Create a cell, say, backup.awesmoe.org. Use a separate database to translate bizare volume names into a particular backup set (say, ab.d92fgaf9a8as0 to backup of foo.bar.awesmoe.org on 23 July 2005 03:28 UTC). You can mount these volumes in a tree, say /afs/backup.awesmoe.org/bydate/2006/07/23/foo.bar.awesmoe.org-200607230328 or /afs/backup.awesmoe.org/byhost/foo.bar.awesmoe.org/2006/07/23/.... Set acls to use list so that machine admins can see files (prolly have to use hashed list names as well --- what is limit on pts list name length?
One issue with netbooting computers is that the standard processes --- get a network address, get a bootloader somehow, load a kernel, pull down an image --- are all pretty unauthenticated. You are trusting that the thing answering your dhcp query or the thing supplying you with an image is the thing you want to be talking to. For client machines this is bad enough, but what if you are wanting to deploy simple services?
So, this afternoon after purchasing an ipod nano (whee) I get a voice mail message on my cell phone. It's someone from Amtrak, telling me that the train I'm scheduled to leave on tomorrow, from Osceola to Chicago, is already 10 hours late. This would put me in Chicago (assuming it didn't lose any more time) a couple hours after the train to Buffalo leaves. So I chat with Lou a bit, basically planning to take the late train tomorrow, kick it at the Castle Juloulie, and take the remainder of my trains one day later.
I come from a midwestern background where goulash is macaroni, ground beef, tomato juice and paprika. It's good, but this stuff is better. Start with this recipe. I put much more paprika, cut the oregano and basil down a bit, made it one potato, one onion and one green pepper. Also, I cut up eight ounces of mushrooms, and added a large handful of what are called "soyatene", basically large chunks of defatted soy protein which unfortunately looks a lot like dog food, pre- soaked in some vegetable broth.
Yeah, I know "Stuffed Grape Leaves" and "Italian" are hardly thought of as complimentary ideas, but I need to go grocery shopping and this is what popped in my head when I got hungry for stuffed peppers, couscous and stuffed grape leaves. In a pot, put in some vegetable broth (I just used broth from the giant pot of vegetable soup I made earler this week) and a bit of butter.
This can lead to nothing but good.
Server: Put appropritate krb5.conf krb5.keytab in place. Make your account directory information appear on this machine (I use hesiod). Make some sort of home directory (I use afs and amd to do this) Set these options in /etc/ssh/sshd_config: KerberosAuthentication yes KerberosGetAFSToken yes GSSAPIAuthentication yes UsePam no Install heimdal from pkgsrc add the following to /etc/ssh/sshrc /usr/pkg/bin/afslog -c nameofyourlocalcell Log in with an appropriately smart ssh client where you have forwardable kerberos credentials.
Set PKG_OPTIONS.imap-uw+= ssl kerberos in /etc/mk.conf Build uw-imap Build pine Pine uses the c-client library from uw-imap, so if you build uw-imap with gssapi support, pine gets it too.
Server: Install recent openssh from pkgsrc, make sure kerberos option is set when building. Make sure your machine has the appropriate krb5.conf in /usr/pkg/etc (I symlink to /etc/krb5.conf) Make sure your machine has a host/machine.name@KERB.REALM keytab in /usr/pkg/etc/krb5.keytab (once again with the symlinking Set these options in /usr/pkg/etc/ssh/sshd_config: KerberosAuthentication yes KerberosGetAFSToken yes GSSAPIAuthentication yes Install heimdal from pkgsrc add the following to /usr/pkg/etc/ssh/sshrc /usr/pkg/bin/afslog Client: Install recent openssh from pkgsrc, make sure kerberos option is set when building.
This link seems to be the best documentation on using the SPECIFIG_PKGS flag in NetBSD pkgsrc. To use it, you have to generate something that looks like SITE_SPECIFIC_PKGS= mail/mutt-devel security/openssh, i.e., a list with PKGPATH for each package you wish to build. The next obvious question is "given a particular machine that has all the packages I want (from me adding packages one-by-one) how do I get a list of PKGPATH for each package?