything again, and restart bos to have localauth:

Add administrative user to UserList

UserList is a list of pts entries allowed to run privileged bos and vos commands on a particular machine. To add your administrative user to the UserList, do:

Create the fileserver processes

Now we will create the fileserver processes. Before you do this, you should make sure that whatever /vicep partitions you will use are mounted --- if you mount them afterwards, you will have to restart the fileserver processes so they know about them.

XXX 

From Tracy: 

You need to install the LWP threaded versions of the fileserver
instead of the pthread version.  The fileserver.LWP version is
what you find in <openafs>/src/viced/fileserver, the pthread
version is from <openafs>/src/tviced/fileserver.

You have to do this because currently the pthread version of the fileserver doesn't quit properly, which makes bos kinda a pain to use to shutdown the fileserver.

The 'inappropriate access' thing is probably some directory permissions problems. XXX Look at these. 

Mon Dec 27 21:31:59 2004: unhappy with /usr/local/openafs/var/openafs which is a dir that should have at least rights 700, at most
 rights 770 , owned by root

Make sure the fileserver process can see your /vicep partitions:

Create root.afs volume

This is the top of the afs space, /afs itself.

Setting up the top level of /afs

Before we get to this step, set up the client stuff on the afs server, so you have regular tokens and whatnot.

Setting up the client side

Starting up arla automatically

Create the following script as /etc/rc.d/arlad (provided by [WWW]Tracy Di Marco White):

Make this executable. You will also need to modify the paths to point to the proper location. Since eventually I'll get around to putting everything in some sane location, I've left it as is.

Config arla to know about your afs server

Edit /usr/local/arla/etc/CellServDB to add your cell. You can just glom on the bit in the server's version to the end:

In fact, it is best to do this, since the format of this file is a bit particular

Edit /usr/local/arla/etc/ThisCell to make your cell the default cell.

Loading nnpfs module

Add the following to /etc/lkm.conf:

Adding the device file

mknod /dev/nnpfs0 c 165 0

Adding bits to /etc/rc.conf

Change:

in /etc/rc.conf, and add

in the same file.

Restart.

Start up bosserver

/usr/local/openafs/sbin/bosserver & 

Getting tokens

If your afs database servers (the ones listed in CellServDB) are also slave kdc (or a master one, for that matter), and you are running a heimdal kdc, you can get tokens directly by setting enable-kaserver in the [kdc] section of /etc/krb5.conf file. I think there is also a kaforwarder, which you run on your db servers to forward requests to your kdc -- XXX look for this

Once again, kinit looks in a particular spot to find ThisCell. I put mine in /usr/arla/etc/ThisCell.

XXX Really, find a krb5.conf configuration for this nonsense. Or merge the trees together so that stuff looks in sane places for stuff for both server and client.

Configure the top level of /afs

Add other stuff

Now you can add other stuff, see the AFS documentation on suggestions for that

Adding other cells

[WWW]http://www.openafs.org/pages/doc/QuickStartUnix/auqbg002.htm#ToC_91

Things to think about

Other useful bits



PythonPowered
Immutable page   [current page size 17675 bytes]   (last edited 2005-03-02 03:59:00 by ThomasKula)
FindPage by browsing, title search , text search or an index
Or try one of these actions: LikePages, LocalSiteMap, SpellCheck