\documentclass[landscape]{slides}
%%\usepackage[usenames,dvipsnames]{color}
%%\pagecolor{MidnightBlue}
%%\color{white}
\usepackage[none]{hyphenat}
\sloppy
\raggedright


\begin{document}
\pdfpagewidth=11in
\pdfpageheight=8.5in
\renewcommand{\thefootnote}{\arabic{footnote}}

\begin{center}\Large{\bfseries{
	NetBSD, Kerberos \& AFS: \\
	From Zero to Distributed Filesystem in {\em N} Easy Steps
	}}
\end{center}
\begin{center}
	\large{
		Tracy Di Marco White \\
		Thomas L. Kula \\
		} 
	{\sc Iowa State University of Science and Technology} \\[1cm]
	AFS \& Kerberos Best Practices Workshop 2005 \\
	{\small {\tt http://kula.public.iastate.edu/talks/afs-bpw-2005/}} \\
	{\tiny Version 2006020700}

\end{center}

\begin{slide}
	\begin{center}\large{Overview}\end{center}

	\begin{itemize}
		\item Using NetBSD as client and server systems
		\item Using Heimdal as a KDC
		\item Using OpenAFS to provide AFS service
		\item Using Arla to provide AFS clients
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Why both OpenAFS and Arla?}\end{center}

        \begin{itemize}
                \item Arla provides a functioning AFS client for NetBSD systems,
		      but some of the functions of {\tt bos}, {\tt vos}, etc,
		      are not implemented, and the server {\tt milko} is really
		      only experimental.
		\item OpenAFS provides all the functions of {\tt bos}, {\tt vos},
		      etc. and all of the servers, but does not have a functioning
		      client for NetBSD.
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Why NetBSD\footnote{{\tt http://www.netbsd.org/Misc/features.html}}}\end{center}

        \begin{itemize}
                \item A small yet full-featured core operating system
		\item Emphasis on clean code and correct design
	\end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Why NetBSD}\end{center}
	
	\begin{itemize}
		\item 48 stable ports for the current release, in 17 CPU architectures,
		      from a single code tree available via snapshots or anonymous CVS
		      access
		      \footnote{{\tt http://www.netbsd.org/Ports/}} 
		\item Over 5400 third-party applications in the Packages Collection
		      \footnote{{\tt http://www.netbsd.org/Documentation/software/packages.html}}
        \end{itemize}
\end{slide}     

\begin{slide}
	\begin{center}\large{Why Heimdal?}\end{center}

	\begin{itemize}
		\item It is included in the NetBSD base install
		\item It is also included in the pkgsrc system
		\item Can also emulate enough of a kaserver to provide
			authentication to clients that require that
		\item Included {\tt ktutil} can convert between v5 keytabs and
			AFS KeyFiles
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Prepping NetBSD}\end{center}

        \begin{itemize}
                \item Install the NetBSD kernel source, needed during Arla compilation \\
	              {\tt http://www.netbsd.org/guide/en/chap-kernel.html}
		\item Install NetBSD pkgsrc, needed to create the OpenAFS package \\
		      {\tt http://www.netbsd.org/Documentation/pkgsrc/getting.html}
        \end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Prepping NetBSD}\end{center}

	\begin{itemize}
		\item As both Kerberos and AFS require close time synchronization between clients
	 	      and servers, you will want to configure NTP
		\item {\tt http://www.netbsd.org/guide/en/chap-misc.html}
		\item It is recommended that you set both {\tt ntpdate=YES} and 
			{\tt ntpd=YES} in {\tt /etc/rc.conf}, since if your date
			is way off, ntpd will give up and not sync it.
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}

        \begin{itemize}
                \item If you already have a KDC, you can use that, as long as you can
 		      add various principals to it and extract keys from it 
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
	
	\begin{quote}
		The entire authentication system depends on the trustability of the KDC(s), 
		so anyone who can compromise system security on a KDC system can 
		theoretically compromise the authentication of all users of systems 
		depending on the KDC. Again, no amount of cleverness in the design of 
		the Kerberos system can take the place of solid system administration 
		practices employed in managing the Kerberos KDC(s).
		\footnote{{\tt http://www.oit.duke.edu/$\ensuremath{\sim}$rob/kerberos/kerbasnds.html}}
	\end{quote}


\end{slide}     

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Set up DNS SRV Records\end{center}

        \begin{itemize}
                \item Doing this allows clients to talk to your KDC without having to have
		      a local krb5.conf file
		\item {\tt draft-ietf-krb-wg-krb-dns-locate}
		\item RFC 2782
	\end{itemize}
\end{slide}


\begin{slide}
	\begin{center}\large{Configuring Heimdal as your KDC}\end{center}
	\begin{center}Set up DNS SRV Records\end{center}
	\begin{quote}
		{\small {\tt \$ORIGIN example.com. \\ 
		     \_kerberos.\_udp	IN	SRV	0 0 88 kerberos-1.example.com. \\
		     \_kerberos.\_udp	IN	SRV	1 0 88 kerberos-2.example.com. \\
		     \_kerberos.\_tcp IN	SRV	0 0 88 kerberos-1.example.com.  \\
		     \_kerberos.\_tcp IN	SRV	1 0 88 kerberos-2.example.com.  \\
		     \_kpasswd.\_udp	IN	SRV	0 0 464 kerberos-1.example.com.  \\
		     \_kerberos-adm.\_tcp	IN	SRV	0 0 749 kerberos-1.example.com.  \\
		     \_kerberos IN TXT "EXAMPLE.COM" \\
		}}
	\end{quote}
\end{slide}    


\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Configuring {\tt /etc/krb5.conf}\end{center}

        \begin{itemize}
                \item NetBSD's default installed kerberos is disabled unless {\tt /etc/krb5.conf} exists
		\item If you do not have DNS SRV records you will have to configure {\tt /etc/krb5.conf}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Configuring {\tt /etc/krb5.conf}\end{center}

	{\tt {\small
	\begin{tabbing}
		\qquad \= \qquad \=  \\

		[libdefaults] \\
		\>default\_realm = EXAMPLE.COM \\
	
		[appdefaults] \\
		\>afs-use-524 = no \\
		\>afslog = yes \\
	
		[realms] \\
		\>EXAMPLE.COM = \{ \\
	 	\>\>kdc = kerberos-1.example.com \\
		\>\>kdc = kerberos-2.example.com \\
		\>\> admin\_server = kerberos-1.example.com \\
		\>\>kpasswd\_server = kerberos-1.example.com \\
		\>\} \\
		
	\end{tabbing}	
	}}


\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Create Master Key\end{center}

        \begin{itemize}
                \item Used to encrypt the keys in the database
		\item Do not have to remember this password, stashed in \\
		      {\tt /var/heimdal/m-key}
		\item {\tt kstash}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Initialize database\end{center}

	{\tt kadmin -l \\
	kadmin> init EXAMPLE.COM \\
	Realm max ticket life [unlimited]: \\
	Realm max renewable ticket life [unlimited]: \\
	}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Create KDC host principal\end{center}

	{\tt kadmin -l \\
	kadmin> add {--}random-key host/kerberos-1.example.com \\
	Realm max ticket life [unlimited]: \\	
	Realm max renewable ticket life [unlimited]: \\
	Attributes []: \\
	kadmin> ext\_keytab host/kerberos-1.example.com \\
	}

\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Add user principals\end{center}
	\begin{itemize}
		\item Add {\tt alice} (for normal use)
		\item Add {\tt alice/admin} (for Kerberos administrative tasks)
		\item Add {\tt alice/afs} (for AFS administrative tasks)
	\end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Configuring Heimdal as your KDC}\end{center}
	\begin{center}Add user principals\end{center}

	{\tt 
	kadmin -l \\
        kadmin> add alice \\
        Max ticket life [1 day]: \\
        Max renewable life [1 week]: \\
        Attributes []: \\
        Password: \\
        Verifying password - Password: \\
        }
	\begin{itemize}
		\item Also add {\tt alice/admin} and {\tt alice/afs}
	\end{itemize}
	
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Starting KDC at startup\end{center}

        \begin{itemize}
                \item To {\tt /etc/rc.conf} add the line {\tt kdc=YES}
		\item To immediately start kdc, run {\tt /etc/rc.d/kdc start}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Running kadmind and kpasswd\end{center}

        \begin{itemize}
                \item Edit {\tt /etc/inetd.conf} and uncomment the following lines \\
		{\small {\tt kerberos-adm stream tcp nowait root /usr/libexec/kadmind kadmind \\
		     kpasswdd dgram udp wait root /usr/libexec/kpasswdd kpasswdd }}
		\item Restart {\tt inetd: /etc/rc.d/inetd restart}
        \end{itemize}
\end{slide}


\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Setting administrative ACL\end{center}

        \begin{itemize}
                \item Edit {/var/heimdal/kadmind.acl} \\
		{\tt alice/admin@EXAMPLE.COM all}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
        \begin{center}Making keytabs for other machines\end{center}

        \begin{itemize}
                \item {\tt kadmin -p alice/admin \\
			   kadmin> add {--}random-key host/}{\it hostname.example.com} \\
		      {\tt kadmin> ext\_keytab -k /tmp/krb5.keytab-}{\it hostname }{\tt host/}{\it hostname.example.com}

		\item Copy {\tt /tmp/krb5.keytab-}{\it hostname } to {\tt /etc/krb5.keytab}
		      on remote machine
		\item Should be owned by {\tt root:wheel} and mode 700
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring Heimdal as your KDC}\end{center}
	\begin{center}Making afs principal and {\tt KeyFile}\end{center}

        \begin{itemize}
                \item {\tt kadmin -p alice/admin \\
			   kadmin> add {--}random-key afs/example.com \\
			   kadmin> ext\_keytab -k /tmp/afsv5key afs/example.com }
		\item Create the file {\tt /usr/afs/etc/ThisCell} and put in it one line: \\
			{\tt example.com}
		\item {\tt ktutil copy /tmp/afsv5key AFSKEYFILE:/tmp/KeyFile }
		\item This is used by all AFS servers to authenticate themselves
        \end{itemize}
\end{slide}	

\begin{slide}
        \begin{center}\large{Installing OpenAFS}\end{center}

        \begin{itemize}
                \item {\tt cd /usr/pkgsrc/net/openafs}
		\item {\tt make \&\& make package}
		\item You can copy the binary package in {\tt /usr/pkgsrc/packages/All}
		      to other machines and install by doing {\tt pkg\_add openafs},
		      as long as the destination machines have the same architecture
		      and OS version as the build machine
        \end{itemize}
\end{slide}


\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
	
        \begin{itemize}
                \item Install OpenAFS (lets pretend the machine is called afs-1.example.com)
		\item Copy {\tt KeyFile} created above to {\tt /usr/pkg/etc/openafs/server/KeyFile}
		\item Copy over {\tt /etc/krb5.conf} file
		\item Create and install a keytab containing {\tt host/afs-1.example.com} on this
 		      machine
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}

        \begin{itemize}
		\item Configure ntp and ntpdate and set them to start automatically on boot
		\item Make the file {\tt /usr/afs/etc/ThisCell} contain the line {\tt example.com}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
        \begin{center}Starting Basic OverSeer Server\end{center}

        \begin{itemize}
		\item The bosserver is the process that oversees all other AFS server processes
                \item {\tt /usr/pkg/sbin/bosserver -noauth}
		\item {\it Note:} this starts {\tt bosserver} with no authentication at all, 
		      which is necessary since the protection database doesn't know about 
		      anyone at all
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
        \begin{center}Setting cell name\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/bin/bos setcellname afs-1.example.com example.com -noauth}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
        \begin{center}Create database processes\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/bin/bos create afs-1.example.com buserver simple \\
			/usr/pkg/libexec/openafs/buserver -noauth}
		\item {\tt /usr/pkg/bin/bos create afs-1.example.com ptserver simple \\
			/usr/pkg/libexec/openafs/ptserver -noauth} 
		\item {\tt /usr/pkg/bin/bos create afs-1.example.com vlserver simple \\
			/usr/pkg/libexec/openafs/vlserver -noauth}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
        \begin{center}Create initial pts entries\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/bin/pts createuser -name alice -cell example.com 
			-id }{\it somenumber }{\tt -noauth}
		\item {\tt /usr/pkg/bin/pts createuser -name alice.afs -cell example.com 
			-id }{\it anothernumber }{\tt -noauth}
		\item You can leave out {\tt -id }{\it somenumber} and {\tt -id }{\it anothernumber}
			if you don't care what the user's pts id number is
		
        \end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Installing the initial AFS database server}\end{center}
	\begin{center}Adding afs principals to the {\tt system:administrators} list\end{center}

	\begin{itemize}
		\item {\tt /usr/pkg/bin/pts adduser alice.afs system:administrators \\
                        -cell example.com -noauth }
		\item {\it Note: } Even though you created the v5 principal {\tt alice/afs}
			and will be using only v5 kerberos tickets to get tokens, the afs
			side still knows this user as {\tt alice.afs}
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installng the initial AFS database server}\end{center}
        \begin{center}Create SUsers\end{center}

        \begin{itemize}
                \item Each AFS server has a list of users who can perform privileged operations on it
		\item {\tt /usr/pkg/bin/bos adduser afs-1.example.com alice.afs \\
			-cell example.com -noauth}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the inital AFS database server}\end{center}
        \begin{center}Restart bosserver with authentication\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/bin/bos shutdown afs-1.example.com -noauth}
		\item {\tt ps ax | grep bosserver}
		\item {\tt kill -HUP }{\it pid-of-bosserver}
		\item {\tt /usr/pkg/sbin/bosserver}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS database server}\end{center}
        \begin{center}Automatically starting bosserver\end{center}

	\begin{itemize}
		\item {\tt cp /usr/pkg/share/examples/rc.d/bosserver /etc/rc.d/bosserver}
		\item {\tt chmod 555 /etc/rc.d/bosserver}
		\item Add {\tt bosserver=YES} to {\tt /etc/rc.conf}
	\end{itemize}

\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}

        \begin{itemize}
                \item The initial file server can be on the same machine as the initial database server
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Preliminary Setup\end{center}

        \begin{itemize}
                \item For the sake of discussion, we are going to set up afs-2.example.com as 
			our first AFS file server
		\item If your first AFS file server is on your initial database server, you can
			skip all of the preliminary setup steps
        \end{itemize}
\end{slide}


\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Preliminary Setup\end{center}

	\begin{itemize}
                \item Install OpenAFS 
                \item Copy same {\tt KeyFile} used on afs-1 to \\
			{\tt /usr/pkg/etc/openafs/server/KeyFile}
                \item Copy over {\tt /etc/krb5.conf}
		\item Configure and set ntp and ntpdate to start automatically on boot
        \end{itemize}
\end{slide}	

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Preliminary Setup\end{center}

        \begin{itemize}
		\item Create and install a keytab containing {\tt host/afs-2.example.com} on this
                      machine
		\item Copy {\tt CellServDB} and {\tt ThisCell} from {\tt /usr/pkg/etc/openafs/server} on
			{\tt afs-1.example.com} to the same location on this machine
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Preliminary Setup\end{center}

        \begin{itemize}
		\item Make the file {\tt /usr/afs/etc/ThisCell} contain the line {\tt example.com}
		\item Configure bosserver to start automatically on boot, and start it 
        \end{itemize}
\end{slide}     



\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Create file server processes\end{center}

        \begin{itemize}
		\item You will need to have at least one partition to store afs files in. These
			partitions must be mounted at / and be called {\tt /vicepa} through
			{\tt /vicepzz} (although you can only have up to 255 partitions)
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Create file server processes\end{center}
	
	\begin{itemize}
		\item {\tt /usr/pkg/bin/bos create afs-2.example.com fs fs \\
			/usr/pkg/libexec/openafs/fileserver \\
			/usr/pkg/libexec/openafs/volserver \\
			/usr/pkg/libexec/openafs/salvager \\
			-cell example.com -localauth
			}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Create root.afs\end{center}

        \begin{itemize}
                \item The volume {\tt root.afs} represents what is in {\tt /afs}
		\item {\tt /usr/pkg/sbin/vos create afs-2.example.com /vicepa \\
			root.afs -localauth}		
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Create root.cell\end{center}

        \begin{itemize}
                \item The volume {\tt root.cell} represents what is in the top 
			level of your cell (i.e. {\tt /afs/example.com} in this
			example)
		\item {\tt /usr/pkg/sbin/vos create afs-2.example.com /vicepa \\
			root.cell -localauth}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla client}\end{center}

        \begin{itemize}
                \item Currently, the arla client in NetBSD pkgsrc is a little old
		\item And since the arla client is very dependent on which kernel
			you are running, you want to build it on each machine
			you have
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla client}\end{center}
        \begin{center}Compiling Arla\end{center}

        \begin{itemize}
                \item Download {\tt arla-0.39} from the Arla Project Homepage: \\
			{\tt http://www.stacken.kth.se/projekt/arla/}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla client}\end{center}
        \begin{center}Compiling Arla\end{center}

        \begin{itemize}
                \item {\tt ./configure {--}prefix=/usr/local \\
			{--}with-krb4-lib=/usr/lib \\
			{--}with-krb4-include=/usr/include/kerberosIV \\
			{--}with-krb5-lib=/usr/lib {--}with-krb5-include=/usr/include/krb5 \\
			{--}with-sys=/usr/src/sys }
		\item {make \&\& make install}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla Client}\end{center}
        \begin{center}Configuring Arla\end{center}

        \begin{itemize}
                \item Add the lines in your database server's CellServDB file into \\
			{\tt /usr/local/etc/CellServDB}
		\item Make {\tt /usr/local/etc/ThisCell} read {\tt example.com}
		\item Change items in {\tt /usr/local/etc/arla.conf} as you see fit
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla Client}\end{center}
        \begin{center}Configuring LKM\end{center}

        \begin{itemize}
                \item Arla uses a Loadable Kernel Module to provide the interface between
			the arla client and the kernel
		\item Add the following on one line to your {\tt /etc/lkm.conf}: \\
		{\tt /usr/local/bin/nnpfs\_mod.o - nnpfs\_mod \\
		/usr/local/sbin/nnpfs\_makedev /var/db/nnpfs\_sym \\
		BEFOREMOUNT}
        \end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Installing the Arla client}\end{center}

	{\tiny {\tt 
\#!/bin/sh \\
\#  \\
\# PROVIDE: arlad \\
\# REQUIRE: beforemountlkm \\

. /etc/rc.subr               \\                                                                                           
                                                                                                                        
name="arlad"  \\ 
rcvar=\$name \\ 
command="/usr/local/libexec/\${name}" \\
command\_args="-z /dev/nnpfs0" \\
start\_precmd="/usr/local/sbin/mount\_nnpfs /dev/nnpfs0 /afs" \\
stop\_postcmd="/sbin/umount /afs" \\
required\_files="/dev/nnpfs0" \\
required\_dirs="/afs"\\
                                                                                                   
load\_rc\_config \$name \\
run\_rc\_command "\$1" \\
	}}
	\begin{itemize}
		\item Install this
		 as {\tt /etc/rc.d/arlad}
		\item {\tt chmod 555 /etc/rc.d/arlad}
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the Arla Client}\end{center}
        \begin{center}Configuring LKM\end{center}

        \begin{itemize}
                \item In {\tt /etc/rc.conf} add the lines {\tt lkm=YES} and {\tt arlad=YES}
		\item If your {\tt /usr} directory is on a separate partition, add the
			following to {\tt /etc/rc.conf}: \\
			{\tt critical\_filesytems\_local="/var /usr"}
        \end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Installing the Arla client}\end{center}

	\begin{itemize}
		\item {\tt mknod /dev/nnpfs0 c 165 0}
		\item {\tt mkdir /afs}
		\item Restart
	\end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Configuring the top-level of AFS}\end{center}
	\begin{center}Set permissions for /afs\end{center}
	
	\begin{itemize}
		\item Get {\tt alice/afs} tickets/tokens ({\tt kinit alice/afs})	
		\item {\tt /usr/pkg/bin/fs setacl /afs system:administrators rlidwka}
		\item {\tt /usr/pkg/bin/fs setacl /afs system:anyuser rl}
	\end{itemize}
\end{slide}	

\begin{slide}
        \begin{center}\large{Configuring the top-level of AFS}\end{center}
        \begin{center}Create mountpoint for root.cell\end{center}

        \begin{itemize}
	      	\item {\tt /usr/pkg/bin/fs mkmount /afs/example.com root.cell}
                \item {\tt /usr/pkg/bin/fs setacl /afs/example.com system:administrators rlidwka}
		\item {\tt /usr/pkg/bin/fs setacl /afs/example.com system:anyuser rl}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring the top-level of AFS}\end{center}
        \begin{center}Create mountpoint for root.cell\end{center}

        \begin{itemize}
                \item You can create read-only copies of volumes in AFS, and replicate them
                        on different afs file servers
                \item By default, AFS will chose a read-only version of a volume, so if you need
                        to make changes to a replicated volume, you need some way of getting to
                        the read-write version of the volume
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Configuring the top-level of AFS}\end{center}
        \begin{center}Create mountpoints for root.cell\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/bin/fs mkmount /afs/.example.com root.cell -rw}
                \item Allows you to explicitly access the read-write version of
			replicated volumes by going through
                        {\tt /afs/.example.com}
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Replicating root.afs and root.cell\end{center}

        \begin{itemize}
                \item Adding a read-only copy of volumes on the server that contains the read-write
                        copy of the volume costs nothing
                \item If you add other file servers you will want to have read-only volumes replicated
                        on at least another machine
		\item In order to get to any volume, you need to be able to get to any volumes 
			above its mount-point 
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Installing the initial AFS file server}\end{center}
        \begin{center}Replicating root.afs and root.cell\end{center}

        \begin{itemize}
                \item {\tt /usr/pkg/sbin/vos addsite afs-2.example.com /vicepa root.cell}
                \item {\tt /usr/pkg/sbin/vos addsite afs-2.example.com /vicepa root.afs}
                \item {\tt /usr/pkg/sbin/vos release root.afs}
                \item {\tt /usr/pkg/sbin/vos release root.cell}
        \end{itemize}
\end{slide}

	
\begin{slide}
	\begin{center}\large{Other things}\end{center}
	\begin{center}Having ssh get afs tokens on login\end{center}
        
	\begin{itemize}
                \item While the OpenSSH that comes by default does not currently
			support this, the OpenSSH in pkgsrc does
		\item Installing that and then adding the following to your \\
			{\tt /usr/pkg/etc/ssh/sshd\_config} file will get you
			afs tokens on login: \\
			{\tt KerberosAuthentication yes \\
				KerberosGetAFSToken yes}
        \end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Other Considerations}\end{center}

	\begin{itemize}
		\item Adding a slave KDC
		\item Adding additional database or file servers
		\item Dealing with clients that expect to talk to a kaserver
	\end{itemize}
\end{slide}

\begin{slide}
	\begin{center}\large{Acknowledgements}\end{center}
	\begin{center}Thanks to:\end{center}
	\begin{itemize}
                \item The NetBSD, Heimdal, Arla and OpenAFS projects for producing
                        high-quality software
		\item Ty Sarna for presentation testing
	\end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Acknowledgements}\end{center}
        \begin{center}Thomas would like to thank\end{center}
	
	\begin{itemize}
		\item Stomping Grounds in Ames, IA, for providing free wireless access
			and high-quality caffeine
        \end{itemize}
\end{slide}

\begin{slide}
        \begin{center}\large{Acknowledgements}\end{center}
        \begin{center}Tracy would like to thank\end{center}

        \begin{itemize}
                \item Thomas for producing the giant PDF file
        \end{itemize}
\end{slide}

\begin{center}\Large{\bfseries{
        NetBSD, Kerberos \& AFS: \\
        From Zero to Distributed Filesystem in {\em N} Easy Steps
        }}
\end{center}
\begin{center}
        \large{
                Tracy Di Marco White \\
                Thomas L. Kula \\
                }
        {\sc Iowa State University of Science and Technology} \\[1cm]
        AFS \& Kerberos Best Practices Workshop 2005 \\
	{\small {\tt http://kula.public.iastate.edu/talks/afs-bpw-2005/}} \\

\end{center}

\end{document}
