From mike@bizittech.com Tue Oct 1 14:04:57 2002 From: mike@bizittech.com (Mike T) Date: Tue, 01 Oct 2002 06:04:57 -0700 Subject: [OpenAFS] fs: Input/output error Message-ID: <3D999D79.3020106@bizittech.com> hi I am a newbie to AFS . I installed the Redhat packages that were generated by rpm --rebuild openafs-1.2.7xxxx.src.rpm Following the instructions in the Quick Beginnings for Unix . I am trying to create a afs server only . -Do I have to setup the client on that server . -I am running Redhat 7.3 with XFS . When I run the /etc/init.d/afs no errors generated . How do I check that the volumes are mounted by the afs fs. When executing fs checkvolumes from / ..... fs: Input/output error . -/afs does exist , and 755 . /vicepa is mounted . [root@h2 /]# bos status h2.bizittech.com bos: a pioctl failed (getting tickets) bos: running unauthenticated Instance kaserver, currently running normally. Instance buserver, currently running normally. Instance ptserver, currently running normally. Instance vlserver, currently running normally. Instance fs, currently running normally. Auxiliary status is: file server running. Instance upserver, currently running normally. Maybe some one can point me to a Howto or a document that is a little more detailed . Any help appreciated . Thanks From mike@bizittech.com Tue Oct 1 14:11:07 2002 From: mike@bizittech.com (mike@bizittech.com) Date: Tue, 1 Oct 2002 06:11:07 -0700 Subject: [OpenAFS] fs: Input/output error . Message-ID: <001601c2694c$01bc16d0$01000001@ast> This is a multi-part message in MIME format. ------=_NextPart_000_0013_01C26911.54D9DE00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hi I am a newbie to AFS . I installed the Redhat packages that were = generated by=20 rpm --rebuild openafs-1.2.7xxxx.src.rpm Following the instructions in the Quick Beginnings for Unix , I am = trying to create a afs server only .=20 -Do I have to setup the client on the server . -I am running Redhat 7.3 with XFS . When I run the /etc/init.d/afs no = errors generated . How do I check that the volumes are mounted by the afs fs. When = executing=20 fs checkvolumes from / ..... fs: Input/output error . /afs does exist , and 755 . /vicepa is mounted .=20 [root@h2 /]# bos status h2.bizittech.com bos: a pioctl failed (getting tickets) bos: running unauthenticated Instance kaserver, currently running normally. Instance buserver, currently running normally. Instance ptserver, currently running normally. Instance vlserver, currently running normally. Instance fs, currently running normally. Auxiliary status is: file server running. Instance upserver, currently running normally. Maybe some one can point me to a Howto or a document that is a little more detailed . Any help appreciated . Thanks ------=_NextPart_000_0013_01C26911.54D9DE00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
 hi
I am a newbie to AFS . I installed the Redhat = packages that=20 were generated by
rpm --rebuild = openafs-1.2.7xxxx.src.rpm
Following the=20 instructions in the Quick Beginnings for Unix , I am trying to = create a afs=20 server only .
-Do I have to setup the client on the server .
-I = am=20 running Redhat 7.3 with XFS . When I run the /etc/init.d/afs no errors = generated=20 .
How do I check that the volumes are mounted by the afs fs. When = executing=20
fs checkvolumes  from /   .....  fs: Input/output = error=20 .
/afs  does exist , and  755  .  /vicepa =  is=20 mounted .

[root@h2=20 /]# bos status h2.bizittech.com
bos: a pioctl failed (getting=20 tickets)
bos: running unauthenticated
Instance kaserver, currently = running=20 normally.
Instance buserver, currently running normally.
Instance=20 ptserver, currently running normally.
Instance vlserver, currently = running=20 normally.
Instance fs, currently running = normally.
   =20 Auxiliary status is: file server running.
Instance upserver, = currently=20 running normally.


Maybe some one can point me to a Howto or a = document  that is a little
more detailed  .
Any help = appreciated=20 .
Thanks

------=_NextPart_000_0013_01C26911.54D9DE00-- From shadow@dementia.org Tue Oct 1 11:10:56 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 1 Oct 2002 06:10:56 -0400 (EDT) Subject: [OpenAFS] fs: Input/output error In-Reply-To: <3D999D79.3020106@bizittech.com> Message-ID: On Tue, 1 Oct 2002, Mike T wrote: > hi > I am a newbie to AFS . I installed the Redhat packages that were > generated by > rpm --rebuild openafs-1.2.7xxxx.src.rpm > Following the instructions in the Quick Beginnings for Unix . I am > trying to create a afs server only . > -Do I have to setup the client on that server . no, but... > -I am running Redhat 7.3 with XFS . When I run the /etc/init.d/afs no > errors generated . > How do I check that the volumes are mounted by the afs fs. When executing > fs checkvolumes from / ..... fs: Input/output error . this won't work if you're not running a client, and... > -/afs does exist , and 755 . /vicepa is mounted . you also need a root.afs volume which the client mounts at root.afs the quick start guide does tell you to do this, if you followed that From shadow@dementia.org Tue Oct 1 11:21:44 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 1 Oct 2002 06:21:44 -0400 (EDT) Subject: [OpenAFS] fs: Input/output error In-Reply-To: <3D99A0DD.7030808@bizittech.com> Message-ID: you should send to the list, rather than to me. On Tue, 1 Oct 2002, Mike T wrote: > hi > That is done > vos create machine name /vicepa root.afs -cell cellname -noauth well, > lsmod > [root@h2 /]# lsmod > Module Size Used by Tainted: PF > libafs-2.4.18-4SGI_XFS_1.1 446336 0 (unused) this tells me the client isn't running (since the used count is 0) no afsd is running. if it's the redhat rpm rc script, did you set AFS_CLIENT=yes in /etc/sysconfig/afs (i think; look at the script)? anyhow, it's now 6:20am, and i'm going to bed. From sdevine@msu.edu Tue Oct 1 14:45:34 2002 From: sdevine@msu.edu (Steve Devine) Date: 01 Oct 2002 09:45:34 -0400 Subject: [OpenAFS] Backup using Tape Library In-Reply-To: <200209231150.16555.barrows@ptolemy.arc.nasa.gov> References: <1032535101.13154.14.camel@jax.cl.msu.edu> <200209231150.16555.barrows@ptolemy.arc.nasa.gov> Message-ID: <1033479934.28518.99.camel@jax.cl.msu.edu> A reply to my own question so I can offer a summary. Ok here is what I did to use Library Pro on Solaris 8 (Thanks to Lester Barrows and FBO for the tip on mtx) download and install mtx from sourceforge. edit /kernel/drv/sgen.conf as such : device-type-config-list="changer"; uncomment every line like this one: name="sgen" class="scsi" ..... ; then boot -r give correct group permissions to /dev/changer or (/dev/scsi/changer ) so the backup user can read the changer device Set up tape coordinator as described in CFG_devine_name man page Here I spent some wasted time trying to set it up to use the changer device, rather than /dev/rmt/Xc. The only time I had to reference the changer was in the script called by CFG_device_name. I used the mtx next command to swap tapes as needed. There is much more it can do I am sure. The idea of bar codes is interesting. Thanks again to all who responded. /sd All > We currently backup our servers via Sun boxes with individual AIT tape > drives. I am converting one of our systems over to use a Overland Data > Library Pro. Has any one out there had any experience with these? I am > particularly interested in a script to mount and unmount tapes as > needed. I am going to try it with the sample script in the man page for > CFG_device_name but I expect there may be someone with a better idea. > Thanks in advance for the help. > > > Library Pro. Has any one out there had any experience with these? I am > > particularly interested in a script to mount and unmount tapes as > > needed. I am going to try it with the sample script in the man page for > > CFG_device_name but I expect there may be someone with a better idea. > > Thanks in advance for the help. > > Hi Steve, > > I haven't tried this particular library, however the mtx package at > http://mtx.sourceforge.net works great with an Exabyte EZ17 autoloader under > Linux ia32. They mention "at least Solaris 8" support on their page, and > claim to support large media libraries with multiple drives. A Solaris admin > here has used it successfully on (I believe) an Ultra 2. He's also using an > Exabyte EZ17, however it can't hurt to try. > > The useage is fairly simple and self-explanatory, commands such as "mtx next", > "mtx inventory" and "mtx load 4" do pretty much what you would expect. I > personally use a script which keeps track of the drive number instead of > next, but if that information isn't useful to you then the "mtx next" command > should suffice with the example scripts. > > One thing I've noticed with this software however, is that at least with the > EZ17 drives I need to do an "mt offline" before I unload the drive. This is > the case under both Solaris and Linux. > > -- > Regards, > > Lester Barrows > Asani Solutions, LLC > Code IC Systems Group > NASA Ames Research Center > > "Jura rapelcgvba vf bhgynjrq, bayl bhgynjf jvyy unir cevinpl." > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Steve Devine Core Systems Michigan State University From R.D.Schaffer@cern.ch Tue Oct 1 14:03:42 2002 From: R.D.Schaffer@cern.ch (RD Schaffer) Date: Tue, 1 Oct 2002 15:03:42 +0200 Subject: [OpenAFS] Problems installing OpenAFS 1.2.7 for MacOS X 10.1 Message-ID: <35CC4014-D53E-11D6-9D4D-0003939E01F6@cern.ch> Hi there, Yesterday I tried to install OpenAFS 1.2.7 for MacOS X 10.1 on a powerbook: G4, MacOS X 10.1.5. I have been working successfully with 1.2.6. The installation went all right up to the "installing" step where it just stopped. A colleague had similar problems, but could not even get the installer to begin. As well, reinstalling 1.2.6 was non-trivial. It seemed that I had to move the previously installed 1.2.6 out of the way. If you need more info, let me know. see you, RD Schaffer Email: R.D.Schaffer@cern.ch Address: LAL BAT 200 tel(Orsay): 33-1 64 46 8378 BP 34 tel(cern) : 41-22 76 71267 91898 ORSAY France From warlord@MIT.EDU Tue Oct 1 15:34:09 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 01 Oct 2002 10:34:09 -0400 Subject: [OpenAFS] Ubik init failed In-Reply-To: References: Message-ID: What _is_ in your hosts fine? What is your "hostname" (as per the command "hostname") Does you hostname resolve to a REAL IP address? Or does it resolve to 127.0.0.1? -derek "Muhsin Tawafig" writes: > hi > I am trying to setup openafs on rh7.3 . > ./bosserver -noauth $ buserver unable to start ... > > /usr/afs/bin/buserver: problems with host name Ubik init failed > > I scanned the mailling list found only a hosts file related problem . > Checked but didn't find > anything wrong with my hosts file . Any hint will be appreciated . > > Thanks > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From dawson@fnal.gov Tue Oct 1 15:41:45 2002 From: dawson@fnal.gov (Troy Dawson) Date: Tue, 01 Oct 2002 09:41:45 -0500 Subject: [OpenAFS] OpenAFS on RedHat 8.0 Message-ID: <3D99B429.2020005@fnal.gov> I feel like someone doing a firstpost. Has anyone been able to get the OpenAFS rpm's to compile and work on RedHat 8.0? I have tried both OpenAFS 1.2.6 and OpenAFS 1.2.7, using the RedHat 7.3 .src rpm's. After turning of the kerberos option in the spec file I was able to compile the rpm's, but for both of them, they wouldn't start and I got this same message in the /usr/vice/etc/modload/libafs.map ----- /usr/vice/etc/modload/libafs-2.4.18-14-i686.mp.o: unresolved symbol sys_call_table /usr/vice/etc/modload/libafs-2.4.18-14-i686.mp.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. ----- I have not yet tried compiling the source code directly from the source tar ball. That will be my next step. But I was wondering if there was something in the spec file that can be turned on or off to get this to compile correctly, or is it something in the kernel. Troy p.s. I left on the 'Hint' part for completeness. -- __________________________________________________ Troy Dawson dawson@fnal.gov (630)840-6468 Fermilab ComputingDivision/OSS CSI Group __________________________________________________ From schulz@iwrmm.math.uni-karlsruhe.de Tue Oct 1 16:02:30 2002 From: schulz@iwrmm.math.uni-karlsruhe.de (Martin Schulz) Date: 01 Oct 2002 17:02:30 +0200 Subject: [OpenAFS] reauth In-Reply-To: <200209301824.43668.rla9216@rit.edu> References: <200209301824.43668.rla9216@rit.edu> Message-ID: Renato Arruda writes: > I'm trying to get reauth to work so i can drop /var/spool/mail in afs... is > this sane or is there some consideration i did not take into account? (of Dont do that. Done that, been there. Consistency of the files is only guaranteed upon the closure of a file, thus opening a wide range of race conditions. The locking by sendmail seemed not to work on AFS. After some troubles, I ended up installing an imap server, serving out mails from local disk. The UW-imap is rather trivial to install; you can even use your krb5 tickets to avoid retyping your password if the mail client supports this (not all do so, some not out of the box). BTW I do have a reauth.pl perl script, but that is rather for the interactive start of long-running jobs. What you are probably looking for is the kinit -k option. Yours, -- Martin Schulz schulz@iwrmm.math.uni-karlsruhe.de Uni Karlsruhe, Institut f. wissenschaftliches Rechnen u. math. Modellbildung Engesser Str. 6, 76128 Karlsruhe From mike@bizittech.com Tue Oct 1 16:11:57 2002 From: mike@bizittech.com (mike@bizittech.com) Date: Tue, 1 Oct 2002 11:11:57 -0400 Subject: [OpenAFS] Configuring top level of the afs Filespace Message-ID: <001201c2695c$e31d2140$01000001@micron> This is a multi-part message in MIME format. ------=_NextPart_000_000F_01C2693B.5B668EB0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi I am trying to install following Quick Beginnings for UNIX on redhat 7.3 = system. A server only setup .=20 [root@rh73xfs root]# fs setacl /afs system:anyuser rl fs: Invalid argument; it is possible that /afs is not in AFS. bos status `hostname` bos: a pioctl failed (getting tickets) bos: running unauthenticated Instance kaserver, currently running normally. Instance buserver, currently running normally. Instance ptserver, currently running normally. Instance vlserver, currently running normally. Instance fs, currently running normally. Auxiliary status is: file server running. Instance upserver, currently running normally. lsmod Module Size Used by Tainted: PF libafs-2.4.18-4SGI_XFS_1.1-i686 444576 0 (unused) autofs 12164 0 (autoclean) (unused) 3c59x 28488 1 ext3 67104 1 (autoclean) jbd 49320 1 (autoclean) [ext3] usb-uhci 24452 0 (unused) usbcore 73184 1 [usb-uhci] /etc/sysconfig/afs =20 AFS_CLIENT=3Doff AFS_SERVER=3Don ------=_NextPart_000_000F_01C2693B.5B668EB0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi
I am trying to install following Quick = Beginnings=20 for UNIX on redhat 7.3 system.
A server only setup .
 
[root@rh73xfs root]# fs setacl /afs = system:anyuser=20 rl
fs: Invalid argument; it is possible that /afs is not in=20 AFS.
bos status `hostname`
bos: a pioctl = failed=20 (getting tickets)
bos: running unauthenticated
Instance kaserver,=20 currently running normally.
Instance buserver, currently running=20 normally.
Instance ptserver, currently running normally.
Instance=20 vlserver, currently running normally.
Instance fs, currently running=20 normally.
    Auxiliary status is: file server=20 running.
Instance upserver, currently running = normally.
 lsmod
Module       &= nbsp;         =20 Size  Used by    Tainted:=20 PF
libafs-2.4.18-4SGI_XFS_1.1-i686  444576   0 =20 (unused)
autofs         &= nbsp;      =20 12164   0  (autoclean)=20 (unused)
3c59x         &n= bsp;       =20 28488  =20 1
ext3          &nbs= p;       =20 67104   1 =20 (autoclean)
jbd         &= nbsp;         =20 49320   1  (autoclean)=20 [ext3]
usb-uhci         &= nbsp;    =20 24452   0 =20 (unused)
usbcore         =       =20 73184   1  [usb-uhci]
/etc/sysconfig/afs    =
 
AFS_CLIENT=3Doff
AFS_SERVER=3Don
------=_NextPart_000_000F_01C2693B.5B668EB0-- From cg2v@andrew.cmu.edu Tue Oct 1 16:30:05 2002 From: cg2v@andrew.cmu.edu (Chaskiel M Grundman) Date: Tue, 01 Oct 2002 11:30:05 -0400 Subject: [OpenAFS] OpenAFS on RedHat 8.0 In-Reply-To: <3D99B429.2020005@fnal.gov> References: <3D99B429.2020005@fnal.gov> Message-ID: <72570000.1033486205@endicott> --On Tuesday, October 01, 2002 09:41:45 -0500 Troy Dawson wrote: > /usr/vice/etc/modload/libafs-2.4.18-14-i686.mp.o: unresolved symbol > sys_call_table This is because some smart kernel developer decided that it is Evil for modules to manipulate (and in most cases use) the system call entry points, and decided to forbid it by removing the functionality. Various openafs-oriented people had been in touch with kernel developers to see if afs's needs could be met. I thought that something had been worked out...., but at first glance, I don't see a syscall registration function in any of the RH 8 kernel patches. In any case, I think I this can be hacked around in redhat kernels by using kallsyms_symbol_to_address, but it will take me a few days before I'll be able to get to it (having to install a machine and all). From Mitchell.D.Baker@rose-hulman.edu Tue Oct 1 17:03:22 2002 From: Mitchell.D.Baker@rose-hulman.edu (Mitchell D. Baker) Date: 01 Oct 2002 11:03:22 -0500 Subject: [OpenAFS] Return codes.. Message-ID: <1033488202.13868.20.camel@babylon5.rose-hulman.edu> Looking for what some of the return codes are that are being logged but the Fileserver process... Where in the source tree would I look or some documentation? Like SRXAFS_FetchData SAFS_FetchStatus Like we will get a returns 13 for FetchStatus.. just want to be able to look things up... Thanks all See-ya Mitch -- /####################################################################/ /# Mitchell "Buzz" Baker "To Infinity And Beyond..." #/ /# Sr. Systems/Security Admin Rose-Hulman Institute of Technology #/ /# Mitchell.D.Baker@rose-hulman.edu www.rose-hulman.edu #/ /# For PGP Public key, check out www.keyserver.net #/ /####################################################################/ From Todd_DeSantis@transarc.com Tue Oct 1 17:34:43 2002 From: Todd_DeSantis@transarc.com (Todd_DeSantis@transarc.com) Date: Tue, 1 Oct 2002 12:34:43 -0400 (EDT) Subject: [OpenAFS] Return codes.. In-Reply-To: <1033488202.13868.20.camel@babylon5.rose-hulman.edu> References: <1033488202.13868.20.camel@babylon5.rose-hulman.edu> Message-ID: <4xaQuXE99g1T5RKU1Q@transarc.com> Hi Buzz: > Looking for what some of the return codes are that are being logged > but the Fileserver process... Where in the source tree would I look > or some documentation? Like > SRXAFS_FetchData > SAFS_FetchStatus > Like we will get a returns 13 for FetchStatus.. just want to be able > to look things up... You can use the AFS command, trnaslate_et to translate the error text [viced] translate_et 13 13 ().13 = Permission denied And you can always search through the OS's /usr/include/sys/errno.h for errors with a lower number. The user trying to Fetch this file does not have permission to do so. Todd DeSantis AFS Support IBM Pittsburgh Lab From warlord@MIT.EDU Tue Oct 1 17:54:06 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 01 Oct 2002 12:54:06 -0400 Subject: [OpenAFS] Configuring top level of the afs Filespace In-Reply-To: <001201c2695c$e31d2140$01000001@micron> References: <001201c2695c$e31d2140$01000001@micron> Message-ID: writes: > Hi > I am trying to install following Quick Beginnings for UNIX on redhat 7.3 system. > A server only setup . > > [root@rh73xfs root]# fs setacl /afs system:anyuser rl > fs: Invalid argument; it is possible that /afs is not in AFS. [snip] > AFS_CLIENT=off > AFS_SERVER=on 'fs' is a client application, and you have the client turned off. Fix that and try again! -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From jgarman@wedgie.org Tue Oct 1 18:44:38 2002 From: jgarman@wedgie.org (Jason Garman) Date: Tue, 1 Oct 2002 13:44:38 -0400 Subject: [OpenAFS] Web-based file managers that play well with AFS...? Message-ID: <20021001134438.A35728@got.wedgie.org> Sigh... Does anyone know of a web-based "file manager" that works with AFS? Unfortunately I've been tasked with finding some solution and so didn't want to reinvent the wheel if someone else had already implemented a solution. Thanks -- Jason Garman / jgarman@wedgie.org From shadow@dementia.org Tue Oct 1 18:56:38 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 1 Oct 2002 13:56:38 -0400 (EDT) Subject: [OpenAFS] Return codes.. In-Reply-To: <1033488202.13868.20.camel@babylon5.rose-hulman.edu> Message-ID: On 1 Oct 2002, Mitchell D. Baker wrote: > Looking for what some of the return codes are that are being logged but > the Fileserver process... Where in the source tree would I look or some > documentation? Like > SRXAFS_FetchData > SAFS_FetchStatus > Todd's answer is probably what you want, but if you do care these functions are in src/viced. From shadow@dementia.org Tue Oct 1 19:00:59 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 1 Oct 2002 14:00:59 -0400 (EDT) Subject: [OpenAFS] OpenAFS on RedHat 8.0 In-Reply-To: <72570000.1033486205@endicott> Message-ID: On Tue, 1 Oct 2002, Chaskiel M Grundman wrote: > --On Tuesday, October 01, 2002 09:41:45 -0500 Troy Dawson > wrote: > > > /usr/vice/etc/modload/libafs-2.4.18-14-i686.mp.o: unresolved symbol > > sys_call_table > > This is because some smart kernel developer decided that it is Evil for > modules to manipulate (and in most cases use) the system call entry points, > and decided to forbid it by removing the functionality. Various Across a minor version (of the kernel) update, too. "Yay". From rtm@cert.org Tue Oct 1 19:35:44 2002 From: rtm@cert.org (Rudolph T Maceyko) Date: Tue, 01 Oct 2002 14:35:44 -0400 Subject: [OpenAFS] OpenAFS on RedHat 8.0 In-Reply-To: References: Message-ID: <229240000.1033497344@vorst.blue.cert.org> Actually... --On Tuesday, October 01, 2002 14:00:59 -0400 Derrick J Brashear wrote: >> This is because some smart kernel developer decided that it is Evil >> for modules to manipulate (and in most cases use) the system call >> entry points, and decided to forbid it by removing the >> functionality. Various > > Across a minor version (of the kernel) update, too. "Yay". To Red Hat's "credit", they did not introduce this change in the 2.4.18 kernels for Red Hat 7.3. It was only for Red Hat 8.0 (and its betas), which also uses 2.4.18 kernels that they stopped exporting sys_call_list. Another way to put it is that they made the change across "releases" of the kernel (in RPM speak), which you would normally think of as a much smaller interval than "versions"... Rudy From openafs-info@openafs.org Tue Oct 1 20:15:05 2002 From: openafs-info@openafs.org (Derek Atkins) Date: 01 Oct 2002 15:15:05 -0400 Subject: [OpenAFS] Configuring top level of the afs Filespace In-Reply-To: <001501c26977$690dec20$01000001@micron> References: <001201c2695c$e31d2140$01000001@micron> <001501c26977$690dec20$01000001@micron> Message-ID: hi, Please CC all your responses to openafs-info.. writes: > Hi > I am trying to setup server only . is That possible without using the client You need an AFS client in order to setup an AFS server. Once you have the server set up you can turn off the client (and use it from other machines). But you DO need access to _some_ AFS client in order to set volume/directory ACLS, make mount points, etc. -derek > thanks > ----- Original Message ----- > From: "Derek Atkins" > To: > Cc: > Sent: Tuesday, October 01, 2002 12:54 PM > Subject: Re: [OpenAFS] Configuring top level of the afs Filespace > > > > writes: > > > > > Hi > > > I am trying to install following Quick Beginnings for UNIX on redhat 7.3 > system. > > > A server only setup . > > > > > > [root@rh73xfs root]# fs setacl /afs system:anyuser rl > > > fs: Invalid argument; it is possible that /afs is not in AFS. > > [snip] > > > AFS_CLIENT=off > > > AFS_SERVER=on > > > > 'fs' is a client application, and you have the client turned off. > > > > Fix that and try again! > > > > -derek > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From abuechle@fhzh.ch Wed Oct 2 09:02:01 2002 From: abuechle@fhzh.ch (Andreas Buechler) Date: Wed, 2 Oct 2002 10:02:01 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 Message-ID: <15770.43001.206989.710003@hszpc38.isz.ch> Hello, I just installed openafs 1.2.7 on a alpha machine. Everything worked fine (rebuilding and installing the rpm's) and at the end I was told to change the files cacheinfo and ThisCell. I changed both files, now I am able to get tokens etc as root for any afs-user. To be able to login and get a token automatically I changed /etc/pam.d/system-auth as discribed at the end of the installation. Does anybody have an idea why I still cant login via ssh as an afs-user? I posted my sshd and system-auth pam-files at the end of this mail. Thanks for any help and sorry if this message was posted twice! Andi ##### sshd ##### #%PAM-1.0 auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so ##### end sshd ##### #### system-auth ##### #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth required /lib/security/pam_deny.so auth sufficient /lib/security/pam_afs.so try_first_pass ignore_root account required /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so retry=3 type= password sufficient /lib/security/pam_unix.so nullok use_authtok md5 shado w password required /lib/security/pam_deny.so session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so ##### end system-auth ##### -- From schulz@iwrmm.math.uni-karlsruhe.de Wed Oct 2 09:10:20 2002 From: schulz@iwrmm.math.uni-karlsruhe.de (Martin Schulz) Date: 02 Oct 2002 10:10:20 +0200 Subject: [OpenAFS] reauth In-Reply-To: References: <200209301824.43668.rla9216@rit.edu> Message-ID: Well. I hate personal mail as response to the mailing list.. thought I had put it to the list.. so here it goes again: Lee Damon writes: > > > >BTW I do have a reauth.pl perl script, but that is rather for the > >interactive start of long-running jobs. > > I'd be interested in seeing this, if you're willing to share. This perl script is nothing really great. Well, I just added the following to my afs-krb5 document: (tough this is not yet online due to some Webserver-rsync issue at the moment) ------------------------------------------------------------------ How do I start a long-running job? AFS tokens are limited to a 8 hours lifetime by default, this is a problem for long running jobs. Suppose a user want to run a job over night on his workstation. He/She can use the little perl script reauth.pl to make sure the program has valid tokens all the time. The basic function is as follows: The script asks for the users password, goes into background and then obtains new tickets and tokens on a regularly basis. This is done by the use of kinit and aklog. A more thourough description is found in the comments. ------------------------------------------------------------------ You will find reauth.pl under http://www.mathematik.uni-karlsruhe.de/~iwrmm/Persons/Schulz/Unix/afs/reauth.pl Sorry for the incorrect mime type (webserver misconfig). To read it, use "view Source". Comments are welcome. Yours, -- Martin Schulz schulz@iwrmm.math.uni-karlsruhe.de Uni Karlsruhe, Institut f. wissenschaftliches Rechnen u. math. Modellbildung Engesser Str. 6, 76128 Karlsruhe From security@xauth.net Wed Oct 2 09:51:14 2002 From: security@xauth.net (Charles Clancy) Date: Wed, 2 Oct 2002 03:51:14 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <15770.43001.206989.710003@hszpc38.isz.ch> Message-ID: > Does anybody have an idea why I still cant login via ssh as an afs-user? > I posted my sshd and system-auth pam-files at the end of this mail. Your configuration: > auth required /lib/security/pam_env.so > auth sufficient /lib/security/pam_unix.so likeauth nullok > auth required /lib/security/pam_deny.so > auth sufficient /lib/security/pam_afs.so try_first_pass > ignore_root Once it gets down to pam_deny.so, your login has failed. It never tries pam_afs.so. Try the following: auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_afs.so try_first_pass ignore_root auth required /lib/security/pam_unix.so likeauth nullok auth required /lib/security/pam_deny.so [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From rsc@semantics.ch Wed Oct 2 10:00:20 2002 From: rsc@semantics.ch (Reto Schneider) Date: Wed, 2 Oct 2002 11:00:20 +0200 (MEST) Subject: [OpenAFS] multiple network interfaces in AFS Message-ID: <37544.194.196.100.18.1033549220.squirrel@www.semantics.ch> Hi does anybody know, how i can prevent an network interface beeing used by AFS ? I have a public and a private network interface - only the public interface is reachable by the clients. In DFS, there was the RPC_UNSUPPORTED_NETIFS environment variable. Is there anything similar in AFS ? Thanks Reto -- __________________________ Reto Schneider Partner Semantics AG Toggenburgerstrasse 156 9500 Wil Tel. +41 71 929 46 04 Fax. +41 71 929 46 01 http://www.semantics.ch From Derrick J Brashear Wed Oct 2 10:06:39 2002 From: Derrick J Brashear (Derrick J Brashear) Date: Wed, 2 Oct 2002 05:06:39 -0400 (EDT) Subject: [OpenAFS] multiple network interfaces in AFS In-Reply-To: <37544.194.196.100.18.1033549220.squirrel@www.semantics.ch> Message-ID: On Wed, 2 Oct 2002, Reto Schneider wrote: > Hi > > does anybody know, how i can prevent an network interface > beeing used by AFS ? I have a public and a private network > interface - only the public interface is reachable by the clients. > In DFS, there was the RPC_UNSUPPORTED_NETIFS environment variable. > Is there anything similar in AFS ? /usr/vice/etc/NetInfo and/or /usr/vice/etc/NetRestrict can be used for this. Quoting from documentation: If the NetInfo file exists when the Cache Manager initializes, the Cache Managers uses its contents as the basis for a list of the machine's interfaces. If the file does not exist, the Cache Manager instead uses the network interfaces configured with the operating system. If the NetRestrict file exists, the Cache Manager removes any addresses included in it from the list it is compiling. It records the completed list in kernel memory. From abuechle@fhzh.ch Wed Oct 2 10:46:20 2002 From: abuechle@fhzh.ch (Andreas Buechler) Date: Wed, 2 Oct 2002 11:46:20 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: References: <15770.43001.206989.710003@hszpc38.isz.ch> Message-ID: <15770.49260.4762.561962@hszpc38.isz.ch> After modifing /etc/pam.d/system-auth as you proposed I still have troubles login in. In the /var/log/messages I get following entries afterwards: Oct 2 11:29:43 burner pam_afs[5701]: AFS Authentication failed for user testuser. password was incorrect Oct 2 11:29:43 burner pam_afs[5702]: AFS Authentication failed for user testuser. password was incorrect Oct 2 11:29:49 burner pam_afs[5703]: AFS Authentication failed for user testuser. password was incorrect Oct 2 11:29:49 burner pam_afs[5704]: AFS Authentication failed for user testuser. password was incorrect Oct 2 11:29:52 burner sshd(pam_unix)[5699]: 2 more authentication failures; logname= uid=0 euid=0 tty=NODEVssh user=testuser I don't understand this because I am sure that I didn't misstype the password (tried it several times...). Is there a way to find out that this is really a pam related problem? Andi -- From jarausch@igpm.rwth-aachen.de Wed Oct 2 12:38:28 2002 From: jarausch@igpm.rwth-aachen.de (jarausch@igpm.rwth-aachen.de) Date: Wed, 2 Oct 2002 13:38:28 +0200 Subject: [OpenAFS] client without a server Message-ID: <200210021138.NAA92206@numa1.igpm.rwth-aachen.de> Hi, I would like to have the possibility to run a client even if the afs server is not available. Currently I get (lots of) messages Lost contact of volume location server ... and even worse, I cannot login (as non-root) here is (the relevant part of) my file /etc/pam.conf # The PAM configuration file for the `login' service # login auth requisite pam_securetty.so login auth required pam_unix.so login auth sufficient pam_afs.so debug try_first_pass ignore_root login auth optional pam_group.so login account requisite pam_time.so login account required pam_unix.so login password required pam_cracklib.so retry=3 login password required pam_unix.so shadow md5 use_authtok login session required pam_unix.so Any help is very much appreciated, Helmut Jarausch Lehrstuhl fuer Numerische Mathematik Institute of Technology, RWTH Aachen D 52056 Aachen, Germany From kerberos@northsailor.de Wed Oct 2 13:18:56 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Wed, 2 Oct 2002 14:18:56 +0200 Subject: [OpenAFS] scripts for automatic installation + client cache questions Message-ID: <003a01c26a0d$e1dd6fe0$2b03a8c0@mummert.priv> Hello, i am currently trying to write scripts for an automatic setup for openafs-file-servers and dbms-servers. Therefor i use the bos exec command quite a lot. But when adding a new server, i have to restart all servers. So i want a "bos exec host "/etc/init.d/afs restart" But it ends up with a communication failure. Does someone have an idea for a workaround for this? Then i have got another question: what are the advances for an own partition for the client on /usr/vice/cache? Currently, i do not have a seperate partition for it and it works good. Thanks for your answers Klaas From excds@kth.se Wed Oct 2 13:23:47 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 02 Oct 2002 14:23:47 +0200 Subject: [OpenAFS] Unnamed groups? Message-ID: <1033561427.575.30.camel@hybris> I've got openafs and Kerberos up and running. But something puzzles me: The users I've created are members of the groups cdrom,audio,floppy but when I'm logged in as one of the users and issue the command "groups" I get two extra gid's without groupnames. Is this something afs/Kerberos-related? /Daniel btw, I found an afs-wikiwikiweb before but I seem to have lost the URL. Anyone who knows where it is? From kerberos@northsailor.de Wed Oct 2 13:31:32 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Wed, 2 Oct 2002 14:31:32 +0200 Subject: Fw: [OpenAFS] client without a server Message-ID: <006001c26a0f$a42d96a0$2b03a8c0@mummert.priv> Hello (or Hallo ;-) ) Helmut, you can start the afs-client without an afs-server as far as i can see it. But feel free to correct my. You just cannot use any functions of the afs-client. The pam-afs Modul you are using uses these functions . So you should change your /etc/pam.d/login like this: login auth requisite pam_securetty.so login auth sufficient pam_unix.so login auth required pam_afs.so debug try_first_pass ignore_root login auth optional pam_group.so login account requisite pam_time.so login account required pam_unix.so login password required pam_cracklib.so retry=3 login password required pam_unix.so shadow md5 use_authtok login session required pam_unix.so So the login-session will be terminatet, if the pam_unix is sufficient. To make this usefull, users should have a different password in afs then on the unix-box (otherwise it won't get to pam_afs.so). Klaas ----- Original Message ----- > From: > To: > Sent: Wednesday, October 02, 2002 1:38 PM > Subject: [OpenAFS] client without a server > > > > Hi, > > > > I would like to have the possibility to run a client even if the > > afs server is not available. > > Currently I get (lots of) messages > > Lost contact of volume location server ... > > > > and even worse, I cannot login (as non-root) > > > > here is (the relevant part of) my file /etc/pam.conf > > > > # The PAM configuration file for the `login' service > > # > > login auth requisite pam_securetty.so > > login auth required pam_unix.so > > login auth sufficient pam_afs.so debug try_first_pass ignore_root > > login auth optional pam_group.so > > login account requisite pam_time.so > > login account required pam_unix.so > > login password required pam_cracklib.so retry=3 > > login password required pam_unix.so shadow md5 use_authtok > > login session required pam_unix.so > > > > Any help is very much appreciated, > > > > Helmut Jarausch > > > > Lehrstuhl fuer Numerische Mathematik > > Institute of Technology, RWTH Aachen > > D 52056 Aachen, Germany > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > From warlord@MIT.EDU Wed Oct 2 14:17:44 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 09:17:44 -0400 Subject: [OpenAFS] scripts for automatic installation + client cache questions In-Reply-To: <003a01c26a0d$e1dd6fe0$2b03a8c0@mummert.priv> References: <003a01c26a0d$e1dd6fe0$2b03a8c0@mummert.priv> Message-ID: "Klaas Hagemann" writes: > Hello, > > i am currently trying to write scripts for an automatic setup for > openafs-file-servers and dbms-servers. > Therefor i use the bos exec command quite a lot. > But when adding a new server, i have to restart all servers. > So i want a "bos exec host "/etc/init.d/afs restart" > But it ends up with a communication failure. Does someone have an idea for a > workaround for this? No, because the bosserver get's killed before the command completes. Is there any particular reason you don't use "bos restart -all -bosserver"? > Then i have got another question: > what are the advances for an own partition for the client on > /usr/vice/cache? > Currently, i do not have a seperate partition for it and it works good. Basically, if your cache partition fills, AFS is screwed. The benefit of having your own AFS cache partition is that if only AFS uses the partition you are guaranteed that it will never fill to capacity. If you share the cache partition, then you have to always worry about how much space is left, because AFS will crash ungracefully in the face of a full cache (or worse, it could destroy data). > Thanks for your answers > Klaas -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Wed Oct 2 14:18:37 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 09:18:37 -0400 Subject: [OpenAFS] Unnamed groups? In-Reply-To: <1033561427.575.30.camel@hybris> References: <1033561427.575.30.camel@hybris> Message-ID: Daniel Sw=E4rd writes: > I've got openafs and Kerberos up and running. But something puzzles me: > The users I've created are members of the groups cdrom,audio,floppy but > when I'm logged in as one of the users and issue the command "groups" I > get two extra gid's without groupnames. >=20 > Is this something afs/Kerberos-related? Yes. This is the PAG. > /Daniel >=20 > btw, I found an afs-wikiwikiweb before but I seem to have lost the URL. > Anyone who knows where it is? It's off www.openafs.org. -derek --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From excds@kth.se Wed Oct 2 14:56:35 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 02 Oct 2002 15:56:35 +0200 Subject: [OpenAFS] Unnamed groups? In-Reply-To: References: <1033561427.575.30.camel@hybris> Message-ID: <1033566995.575.48.camel@hybris> > > Is this something afs/Kerberos-related? > > Yes. This is the PAG. Shouldn't that resolve to a name? That is, exist in /etc/group or something similar? > > btw, I found an afs-wikiwikiweb before but I seem to have lost the URL. > > Anyone who knows where it is? > > It's off www.openafs.org. Thanks. /Daniel From excds@kth.se Wed Oct 2 14:59:33 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 02 Oct 2002 15:59:33 +0200 Subject: [OpenAFS] Unnamed groups? In-Reply-To: References: <1033561427.575.30.camel@hybris> Message-ID: <1033567173.571.50.camel@hybris> Don't mind my previous post... I just RTFM:ed a little bit more now... ;-)) /Daniel From abuechle@hszpc30.isz.ch Tue Oct 1 15:34:59 2002 From: abuechle@hszpc30.isz.ch (Andreas Buechler) Date: Tue, 1 Oct 2002 16:34:59 +0200 (CEST) Subject: [OpenAFS] openafs 1.2.7 for RH 7.2 Message-ID: Hello, I just installed openafs 1.2.7 on a alpha machine. Everything worked fine (rebuilding and installing the rpm's) and at the end I was told to change the files cacheinfo and ThisCell. I changed both files, now I am able to get tokens etc as root for any afs-user. To be able to login and get a token automatically I changed /etc/pam.d/system-auth as discribed at the end of the installation. Does anybody have an idea why I still can't login via ssh as an afs-user? I posted my sshd and system-auth pam-files at the end of this mail. Thanks for any help! Andi #### system-auth #### #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth required /lib/security/pam_deny.so auth sufficient /lib/security/pam_afs.so try_first_pass ignore_root account required /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so retry=3 type= password sufficient /lib/security/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/pam_deny.so session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so #### end system-auth #### #### sshd #### #%PAM-1.0 auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so #### end sshd #### From mcintyre@ucsc.edu Tue Oct 1 19:21:48 2002 From: mcintyre@ucsc.edu (Charles McIntyre) Date: Tue, 01 Oct 2002 11:21:48 -0700 Subject: [OpenAFS] file server preferences disappearing intermittently Message-ID: <5.1.0.14.2.20021001111741.032ef338@cats-po-1.ucsc.edu> Has anyone seen this? I'm using OpenAFS 1.2.2b for Windows on a W2K=20 workstation. Intermittently, I won't be able to get tokens. The error=20 says that the afsd service cannot be contacted. I check the Preferences in= =20 the AFS Client Configuration control panel and there aren't any file server= =20 or volume locator servers specified. If I restart the service or restart=20 the computer, they reappear. I'm also wondering if there's a way to=20 restart the service as a non-administrator. Thanks! Charles =BA=B0`=B0=BA=A4=F8=A4=BA=B0`=B0=BA=A4=F8=F8=A4=BA=B0`=B0=BA=A4=F8=A4=BA=B0`= =B0=BA=A4=F8=F8=A4=BA=B0`=B0=BA=A4 Charles McIntyre PC/UNIX Support Engineer Instructional Computing, UCSC ph: 831/459-5746 got a question? see http://ic.ucsc.edu/help From klaas@northsailor.de Wed Oct 2 13:29:51 2002 From: klaas@northsailor.de (klaas hagemann) Date: Wed, 2 Oct 2002 14:29:51 +0200 Subject: [OpenAFS] client without a server References: <200210021138.NAA92206@numa1.igpm.rwth-aachen.de> Message-ID: <005101c26a0f$68a82960$2b03a8c0@mummert.priv> Hello (or Hallo ;-) ) Helmut, you can start the afs-client without an afs-server as far as i can see it. But feel free to correct my. You just cannot use any functions of the afs-client. The pam-afs Modul you are using uses these functions . So you should change your /etc/pam.d/login like this: login auth requisite pam_securetty.so login auth sufficient pam_unix.so login auth required pam_afs.so debug try_first_pass ignore_root login auth optional pam_group.so login account requisite pam_time.so login account required pam_unix.so login password required pam_cracklib.so retry=3 login password required pam_unix.so shadow md5 use_authtok login session required pam_unix.so So the login-session will be terminatet, if the pam_unix is sufficient. To make this usefull, users should have a different password in afs then on the unix-box (otherwise it won't get to pam_afs.so). Klaas ----- Original Message ----- From: To: Sent: Wednesday, October 02, 2002 1:38 PM Subject: [OpenAFS] client without a server > Hi, > > I would like to have the possibility to run a client even if the > afs server is not available. > Currently I get (lots of) messages > Lost contact of volume location server ... > > and even worse, I cannot login (as non-root) > > here is (the relevant part of) my file /etc/pam.conf > > # The PAM configuration file for the `login' service > # > login auth requisite pam_securetty.so > login auth required pam_unix.so > login auth sufficient pam_afs.so debug try_first_pass ignore_root > login auth optional pam_group.so > login account requisite pam_time.so > login account required pam_unix.so > login password required pam_cracklib.so retry=3 > login password required pam_unix.so shadow md5 use_authtok > login session required pam_unix.so > > Any help is very much appreciated, > > Helmut Jarausch > > Lehrstuhl fuer Numerische Mathematik > Institute of Technology, RWTH Aachen > D 52056 Aachen, Germany > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From ian@assv.net Wed Oct 2 15:31:46 2002 From: ian@assv.net (Ian Delahorne) Date: 02 Oct 2002 16:31:46 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <15770.49260.4762.561962@hszpc38.isz.ch> References: <15770.43001.206989.710003@hszpc38.isz.ch> <15770.49260.4762.561962@hszpc38.isz.ch> Message-ID: Andreas Buechler writes: > After modifing /etc/pam.d/system-auth as you proposed I still have > troubles login in. In the /var/log/messages I get following entries > afterwards: > > Oct 2 11:29:43 burner pam_afs[5701]: AFS Authentication failed for user testuser. password was incorrect > Oct 2 11:29:43 burner pam_afs[5702]: AFS Authentication failed for user testuser. password was incorrect > Oct 2 11:29:49 burner pam_afs[5703]: AFS Authentication failed for user testuser. password was incorrect > Oct 2 11:29:49 burner pam_afs[5704]: AFS Authentication failed for user testuser. password was incorrect > Oct 2 11:29:52 burner sshd(pam_unix)[5699]: 2 more authentication failures; logname= uid=0 euid=0 tty=NODEVssh user=testuser > > I don't understand this because I am sure that I didn't misstype the > password (tried it several times...). Is there a way to find out that > this is really a pam related problem? Try klog:ing as the user, that should tell you if AFS thinks you have the right password or not. -- /Ian D ian@assv.net - www.assv.net From warlord@MIT.EDU Wed Oct 2 15:38:33 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 10:38:33 -0400 Subject: [OpenAFS] scripts for automatic installation + client cache questions In-Reply-To: <007301c26a20$c6774c40$2b03a8c0@mummert.priv> References: <003a01c26a0d$e1dd6fe0$2b03a8c0@mummert.priv> <007301c26a20$c6774c40$2b03a8c0@mummert.priv> Message-ID: "klaas hagemann" writes: > > Basically, if your cache partition fills, AFS is screwed. The benefit > > of having your own AFS cache partition is that if only AFS uses the > > partition you are guaranteed that it will never fill to capacity. If > > you share the cache partition, then you have to always worry about how > > much space is left, because AFS will crash ungracefully in the face of > > a full cache (or worse, it could destroy data). > > Ok, i thought of something like that. But there is no performance increase? There may be a small performance increase due to a smaller iget() search area... I would always recommend a standalone cache partition, mostly for stability, but just in general. > Thanks, Klaas -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Wed Oct 2 16:19:51 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Wed, 2 Oct 2002 17:19:51 +0200 Subject: [OpenAFS] client without a server References: <200210021138.NAA92206@numa1.igpm.rwth-aachen.de> <005101c26a0f$68a82960$2b03a8c0@mummert.priv> Message-ID: <007a01c26a27$279c03c0$2b03a8c0@mummert.priv> Hello, i just recognized, that the afs-client will run into a long time-out, if no afs-server is available. Then it won't really start, although the libafs-module is loaded (i am using suse linux). BTW, does anyone has a solution for this problem? To my point of view the afs client should come up although without an afs server and should work automatically as soon as an afs-dbms is available. Klaas ----- Original Message ----- From: "klaas hagemann" To: ; Sent: Wednesday, October 02, 2002 2:29 PM Subject: Re: [OpenAFS] client without a server > Hello (or Hallo ;-) ) Helmut, > > you can start the afs-client without an afs-server as far as i can see it. > But feel free to correct my. > You just cannot use any functions of the afs-client. > The pam-afs Modul you are using uses these functions . > > So you should change your /etc/pam.d/login like this: > > login auth requisite pam_securetty.so > login auth sufficient pam_unix.so > login auth required pam_afs.so debug try_first_pass ignore_root > login auth optional pam_group.so > login account requisite pam_time.so > login account required pam_unix.so > login password required pam_cracklib.so retry=3 > login password required pam_unix.so shadow md5 use_authtok > login session required pam_unix.so > > So the login-session will be terminatet, if the pam_unix is sufficient. > To make this usefull, users should have a different password in afs then on > the unix-box (otherwise it won't get to pam_afs.so). > > Klaas > > ----- Original Message ----- > From: > To: > Sent: Wednesday, October 02, 2002 1:38 PM > Subject: [OpenAFS] client without a server > > > > Hi, > > > > I would like to have the possibility to run a client even if the > > afs server is not available. > > Currently I get (lots of) messages > > Lost contact of volume location server ... > > > > and even worse, I cannot login (as non-root) > > > > here is (the relevant part of) my file /etc/pam.conf > > > > # The PAM configuration file for the `login' service > > # > > login auth requisite pam_securetty.so > > login auth required pam_unix.so > > login auth sufficient pam_afs.so debug try_first_pass ignore_root > > login auth optional pam_group.so > > login account requisite pam_time.so > > login account required pam_unix.so > > login password required pam_cracklib.so retry=3 > > login password required pam_unix.so shadow md5 use_authtok > > login session required pam_unix.so > > > > Any help is very much appreciated, > > > > Helmut Jarausch > > > > Lehrstuhl fuer Numerische Mathematik > > Institute of Technology, RWTH Aachen > > D 52056 Aachen, Germany > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From rees@umich.edu Wed Oct 2 16:33:33 2002 From: rees@umich.edu (Jim Rees) Date: Wed, 02 Oct 2002 11:33:33 -0400 Subject: [OpenAFS] client without a server In-Reply-To: "Klaas Hagemann", Wed, 02 Oct 2002 17:19:51 +0200 Message-ID: <20021002153333.BAF6C207C1@citi.umich.edu> How is the client supposed to know the server is unavailable without using a timeout? From security@xauth.net Wed Oct 2 16:42:23 2002 From: security@xauth.net (Charles Clancy) Date: Wed, 2 Oct 2002 10:42:23 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <15770.49260.4762.561962@hszpc38.isz.ch> Message-ID: > After modifing /etc/pam.d/system-auth as you proposed I still have > troubles login in. In the /var/log/messages I get following entries > afterwards: > > Oct 2 11:29:43 burner pam_afs[5701]: AFS Authentication failed for user > testuser. password was incorrect Sorry -- there was a mistake in my previous post. > auth required /lib/security/pam_env.so > auth sufficient /lib/security/pam_afs.so try_first_pass > ignore_root > auth required /lib/security/pam_unix.so likeauth nullok > auth required /lib/security/pam_deny.so If you'll notice, there is no first pass to try (as pam_unix is called after pam_afs), hence you should remove the try_first_pass option. This shouldn't completely prevent you from logging in, but it will make the entries you noticed show up in your logs. Try removing that option, and see if it works then. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From warlord@MIT.EDU Wed Oct 2 16:49:25 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 11:49:25 -0400 Subject: [OpenAFS] client without a server In-Reply-To: <007a01c26a27$279c03c0$2b03a8c0@mummert.priv> References: <200210021138.NAA92206@numa1.igpm.rwth-aachen.de> <005101c26a0f$68a82960$2b03a8c0@mummert.priv> <007a01c26a27$279c03c0$2b03a8c0@mummert.priv> Message-ID: Run afs with -dynroot -derek "Klaas Hagemann" writes: > Hello, > > i just recognized, that the afs-client will run into a long time-out, if no > afs-server is available. > Then it won't really start, although the libafs-module is loaded (i am using > suse linux). > > BTW, does anyone has a solution for this problem? To my point of view the > afs client should come up although without an afs server and should work > automatically as soon as an afs-dbms is available. > > Klaas > ----- Original Message ----- > From: "klaas hagemann" > To: ; > Sent: Wednesday, October 02, 2002 2:29 PM > Subject: Re: [OpenAFS] client without a server > > > > Hello (or Hallo ;-) ) Helmut, > > > > you can start the afs-client without an afs-server as far as i can see it. > > But feel free to correct my. > > You just cannot use any functions of the afs-client. > > The pam-afs Modul you are using uses these functions . > > > > So you should change your /etc/pam.d/login like this: > > > > login auth requisite pam_securetty.so > > login auth sufficient pam_unix.so > > login auth required pam_afs.so debug try_first_pass ignore_root > > login auth optional pam_group.so > > login account requisite pam_time.so > > login account required pam_unix.so > > login password required pam_cracklib.so retry=3 > > login password required pam_unix.so shadow md5 use_authtok > > login session required pam_unix.so > > > > So the login-session will be terminatet, if the pam_unix is sufficient. > > To make this usefull, users should have a different password in afs then > on > > the unix-box (otherwise it won't get to pam_afs.so). > > > > Klaas > > > > ----- Original Message ----- > > From: > > To: > > Sent: Wednesday, October 02, 2002 1:38 PM > > Subject: [OpenAFS] client without a server > > > > > > > Hi, > > > > > > I would like to have the possibility to run a client even if the > > > afs server is not available. > > > Currently I get (lots of) messages > > > Lost contact of volume location server ... > > > > > > and even worse, I cannot login (as non-root) > > > > > > here is (the relevant part of) my file /etc/pam.conf > > > > > > # The PAM configuration file for the `login' service > > > # > > > login auth requisite pam_securetty.so > > > login auth required pam_unix.so > > > login auth sufficient pam_afs.so debug try_first_pass ignore_root > > > login auth optional pam_group.so > > > login account requisite pam_time.so > > > login account required pam_unix.so > > > login password required pam_cracklib.so retry=3 > > > login password required pam_unix.so shadow md5 use_authtok > > > login session required pam_unix.so > > > > > > Any help is very much appreciated, > > > > > > Helmut Jarausch > > > > > > Lehrstuhl fuer Numerische Mathematik > > > Institute of Technology, RWTH Aachen > > > D 52056 Aachen, Germany > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From tino.schwarze@informatik.tu-chemnitz.de Wed Oct 2 16:50:24 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Wed, 2 Oct 2002 17:50:24 +0200 Subject: [OpenAFS] Web-based file managers that play well with AFS...? In-Reply-To: <20021001134438.A35728@got.wedgie.org>; from jgarman@wedgie.org on Tue, Oct 01, 2002 at 01:44:38PM -0400 References: <20021001134438.A35728@got.wedgie.org> Message-ID: <20021002175024.A21701@informatik.tu-chemnitz.de> Hi there, On Tue, Oct 01, 2002 at 01:44:38PM -0400, Jason Garman wrote: > Does anyone know of a web-based "file manager" that works with AFS? > Unfortunately I've been tasked with finding some solution and so didn't > want to reinvent the wheel if someone else had already implemented a > solution. Here at Chemnitz University of Technology, a self-developed too called "wfm" is used. It's available at http://www-user.tu-chemnitz.de/~fri/wfm/ Unfortunately, it's documentation is German-only. I'm going to roll this thing out myself and could probably translate it in the process. You also need a modified mod_auth_pam for Apache which allows the server to acquire tokens on behalf of the user. It works quite well and is available at: http://www.tu-chemnitz.de/urz/afs/openafs/download/AddOn/mod_auth_pam/ (or /afs/tu-chemnitz.de/openafs/AddOn/mod_auth_pam ) HTH! Tino. PS: Rough translation of INSTALL: 1. Prerequisites - Apache (with mod_ssl for security) and PHP3 or PHP4 - mod_auth_pam and /etc/pam.d/httpd: auth sufficient /lib/security/pam_afs.so.1 ignore_root dont_fork session required /lib/security/pam_afs.so.1 account required pam_pwdb.so 2. Installation Modify the following files: - htaccess - config.php3, help, maybe index.php3 - copy everything into $DOCUMENT_ROOT/wfm - cp htaccess $DOCUMENT_ROOT/wfm/.htaccess 3. Test https://server-name/wfm -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From Mitchell.D.Baker@rose-hulman.edu Wed Oct 2 21:06:47 2002 From: Mitchell.D.Baker@rose-hulman.edu (Mitchell D. Baker) Date: 02 Oct 2002 15:06:47 -0500 Subject: [OpenAFS] AFS_BulkStatus info... Message-ID: <1033589207.28295.5.camel@babylon5.rose-hulman.edu> On on the servers, we are just started to get several seconds at a time the following messages: ed Oct 2 15:00:40 2002 SAFS_BulkStatus returns 0 Wed Oct 2 15:00:40 2002 SAFS_BulkStatus Wed Oct 2 15:00:40 2002 SAFS_BulkStatus returns 0 Wed Oct 2 15:00:40 2002 SAFS_BulkStatus Wed Oct 2 15:00:40 2002 SAFS_BulkStatus returns 0 fileserver CPU time has also jumped up... We upgraded to 1.2.7 last night to get over the callback issue.. What does the AFS_BulkStatus call do? Does that many in a short about of time indicate a probem or potential problem? After that goes on for several seconds, then I get the normal flow of FETCHDATA FETCHSTATUS etc calls and the load and CPU usage for fileserver settles down.. Thanks See-ya Mitch -- /####################################################################/ /# Mitchell "Buzz" Baker "To Infinity And Beyond..." #/ /# Sr. Systems/Security Admin Rose-Hulman Institute of Technology #/ /# Mitchell.D.Baker@rose-hulman.edu www.rose-hulman.edu #/ /# For PGP Public key, check out www.keyserver.net #/ /####################################################################/ From adler@bnl.gov Wed Oct 2 23:05:24 2002 From: adler@bnl.gov (Adler, Stephen) Date: 02 Oct 2002 18:05:24 -0400 Subject: [OpenAFS] redhat 8.0 Message-ID: <1033596324.1902.22.camel@newadler.phy.bnl.gov> I've also gone through the exersize to build afs 1.2.7 on my red hat 8.0 system. I've attached the .spec and a patch file. But as with the other posts, I get the unresolved sys_call_table symbol error as well when I go to load the module. I'll be glad to add an account on my system to someone from the openafs development team who wishes to work on this problem. Cheers. Steve. From adler@bnl.gov Wed Oct 2 23:07:56 2002 From: adler@bnl.gov (Adler, Stephen) Date: 02 Oct 2002 18:07:56 -0400 Subject: [OpenAFS] forgot the attachements.. duhhhh... Message-ID: <1033596476.1902.25.camel@newadler.phy.bnl.gov> --=-OoaDeI6iwlHwgGVdTi0k Content-Type: text/plain Content-Transfer-Encoding: 7bit long day... --=-OoaDeI6iwlHwgGVdTi0k Content-Disposition: attachment; filename=openafs-1.2.7.spec Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; name=openafs-1.2.7.spec; charset=ISO-8859-1 %define afsvers 1.2.7 %define pkgrel 2 # Define your particular Red Hat and kernel versions: # For Linux 2.2: 22 # For Linux 2.4: 24 # %define osvers rh8.0 %define kernvers 24 # This is where to look for kernel-build includes files. # Most likely you don't want to change this, but # depending on your situation you may want: # Linux 2.2: # kbase =3D /usr/src/linux- # kend =3D "" # Linux 2.4: # kbase =3D /lib/modules/ # kend =3D /build # %define kbase /usr/src/linux- %define kend "" # Set 'debugspec' to 1 if you want to debug the spec file. This will # not remove the installed tree as part of the %clean operation %define debugspec 0 # Set 'enterprisekernelsupport' to 1 if you want to build the # kernel module for the enterprise kernel # Note: This will only work for kernvers =3D=3D 24 on i686 %define enterprisekernelsupport 1 # Set 'bigmemkernelsupport' to 1 if you want to build the # kernel module for the bigmem kernel # Note: This will only work for kernvers =3D=3D 24 on i686 %define bigmemkernelsupport 1 # Set 'krb5support' to 1 if you want to build the openafs-krb5 package # to distribute aklog and asetkey %define krb5support 1 # OpenAFS configuration options %define enable_bitmap_later 0 %define enable_bos_restricted_mode 0 %define enable_fast_restart 0 ####################################################################### # You probably don't need to change anything beyond this line # NOTE: If you do, please email me!!! Summary: OpenAFS distributed filesystem Name: openafs Version: %{afsvers} Release: %{osvers}.%{pkgrel} Copyright: IPL BuildRoot: %{_tmppath}/%{name}-%{version}-root Packager: Derek Atkins Group: Networking/Filesystems BuildRequires: kernel-source %if "%{osvers}" !=3D "rh6.2" # Newer versions of Red Hat require pam-devel in order to build BuildRequires: pam-devel %endif Source0: = http://www.openafs.org/dl/openafs/${afsvers}/openafs-%{afsvers}-src.tar.= gz Source1: = http://www.openafs.org/dl/openafs/${afsvers}/openafs-%{afsvers}-doc.tar.= gz Source2: openafs-ThisCell # http://grand.central.org/dl/cellservdb/CellServDB Source3: openafs-CellServDB Source4: openafs-SuidCells Source5: openafs-cacheinfo Source6: openafs-afsmodname Source7: openafs-LICENSE.Sun Source8: openafs-README Source10: = http://www.openafs.org/dl/openafs/${afsvers}/RELNOTES-%{afsvers} Source11: http://www.openafs.org/dl/openafs/${afsvers}/ChangeLog Source20: openafs-krb5-1.3.tar.gz Patch0: openafs-%{afsvers}-rc.patch Patch1: openafs-gcc-32.patch Patch20: openafs-krb5-1.3-1.2.1.diff.gz Patch21: openafs-krb5-1.3-configure.patch %description The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides common files shared across all the various OpenAFS packages but are not necessarily tied to a client or server. %package client Requires: binutils, openafs-kernel, openafs =3D %{PACKAGE_VERSION} Summary: OpenAFS Filesystem Client Group: Networking/Filesystem %description client The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides basic client support to mount and manipulate AFS. %package server Requires: openafs-kernel, openafs =3D %{PACKAGE_VERSION} Summary: OpenAFS Filesystem Server Group: Networking/Filesystems %description server The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides basic server support to host files in an AFS Cell. %package devel Summary: OpenAFS Development Libraries and Headers Group: Development/Filesystems %description devel The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides static development libraries and headers needed to compile AFS applications. Note: AFS currently does not provide shared libraries. %package kernel Summary: OpenAFS Kernel Module(s) Requires: openafs =3D %{PACKAGE_VERSION} Group: Networking/Filesystems %description kernel The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides precompiled AFS kernel modules for various kernels. %package kernel-source Summary: OpenAFS Kernel Module source tree Group: Networking/Filesystems %description kernel-source The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides the source code to build your own AFS kernel module. %package compat Summary: OpenAFS client compatibility symlinks Requires: openafs =3D %{PACKAGE_VERSION}, openafs-client =3D = %{PACKAGE_VERSION} Group: Networking/Filesystems Obsoletes: openafs-client-compat %description compat The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides compatibility symlinks in /usr/afsws. It is completely optional, and is only necessary to support legacy applications and scripts that hard-code the location of AFS client programs. %package kpasswd Summary: OpenAFS KA kpasswd support Requires: openafs Group: Networking/Filesystems %description kpasswd The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides the compatibility symlink for kpasswd, in case you are using KAserver instead of Krb5. %if %{krb5support} %package krb5 Summary: OpenAFS programs to use with krb5 Requires: openafs =3D %{PACKAGE_VERSION} Group: Networking/Filesystems BuildRequires: krb5-devel %description krb5 The AFS distributed filesystem. AFS is a distributed filesystem allowing cross-platform sharing of files among multiple computers. Facilities are provided for access control, authentication, backup and administrative management. This package provides compatibility programs so you can use krb5 to authenticate to AFS services, instead of using AFS's homegrown krb4 lookalike services. %endif # # PREP # %prep %setup -q -b 1 %setup -q -T -D -a 20 %patch0 -p0 %patch1 -p0 %patch20 -p0 %patch21 -p0 ### ### build ### %build ### set an alias for autoconf to use autoconf-2.13.. I hope this ### works. Stephen Adler, Wed, Oct 02, 2002 alias autoconf=3Dautoconf-2.13 %ifarch i386 i486 i586 i686 athlon sysbase=3Di386 %else sysbase=3D%{_arch} %endif %ifarch alpha sysname=3D${sysbase}_linux_%{kernvers} %else sysname=3D${sysbase}_linux%{kernvers} %endif if [ %{kernvers} =3D 22 ]; then kv=3D'2\.2\.' elif [ %{kernvers} =3D 24 ]; then kv=3D'2\.4\.' else echo "I don't know how to build $sysname" exit 1 fi %ifarch i386 i486 i586 i686 athlon archlist=3D"i386 i586 i686 athlon" %else archlist=3D${sysbase} %endif # # PrintDefine var value statements file # PrintDefine() { case $3 in *ifn*) echo "#ifndef $1" >> $4 ;; esac case $3 in *und*) echo "#undef $1" >> $4 ;; esac case $3 in *def*) echo "#define $1 $2" >> $4 ;; esac case $3 in *end*) echo "#endif" >> $4 ;; esac case $3 in *inc*) echo "#include $1" >> $4 ;; esac case $3 in *nl*) echo "" >> $4 ;; esac } # PrintRedhatKernelFix arch mp file PrintRedhatKernelFix() { arch=3D"$1" up=3D0 smp=3D0 ent=3D0 bm=3D0 if [ "$2" =3D "MP" ]; then smp=3D1 elif [ "$2" =3D "EP" ]; then ent=3D1 elif [ "$2" =3D "BM" ]; then bm=3D1 else up=3D1 fi file=3D"$3" # deal with the various boot kernels boot=3D0 bootsmp=3D0 # arch of 'BOOT' =3D=3D 386 if [ "$arch" =3D "BOOT" ]; then if [ "$up" =3D 1 ]; then boot=3D1 up=3D0 elif [ "$smp" =3D 1 ]; then bootsmp=3D1 smp=3D0 fi arch=3Di386 fi rm -f $file touch $file PrintDefine "REDHAT_FIX_H" "" ifn,def,nl $file PrintDefine "__BOOT_KERNEL_ENTERPRISE" $ent und,def,nl $file PrintDefine "__BOOT_KERNEL_BIGMEM" $bm und,def,nl $file PrintDefine "__BOOT_KERNEL_SMP" $smp und,def,nl $file PrintDefine "__BOOT_KERNEL_UP" $up und,def,nl $file PrintDefine "__BOOT_KERNEL_BOOT" $boot und,def,nl $file PrintDefine "__BOOT_KERNEL_BOOTSMP" $bootsmp und,def,nl $file PrintDefine \"/boot/kernel.h\" "" inc,nl $file # include file for ar in $archlist ; do if [ "$ar" =3D "$arch" ]; then PrintDefine "__MODULE_KERNEL_$ar" "1" ifn,def,end $file else PrintDefine "__MODULE_KERNEL_$ar" "" und $file # undef fi done echo "" >> $file PrintDefine "" "" end $file if [ %{debugspec} =3D 1 ] ; then echo "Kernel Configuration File for Red Hat kernels:" cat $file fi } # Pick up all the 'appropriate' kernels kvers=3D`ls -d %{kbase}* | sed 's^%{kbase}^^g' | grep $kv` # Choose the last one for now.. It doesn't really matter, really. hdrdir=3D`ls -d %{kbase}*%{kend} | grep $kv | tail -1` config_opts=3D"--enable-redhat-buildsys \ %if %{enable_bitmap_later} --enable-bitmap-later \ %endif %if %{enable_bos_restricted_mode} --enable-bos-restricted-mode \ %endif %if %{enable_fast_restart} --enable-fast-restart \ %endif --enable-transarc-paths" # Configure AFS ./configure --with-afs-sysname=3D${sysname} \ --with-linux-kernel-headers=3D$hdrdir $config_opts # Build the user-space AFS stuff make dest_nolibafs # Build the libafs tree make only_libafs_tree # Now build all the kernel modules for vers in $kvers ; do # Reconfigure sources for this kernel version, to catch various # kernel params in the configure script. Yes. this takes more time, # but it's worth it in the long run.. But first remove config.cache # to be sure we get a clean configuration. rm -f config.cache ./configure --with-afs-sysname=3D${sysname} \ --with-linux-kernel-headers=3D%{kbase}$vers%{kend} \ $config_opts KTL=3D"SP MP" %if %{enterprisekernelsupport} # See if we should build EP support if grep -q -r __BOOT_KERNEL_ENTERPRISE %{kbase}$vers%{kend}/include then KTL=3D"${KTL} EP" fi %endif %if %{bigmemkernelsupport} # See if we should build BM support if grep -q -r __BOOT_KERNEL_BIGMEM %{kbase}$vers%{kend}/include then KTL=3D"${KTL} BM" fi %endif =20 for mp in $KTL; do # ... for all appropriate 'architectures'... if [ %{kernvers} =3D 22 ]; then # For 2.2 kernels, just do MP and SP kernels; force EP into i686 arch=3D${sysbase} if [ $mp =3D EP -a ${sysbase} =3D i386 ]; then arch=3Di686 fi PrintRedhatKernelFix $arch $mp src/config/redhat-fix.h make dest_only_libafs LOCAL_SMP_DEF=3D-DREDHAT_FIX MPS=3D$mp elif [ %{kernvers} =3D 24 ]; then # For 2.4 kernels, need to build modules for each architecture! for arch in $archlist ; do # build SP and MP on all architectures. # build EP and BM only on i686 if [ $mp =3D SP -o $mp =3D MP -o \ \( $mp =3D EP -a $arch =3D i686 \) -o \ \( $mp =3D BM -a $arch =3D i686 \) ]; then PrintRedhatKernelFix $arch $mp src/config/redhat-fix.h make dest_only_libafs LOCAL_SMP_DEF=3D-DREDHAT_FIX \ LINUX_MODULE_NAME=3D"-$arch" MPS=3D$mp fi done else =20 echo "I don't know how to build $sysname" exit 1 fi done done rm -f src/config/redhat-fix.h %if %{krb5support} # Now build aklog/asetkey (cd openafs-krb5-1.3/src && autoconf && ./configure --prefix=3D/usr --with-krb5=3D/usr/kerberos \ --with-afs=3D`pwd`/../../${sysname}/dest/ && \ make all && \ make install DESTDIR=3D`pwd`/../../${sysname}/dest/ INSTALL_BIN=3D/bin = \ INSTALL_SBIN=3D/etc) %endif ### ### install ### %install [ $RPM_BUILD_ROOT !=3D / ] && rm -rf $RPM_BUILD_ROOT %ifarch i386 i486 i586 i686 athlon sysbase=3Di386 %else sysbase=3D%{_arch} %endif %ifarch alpha sysname=3D${sysbase}_linux_%{kernvers} %else sysname=3D${sysbase}_linux%{kernvers} %endif # Build install tree mkdir -p $RPM_BUILD_ROOT/usr/sbin mkdir -p $RPM_BUILD_ROOT/etc/sysconfig mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d mkdir -p $RPM_BUILD_ROOT/etc/openafs mkdir -p $RPM_BUILD_ROOT/lib/security mkdir -p $RPM_BUILD_ROOT/usr/afs/logs mkdir -p $RPM_BUILD_ROOT/usr/vice/etc mkdir -p $RPM_BUILD_ROOT/usr/vice/cache chmod 700 $RPM_BUILD_ROOT/usr/vice/cache # Copy files from dest to the appropriate places in BuildRoot tar cf - -C ${sysname}/dest bin include lib | tar xf - -C = $RPM_BUILD_ROOT/usr tar cf - -C ${sysname}/dest/etc . | tar xf - -C = $RPM_BUILD_ROOT/usr/sbin tar cf - -C ${sysname}/dest/root.server/usr/afs bin | tar xf - -C = $RPM_BUILD_ROOT/usr/afs tar cf - -C ${sysname}/dest/root.client/usr/vice/etc afsd modload | tar = xf - -C $RPM_BUILD_ROOT/usr/vice/etc # Link kpasswd to kapasswd ln -f $RPM_BUILD_ROOT/usr/bin/kpasswd $RPM_BUILD_ROOT/usr/bin/kapasswd # Copy root.client config files install -m 755 ${sysname}/dest/root.client/usr/vice/etc/afs.conf = $RPM_BUILD_ROOT/etc/sysconfig/afs install -m 755 ${sysname}/dest/root.client/usr/vice/etc/afs.rc = $RPM_BUILD_ROOT/etc/rc.d/init.d/afs # Copy PAM modules install -m 755 ${sysname}/dest/lib/pam* $RPM_BUILD_ROOT/lib/security # PAM symlinks ln -sf pam_afs.so.1 $RPM_BUILD_ROOT/lib/security/pam_afs.so ln -sf pam_afs.krb.so.1 $RPM_BUILD_ROOT/lib/security/pam_afs.krb.so # Populate /usr/vice/etc uve=3D$RPM_BUILD_ROOT/usr/vice/etc install -p -m 644 $RPM_SOURCE_DIR/openafs-CellServDB $uve/CellServDB install -p -m 644 $RPM_SOURCE_DIR/openafs-SuidCells $uve/SuidCells install -p -m 644 $RPM_SOURCE_DIR/openafs-ThisCell $uve/ThisCell install -p -m 644 $RPM_SOURCE_DIR/openafs-cacheinfo $uve/cacheinfo install -p -m 755 $RPM_SOURCE_DIR/openafs-afsmodname $uve/afsmodname # # Build the SymTable symtable=3D$RPM_BUILD_ROOT/usr/vice/etc/modload/SymTable rm -f $symtable echo "# SymTable, automatically generated" > $symtable echo "# symbol version cpu module" >> $symtable echo "" >> $symtable $RPM_BUILD_ROOT/usr/vice/etc/afsmodname -x -f $symtable \ $RPM_BUILD_ROOT/usr/vice/etc/modload/libafs*.o # # install kernel-source # # Install the kernel module source tree mkdir -p $RPM_BUILD_ROOT/usr/src/openafs-kernel-%{afsvers}/src tar cf - -C libafs_tree . | \ tar xf - -C $RPM_BUILD_ROOT/usr/src/openafs-kernel-%{afsvers}/src # Next, copy the LICENSE Files, README install -m 644 src/LICENSE = $RPM_BUILD_ROOT/usr/src/openafs-kernel-%{afsvers}/LICENSE.IBM install -m 644 $RPM_SOURCE_DIR/openafs-LICENSE.Sun = $RPM_BUILD_ROOT/usr/src/openafs-kernel-%{afsvers}/LICENSE.Sun install -m 644 $RPM_SOURCE_DIR/openafs-README = $RPM_BUILD_ROOT/usr/src/openafs-kernel-%{afsvers}/README # # Install DOCUMENTATION # # Build the DOC directory mkdir -p $RPM_BUILD_ROOT/$RPM_DOC_DIR/openafs-%{afsvers} tar cf - -C doc LICENSE html pdf | \ tar xf - -C $RPM_BUILD_ROOT/$RPM_DOC_DIR/openafs-%{afsvers} install -m 644 $RPM_SOURCE_DIR/RELNOTES-%{afsvers} = $RPM_BUILD_ROOT/$RPM_DOC_DIR/openafs-%{afsvers} install -m 644 $RPM_SOURCE_DIR/ChangeLog = $RPM_BUILD_ROOT/$RPM_DOC_DIR/openafs-%{afsvers} # # create filelist # grep -v "^#" >openafs-file-list < CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) \ - -fno-strength-reduce -pipe -march=3Di486 -malign-loops=3D2 = -malign-jumps=3D2 \ - -malign-functions=3D2 + -fno-strength-reduce -pipe -march=3Di486 -falign-loops=3D2 = -falign-jumps=3D2 \ + -falign-functions=3D2 DEFINES =3D -D__KERNEL__ -DCPU=3D586 -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} ${KDEFINES} CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) -fno-strength-reduce -pipe = -mno-fp-regs -ffixed-8 --=-OoaDeI6iwlHwgGVdTi0k-- From nneul@umr.edu Wed Oct 2 23:23:07 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 02 Oct 2002 17:23:07 -0500 Subject: [OpenAFS] forgot the attachements.. duhhhh... In-Reply-To: <1033596476.1902.25.camel@newadler.phy.bnl.gov> References: <1033596476.1902.25.camel@newadler.phy.bnl.gov> Message-ID: <1033597387.27570.24.camel@cessna.rollanet.org> The gcc32 patch won't be accepted, as it breaks compiles for older gcc's. It will need to say with the warnings, or add a configure check for what syntax to use. -- Nathan On Wed, 2002-10-02 at 17:07, Adler, Stephen wrote: > long day... -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From warlord@MIT.EDU Wed Oct 2 23:34:57 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 18:34:57 -0400 Subject: [OpenAFS] redhat 8.0 In-Reply-To: <1033596324.1902.22.camel@newadler.phy.bnl.gov> References: <1033596324.1902.22.camel@newadler.phy.bnl.gov> Message-ID: Any chance you could actually send a diff of the spec rather than the whole spec? At a glance you: changed the version number added the patch file However I may have missed something else. -derek PS: Considering the kernel module doesn't load, I don't see a reason to worry about the packaging yet. I'm sure that, in the process of getting AFS to work with the lack of the sys_call_table they will get the modules to build. "Adler, Stephen" writes: > I've also gone through the exersize to build afs 1.2.7 on my red hat > 8.0 system. I've attached the .spec and a patch file. But > as with the other posts, I get the unresolved sys_call_table symbol > error as well when I go to load the module. I'll be glad to > add an account on my system to someone from the openafs development > team who wishes to work on this problem. > > Cheers. Steve. > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From jds@soltis.cc Thu Oct 3 02:53:32 2002 From: jds@soltis.cc (Jesus Delgado) Date: Wed, 2 Oct 2002 19:53:32 -0600 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <20021002151128.M26033@soltis.cc> References: <20021002151128.M26033@soltis.cc> Message-ID: <20021002195332.M26176@soltis.cc> ---------- Forwarded Message ----------- Hi: Problems when try the build openafs source rpm in redhat 8.0 the errors is the same with openafs-1.2.6 y openafs-1.2.7: Errors in openafs-1.2.7 .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) Processing files: openafs-krb5-1.2.7-rh7.3.1 error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey Requires: openafs = 1.2.7 RPM build errors: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey Errors with openafs-1.2.6 Requires: openafs = 1.2.6 openafs-client = 1.2.6 Obsoletes: openafs-client-compat Processing files: openafs-kpasswd-1.2.6-rh7.3.1 Finding Provides: /usr/lib/rpm/find-provides Finding Requires: /usr/lib/rpm/find-requires PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) Processing files: openafs-krb5-1.2.6-rh7.3.1 error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey Requires: openafs = 1.2.6 RPM build errors: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey Help me plase Regards. ------- End of Forwarded Message ------- From warlord@MIT.EDU Thu Oct 3 03:11:21 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 02 Oct 2002 22:11:21 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <20021002195332.M26176@soltis.cc> References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> Message-ID: Hi, We do not support RedHat 8.0 yet. We will release an RPM for RH8.0 once it is supported. -derek "Jesus Delgado" writes: > Hi: > > Problems when try the build openafs source rpm in redhat 8.0 > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > Errors in openafs-1.2.7 [snip] > Help me plase > > Regards. -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From mitch@ccmr.cornell.edu Thu Oct 3 06:41:56 2002 From: mitch@ccmr.cornell.edu (Mitch Collinsworth) Date: Thu, 3 Oct 2002 01:41:56 -0400 (EDT) Subject: [OpenAFS] AFS Training ? In-Reply-To: Message-ID: Following up to my own followup: There is currently only one person registered for the December class. One of my group would also like to attend, making a total of 2 so far. We couldn't get an exact answer from IBM as to what constitutes sufficient critical mass to be sure the class won't be cancelled, but it seems to be in the neighborhood of 4 or 5. Are there others here who might be interested in this? Write to me off-list and I can give you the address of the teacher if you want more direct info. My selfish motivation is in recruiting enough additional attendees to see the class not get canceled again. If you'd like to go but the December dates are bad, when is better? Maybe we can work with them in scheduling it for a time when we can succeed in achieving critical mass. It's been over a decade since I took this class, but it was a good class then and would be quite useful today even if little has changed in the presentation since then. -Mitch On Sun, 29 Sep 2002, Mitch Collinsworth wrote: > External web site is: > http://www7b.software.ibm.com/wsdd/education/enablement/curriculum/sw800.html > > A word of caution: Just because it's listed here doesn't mean it will > actually be held. The last class that was scheduled for Pittsburgh was > cancelled at the last minute due to insufficient number of registrants. > > There was supposed to be another one this fall in California (San Jose?). > It no longer seems to be on the schedule. I take it it was cancelled, too. > > -Mitch > > > On Sun, 29 Sep 2002, Daniel Clark/Cambridge/IBM wrote: > > > Paul Blackburn wrote: > > > Transarc used to run some excellent AFS administrator courses. > > > Does anyone know of AFS training available today? > > > > According to w3.education.ibm.com (internal IBM site, there is some > > external equivalent but I don't know what it is) Transarc - now "IBM > > Pittsburgh Lab" - still runs the "AFS Administration" course. It's course > > code SW800 and will next occur in Pittsburgh, PA 2002-12-10 to 2002-12-13. > > Below are the full details, which include a contact number/email to get > > more info and future course dates. I have taken this class and can vouch > > that it is excellent. My class was taught by someone who had been > > administering AFS since it was a research project at CMU, so in addition to > > access to deep technical knowledge there were also interesting historical > > asides. > > > > Course Details: AFS Administration > > > > 2002-12-10 to 2002-12-13 > > > > Course Code:SW800 > > Section:K8II > > > > Course Location: > > Room: TBA 2 > > IBM Pittsburgh Lab 9Fl > > 11 Stanwix Street > > Pittsburgh > > United States > > 15222 > > > > Course Contact: > > Tracy Linza > > linza at IBMUS > > 412-667-4477 > > TL 989-4477 > > > > Course Schedule: > > 2002-12-10 to 2002-12-13 > > 09:00:00 to 18:00:00 > > Last Day End Time: 17:30:00 > > > > Last Cancellation Date without penalty: > > 2002-11-25 > > > > > > Equipment Required: > > None > > > > Course Enrollments: > > Total Students Confirmed: 1 of 14 > > Total on Standby: 0 > > > > Additional Course Information: > > None > > > > Comments: > > None > > > > Location Specific Info: > > > > LOCATION: > > IBM Pittsburgh Lab > > 11 Stanwix Street > > 9th FL > > Pittsburgh, PA 15222 > > > > CONTACT: > > 412-667-4433 > > TL 989-4433 > > > > BADGES: > > See lobby receptionist on 9th Floor > > All visitors are required to sign-in > > (8:00am - 6:00pm) > > > > LOCAL HOTEL INFORMATION > > > > Pittsburgh Hilton > > 600 Commonwealth Place > > Gateway Center > > Pittsburgh, PA 15222 > > 412-391-4600 > > Ask for IBM/Transarc rate of $92 per night > > (Subject to change without notice) > > 5 minute walk to Lab > > > > Sheraton Hotel > > Carson & SMithfield Streets > > Pittsburgh, PA 15219 > > 412-261-2000 > > 5-10 minute subway ride to Lab > > Ask for IBM/Transarc rate of $116 per night > > (Subject to change without notice) > > > > > > DIRECTIONS > > > > FROM AIRPORT: > > * From Airport follow the signs toward Pittsburgh > > (Approx 15 miles) to the Fort Pitt Tunnel > > * Stay in the left lane. > > * After the tunnel, you will be on the Fort Pitt Bridge > > * Take the Boulevard of the Allies Exit > > * Proceed to Stanwix St and turn right. > > * Proceed one block to 11 Stanwix > > (Look for Blattner Bruner revolving sign) > > * Parking garage is in the building > > * Parking in the garage is $14 per day - student expense. > > > > -- > > Daniel Clark # Sys Admin & Release Engineer > > IBM > Lotus > Messaging Technology Group > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From mpb@est.ibm.com Thu Oct 3 08:53:52 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Thu, 03 Oct 2002 08:53:52 +0100 Subject: [OpenAFS] AFS Training ? References: Message-ID: <3D9BF790.3020000@est.ibm.com> I have also attended AFS classes presented by Transarc staff some years ago. In my experience, these were some of the best computer education courses I have been lucky enough to go to. The course presenter was very knowledgeable with a good experience in the practical issues of administering AFS. If you have the opportunity, then I highly recommend booking this course. Good training makes all the difference to having a successful implementation of AFS at your site. Don't miss this! -- cheers paul http://acm.org/~mpb "The defense of individual rights has reached such extremes as to make society as a whole defenseless agains certain individuals. It is time, in the West, to defend not so much human rights as human obligations." -- Aleksandr Solzhenisyn Mitch Collinsworth wrote: >Following up to my own followup: There is currently only one person >registered for the December class. One of my group would also like >to attend, making a total of 2 so far. We couldn't get an exact >answer from IBM as to what constitutes sufficient critical mass to >be sure the class won't be cancelled, but it seems to be in the >neighborhood of 4 or 5. Are there others here who might be interested >in this? Write to me off-list and I can give you the address of the >teacher if you want more direct info. My selfish motivation is in >recruiting enough additional attendees to see the class not get >canceled again. If you'd like to go but the December dates are bad, >when is better? Maybe we can work with them in scheduling it for a >time when we can succeed in achieving critical mass. > >It's been over a decade since I took this class, but it was a good >class then and would be quite useful today even if little has changed >in the presentation since then. > >-Mitch > > >On Sun, 29 Sep 2002, Mitch Collinsworth wrote: > >>External web site is: >>http://www7b.software.ibm.com/wsdd/education/enablement/curriculum/sw800.html >> >>A word of caution: Just because it's listed here doesn't mean it will >>actually be held. The last class that was scheduled for Pittsburgh was >>cancelled at the last minute due to insufficient number of registrants. >> >>There was supposed to be another one this fall in California (San Jose?). >>It no longer seems to be on the schedule. I take it it was cancelled, too. >> >>-Mitch >> >> >>On Sun, 29 Sep 2002, Daniel Clark/Cambridge/IBM wrote: >> >>>Paul Blackburn wrote: >>> >>>>Transarc used to run some excellent AFS administrator courses. >>>>Does anyone know of AFS training available today? >>>> >>>According to w3.education.ibm.com (internal IBM site, there is some >>>external equivalent but I don't know what it is) Transarc - now "IBM >>>Pittsburgh Lab" - still runs the "AFS Administration" course. It's course >>>code SW800 and will next occur in Pittsburgh, PA 2002-12-10 to 2002-12-13. >>>Below are the full details, which include a contact number/email to get >>>more info and future course dates. I have taken this class and can vouch >>>that it is excellent. My class was taught by someone who had been >>>administering AFS since it was a research project at CMU, so in addition to >>>access to deep technical knowledge there were also interesting historical >>>asides. >>> >>>Course Details: AFS Administration >>> >>>2002-12-10 to 2002-12-13 >>> >>>Course Code:SW800 >>>Section:K8II >>> >>>Course Location: >>> Room: TBA 2 >>> IBM Pittsburgh Lab 9Fl >>> 11 Stanwix Street >>> Pittsburgh >>> United States >>> 15222 >>> >>>Course Contact: >>> Tracy Linza >>> linza at IBMUS >>> 412-667-4477 >>> TL 989-4477 >>> >>>Course Schedule: >>> 2002-12-10 to 2002-12-13 >>> 09:00:00 to 18:00:00 >>> Last Day End Time: 17:30:00 >>> >>>Last Cancellation Date without penalty: >>> 2002-11-25 >>> >>> >>>Equipment Required: >>> None >>> >>>Course Enrollments: >>> Total Students Confirmed: 1 of 14 >>> Total on Standby: 0 >>> >>>Additional Course Information: >>> None >>> >>>Comments: >>> None >>> >>>Location Specific Info: >>> >>>LOCATION: >>> IBM Pittsburgh Lab >>> 11 Stanwix Street >>> 9th FL >>> Pittsburgh, PA 15222 >>> >>>CONTACT: >>> 412-667-4433 >>> TL 989-4433 >>> >>>BADGES: >>> See lobby receptionist on 9th Floor >>> All visitors are required to sign-in >>> (8:00am - 6:00pm) >>> >>>LOCAL HOTEL INFORMATION >>> >>>Pittsburgh Hilton >>>600 Commonwealth Place >>>Gateway Center >>>Pittsburgh, PA 15222 >>>412-391-4600 >>>Ask for IBM/Transarc rate of $92 per night >>>(Subject to change without notice) >>>5 minute walk to Lab >>> >>>Sheraton Hotel >>>Carson & SMithfield Streets >>>Pittsburgh, PA 15219 >>>412-261-2000 >>>5-10 minute subway ride to Lab >>>Ask for IBM/Transarc rate of $116 per night >>>(Subject to change without notice) >>> >>> >>>DIRECTIONS >>> >>>FROM AIRPORT: >>>* From Airport follow the signs toward Pittsburgh >>> (Approx 15 miles) to the Fort Pitt Tunnel >>>* Stay in the left lane. >>>* After the tunnel, you will be on the Fort Pitt Bridge >>>* Take the Boulevard of the Allies Exit >>>* Proceed to Stanwix St and turn right. >>>* Proceed one block to 11 Stanwix >>> (Look for Blattner Bruner revolving sign) >>>* Parking garage is in the building >>>* Parking in the garage is $14 per day - student expense. >>> >>>-- >>>Daniel Clark # Sys Admin & Release Engineer >>>IBM > Lotus > Messaging Technology Group >>> >>>_______________________________________________ >>>OpenAFS-info mailing list >>>OpenAFS-info@openafs.org >>>https://lists.openafs.org/mailman/listinfo/openafs-info >>> >>_______________________________________________ >>OpenAFS-info mailing list >>OpenAFS-info@openafs.org >>https://lists.openafs.org/mailman/listinfo/openafs-info >> > >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > From traxtopel@HotPOP.com Thu Oct 3 13:32:06 2002 From: traxtopel@HotPOP.com (trax) Date: 03 Oct 2002 14:32:06 +0200 Subject: [OpenAFS] openafs 1.2.7 - mandrake9.0 Message-ID: <1033647143.2400.91.camel@localhost.localdomain> I am trying to recompile the openafs1.2.7 RPM on Mandrake 9.0. The problem I am having is building the openafs-krb5 package. All other packages build correctly. I have modified the spec so that the krb5./configure to kerberos path to /usr as opposed to /usr/kereberos(which is for rh7.3). Processing files: openafs-krb5-1.2.7-mdk9.0.1 error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey After rpm is finished recompiling, it bottles out as the aklog file is not built. All other packages build correctly Running the make all manually from openafs-krb5-1.3/, produces the following. [root@localhost src]# make all gcc -o aklog aklog.o aklog_main.o aklog_param.o krb_util.o linked_list.o adderrtable.o -lkrb524 -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs -lsys -lprot -lubik -lauth -lrxkad -lrx -llwp -ldes -lsys /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a -lresolv -lkrb5 -lk5crypto -lcom_err /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o): In function `add_to_error_table': error_msg.o(.text+0x220): multiple definition of `add_to_error_table' adderrtable.o:/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/adderrtable.c:31: first defined here /usr/bin/ld: Warning: size of symbol `add_to_error_table' changed from 16 to 49 in /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o) collect2: ld returned 1 exit status make: *** [aklog] Error 1 config.log shows the following ... This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. configure:564: checking for C compiler configure:576: checking for gcc configure:689: checking whether the C compiler (gcc ) works configure:705: gcc -o conftest conftest.c 1>&5 configure:731: checking whether the C compiler (gcc ) is a cross-compiler configure:736: checking whether we are using GNU C configure:745: gcc -E conftest.c configure:764: checking whether gcc accepts -g configure:899: checking for a BSD compatible install configure:979: checking for getDirPath in /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a configure:997: gcc -o conftest -g -O2 -I/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//include conftest.c /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a 1>&5 configure:1055: checking for socket in -lsocket configure:1074: gcc -o conftest -g -O2 -I/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//include conftest.c -lsocket -lnsl 1>&5 /usr/bin/ld: cannot find -lsocket collect2: ld returned 1 exit status configure: failed program was: #line 1063 "configure" #include "confdefs.h" /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char socket(); int main() { socket() ; return 0; } configure:1095: checking for t_bind in -lnsl configure:1114: gcc -o conftest -g -O2 -I/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//include conftest.c -lnsl 1>&5 /tmp/ccg62sYD.o: In function `main': /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/configure:1110: undefined reference to `t_bind' collect2: ld returned 1 exit status configure: failed program was: #line 1103 "configure" #include "confdefs.h" /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char t_bind(); int main() { t_bind() ; return 0; } configure:1140: checking for compile configure:1168: gcc -o conftest -g -O2 -I/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//include conftest.c -lgen 1>&5 /usr/bin/ld: cannot find -lgen collect2: ld returned 1 exit status configure: failed program was: #line 1145 "configure" #include "confdefs.h" /* System header to define __stub macros and hopefully few prototypes, which can conflict with char compile(); below. */ #include /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char compile(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_compile) || defined (__stub___compile) choke me #else compile(); #endif ; return 0; } configure:1140: checking for step configure:1168: gcc -o conftest -g -O2 -I/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//include conftest.c -lgen 1>&5 /usr/bin/ld: cannot find -lgen collect2: ld returned 1 exit status configure: failed program was: #line 1145 "configure" #include "confdefs.h" /* System header to define __stub macros and hopefully few prototypes, which can conflict with char step(); below. */ #include /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 buchar step(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_step) || defined (__stub___step) choke me #else step(); #endif ; return 0; } iltin and then its argument prototype would still apply. */ I have tried recompiling with gcc2.96 aswell as 3.2, both give the same result. From adler@bnl.gov Thu Oct 3 13:55:27 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 08:55:27 -0400 Subject: [OpenAFS] redhat 8.0 In-Reply-To: References: <1033596324.1902.22.camel@newadler.phy.bnl.gov> Message-ID: <1033649727.15413.2.camel@newadler.phy.bnl.gov> one more tweek, I aliased autoconf to autoconf-2.13. It looks like redhat 8.0 ships with 2 versions of autoconf and the default is 2.53. Trying to build openafs with autoconf 2.53 leads to problems in AC_LANG definition when configing one of the sub systems of open afs. (Sorry, don't remember which one....) Summary: 3 changes. 1) the version 2) patch2: 3) alias autoconf=autoconf-2.13 Cheers. Steve. On Wed, 2002-10-02 at 18:34, Derek Atkins wrote: > Any chance you could actually send a diff of the spec rather > than the whole spec? At a glance you: > > changed the version number > added the patch file > > However I may have missed something else. > > -derek > > PS: Considering the kernel module doesn't load, I don't see a reason > to worry about the packaging yet. I'm sure that, in the process of > getting AFS to work with the lack of the sys_call_table they will get > the modules to build. > > "Adler, Stephen" writes: > > > I've also gone through the exersize to build afs 1.2.7 on my red hat > > 8.0 system. I've attached the .spec and a patch file. But > > as with the other posts, I get the unresolved sys_call_table symbol > > error as well when I go to load the module. I'll be glad to > > add an account on my system to someone from the openafs development > > team who wishes to work on this problem. > > > > Cheers. Steve. > > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From adler@bnl.gov Thu Oct 3 14:00:20 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 09:00:20 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> Message-ID: <1033650020.15413.7.camel@newadler.phy.bnl.gov> How can we help? On Wed, 2002-10-02 at 22:11, Derek Atkins wrote: > Hi, > > We do not support RedHat 8.0 yet. > > We will release an RPM for RH8.0 once it is supported. > > -derek > > "Jesus Delgado" writes: > > > Hi: > > > > Problems when try the build openafs source rpm in redhat 8.0 > > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > > > Errors in openafs-1.2.7 > > [snip] > > > Help me plase > > > > Regards. > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From adler@bnl.gov Thu Oct 3 14:06:08 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 09:06:08 -0400 Subject: [OpenAFS] forgot the attachements.. duhhhh... In-Reply-To: <1033597387.27570.24.camel@cessna.rollanet.org> References: <1033596476.1902.25.camel@newadler.phy.bnl.gov> <1033597387.27570.24.camel@cessna.rollanet.org> Message-ID: <1033650368.15413.10.camel@newadler.phy.bnl.gov> I wouldn't expect the patch to be permanently integrated into the rpm build for the reasons you stated. Basically it's a quick work around so that I can get up and running. I'm very much a novice with m4/autoconf and all that. Steve. On Wed, 2002-10-02 at 18:23, Nathan Neulinger wrote: > The gcc32 patch won't be accepted, as it breaks compiles for older > gcc's. > > It will need to say with the warnings, or add a configure check for what > syntax to use. > > -- Nathan > > On Wed, 2002-10-02 at 17:07, Adler, Stephen wrote: > > long day... > -- > > ------------------------------------------------------------ > Nathan Neulinger EMail: nneul@umr.edu > University of Missouri - Rolla Phone: (573) 341-4841 > Computing Services Fax: (573) 341-4216 > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From nneul@umr.edu Thu Oct 3 14:14:47 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Thu, 3 Oct 2002 08:14:47 -0500 Subject: [OpenAFS] forgot the attachements.. duhhhh... Message-ID: <2B45A04D8F18D947A400F0850CE3B53B060D69@umr-mail7.umr.edu> Problem is - right now, redhat's kernel will not support afs at all due to changes they made that removed support for some facilities that afs requires in order to function properly. If you switch to a virgin/standard kernel build instead of the kernel rpm, it will work ok. You shouldn't need that patch to get it built anyway - they are just warnings, they shouldn't prevent the compile from finishing.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Adler, Stephen [mailto:adler@bnl.gov]=20 > Sent: Thursday, October 03, 2002 8:06 AM > To: Neulinger, Nathan > Cc: openafs-info@openafs.org > Subject: Re: [OpenAFS] forgot the attachements.. duhhhh... >=20 >=20 > I wouldn't expect the patch to be permanently integrated into > the rpm build for the reasons you stated. Basically it's a quick > work around so that I can get up and running. I'm very much a > novice with m4/autoconf and all that. >=20 > Steve. >=20 > On Wed, 2002-10-02 at 18:23, Nathan Neulinger wrote: > > The gcc32 patch won't be accepted, as it breaks compiles for older > > gcc's.=20 > >=20 > > It will need to say with the warnings, or add a configure=20 > check for what > > syntax to use. > >=20 > > -- Nathan > >=20 > > On Wed, 2002-10-02 at 17:07, Adler, Stephen wrote: > > > long day... > > --=20 > >=20 > > ------------------------------------------------------------ > > Nathan Neulinger EMail: nneul@umr.edu > > University of Missouri - Rolla Phone: (573) 341-4841 > > Computing Services Fax: (573) 341-4216 > >=20 > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 >=20 From adler@bnl.gov Thu Oct 3 15:08:28 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 10:08:28 -0400 Subject: [OpenAFS] patching the red hat kernel Message-ID: <1033654108.15481.67.camel@newadler.phy.bnl.gov> Guys, I would like to get afs up and running on my red hat 8.0 system and I'm rather dead in the water right now. One thing I could do is patch the red hat kernel so that call_sys_table is visible again. Does anyone know what it would take to do this? At least I could get going again until an official version comes out from the openafs group. (or is this a waist of my time and I should just be patient...) Cheers. Steve. From nneul@umr.edu Thu Oct 3 15:16:19 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Thu, 3 Oct 2002 09:16:19 -0500 Subject: [OpenAFS] patching the red hat kernel Message-ID: <2B45A04D8F18D947A400F0850CE3B53B060D6F@umr-mail7.umr.edu> If you're willing to do that, you're better off just installing a virgin kernel from kernel.org.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Adler, Stephen [mailto:adler@bnl.gov]=20 > Sent: Thursday, October 03, 2002 9:08 AM > To: openafs-info@openafs.org > Subject: [OpenAFS] patching the red hat kernel >=20 >=20 > Guys, >=20 > I would like to get afs up and running on my red hat 8.0 system and > I'm rather dead in the water right now. One thing I could do is > patch the red hat kernel so that call_sys_table is visible again. > Does anyone know what it would take to do this? At least I could > get going again until an official version comes out from the > openafs group. (or is this a waist of my time and I should just > be patient...) >=20 > Cheers. Steve. >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From warlord@MIT.EDU Thu Oct 3 15:31:02 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 10:31:02 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <1033650020.15413.7.camel@newadler.phy.bnl.gov> References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> <1033650020.15413.7.camel@newadler.phy.bnl.gov> Message-ID: "Adler, Stephen" writes: > How can we help? By being patient... The developers know the problem exists and are trying to determine a workaround. This will take _time_, and the more time we spend responding to email the less time we have to work on the problem. ;) -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 3 15:29:59 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 10:29:59 -0400 Subject: [OpenAFS] patching the red hat kernel In-Reply-To: <1033654108.15481.67.camel@newadler.phy.bnl.gov> References: <1033654108.15481.67.camel@newadler.phy.bnl.gov> Message-ID: You're always welcome to tread off into undiscovered country, but if you choose to do so you are on your own. If it were _ME_ I would wait, but honestly I don't know how long it will be. It might be a couple days, it might be a couple weeks. Is there any particular reason you _NEED_ to use RH8 in your environment NOW NOW NOW? -derek "Adler, Stephen" writes: > Guys, > > I would like to get afs up and running on my red hat 8.0 system and > I'm rather dead in the water right now. One thing I could do is > patch the red hat kernel so that call_sys_table is visible again. > Does anyone know what it would take to do this? At least I could > get going again until an official version comes out from the > openafs group. (or is this a waist of my time and I should just > be patient...) > > Cheers. Steve. > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From schmitt@inf.ethz.ch Thu Oct 3 15:34:09 2002 From: schmitt@inf.ethz.ch (Marc Schmitt) Date: Thu, 03 Oct 2002 16:34:09 +0200 Subject: [OpenAFS] patching the red hat kernel References: <2B45A04D8F18D947A400F0850CE3B53B060D6F@umr-mail7.umr.edu> Message-ID: <3D9C5561.6010804@inf.ethz.ch> What about rebuilding the 2.4.18-10 kernel SRPM, installing the resulting RPMs and then rebuilding the OpenAFS SRPM and installing them? Greetz Marc Neulinger, Nathan wrote: > If you're willing to do that, you're better off just installing a virgin > kernel from kernel.org. > > -- Nathan From nneul@umr.edu Thu Oct 3 15:35:30 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Thu, 3 Oct 2002 09:35:30 -0500 Subject: [OpenAFS] patching the red hat kernel Message-ID: <2B45A04D8F18D947A400F0850CE3B53B060D70@umr-mail7.umr.edu> If 2.4.18-10 was what was previously working with 7.x, yeah, that would likely work just fine.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Marc Schmitt [mailto:schmitt@inf.ethz.ch]=20 > Sent: Thursday, October 03, 2002 9:34 AM > To: Neulinger, Nathan > Cc: Adler, Stephen; openafs-info@openafs.org > Subject: Re: [OpenAFS] patching the red hat kernel >=20 >=20 > What about rebuilding the 2.4.18-10 kernel SRPM, installing the=20 > resulting RPMs and then rebuilding the OpenAFS SRPM and=20 > installing them? >=20 > Greetz > Marc >=20 > Neulinger, Nathan wrote: > > If you're willing to do that, you're better off just=20 > installing a virgin > > kernel from kernel.org.=20 > >=20 > > -- Nathan >=20 >=20 From warlord@MIT.EDU Thu Oct 3 15:55:33 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 10:55:33 -0400 Subject: [OpenAFS] openafs 1.2.7 - mandrake9.0 In-Reply-To: <1033647143.2400.91.camel@localhost.localdomain> References: <1033647143.2400.91.camel@localhost.localdomain> Message-ID: trax writes: > gcc -o aklog aklog.o aklog_main.o aklog_param.o krb_util.o > linked_list.o adderrtable.o -lkrb524 > -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs -lsys -lprot -lubik -lauth -lrxkad -lrx -llwp -ldes -lsys /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a -lresolv -lkrb5 -lk5crypto -lcom_err > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o): In function `add_to_error_table': > error_msg.o(.text+0x220): multiple definition of `add_to_error_table' > adderrtable.o:/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/adderrtable.c:31: first defined here > /usr/bin/ld: Warning: size of symbol `add_to_error_table' changed from > 16 to 49 in > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o) > collect2: ld returned 1 exit status > make: *** [aklog] Error 1 [configure snipped snipped] > I have tried recompiling with gcc2.96 aswell as 3.2, both give the same > result. The problem is clearly a redefinition of add_to_error_table(). The question is why this is happening. Your configure snippet did not show anything interesting. This doesn't happen to me on any of my RH builds. The reason is that on my RH system it's pulling in /usr/kerberos/lib/libcom_err.so instead of .../lib/afs/libcom_err.a! So the problem is how you've changed the build process due to kerberos living in /usr instead of /usr/kerberos. You need to keep the -L/usr (as opposed to -L/usr/kerberos) early in the link path so it pulls in the "right" com_err library. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From jasper@plainspace.com Thu Oct 3 16:40:18 2002 From: jasper@plainspace.com (jasper@plainspace.com) Date: Thu, 3 Oct 2002 17:40:18 +0200 Subject: [OpenAFS] cannot mount root.cell on /afs/cellname Message-ID: <3D9C8102.18337.1681D54@localhost> Hi *, I'm trying to install openafs-1.2.3final2-6 (debian package version) on a GNU/Linux debian 3.0 server with kernel 2.2.20. With the afs-newcell script and a lot of manual configuration I managed to get the servers and the client running and to create root.afs and root.cell When I try to run the afs-rootvol script it stops when it tries to fs mkmount the root.cell volume: fs: File '/afs/ardiden.plainspace.com' doesn't exist also I can't write anything to the /afs directory : /afs# touch x touch: creating `x': No such file or directory My BosLog reads: Thu Oct 3 15:34:18 2002: Server directory access is okay Thu Oct 3 15:34:20 2002: fs:salv exited with code 0 My FileLog reads: Thu Oct 3 15:34:21 2002 File server starting Thu Oct 3 15:34:21 2002 afs_krb_get_lrealm failed, using ardiden.plainspace.com. Thu Oct 3 15:34:21 2002 VL_RegisterAddrs rpc failed; will retry periodically (code=5376, err=4) Thu Oct 3 15:34:22 2002 Partition /vicepa: attached 2 volumes; 0 volumes not attached Thu Oct 3 15:34:22 2002 Getting FileServer name... Thu Oct 3 15:34:22 2002 FileServer host name is 'ardiden' Thu Oct 3 15:34:22 2002 Getting FileServer address... Thu Oct 3 15:34:22 2002 FileServer ardiden has address 192.168.12.2 (0x20ca8c0 or 0xc0a80c02 in host byte order) Thu Oct 3 15:34:22 2002 File Server started Thu Oct 3 15:34:22 2002 fs examine /afs returns: Volume status for vid = 536870948 named root.afs Current disk quota is 5000 Current blocks used are 2 The partition has 30051 blocks available out of 30091 vos examine root.afs returns: root.afs 536870948 RW 2 K On-line ardiden.plainspace.com /vicepa RWrite 536870948 ROnly 0 Backup 0 MaxQuota 5000 K Creation Thu Oct 3 12:19:53 2002 Last Update Thu Oct 3 17:16:39 2002 23 accesses in the past day (i.e., vnode references) RWrite: 536870948 number of sites -> 1 server ardiden.plainspace.com partition /vicepa RW Site vos examine root.cell returns: root.cell 536870951 RW 2 K On-line ardiden.plainspace.com /vicepa RWrite 536870951 ROnly 0 Backup 0 MaxQuota 5000 K Creation Thu Oct 3 12:44:25 2002 Last Update Thu Oct 3 12:44:25 2002 0 accesses in the past day (i.e., vnode references) RWrite: 536870951 number of sites -> 1 server ardiden.plainspace.com partition /vicepa RW Site permissions on the /afs dir are 0775. I guess Kerberos is configured right, tokens returns User's (AFS ID 1) tokens for afs@ardiden.plainspace.com [Expires Oct 4 03:15] This server contains two ethernet-cards and I had to reconfigure the DNS server to return only the ardiden.plainspace.com address and internal ip address and not the external ip address and ISP given internethostname. Does this have to do anything with it? Another thing is that loading the openafs.o kernelmodule makes the kernel complaint about 'tainting' the kernel. Trying to rmmod the openafs.o modules crashes the kernel. Should I upgrade the kernel to 2.4.x and recompile the module? Any help would be greatly appreciated, Jasper den Hertog From traxtopel@HotPOP.com Thu Oct 3 17:37:27 2002 From: traxtopel@HotPOP.com (trax) Date: 03 Oct 2002 18:37:27 +0200 Subject: [OpenAFS] openafs 1.2.7 - mandrake9.0 In-Reply-To: References: <1033647143.2400.91.camel@localhost.localdomain> Message-ID: <1033663130.3795.5.camel@localhost.localdomain> Derek, Actually I shouted to soon using /usr/lib/libcom_err.so creates the files as required. I am gonna try and build the whole package. I will let you know if it works. If anyone wants the srpm, I can post it. On Thu, 2002-10-03 at 16:55, Derek Atkins wrote: > trax writes: > > > gcc -o aklog aklog.o aklog_main.o aklog_param.o krb_util.o > > linked_list.o adderrtable.o -lkrb524 > > -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs -lsys -lprot -lubik -lauth -lrxkad -lrx -llwp -ldes -lsys /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a -lresolv -lkrb5 -lk5crypto -lcom_err > > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o): In function `add_to_error_table': > > error_msg.o(.text+0x220): multiple definition of `add_to_error_table' > > adderrtable.o:/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/adderrtable.c:31: first defined here > > /usr/bin/ld: Warning: size of symbol `add_to_error_table' changed from > > 16 to 49 in > > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o) > > collect2: ld returned 1 exit status > > make: *** [aklog] Error 1 > > [configure snipped snipped] > > > I have tried recompiling with gcc2.96 aswell as 3.2, both give the same > > result. > > The problem is clearly a redefinition of add_to_error_table(). The > question is why this is happening. Your configure snippet did not > show anything interesting. > > This doesn't happen to me on any of my RH builds. The reason is that > on my RH system it's pulling in /usr/kerberos/lib/libcom_err.so > instead of .../lib/afs/libcom_err.a! So the problem is how you've > changed the build process due to kerberos living in /usr instead of > /usr/kerberos. You need to keep the -L/usr (as opposed to > -L/usr/kerberos) early in the link path so it pulls in the "right" > com_err library. > > -derek > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From openafs-info@openafs.org Thu Oct 3 17:49:42 2002 From: openafs-info@openafs.org (Derek Atkins) Date: 03 Oct 2002 12:49:42 -0400 Subject: [OpenAFS] openafs 1.2.7 - mandrake9.0 In-Reply-To: <1033661905.3795.1.camel@localhost.localdomain> References: <1033647143.2400.91.camel@localhost.localdomain> <1033661905.3795.1.camel@localhost.localdomain> Message-ID: Please CC your responses to the list. trax writes: > I am running configure with > > ./configure --prefix=/usr --with-krb5=/usr \ > --with-afs=/usr/src/RPM/BUILD/openafs-1.2.7/i386_linux24/dest That LOOKS reasonable, however... > Which corresponds to what is shown in the rh7.3 spec. > Any further ideas? What's going on is that configure is looking in the default link-path before it tries the --with-krb5= setting. Because kerberos is in the default link-path, it is finding it before it puts in a -L%{krb5lib}. This is an artifact of AC_FIND_LIB and I know of no "correct" workaround. You can try running this command to effect a workaround in your case: env LIBS=-L/usr ./configure .... -derek > On Thu, 2002-10-03 at 16:55, Derek Atkins wrote: > > trax writes: > > > > > gcc -o aklog aklog.o aklog_main.o aklog_param.o krb_util.o > > > linked_list.o adderrtable.o -lkrb524 > > > -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib -L/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs -lsys -lprot -lubik -lauth -lrxkad -lrx -llwp -ldes -lsys /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/util.a -lresolv -lkrb5 -lk5crypto -lcom_err > > > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o): In function `add_to_error_table': > > > error_msg.o(.text+0x220): multiple definition of `add_to_error_table' > > > adderrtable.o:/usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/adderrtable.c:31: first defined here > > > /usr/bin/ld: Warning: size of symbol `add_to_error_table' changed from > > > 16 to 49 in > > > /usr/src/RPM/BUILD/openafs-1.2.7/openafs-krb5-1.3/src/../../i386_linux24/dest//lib/afs/libcom_err.a(error_msg.o) > > > collect2: ld returned 1 exit status > > > make: *** [aklog] Error 1 > > > > [configure snipped snipped] > > > > > I have tried recompiling with gcc2.96 aswell as 3.2, both give the same > > > result. > > > > The problem is clearly a redefinition of add_to_error_table(). The > > question is why this is happening. Your configure snippet did not > > show anything interesting. > > > > This doesn't happen to me on any of my RH builds. The reason is that > > on my RH system it's pulling in /usr/kerberos/lib/libcom_err.so > > instead of .../lib/afs/libcom_err.a! So the problem is how you've > > changed the build process due to kerberos living in /usr instead of > > /usr/kerberos. You need to keep the -L/usr (as opposed to > > -L/usr/kerberos) early in the link path so it pulls in the "right" > > com_err library. > > > > -derek > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From traxtopel@HotPOP.com Thu Oct 3 19:35:18 2002 From: traxtopel@HotPOP.com (trax) Date: 03 Oct 2002 20:35:18 +0200 Subject: [OpenAFS] mandrake 9.0 segmentation fault Message-ID: <1033670164.3973.4.camel@localhost.localdomain> Okay, I have managed to get mdk9.0 to compile, upoun starting afs, I see [root@localhost root]# service afs start Found libafs-2.4.19-16mdksecure-i686.o from SymTable... Loading... Starting AFS services..... /var/log/messages shows ... Oct 3 20:33:28 localhost su(pam_unix)[4100]: session opened for user root by (uid=500) Oct 3 20:34:08 localhost kernel: sock_release(rx_socket) FIXME Oct 3 20:34:08 localhost kernel: AFS: RX failed to initialize. The it just sits there. Am I missing something here? From David.Bear@asu.edu Thu Oct 3 20:01:05 2002 From: David.Bear@asu.edu (David Bear) Date: Thu, 03 Oct 2002 12:01:05 -0700 (MST) Subject: [OpenAFS] windows issues Message-ID: strange happenings with win2k and openafs 1.2.2b. Worked fine yesterday. today, try to get tokens.. always fails. Then from cmd window issue: net stop "IBM AFS Client" net start "IBM AFS Client" stops and starts successfully. Then klog .. works!!! Why? -- David Bear College of Public Programs/ASU 480-965-8257 ...the way is like water, going where nobody wants it to go From David.Bear@asu.edu Thu Oct 3 20:04:50 2002 From: David.Bear@asu.edu (David Bear) Date: Thu, 03 Oct 2002 12:04:50 -0700 (MST) Subject: [OpenAFS] using openafs over wireless Message-ID: Anyone have experience running open-afs on win2k over a wireless nic? we expected lan throughput to be 2-4 mbs. -- David Bear College of Public Programs/ASU 480-965-8257 ...the way is like water, going where nobody wants it to go From adler@bnl.gov Thu Oct 3 20:40:49 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 15:40:49 -0400 Subject: [OpenAFS] sys_call_table symbol Message-ID: <1033674049.7281.25.camel@newadler.phy.bnl.gov> How does the openafs module resolve the sys_call_table symbol? I've built a version of the redhat 8.0 kernel which "exports" this symbol so that it is now in /proc/ksyms. Yet when I went to load the module, I got the unresolved symbol error again. Is there like some kind of command I need to execute which updates some symbol table file somewhere? Or did my attempts at building a kernel which exports sys_call_table fail? Steve. [adler@newadler adler]$ cat /etc/redhat-release Red Hat Linux release 8.0 (Psyche) [adler@newadler adler]$ grep sys_call_table /proc/ksyms c0320d74 sys_call_table_Rsmp_dfdb18bd From slack@quackmaster.net Thu Oct 3 20:43:59 2002 From: slack@quackmaster.net (Jack Neely) Date: Thu, 3 Oct 2002 15:43:59 -0400 Subject: [OpenAFS] locking in OpenAFS 1.2.6 and 1.2.7 Message-ID: <20021003154359.K1217@anduril.pams.ncsu.edu> --NzB8fVQJ5HfG6fxh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi, I've noticed some differences is the locking behavior between 1.2.6 and 1.2.7 using simple fcntl() locking. 1.2.6 had a patch that seemed to fix previous locking problems and it passed my locking tests. 1.2.7 has the same patch but my locking tests do not aquire a lock. My locking test is attached. It's pretty much verbatim out of the openafs bug tracking system. Does any one know what's up here? Thanks Jack Neely -- Jack Neely Linux Realm Kit Administration and Development PAMS Computer Operations at NC State University GPG Fingerprint: 1917 5AC1 E828 9337 7AA4 EA6B 213B 765F 3B6A 5B89 --NzB8fVQJ5HfG6fxh Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="locking_test.c" #include #include #include #define LOCKTYPE(t) (((t) == F_RDLCK) ? "read" : "write") main(argc, argv) int argc; char *argv[]; { int fd; int i; printf("My pid=%d\n", getpid()); for (i=1; i Message-ID: On 3 Oct 2002, Adler, Stephen wrote: > How does the openafs module resolve the sys_call_table symbol? I've > built a version of the redhat 8.0 kernel which "exports" this > symbol so that it is now in /proc/ksyms. Yet when I went to load > the module, I got the unresolved symbol error again. Is there did you rebuild the module against the new kernel headers? > like some kind of command I need to execute which updates some > symbol table file somewhere? Or did my attempts at building > a kernel which exports sys_call_table fail? From warlord@MIT.EDU Thu Oct 3 20:50:21 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 15:50:21 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033674049.7281.25.camel@newadler.phy.bnl.gov> References: <1033674049.7281.25.camel@newadler.phy.bnl.gov> Message-ID: Well, after you rebuilt the kernel did you rebuild the AFS Module? -derek "Adler, Stephen" writes: > How does the openafs module resolve the sys_call_table symbol? I've > built a version of the redhat 8.0 kernel which "exports" this > symbol so that it is now in /proc/ksyms. Yet when I went to load > the module, I got the unresolved symbol error again. Is there > like some kind of command I need to execute which updates some > symbol table file somewhere? Or did my attempts at building > a kernel which exports sys_call_table fail? > > Steve. > > > > [adler@newadler adler]$ cat /etc/redhat-release > Red Hat Linux release 8.0 (Psyche) > [adler@newadler adler]$ grep sys_call_table /proc/ksyms > c0320d74 sys_call_table_Rsmp_dfdb18bd > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From adler@bnl.gov Thu Oct 3 21:02:19 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 16:02:19 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: References: <1033674049.7281.25.camel@newadler.phy.bnl.gov> Message-ID: <1033675339.7281.27.camel@newadler.phy.bnl.gov> The answer is yes. I did rebuild the afs modules. On Thu, 2002-10-03 at 15:50, Derek Atkins wrote: > Well, after you rebuilt the kernel did you rebuild the AFS Module? > > -derek > > "Adler, Stephen" writes: > > > How does the openafs module resolve the sys_call_table symbol? I've > > built a version of the redhat 8.0 kernel which "exports" this > > symbol so that it is now in /proc/ksyms. Yet when I went to load > > the module, I got the unresolved symbol error again. Is there > > like some kind of command I need to execute which updates some > > symbol table file somewhere? Or did my attempts at building > > a kernel which exports sys_call_table fail? > > > > Steve. > > > > > > > > [adler@newadler adler]$ cat /etc/redhat-release > > Red Hat Linux release 8.0 (Psyche) > > [adler@newadler adler]$ grep sys_call_table /proc/ksyms > > c0320d74 sys_call_table_Rsmp_dfdb18bd > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 3 21:03:59 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 16:03:59 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033675339.7281.27.camel@newadler.phy.bnl.gov> References: <1033674049.7281.25.camel@newadler.phy.bnl.gov> <1033675339.7281.27.camel@newadler.phy.bnl.gov> Message-ID: grep sys_call_table /proc/ksyms nm libafs.o | grep sys_call_table -derek "Adler, Stephen" writes: > The answer is yes. I did rebuild the afs modules. > > On Thu, 2002-10-03 at 15:50, Derek Atkins wrote: > > Well, after you rebuilt the kernel did you rebuild the AFS Module? > > > > -derek > > > > "Adler, Stephen" writes: > > > > > How does the openafs module resolve the sys_call_table symbol? I've > > > built a version of the redhat 8.0 kernel which "exports" this > > > symbol so that it is now in /proc/ksyms. Yet when I went to load > > > the module, I got the unresolved symbol error again. Is there > > > like some kind of command I need to execute which updates some > > > symbol table file somewhere? Or did my attempts at building > > > a kernel which exports sys_call_table fail? > > > > > > Steve. > > > > > > > > > > > > [adler@newadler adler]$ cat /etc/redhat-release > > > Red Hat Linux release 8.0 (Psyche) > > > [adler@newadler adler]$ grep sys_call_table /proc/ksyms > > > c0320d74 sys_call_table_Rsmp_dfdb18bd > > > > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From adler@bnl.gov Thu Oct 3 21:07:31 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 16:07:31 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: References: <1033674049.7281.25.camel@newadler.phy.bnl.gov> <1033675339.7281.27.camel@newadler.phy.bnl.gov> Message-ID: <1033675651.7281.29.camel@newadler.phy.bnl.gov> [root@newadler modload]# grep sys_call_table /proc/ksyms c0320d74 sys_call_table_Rsmp_dfdb18bd [root@newadler modload]# nm libafs-2.4.18-14-athlon.mp.o | grep sys_call_table U sys_call_table is it becuase ksyms has the appended _Rsmp_dfdb18bd that libafs module cannot find sys_call_table? On Thu, 2002-10-03 at 16:03, Derek Atkins wrote: > grep sys_call_table /proc/ksyms > nm libafs.o | grep sys_call_table > > -derek > > "Adler, Stephen" writes: > > > The answer is yes. I did rebuild the afs modules. > > > > On Thu, 2002-10-03 at 15:50, Derek Atkins wrote: > > > Well, after you rebuilt the kernel did you rebuild the AFS Module? > > > > > > -derek > > > > > > "Adler, Stephen" writes: > > > > > > > How does the openafs module resolve the sys_call_table symbol? I've > > > > built a version of the redhat 8.0 kernel which "exports" this > > > > symbol so that it is now in /proc/ksyms. Yet when I went to load > > > > the module, I got the unresolved symbol error again. Is there > > > > like some kind of command I need to execute which updates some > > > > symbol table file somewhere? Or did my attempts at building > > > > a kernel which exports sys_call_table fail? > > > > > > > > Steve. > > > > > > > > > > > > > > > > [adler@newadler adler]$ cat /etc/redhat-release > > > > Red Hat Linux release 8.0 (Psyche) > > > > [adler@newadler adler]$ grep sys_call_table /proc/ksyms > > > > c0320d74 sys_call_table_Rsmp_dfdb18bd > > > > > > > > > > > > _______________________________________________ > > > > OpenAFS-info mailing list > > > > OpenAFS-info@openafs.org > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > -- > > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > > Member, MIT Student Information Processing Board (SIPB) > > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > > warlord@MIT.EDU PGP key available > > > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 3 21:09:05 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 16:09:05 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033675651.7281.29.camel@newadler.phy.bnl.gov> References: <1033674049.7281.25.camel@newadler.phy.bnl.gov> <1033675339.7281.27.camel@newadler.phy.bnl.gov> <1033675651.7281.29.camel@newadler.phy.bnl.gov> Message-ID: Yea. did you "make mrproper" before you recompiled your kernel? -derek "Adler, Stephen" writes: > [root@newadler modload]# grep sys_call_table /proc/ksyms > c0320d74 sys_call_table_Rsmp_dfdb18bd > [root@newadler modload]# nm libafs-2.4.18-14-athlon.mp.o | grep > sys_call_table > U sys_call_table > > is it becuase ksyms has the appended _Rsmp_dfdb18bd > that libafs module cannot find sys_call_table? > > On Thu, 2002-10-03 at 16:03, Derek Atkins wrote: > > grep sys_call_table /proc/ksyms > > nm libafs.o | grep sys_call_table > > > > -derek > > > > "Adler, Stephen" writes: > > > > > The answer is yes. I did rebuild the afs modules. > > > > > > On Thu, 2002-10-03 at 15:50, Derek Atkins wrote: > > > > Well, after you rebuilt the kernel did you rebuild the AFS Module? > > > > > > > > -derek > > > > > > > > "Adler, Stephen" writes: > > > > > > > > > How does the openafs module resolve the sys_call_table symbol? I've > > > > > built a version of the redhat 8.0 kernel which "exports" this > > > > > symbol so that it is now in /proc/ksyms. Yet when I went to load > > > > > the module, I got the unresolved symbol error again. Is there > > > > > like some kind of command I need to execute which updates some > > > > > symbol table file somewhere? Or did my attempts at building > > > > > a kernel which exports sys_call_table fail? > > > > > > > > > > Steve. > > > > > > > > > > > > > > > > > > > > [adler@newadler adler]$ cat /etc/redhat-release > > > > > Red Hat Linux release 8.0 (Psyche) > > > > > [adler@newadler adler]$ grep sys_call_table /proc/ksyms > > > > > c0320d74 sys_call_table_Rsmp_dfdb18bd > > > > > > > > > > > > > > > _______________________________________________ > > > > > OpenAFS-info mailing list > > > > > OpenAFS-info@openafs.org > > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > > -- > > > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > > > Member, MIT Student Information Processing Board (SIPB) > > > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > > > warlord@MIT.EDU PGP key available > > > > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Thu Oct 3 21:09:02 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 3 Oct 2002 16:09:02 -0400 (EDT) Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033675651.7281.29.camel@newadler.phy.bnl.gov> Message-ID: On 3 Oct 2002, Adler, Stephen wrote: > [root@newadler modload]# grep sys_call_table /proc/ksyms > c0320d74 sys_call_table_Rsmp_dfdb18bd > [root@newadler modload]# nm libafs-2.4.18-14-athlon.mp.o | grep > sys_call_table > U sys_call_table > > is it becuase ksyms has the appended _Rsmp_dfdb18bd ksyms didn't; the kernel actually uses that name > that libafs module cannot find sys_call_table? Well, yes, but if you built against the right headers the module should have the correct name, instead of the unadorned name From williams@cs.ucr.edu Thu Oct 3 21:07:07 2002 From: williams@cs.ucr.edu (David Williams) Date: Thu, 03 Oct 2002 13:07:07 -0700 Subject: [OpenAFS] mandrake 9.0 segmentation fault References: <1033670164.3973.4.camel@localhost.localdomain> Message-ID: <3D9CA36B.5020108@cs.ucr.edu> I had a similar problem with mdk8.2 and afs 1.2.5. Replacing the mdksecure kernel with a stock one(plus xfs) fixed it for me. david trax wrote: > Okay, I have managed to get mdk9.0 to compile, upoun starting afs, I see > > [root@localhost root]# service afs start > Found libafs-2.4.19-16mdksecure-i686.o from SymTable... Loading... > Starting AFS services..... > > /var/log/messages shows ... > Oct 3 20:33:28 localhost su(pam_unix)[4100]: session opened for user > root by (uid=500) > Oct 3 20:34:08 localhost kernel: sock_release(rx_socket) FIXME > Oct 3 20:34:08 localhost kernel: AFS: RX failed to initialize. > > The it just sits there. Am I missing something here? > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From adler@bnl.gov Thu Oct 3 21:14:38 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 16:14:38 -0400 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: References: Message-ID: <1033676078.26364.32.camel@newadler.phy.bnl.gov> sorry for the stupid questions guys!!! where do I find the headers? I'm trying to figure out if I need to install a separate headers rpm or the kernel source rpm.... Should they be in /usr/src/linux-2.4? On Thu, 2002-10-03 at 16:09, Derrick J Brashear wrote: > On 3 Oct 2002, Adler, Stephen wrote: > > > [root@newadler modload]# grep sys_call_table /proc/ksyms > > c0320d74 sys_call_table_Rsmp_dfdb18bd > > [root@newadler modload]# nm libafs-2.4.18-14-athlon.mp.o | grep > > sys_call_table > > U sys_call_table > > > > is it becuase ksyms has the appended _Rsmp_dfdb18bd > > ksyms didn't; the kernel actually uses that name > > > that libafs module cannot find sys_call_table? > > Well, yes, but if you built against the right headers the module should > have the correct name, instead of the unadorned name > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From shadow@dementia.org Thu Oct 3 21:16:50 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 3 Oct 2002 16:16:50 -0400 (EDT) Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033676078.26364.32.camel@newadler.phy.bnl.gov> Message-ID: On 3 Oct 2002, Adler, Stephen wrote: > sorry for the stupid questions guys!!! where do I find the > headers? I'm trying to figure out if I need to install a > separate headers rpm or the kernel source rpm.... Should > they be in /usr/src/linux-2.4? they're in the kernel you built. where did you build your kernel? give that directory as an argument to configure's --with-linux-kernel-headers= From shadow@dementia.org Thu Oct 3 21:31:45 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 3 Oct 2002 16:31:45 -0400 (EDT) Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033676537.7281.35.camel@newadler.phy.bnl.gov> Message-ID: you should reply to the list, not me On 3 Oct 2002, Adler, Stephen wrote: > I believe you answered the question indirectly. I've installed > the newly built kernel source rpm and rebuilding afs. Lets see > if this fixes it... Is there a particular file within the > source tree that I should look for which tells me if this build > will pickup the full symbol for sys_call_table? somewhere in include/linux/modules; there are lots of .ver files. grep for sys_call_table in that directory From kolya@MIT.EDU Thu Oct 3 21:30:27 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Thu, 03 Oct 2002 16:30:27 -0400 Subject: [OpenAFS] locking in OpenAFS 1.2.6 and 1.2.7 Message-ID: <200210032030.QAA03592@contents-vnder-pressvre.mit.edu> > I've noticed some differences is the locking behavior between 1.2.6 and > 1.2.7 using simple fcntl() locking. 1.2.6 had a patch that seemed to > fix previous locking problems and it passed my locking tests. 1.2.7 has > the same patch but my locking tests do not aquire a lock. Can you be a little more verbose about your problem? The program you attached simply displays the lock status of given files, and appears to do so correctly for me on a sun4x_56 running OpenAFS 1.2.7, as well as a Linux machine running OpenAFS cvs-head. -- kolya From adler@bnl.gov Thu Oct 3 21:50:32 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 16:50:32 -0400 Subject: [OpenAFS] OMG it works!!!! (i.e. openafs 1.2.7 on redhat 8.0) Message-ID: <1033678232.8446.2.camel@newadler.phy.bnl.gov> Well... after a lot of back and forth with the afs guys, its done!!! I got a special version of the red hat 8.0 kernel built along with open afs 1.2.7. I'll put my work on my ftp site soon so that others can use this work around for now. (will follow another post to this e-mail list when the rpms are available for upload.) Cheers to openafs and open source! Steve. From shadow@dementia.org Thu Oct 3 21:57:29 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 3 Oct 2002 16:57:29 -0400 (EDT) Subject: [OpenAFS] workaround for RedHat 8 Message-ID: This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to mime@docserver.cac.washington.edu for more info. --42002020-1449831134-1033678649=:2629 Content-Type: TEXT/PLAIN; charset=US-ASCII Chaskiel Grundman wrote this patch, which basically figures out where the sys_call_table is and uses it anyway. It's evil. Use it if you like. I'm waiting for the first objector (to this method) so I can laugh at them. If you provide your phone number I'll be happy to actually call you and laugh at you for a while. --42002020-1449831134-1033678649=:2629 Content-Type: TEXT/PLAIN; charset=US-ASCII; name="rh8-stable.diff" Content-Transfer-Encoding: BASE64 Content-ID: Content-Description: ZGlmZiAteCBjb25maWd1cmUtbGliYWZzIC14IGNvbmZpZ3VyZSAteCBhY2xv Y2FsLm00IC14IGNvbmZpZy5oaW4gLXJ1TiBvcGVuYWZzLTEuMi43LW9yaWcv YWNjb25maWcuaCBvcGVuYWZzLTEuMi43L2FjY29uZmlnLmgNCi0tLSBvcGVu YWZzLTEuMi43LW9yaWcvYWNjb25maWcuaAkyMDAyLTA5LTExIDAzOjAyOjE1 LjAwMDAwMDAwMCAtMDQwMA0KKysrIG9wZW5hZnMtMS4yLjcvYWNjb25maWcu aAkyMDAyLTEwLTAzIDEyOjE5OjM3LjAwMDAwMDAwMCAtMDQwMA0KQEAgLTM2 LDYgKzM2LDcgQEANCiAjdW5kZWYgU1RSVUNUX0lOT0RFX0hBU19JX0RJUlRZ X0RBVEFfQlVGRkVSUw0KICN1bmRlZiBTVFJVQ1RfSU5PREVfSEFTX0lfREVW SUNFUw0KICN1bmRlZiBFWFBPUlRFRF9UQVNLTElTVF9MT0NLDQorI3VuZGVm IEVYUE9SVEVEX1NZU19DQUxMX1RBQkxFDQogI3VuZGVmIENPTVBMRVRJT05f SF9FWElTVFMNCiAjdW5kZWYgc3NpemVfdA0KIA0KZGlmZiAteCBjb25maWd1 cmUtbGliYWZzIC14IGNvbmZpZ3VyZSAteCBhY2xvY2FsLm00IC14IGNvbmZp Zy5oaW4gLXJ1TiBvcGVuYWZzLTEuMi43LW9yaWcvYWNpbmNsdWRlLm00IG9w ZW5hZnMtMS4yLjcvYWNpbmNsdWRlLm00DQotLS0gb3BlbmFmcy0xLjIuNy1v cmlnL2FjaW5jbHVkZS5tNAkyMDAyLTA5LTI1IDIzOjQ4OjUyLjAwMDAwMDAw MCAtMDQwMA0KKysrIG9wZW5hZnMtMS4yLjcvYWNpbmNsdWRlLm00CTIwMDIt MTAtMDMgMTM6MDY6NDEuMDAwMDAwMDAwIC0wNDAwDQpAQCAtMTMwLDYgKzEz MCwxMiBAQA0KIAkJCU9NSVRfRlJBTUVfUE9JTlRFUj0tZm9taXQtZnJhbWUt cG9pbnRlcg0KIAkJIGZpDQogCQkgQUNfU1VCU1QoT01JVF9GUkFNRV9QT0lO VEVSKQ0KKwkJIE9QRU5BRlNfR0NDX1NVUFBPUlRTX01BUkNIDQorCQkgQUNf U1VCU1QoWDg2X0tPUFRTKQ0KKwkJIE9QRU5BRlNfR0NDX05FRURTX05PX1NU UkVOR1RIX1JFRFVDRQ0KKwkJIE9QRU5BRlNfR0NDX05FRURTX05PX1NUUklD VF9BTElBU0lORw0KKwkJIE9QRU5BRlNfR0NDX1NVUFBPUlRTX05PX0NPTU1P Tg0KKwkJIEFDX1NVQlNUKExJTlVYX0dDQ19LT1BUUykNCiAJICAgICAgICAg aWZkZWYoW09QRU5BRlNfQ09ORklHVVJFX0xJQkFGU10sDQogCSAgICAgICAg ICAgW0xJTlVYX0JVSUxEX1ZOT0RFX0ZST01fSU5PREUoY29uZmlnLGFmcyld LA0KIAkgICAgICAgICAgIFtMSU5VWF9CVUlMRF9WTk9ERV9GUk9NX0lOT0RF KHNyYy9jb25maWcsc3JjL2Fmcy9MSU5VWCldDQpAQCAtMTQ0LDkgKzE1MCwy MiBAQA0KIAkJIExJTlVYX0VYUE9SVFNfVEFTS0xJU1RfTE9DSw0KIAkJIExJ TlVYX05FRURfUkhDT05GSUcNCiAJCSBMSU5VWF9XSElDSF9NT0RVTEVTDQor CQkgaWYgdGVzdCAiJGFjX2N2X2xpbnV4X2NvbmZpZ19tb2R2ZXJzaW9ucyIg PSAieG5vIjsgdGhlbg0KKwkJICAgQUNfTVNHX1dBUk4oW0Nhbm5vdCBkZXRl cm1pbmUgc3lzX2NhbGxfdGFibGUgc3RhdHVzLiBhc3N1bWluZyBpdCdzIGV4 cG9ydGVkXSkNCisJCSBlbHNlDQorCQkgICBMSU5VWF9FWFBPUlRTX1NZU19D QUxMX1RBQkxFDQorCQkgICBMSU5VWF9LQUxMU1lNUw0KKwkJICAgaWYgdGVz dCAieCRhY19jdl9saW51eF9leHBvcnRzX3N5c19jYWxsX3RhYmxlIiA9ICJ4 bm8iIC1hIFwNCisJCQkgIngkYWNfY3ZfbGludXhfa2FsbHN5bXMiID0gInhu byI7IHRoZW4NCisJCQlBQ19NU0dfRVJST1IoW25vIGF2YWlsYWJsZSBzeXNf Y2FsbF90YWJsZSBhY2Nlc3MgbWV0aG9kXSkNCisJCSAgIGZpDQorCQkgZmkN CiAJCSBpZiB0ZXN0ICJ4JGFjX2N2X2xpbnV4X2V4cG9ydHNfdGFza2xpc3Rf bG9jayIgPSAieHllcyIgOyB0aGVuDQogCQkgIEFDX0RFRklORShFWFBPUlRF RF9UQVNLTElTVF9MT0NLKQ0KIAkJIGZpDQorCQkgaWYgdGVzdCAieCRhY19j dl9saW51eF9leHBvcnRzX3N5c19jYWxsX3RhYmxlIiA9ICJ4eWVzIjsgdGhl bg0KKwkJICBBQ19ERUZJTkUoRVhQT1JURURfU1lTX0NBTExfVEFCTEUpDQor CQkgZmkNCiAJCSBpZiB0ZXN0ICJ4JGFjX2N2X2xpbnV4X2NvbXBsZXRpb25f aF9leGlzdHMiID0gInh5ZXMiIDsgdGhlbg0KIAkJICBBQ19ERUZJTkUoQ09N UExFVElPTl9IX0VYSVNUUykNCiAJCSBmaQ0KZGlmZiAteCBjb25maWd1cmUt bGliYWZzIC14IGNvbmZpZ3VyZSAteCBhY2xvY2FsLm00IC14IGNvbmZpZy5o aW4gLXJ1TiBvcGVuYWZzLTEuMi43LW9yaWcvc3JjL2Fmcy9MSU5VWC9vc2lf bW9kdWxlLmMgb3BlbmFmcy0xLjIuNy9zcmMvYWZzL0xJTlVYL29zaV9tb2R1 bGUuYw0KLS0tIG9wZW5hZnMtMS4yLjctb3JpZy9zcmMvYWZzL0xJTlVYL29z aV9tb2R1bGUuYwkyMDAyLTA1LTAyIDExOjM4OjQ1LjAwMDAwMDAwMCAtMDQw MA0KKysrIG9wZW5hZnMtMS4yLjcvc3JjL2Fmcy9MSU5VWC9vc2lfbW9kdWxl LmMJMjAwMi0xMC0wMyAxMjoyNjowNC4wMDAwMDAwMDAgLTA0MDANCkBAIC00 MCwxMSArNDAsMTkgQEANCiBhc21saW5rYWdlIGludCAoKnN5c19raWxscCko aW50IHBpZCwgaW50IHNpZ25hbCk7DQogYXNtbGlua2FnZSBsb25nICgqc3lz X3NldGdyb3Vwc3ApKGludCBnaWRzZXRzaXplLCBnaWRfdCAqZ3JvdXBsaXN0 KTsNCiANCisjaWZkZWYgRVhQT1JURURfU1lTX0NBTExfVEFCTEUNCiAjaWZk ZWYgQUZTX1NQQVJDNjRfTElOVVgyMF9FTlYNCiBleHRlcm4gdW5zaWduZWQg aW50IHN5c19jYWxsX3RhYmxlW107ICAvKiBjaGFuZ2VkIHRvIHVpbnQgYmVj YXVzZSBTUEFSQzY0IGhhcyBzeXNjYWx0YWJsZSBvZiAzMmJpdCBpdGVtcyAq Lw0KICNlbHNlDQogZXh0ZXJuIHZvaWQgKiBzeXNfY2FsbF90YWJsZVtdOyAv KiBzYWZlciBmb3Igb3RoZXIgbGludWNlcyAqLw0KICNlbmRpZg0KKyNlbHNl IC8qIEVYUE9SVEVEX1NZU19DQUxMX1RBQkxFICovDQorI2lmZGVmIEFGU19T UEFSQzY0X0xJTlVYMjBfRU5WDQorc3RhdGljIHVuc2lnbmVkIGludCAqc3lz X2NhbGxfdGFibGU7ICAvKiBjaGFuZ2VkIHRvIHVpbnQgYmVjYXVzZSBTUEFS QzY0IGhhcyBzeXNjYWx0YWJsZSBvZiAzMmJpdCBpdGVtcyAqLw0KKyNlbHNl DQorc3RhdGljIHZvaWQgKiogc3lzX2NhbGxfdGFibGU7IC8qIHNhZmVyIGZv ciBvdGhlciBsaW51Y2VzICovDQorI2VuZGlmDQorI2VuZGlmDQogZXh0ZXJu IHN0cnVjdCBmaWxlX3N5c3RlbV90eXBlIGFmc19maWxlX3N5c3RlbTsNCiAN CiBzdGF0aWMgbG9uZyBnZXRfcGFnZV9vZmZzZXQodm9pZCk7DQpAQCAtNzIs NyArODAsMTEgQEANCiAjaWYgZGVmaW5lZChfX05SX3NldGdyb3VwczMyKQ0K IGFzbWxpbmthZ2UgaW50ICgqc3lzMzJfc2V0Z3JvdXBzMzJwKShpbnQgZ2lk c2V0c2l6ZSwgX19rZXJuZWxfZ2lkX3QzMiAqZ3JvdXBsaXN0KTsNCiAjZW5k aWYNCisjaWZkZWYgRVhQT1JURURfU1lTX0NBTExfVEFCTEUNCiBleHRlcm4g dW5zaWduZWQgaW50IHN5c19jYWxsX3RhYmxlMzJbXTsNCisjZWxzZQ0KK3N0 YXRpYyB1bnNpZ25lZCBpbnQgKnN5c19jYWxsX3RhYmxlMzI7DQorI2VuZGlm DQogDQogYXNtbGlua2FnZSBpbnQgYWZzX3N5c2NhbGwzMihsb25nIHN5c2Nh bGwsIGxvbmcgcGFybTEsIGxvbmcgcGFybTIsIGxvbmcgcGFybTMsDQogCQkJ ICAgICBsb25nIHBhcm00LCBsb25nIHBhcm01KQ0KQEAgLTIwMCw2ICsyMTIs MjEgQEANCiAjZW5kaWYNCiAjZW5kaWYNCiANCisjaWZuZGVmIEVYUE9SVEVE X1NZU19DQUxMX1RBQkxFDQorICAgIGludCByZXQ7DQorICAgIHVuc2lnbmVk IGxvbmcgdG9rZW47DQorICAgIGNoYXIgICAgICAqbW9kX25hbWU7DQorICAg IHVuc2lnbmVkIGxvbmcgICAgbW9kX3N0YXJ0Ow0KKyAgICB1bnNpZ25lZCBs b25nICAgIG1vZF9lbmQ7DQorICAgIGNoYXIgICAgICAqc2VjX25hbWU7DQor ICAgIHVuc2lnbmVkIGxvbmcgICAgc2VjX3N0YXJ0Ow0KKyAgICB1bnNpZ25l ZCBsb25nICAgIHNlY19lbmQ7DQorICAgIGNoYXIgICAgICAqc3ltX25hbWU7 DQorICAgIHVuc2lnbmVkIGxvbmcgICAgc3ltX3N0YXJ0Ow0KKyAgICB1bnNp Z25lZCBsb25nICAgIHN5bV9lbmQ7DQorI2VuZGlmDQorDQorDQogDQogDQog ICAgIC8qIG9idGFpbiBQQUdFX09GRlNFVCB2YWx1ZSAqLw0KQEAgLTIxMyw2 ICsyNDAsNTQgQEANCiAgICAgfQ0KICNlbmRpZg0KIA0KKyNpZm5kZWYgRVhQ T1JURURfU1lTX0NBTExfVEFCTEUNCisgICAgcmV0PTE7DQorICAgIHRva2Vu PTA7DQorICAgIHdoaWxlIChyZXQpIHsNCisgICAgCXN5bV9zdGFydD0wOw0K KyAgICAJcmV0PWthbGxzeW1zX3N5bWJvbF90b19hZGRyZXNzKCJzeXNfY2Fs bF90YWJsZSIsICZ0b2tlbiwgJm1vZF9uYW1lLA0KKwkJICAgIAkmbW9kX3N0 YXJ0LCAmbW9kX2VuZCwgJnNlY19uYW1lLCAmc2VjX3N0YXJ0LCAmc2VjX2Vu ZCwNCisJCSAgICAJJnN5bV9uYW1lLCAmc3ltX3N0YXJ0LCAmc3ltX2VuZCk7 DQorCWlmIChyZXQgJiYgIXN0cmNtcChtb2RfbmFtZSwgImtlcm5lbCIpKQ0K KwkJYnJlYWs7DQorICAgIH0NCisgICAgaWYgKCFyZXQgfHwgIXN5bV9zdGFy dCkgew0KKwkgICAgcHJpbnRmKCJGYWlsZWQgdG8gZmluZCBhZGRyZXNzIG9m IHN5c19jYWxsX3RhYmxlXG4iLCByZXQpOw0KKwkgICAgcmV0dXJuIC1FSU87 DQorICAgIH0NCisjaWYgMA0KKyAgICBwcmludGYoIiVzIGlzIGluIG1vZHVs ZSAlcyBzZWN0aW9uICVzIG9mZnNldCAweCVseCBsZW5ndGggJWRcbiIsIHN5 bV9uYW1lLA0KKwkJICAgIG1vZF9uYW1lLCBzZWNfbmFtZSwgc3ltX3N0YXJ0 LCBzeW1fZW5kLXN5bV9zdGFydCk7DQorICAgIHN5c19jYWxsX3RhYmxlPSh2 b2lkICopc3ltX3N0YXJ0Ow0KKyAgICBpZiAoc3lzX2NhbGxfdGFibGVbX19O Ul9vcGVuXSA9PSBzeXNfb3Blbikgew0KKwkgICAgcHJpbnRmKCJzeXNfY2Fs bF90YWJsZSBzZWVtcyBvay4gc3lzX29wZW4gaXMgYXQgMHglbHhcbiIsDQor CQkJICAgICh1bnNpZ25lZCBsb25nKXN5c19jYWxsX3RhYmxlW19fTlJfb3Bl bl0pOw0KKyAgICB9IGVsc2Ugew0KKwkgICAgcHJpbnRmKCJzeXNfY2FsbF90 YWJsZSBpcyBub3Qgb2suIHN5c19vcGVuIGlzIGF0IDB4JWx4LCBidXQgd2Ug c2VlIGl0IGF0IDB4JWx4XG4iLCAodW5zaWduZWQgbG9uZykodm9pZCAqKXN5 c19vcGVuLCAodW5zaWduZWQgbG9uZylzeXNfY2FsbF90YWJsZVtfX05SX29w ZW5dKTsNCisgICAgfQ0KKyAgICByZXR1cm4gLUVJTzsNCisjZWxzZQ0KKyAg ICBzeXNfY2FsbF90YWJsZT0odm9pZCAqKXN5bV9zdGFydDsNCisjZW5kaWYN CisjIGlmZGVmIEFGU19TUEFSQzY0X0xJTlVYMjBfRU5WDQorICAgIHJldD0x Ow0KKyAgICB0b2tlbj0wOw0KKyAgICB3aGlsZSAocmV0KSB7DQorICAgIAlz eW1fc3RhcnQ9MDsNCisgICAgCXJldD1rYWxsc3ltc19zeW1ib2xfdG9fYWRk cmVzcygic3lzX2NhbGxfdGFibGUzMiIsICZ0b2tlbiwgJm1vZF9uYW1lLA0K KwkJICAgIAkmbW9kX3N0YXJ0LCAmbW9kX2VuZCwgJnNlY19uYW1lLCAmc2Vj X3N0YXJ0LCAmc2VjX2VuZCwNCisJCSAgICAJJnN5bV9uYW1lLCAmc3ltX3N0 YXJ0LCAmc3ltX2VuZCk7DQorCWlmIChyZXQgJiYgIXN0cmNtcChtb2RfbmFt ZSwgImtlcm5lbCIpKQ0KKwkJYnJlYWs7DQorICAgIH0NCisgICAgaWYgKCFy ZXQgfHwgIXN5bV9zdGFydCkgew0KKwkgICAgcHJpbnRmKCJGYWlsZWQgdG8g ZmluZCBhZGRyZXNzIG9mIHN5c19jYWxsX3RhYmxlMzJcbiIsIHJldCk7DQor CSAgICByZXR1cm4gLUVJTzsNCisgICAgfQ0KKyAgICBzeXNfY2FsbF90YWJs ZTMyPXN5bV9zdGFydDsNCisjZW5kaWYNCisjZW5kaWYNCisNCiAgICAgLyog SW5pdGlhbGl6ZSBwb2ludGVycyB0byBrZXJuZWwgc3lzY2FsbHMuICovDQog I2lmIGRlZmluZWQoQUZTX0lBNjRfTElOVVgyMF9FTlYpDQogICAgIGtlcm5l bF9ncCA9ICgoc3RydWN0IGZwdHIgKilwcmludGspLT5ncDsNCmRpZmYgLXgg Y29uZmlndXJlLWxpYmFmcyAteCBjb25maWd1cmUgLXggYWNsb2NhbC5tNCAt eCBjb25maWcuaGluIC1ydU4gb3BlbmFmcy0xLjIuNy1vcmlnL3NyYy9jZi9s aW51eC10ZXN0NC5tNCBvcGVuYWZzLTEuMi43L3NyYy9jZi9saW51eC10ZXN0 NC5tNA0KLS0tIG9wZW5hZnMtMS4yLjctb3JpZy9zcmMvY2YvbGludXgtdGVz dDQubTQJMjAwMi0wOS0xMSAwMzowMjo1MS4wMDAwMDAwMDAgLTA0MDANCisr KyBvcGVuYWZzLTEuMi43L3NyYy9jZi9saW51eC10ZXN0NC5tNAkyMDAyLTEw LTAzIDExOjM5OjU4LjAwMDAwMDAwMCAtMDQwMA0KQEAgLTE0LDYgKzE0LDM4 IEBADQogQUNfTVNHX1JFU1VMVCgkYWNfY3ZfbGludXhfZXhwb3J0c190YXNr bGlzdF9sb2NrKQ0KIENQUEZMQUdTPSIkc2F2ZV9DUFBGTEFHUyJdKQ0KIA0K K0FDX0RFRlVOKExJTlVYX0VYUE9SVFNfU1lTX0NBTExfVEFCTEUsIFsNCitB Q19NU0dfQ0hFQ0tJTkcoZm9yIGV4cG9ydGVkIHN5c19jYWxsX3RhYmxlKQ0K K3NhdmVfQ1BQRkxBR1M9IiRDUFBGTEFHUyINCitDUFBGTEFHUz0iLUkke0xJ TlVYX0tFUk5FTF9QQVRIfS9pbmNsdWRlIC1EX19LRVJORUxfXyAkQ1BQRkxB R1MiDQorQUNfQ0FDSEVfVkFMKGFjX2N2X2xpbnV4X2V4cG9ydHNfc3lzX2Nh bGxfdGFibGUsDQorWw0KK0FDX1RSWV9DT01QSUxFKA0KK1sjaW5jbHVkZSA8 bGludXgvbW9kdmVyc2lvbnMuaD5dLA0KK1sjaWZuZGVmIF9fdmVyX3N5c19j YWxsX3RhYmxlDQorI2Vycm9yIHN5c19jYWxsX3RhYmxlIG5vdCBleHBvcnRl ZA0KKyNlbmRpZl0sDQorYWNfY3ZfbGludXhfZXhwb3J0c19zeXNfY2FsbF90 YWJsZT15ZXMsDQorYWNfY3ZfbGludXhfZXhwb3J0c19zeXNfY2FsbF90YWJs ZT1ubyldKQ0KK0FDX01TR19SRVNVTFQoJGFjX2N2X2xpbnV4X2V4cG9ydHNf c3lzX2NhbGxfdGFibGUpDQorQ1BQRkxBR1M9IiRzYXZlX0NQUEZMQUdTIl0p DQorDQorQUNfREVGVU4oTElOVVhfS0FMTFNZTVMsIFsNCitBQ19NU0dfQ0hF Q0tJTkcoZm9yIGthbGxzeW1zIHN1cHBvcnQpDQorc2F2ZV9DUFBGTEFHUz0i JENQUEZMQUdTIg0KK0NQUEZMQUdTPSItSSR7TElOVVhfS0VSTkVMX1BBVEh9 L2luY2x1ZGUgLURfX0tFUk5FTF9fICRDUFBGTEFHUyINCitBQ19DQUNIRV9W QUwoYWNfY3ZfbGludXhfa2FsbHN5bXMsDQorWw0KK0FDX1RSWV9DT01QSUxF KA0KK1sjaW5jbHVkZSA8bGludXgvY29uZmlnLmg+XSwNCitbI2lmbmRlZiBD T05GSUdfS0FMTFNZTVMNCisjZXJyb3Igbm8ga2FsbHN5bXMNCisjZW5kaWZd LA0KK2FjX2N2X2xpbnV4X2thbGxzeW1zPXllcywNCithY19jdl9saW51eF9r YWxsc3ltcz1ubyldKQ0KK0FDX01TR19SRVNVTFQoJGFjX2N2X2xpbnV4X2th bGxzeW1zKQ0KK0NQUEZMQUdTPSIkc2F2ZV9DUFBGTEFHUyJdKQ0KKw0KIEFD X0RFRlVOKExJTlVYX0NPTVBMRVRJT05fSF9FWElTVFMsIFsNCiBBQ19NU0df Q0hFQ0tJTkcoZm9yIGxpbnV4L2NvbXBsZXRpb24uaCBleGlzdGFuY2UpDQog c2F2ZV9DUFBGTEFHUz0iJENQUEZMQUdTIg0KZGlmZiAteCBjb25maWd1cmUt bGliYWZzIC14IGNvbmZpZ3VyZSAteCBhY2xvY2FsLm00IC14IGNvbmZpZy5o aW4gLXJ1TiBvcGVuYWZzLTEuMi43LW9yaWcvc3JjL2NmL2xpbnV4LXRlc3Q1 Lm00IG9wZW5hZnMtMS4yLjcvc3JjL2NmL2xpbnV4LXRlc3Q1Lm00DQotLS0g b3BlbmFmcy0xLjIuNy1vcmlnL3NyYy9jZi9saW51eC10ZXN0NS5tNAkxOTY5 LTEyLTMxIDE5OjAwOjAwLjAwMDAwMDAwMCAtMDUwMA0KKysrIG9wZW5hZnMt MS4yLjcvc3JjL2NmL2xpbnV4LXRlc3Q1Lm00CTIwMDItMTAtMDMgMTI6MTk6 MDkuMDAwMDAwMDAwIC0wNDAwDQpAQCAtMCwwICsxLDcxIEBADQorDQorQUNf REVGVU4oT1BFTkFGU19HQ0NfU1VQUE9SVFNfTUFSQ0gsIFsNCitBQ19NU0df Q0hFQ0tJTkcoaWYgJENDIGFjY2VwdHMgLW1hcmNoPXBlbnRpdW0pDQorc2F2 ZV9DRkxBR1M9IiRDRkxBR1MiDQorQ0ZMQUdTPSItTUFSQ0g9cGVudGl1bSIN CitBQ19DQUNIRV9WQUwob3BlbmFmc19nY2Nfc3VwcG9ydHNfbWFyY2gsWw0K K0FDX1RSWV9DT01QSUxFKA0KK1tdLA0KK1tpbnQgeDtdLA0KK29wZW5hZnNf Z2NjX3N1cHBvcnRzX21hcmNoPXllcywNCitvcGVuYWZzX2djY19zdXBwb3J0 c19tYXJjaD1ubyldKQ0KK0FDX01TR19SRVNVTFQoJG9wZW5hZnNfZ2NjX3N1 cHBvcnRzX21hcmNoKQ0KK2lmIHRlc3QgeCRvcGVuYWZzX2djY19zdXBwb3J0 c19tYXJjaCA9IHh5ZXM7IHRoZW4NCisgIFg4Nl9LT1BUUz0iLW1hcmNoPXBl bnRpdW0iDQorZWxzZQ0KKyAgWDg2X0tPUFRTPSItbTQ4NiAtbWFsaWduLWxv b3BzPTIgLW1hbGlnbi1qdW1wcz0yIC1tYWxpZ24tZnVuY3Rpb25zPTIiDQor ZmkNCitDRkxBR1M9IiRzYXZlX0NGTEFHUyINCitdKQ0KKw0KK0FDX0RFRlVO KE9QRU5BRlNfR0NDX05FRURTX05PX1NUUklDVF9BTElBU0lORywgWw0KK0FD X01TR19DSEVDS0lORyhpZiAkQ0MgbmVlZHMgLWZuby1zdHJpY3QtYWxpYXNp bmcpDQorc2F2ZV9DRkxBR1M9IiRDRkxBR1MiDQorQ0ZMQUdTPSItZm5vLXN0 cmljdC1hbGlhc2luZyINCitBQ19DQUNIRV9WQUwob3BlbmFmc19nY2NfbmVl ZHNfbm9fc3RyaWN0X2FsaWFzaW5nLFsNCitBQ19UUllfQ09NUElMRSgNCitb XSwNCitbaW50IHg7XSwNCitvcGVuYWZzX2djY19uZWVkc19ub19zdHJpY3Rf YWxpYXNpbmc9eWVzLA0KK29wZW5hZnNfZ2NjX25lZWRzX25vX3N0cmljdF9h bGlhc2luZz1ubyldKQ0KK0FDX01TR19SRVNVTFQoJG9wZW5hZnNfZ2NjX25l ZWRzX25vX3N0cmljdF9hbGlhc2luZykNCitpZiB0ZXN0IHgkb3BlbmFmc19n Y2NfbmVlZHNfbm9fc3RyaWN0X2FsaWFzaW5nID0geHllczsgdGhlbg0KKyAg TElOVVhfR0NDX0tPUFRTPSIkTElOVVhfR0NDX0tPUFRTIC1mbm8tc3RyaWN0 LWFsaWFzaW5nIg0KK2ZpDQorQ0ZMQUdTPSIkc2F2ZV9DRkxBR1MiDQorXSkN CisNCitBQ19ERUZVTihPUEVOQUZTX0dDQ19ORUVEU19OT19TVFJFTkdUSF9S RURVQ0UsIFsNCitBQ19NU0dfQ0hFQ0tJTkcoaWYgJENDIG5lZWRzIC1mbm8t c3RyZW5ndGgtcmVkdWNlKQ0KK3NhdmVfQ0ZMQUdTPSIkQ0ZMQUdTIg0KK0NG TEFHUz0iLWZuby1zdHJlbmd0aC1yZWR1Y2UiDQorQUNfQ0FDSEVfVkFMKG9w ZW5hZnNfZ2NjX25lZWRzX25vX3N0cmVuZ3RoX3JlZHVjZSxbDQorQUNfVFJZ X0NPTVBJTEUoDQorW10sDQorW2ludCB4O10sDQorb3BlbmFmc19nY2NfbmVl ZHNfbm9fc3RyZW5ndGhfcmVkdWNlPXllcywNCitvcGVuYWZzX2djY19uZWVk c19ub19zdHJlbmd0aF9yZWR1Y2U9bm8pXSkNCitBQ19NU0dfUkVTVUxUKCRv cGVuYWZzX2djY19uZWVkc19ub19zdHJlbmd0aF9yZWR1Y2UpDQoraWYgdGVz dCB4JG9wZW5hZnNfZ2NjX25lZWRzX25vX3N0cmVuZ3RoX3JlZHVjZSA9IHh5 ZXM7IHRoZW4NCisgIExJTlVYX0dDQ19LT1BUUz0iJExJTlVYX0dDQ19LT1BU UyAtZm5vLXN0cmVuZ3RoLXJlZHVjZSINCitmaQ0KK0NGTEFHUz0iJHNhdmVf Q0ZMQUdTIg0KK10pDQorDQorQUNfREVGVU4oT1BFTkFGU19HQ0NfU1VQUE9S VFNfTk9fQ09NTU9OLCBbDQorQUNfTVNHX0NIRUNLSU5HKGlmICRDQyBzdXBw b3J0cyAtZm5vLWNvbW1vbikNCitzYXZlX0NGTEFHUz0iJENGTEFHUyINCitD RkxBR1M9Ii1mbm8tY29tbW9uIg0KK0FDX0NBQ0hFX1ZBTChvcGVuYWZzX2dj Y19zdXBwb3J0c19ub19jb21tb24sWw0KK0FDX1RSWV9DT01QSUxFKA0KK1td LA0KK1tpbnQgeDtdLA0KK29wZW5hZnNfZ2NjX3N1cHBvcnRzX25vX2NvbW1v bj15ZXMsDQorb3BlbmFmc19nY2Nfc3VwcG9ydHNfbm9fY29tbW9uPW5vKV0p DQorQUNfTVNHX1JFU1VMVCgkb3BlbmFmc19nY2Nfc3VwcG9ydHNfbm9fY29t bW9uKQ0KK2lmIHRlc3QgeCRvcGVuYWZzX2djY19zdXBwb3J0c19ub19jb21t b24gPSB4eWVzOyB0aGVuDQorICBMSU5VWF9HQ0NfS09QVFM9IiRMSU5VWF9H Q0NfS09QVFMgLWZuby1jb21tb24iDQorZmkNCitDRkxBR1M9IiRzYXZlX0NG TEFHUyINCitdKQ0KKw0KZGlmZiAteCBjb25maWd1cmUtbGliYWZzIC14IGNv bmZpZ3VyZSAteCBhY2xvY2FsLm00IC14IGNvbmZpZy5oaW4gLXJ1TiBvcGVu YWZzLTEuMi43LW9yaWcvc3JjL2xpYmFmcy9NYWtlZmlsZVByb3RvLkxJTlVY LmluIG9wZW5hZnMtMS4yLjcvc3JjL2xpYmFmcy9NYWtlZmlsZVByb3RvLkxJ TlVYLmluDQotLS0gb3BlbmFmcy0xLjIuNy1vcmlnL3NyYy9saWJhZnMvTWFr ZWZpbGVQcm90by5MSU5VWC5pbgkyMDAyLTA2LTA4IDAwOjQ3OjQyLjAwMDAw MDAwMCAtMDQwMA0KKysrIG9wZW5hZnMtMS4yLjcvc3JjL2xpYmFmcy9NYWtl ZmlsZVByb3RvLkxJTlVYLmluCTIwMDItMTAtMDMgMTI6MTk6NDYuMDAwMDAw MDAwIC0wNDAwDQpAQCAtNTIsNDQgKzUyLDQxIEBADQogIyBTeXN0ZW0gc3Bl Y2lmaWMgYnVpbGQgY29tbWFuZHMgYW5kIGZsYWdzDQogQ0MgPSBnY2MNCiBM RCA9IGxkDQorR0NDX0tPUFRTPUBMSU5VWF9HQ0NfS09QVFNADQogIyAtV2Fs bA0KIDxpMzg2X2xpbnV4MjIgaTM4Nl9saW51eDI0Pg0KLUNDRkxBR1MgPSAg JChLREVCVUcpIC1PMiAkKEZPTUlUKSBcDQotCS1mbm8tc3RyZW5ndGgtcmVk dWNlIC1waXBlIC1tYXJjaD1pNDg2IC1tYWxpZ24tbG9vcHM9MiAtbWFsaWdu LWp1bXBzPTIgXA0KLQktbWFsaWduLWZ1bmN0aW9ucz0yDQorWDg2PUBYODZf S09QVFNADQorQ0NGTEFHUyA9ICAkKEtERUJVRykgLU8yICQoRk9NSVQpICQo R0NDX0tPUFRTKSAtcGlwZSAkKFg4NikNCiBERUZJTkVTID0gLURfX0tFUk5F TF9fICAtRENQVT01ODYgLURLRVJORUwgLURfS0VSTkVMIC1ETU9EVUxFICR7 U01QX0RFRn0gJHtLREVGSU5FU30NCiA8YWxwaGFfbGludXhfMjIgYWxwaGFf bGludXhfMjQ+DQotQ0NGTEFHUyA9ICQoS0RFQlVHKSAtTzIgJChGT01JVCkg LWZuby1zdHJlbmd0aC1yZWR1Y2UgLXBpcGUgLW1uby1mcC1yZWdzIC1mZml4 ZWQtOA0KK0NDRkxBR1MgPSAkKEtERUJVRykgLU8yICQoRk9NSVQpICQoR0ND X0tPUFRTKSAtcGlwZSAtbW5vLWZwLXJlZ3MgLWZmaXhlZC04DQogREVGSU5F UyA9IC1EX19LRVJORUxfXyAtREtFUk5FTCAtRF9LRVJORUwgLURNT0RVTEUg JHtTTVBfREVGfQ0KIDxzMzkwX2xpbnV4MjIgczM5MF9saW51eDI0Pg0KLUND RkxBR1MgPSAgIC1PICQoRk9NSVQpIC1mbm8tc3RyZW5ndGgtcmVkdWNlIFwN Ci0JLWZuby1zdHJpY3QtYWxpYXNpbmcgLWZzaWduZWQtY2hhciANCitDQ0ZM QUdTID0gICAtTyAkKEZPTUlUKSAkKEdDQ19LT1BUUykgLWZzaWduZWQtY2hh ciANCiBERUZJTkVTID0gLURfX0tFUk5FTF9fICAtRF9fczM5MF9fIC1ES0VS TkVMIC1EX0tFUk5FTCAtRE1PRFVMRSAke1NNUF9ERUZ9DQogPHNwYXJjX2xp bnV4MjIgc3BhcmNfbGludXgyND4NCiBMRCA9IGxkIC1tIGVsZjMyX3NwYXJj DQotQ0NGTEFHUyA9ICAgJChLREVCVUcpIC1PMiAkKEZPTUlUKSBcDQotCS1m bm8tc3RyZW5ndGgtcmVkdWNlIC1waXBlIC1tY3B1PXY4IC1tbm8tZnB1IC1m Y2FsbC11c2VkLWc1IC1mY2FsbC11c2VkLWc3DQorQ0NGTEFHUyA9ICAgJChL REVCVUcpIC1PMiAkKEZPTUlUKSAkKEdDQ19LT1BUUykgXA0KKwktcGlwZSAt bWNwdT12OCAtbW5vLWZwdSAtZmNhbGwtdXNlZC1nNSAtZmNhbGwtdXNlZC1n Nw0KIERFRklORVMgPSAtRF9fS0VSTkVMX18gIC1EQ1BVPXNwYXJjIC1ES0VS TkVMIC1EX0tFUk5FTCAtRE1PRFVMRSAke1NNUF9ERUZ9DQogPHNwYXJjNjRf bGludXgyMiBzcGFyYzY0X2xpbnV4MjQ+DQogQ0MgPSBzcGFyYzY0LWxpbnV4 LWdjYw0KIExEID0gbGQgLW0gZWxmNjRfc3BhcmMNCi1DQ0ZMQUdTID0gICAk KEtERUJVRykgLU8yICQoRk9NSVQpIFwNCi0JLWZuby1zdHJlbmd0aC1yZWR1 Y2UgLXBpcGUgLW1jcHU9dWx0cmFzcGFyYyAtbTY0IC1tbm8tZnB1IC1tY21v ZGVsPW1lZGxvdyAtZmZpeGVkLWc0IC1mY2FsbC11c2VkLWc1IC1mY2FsbC11 c2VkLWc3IC1Xbm8tc2lnbi1jb21wYXJlDQorQ0NGTEFHUyA9ICAgJChLREVC VUcpIC1PMiAkKEZPTUlUKSAkKEdDQ19LT1BUUykgXA0KKwktcGlwZSAtbWNw dT11bHRyYXNwYXJjIC1tNjQgLW1uby1mcHUgLW1jbW9kZWw9bWVkbG93IC1m Zml4ZWQtZzQgLWZjYWxsLXVzZWQtZzUgLWZjYWxsLXVzZWQtZzcgLVduby1z aWduLWNvbXBhcmUNCiBERUZJTkVTID0gLURfX0tFUk5FTF9fICAtRENQVT1z cGFyYzY0IC1ES0VSTkVMIC1EX0tFUk5FTCAtRE1PRFVMRSAke1NNUF9ERUZ9 DQogPHBwY19saW51eDIyIHBwY19saW51eDI0Pg0KLUNDRkxBR1MgPSAgICQo S0RFQlVHKSAtTzIgJChGT01JVCkgLWZuby1zdHJlbmd0aC1yZWR1Y2UgXA0K LQktZm5vLXN0cmljdC1hbGlhc2luZyAtZnNpZ25lZC1jaGFyIC1tc29mdC1m bG9hdCAtcGlwZSBcDQorQ0NGTEFHUyA9ICAgJChLREVCVUcpIC1PMiAkKEZP TUlUKSAkKEdDQ19LT1BUUykgLWZzaWduZWQtY2hhciAtbXNvZnQtZmxvYXQg LXBpcGUgXA0KIAktZm5vLWJ1aWx0aW4gLWZmaXhlZC1yMg0KIERFRklORVMg PSAtRF9fS0VSTkVMX18gIC1EX19wb3dlcnBjX18gLURLRVJORUwgLURfS0VS TkVMIC1ETU9EVUxFICR7U01QX0RFRn0NCiA8cGFyaXNjX2xpbnV4MjQ+DQot Q0NGTEFHUyA9ICAgJChLREVCVUcpIC1PMiAkKEZPTUlUKSBcDQotCS1mbm8t c3RyaWN0LWFsaWFzaW5nIC1mbm8tY29tbW9uIC1mbm8tc3RyZW5ndGgtcmVk dWNlIFwNCi0gICAgICAgIC1mbm8tc3RyaWN0LWFsaWFzaW5nIC1mc2lnbmVk LWNoYXIgLW1uby1zcGFjZS1yZWdzIC1tZmFzdC1pbmRpcmVjdC1jYWxscyBc DQotICAgICAgICAtbWRpc2FibGUtZnByZWdzIC1mZnVuY3Rpb24tc2VjdGlv bnMgLW1hcmNoPTEuMSAtbXNjaGVkdWxlPTcxMDANCitDQ0ZMQUdTID0gICAk KEtERUJVRykgLU8yICQoRk9NSVQpICQoR0NDX0tPUFRTKSAtZnNpZ25lZC1j aGFyIC1tbm8tc3BhY2UtcmVncyBcDQorCS1tZmFzdC1pbmRpcmVjdC1jYWxs cyAtbWRpc2FibGUtZnByZWdzIC1mZnVuY3Rpb24tc2VjdGlvbnMgXA0KKwkt bWFyY2g9MS4xIC1tc2NoZWR1bGU9NzEwMA0KIERFRklORVMgPSAtRF9fS0VS TkVMX18gIC1EX19saW51eF9fIC1ES0VSTkVMIC1EX0tFUk5FTCAtRE1PRFVM RSAke1NNUF9ERUZ9DQogPGlhNjRfbGludXgyND4NCi1DQ0ZMQUdTID0gICAk KEtERUJVRykgLU8yICQoRk9NSVQpIC1mbm8tc3RyaWN0LWFsaWFzaW5nIC1m bm8tY29tbW9uIC1waXBlIFwNCi0JLWZmaXhlZC1yMTMgLW1maXhlZC1yYW5n ZT1mMTAtZjE1LGYzMi1mMTI3IC1mYWxpZ24tZnVuY3Rpb25zPTMyIC1tYi1z dGVwDQorQ0NGTEFHUyA9ICAgJChLREVCVUcpIC1PMiAkKEZPTUlUKSAkKEdD Q19LT1BUUykgLXBpcGUgLWZmaXhlZC1yMTMgXA0KKwkgLW1maXhlZC1yYW5n ZT1mMTAtZjE1LGYzMi1mMTI3IC1mYWxpZ24tZnVuY3Rpb25zPTMyIC1tYi1z dGVwDQogREVGSU5FUyA9IC1EX19LRVJORUxfXyAtREtFUk5FTCAtRF9LRVJO RUwgJHtTTVBfREVGfSAtRE1PRFVMRQ0KIDxhbGw+DQogSU5DTFVERVMgPSAt SS4gLUkuLi8gLUkke1RPUF9TUkNESVJ9L2NvbmZpZw0K --42002020-1449831134-1033678649=:2629-- From adler@bnl.gov Thu Oct 3 22:14:15 2002 From: adler@bnl.gov (Adler, Stephen) Date: 03 Oct 2002 17:14:15 -0400 Subject: [OpenAFS] red hat 8.0/openafs ftp site open Message-ID: <1033679655.8446.7.camel@newadler.phy.bnl.gov> Guys, I've uploaded my work to ftp://ftp.phy.bnl.gov/pub/openafs-rh80 There you'll find a red hat 8.0 kernel with sys_call_table exported as well as my build of openafs 1.2.7. Only the athlon kernel build is there right now. I'm building the i586 and i686 soon followed by the i386 kernel build. Those will be uploaded by tomorrow AM. I hope this work is useful to others in the openafs community. Cheers. Steve Adler. From warlord@MIT.EDU Thu Oct 3 23:50:35 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 03 Oct 2002 18:50:35 -0400 Subject: [OpenAFS] mandrake 9.0 segmentation fault In-Reply-To: <1033670164.3973.4.camel@localhost.localdomain> References: <1033670164.3973.4.camel@localhost.localdomain> Message-ID: Sounds like mandrake is adding some new kernel item that we (openafs) need to initialize.. -derek trax writes: > Okay, I have managed to get mdk9.0 to compile, upoun starting afs, I see > > [root@localhost root]# service afs start > Found libafs-2.4.19-16mdksecure-i686.o from SymTable... Loading... > Starting AFS services..... > > /var/log/messages shows ... > Oct 3 20:33:28 localhost su(pam_unix)[4100]: session opened for user > root by (uid=500) > Oct 3 20:34:08 localhost kernel: sock_release(rx_socket) FIXME > Oct 3 20:34:08 localhost kernel: AFS: RX failed to initialize. > > The it just sits there. Am I missing something here? > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From excds@kth.se Fri Oct 4 00:13:17 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 04 Oct 2002 01:13:17 +0200 Subject: [OpenAFS] sys_call_table symbol In-Reply-To: <1033676078.26364.32.camel@newadler.phy.bnl.gov> References: <1033676078.26364.32.camel@newadler.phy.bnl.gov> Message-ID: <1033686797.1138.2.camel@hybris> On Thu, 2002-10-03 at 22:14, Adler, Stephen wrote: > sorry for the stupid questions guys!!! "Now remember Kyle, there are no stupid questions. Only stupid people." Sorry... Just had to... ;-) Anyway, I believe I'm in the lead of stupid questions here... ;-)) /Daniel, too tired to exist. From jds@soltis.cc Fri Oct 4 02:52:00 2002 From: jds@soltis.cc (Jesus Delgado) Date: Thu, 3 Oct 2002 19:52:00 -0600 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <1033649961.15481.4.camel@newadler.phy.bnl.gov> References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> <1033649961.15481.4.camel@newadler.phy.bnl.gov> Message-ID: <20021003195200.M44025@soltis.cc> Thanks, perfect the build Ok Rethat 8.0 kernel 2.4.19 openafs-1.2.7 OK Muchas Gracias > You got this because of red hat going to autoconf 2.53. I aliased > autoconf to autoconf-2.13 which fixed the build. > > Steve. > > On Wed, 2002-10-02 at 21:53, Jesus Delgado wrote: > > > > ---------- Forwarded Message ----------- > > Hi: > > > > Problems when try the build openafs source rpm in redhat 8.0 > > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > > > Errors in openafs-1.2.7 > > > > .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > > 3.0.4-1 > > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > > rpmlib(CompressedFileNames) <= 3.0.4-1 > > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > > Processing files: openafs-krb5-1.2.7-rh7.3.1 > > error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > > error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > Requires: openafs = 1.2.7 > > > > RPM build errors: > > File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > > File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > > > Errors with openafs-1.2.6 > > > > Requires: openafs = 1.2.6 openafs-client = 1.2.6 > > Obsoletes: openafs-client-compat > > Processing files: openafs-kpasswd-1.2.6-rh7.3.1 > > Finding Provides: /usr/lib/rpm/find-provides > > Finding Requires: /usr/lib/rpm/find-requires > > PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > > 3.0.4-1 > > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > > rpmlib(CompressedFileNames) <= 3.0.4-1 > > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > > Processing files: openafs-krb5-1.2.6-rh7.3.1 > > error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > > error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > Requires: openafs = 1.2.6 > > > > RPM build errors: > > File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > > File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > > > Help me plase > > > > Regards. > > ------- End of Forwarded Message ------- > > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info From elizabeth@linuxbox.nu Fri Oct 4 02:46:12 2002 From: elizabeth@linuxbox.nu (Elizabeth Ziph) Date: 03 Oct 2002 21:46:12 -0400 Subject: [OpenAFS] AFS Training ? In-Reply-To: References: Message-ID: <1033695973.25528.528.camel@apollo> if the class is on, we might send one person. elizabeth On Thu, 2002-10-03 at 01:41, Mitch Collinsworth wrote: > > Following up to my own followup: There is currently only one person > registered for the December class. One of my group would also like > to attend, making a total of 2 so far. We couldn't get an exact > answer from IBM as to what constitutes sufficient critical mass to > be sure the class won't be cancelled, but it seems to be in the > neighborhood of 4 or 5. Are there others here who might be interested > in this? Write to me off-list and I can give you the address of the > teacher if you want more direct info. My selfish motivation is in > recruiting enough additional attendees to see the class not get > canceled again. If you'd like to go but the December dates are bad, > when is better? Maybe we can work with them in scheduling it for a > time when we can succeed in achieving critical mass. > > It's been over a decade since I took this class, but it was a good > class then and would be quite useful today even if little has changed > in the presentation since then. > > -Mitch > > > On Sun, 29 Sep 2002, Mitch Collinsworth wrote: > > > External web site is: > > http://www7b.software.ibm.com/wsdd/education/enablement/curriculum/sw800.html > > > > A word of caution: Just because it's listed here doesn't mean it will > > actually be held. The last class that was scheduled for Pittsburgh was > > cancelled at the last minute due to insufficient number of registrants. > > > > There was supposed to be another one this fall in California (San Jose?). > > It no longer seems to be on the schedule. I take it it was cancelled, too. > > > > -Mitch > > > > > > On Sun, 29 Sep 2002, Daniel Clark/Cambridge/IBM wrote: > > > > > Paul Blackburn wrote: > > > > Transarc used to run some excellent AFS administrator courses. > > > > Does anyone know of AFS training available today? > > > > > > According to w3.education.ibm.com (internal IBM site, there is some > > > external equivalent but I don't know what it is) Transarc - now "IBM > > > Pittsburgh Lab" - still runs the "AFS Administration" course. It's course > > > code SW800 and will next occur in Pittsburgh, PA 2002-12-10 to 2002-12-13. > > > Below are the full details, which include a contact number/email to get > > > more info and future course dates. I have taken this class and can vouch > > > that it is excellent. My class was taught by someone who had been > > > administering AFS since it was a research project at CMU, so in addition to > > > access to deep technical knowledge there were also interesting historical > > > asides. > > > > > > Course Details: AFS Administration > > > > > > 2002-12-10 to 2002-12-13 > > > > > > Course Code:SW800 > > > Section:K8II > > > > > > Course Location: > > > Room: TBA 2 > > > IBM Pittsburgh Lab 9Fl > > > 11 Stanwix Street > > > Pittsburgh > > > United States > > > 15222 > > > > > > Course Contact: > > > Tracy Linza > > > linza at IBMUS > > > 412-667-4477 > > > TL 989-4477 > > > > > > Course Schedule: > > > 2002-12-10 to 2002-12-13 > > > 09:00:00 to 18:00:00 > > > Last Day End Time: 17:30:00 > > > > > > Last Cancellation Date without penalty: > > > 2002-11-25 > > > > > > > > > Equipment Required: > > > None > > > > > > Course Enrollments: > > > Total Students Confirmed: 1 of 14 > > > Total on Standby: 0 > > > > > > Additional Course Information: > > > None > > > > > > Comments: > > > None > > > > > > Location Specific Info: > > > > > > LOCATION: > > > IBM Pittsburgh Lab > > > 11 Stanwix Street > > > 9th FL > > > Pittsburgh, PA 15222 > > > > > > CONTACT: > > > 412-667-4433 > > > TL 989-4433 > > > > > > BADGES: > > > See lobby receptionist on 9th Floor > > > All visitors are required to sign-in > > > (8:00am - 6:00pm) > > > > > > LOCAL HOTEL INFORMATION > > > > > > Pittsburgh Hilton > > > 600 Commonwealth Place > > > Gateway Center > > > Pittsburgh, PA 15222 > > > 412-391-4600 > > > Ask for IBM/Transarc rate of $92 per night > > > (Subject to change without notice) > > > 5 minute walk to Lab > > > > > > Sheraton Hotel > > > Carson & SMithfield Streets > > > Pittsburgh, PA 15219 > > > 412-261-2000 > > > 5-10 minute subway ride to Lab > > > Ask for IBM/Transarc rate of $116 per night > > > (Subject to change without notice) > > > > > > > > > DIRECTIONS > > > > > > FROM AIRPORT: > > > * From Airport follow the signs toward Pittsburgh > > > (Approx 15 miles) to the Fort Pitt Tunnel > > > * Stay in the left lane. > > > * After the tunnel, you will be on the Fort Pitt Bridge > > > * Take the Boulevard of the Allies Exit > > > * Proceed to Stanwix St and turn right. > > > * Proceed one block to 11 Stanwix > > > (Look for Blattner Bruner revolving sign) > > > * Parking garage is in the building > > > * Parking in the garage is $14 per day - student expense. > > > > > > -- > > > Daniel Clark # Sys Admin & Release Engineer > > > IBM > Lotus > Messaging Technology Group > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- elizabeth ziph 734.761.4689 www.linuxbox.nu From security@xauth.net Fri Oct 4 05:33:16 2002 From: security@xauth.net (Charles Clancy) Date: Thu, 3 Oct 2002 23:33:16 -0500 (CDT) Subject: [OpenAFS] using openafs over wireless In-Reply-To: Message-ID: > Anyone have experience running open-afs on win2k over a wireless nic? we > expected lan throughput to be 2-4 mbs. I've done it with RH71, kernel 2.4.9, with a Prism2-based card. Wireless is no different than wireline -- just slower. I wouldn't want to run my homedir from AFS over 802.11, but for casual access it's just fine. For that matter, I use OpenAFS over my 768/128K ADSL connection from home. Again, it's fine for casual access, but I wouldn't want to run applications from it. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From abuechle@fhzh.ch Fri Oct 4 08:21:43 2002 From: abuechle@fhzh.ch (Andreas Buechler) Date: Fri, 4 Oct 2002 09:21:43 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: References: <15770.49260.4762.561962@hszpc38.isz.ch> Message-ID: <15773.16775.746446.362012@hszpc38.isz.ch> > Try removing that option, and see if it works then. Unfortunately that doesn't have any impact, error messages in /var/log/messages still look the same after an attempt to login in. I really don't have a clou what's going on. Because I tried the same pam.d configuration on an Intel machine (with SuSE Linux 7.3, openafs1.2.3) and it works as expected! Do you have any ideas what else I could try out? Andi -- From turbo@bayour.com Fri Oct 4 09:07:46 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 04 Oct 2002 10:07:46 +0200 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell Message-ID: <87ofaaeiel.fsf@papadoc.bayour.com> I have a number of machines at home which I can log in to. If I login on multiple machines, the previous host looses connection to the AFS file server. Example: 1. Login in on host1. Homedir on AFS. Works fine. 2. Login in on host2. Homedir on AFS. Works fine - BUT: host1 looses the connection to the file server! The firewall is a Linux machine, doing NAT (masquerading). Is this supposed to happen? From tino.schwarze@informatik.tu-chemnitz.de Fri Oct 4 10:04:30 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Fri, 4 Oct 2002 11:04:30 +0200 Subject: [OpenAFS] using openafs over wireless In-Reply-To: ; from security@xauth.net on Thu, Oct 03, 2002 at 11:33:16PM -0500 References: Message-ID: <20021004110430.A23960@informatik.tu-chemnitz.de> On Thu, Oct 03, 2002 at 11:33:16PM -0500, Charles Clancy wrote: > > Anyone have experience running open-afs on win2k over a wireless nic? we > > expected lan throughput to be 2-4 mbs. > > I've done it with RH71, kernel 2.4.9, with a Prism2-based card. Wireless > is no different than wireline -- just slower. I wouldn't want to run my > homedir from AFS over 802.11, but for casual access it's just fine. > > For that matter, I use OpenAFS over my 768/128K ADSL connection from home. > Again, it's fine for casual access, but I wouldn't want to run > applications from it. Some time ago, I've been developing a little app and half the libraries (GTK2, Pango et al.) were built in AFS space. Since I was too lazy to recompile at home, I just used them where they were. The AFS caching and on demand paging kicked ass. All went over a single ISDN line and I was able to observe that running a program accesses different parts of a library than debugging. B-) Bye, Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From andrei@caspur.it Fri Oct 4 12:55:59 2002 From: andrei@caspur.it (Andrei Maslennikov) Date: Fri, 4 Oct 2002 11:55:59 +0000 ( ) Subject: [OpenAFS] rh8.0 kernel RPMs In-Reply-To: <20021004110430.A23960@informatik.tu-chemnitz.de> Message-ID: If somebody wants to give them a try, there's a set of kernel RPMs with sys_call_table re-exported (I've built them yesterday; libafs 1.2.7 does load with these): # ls /afs/italia/project/afs/rh80 kernel-2.4.18-14.athlon.rpm kernel-doc-2.4.18-14.i386.rpm kernel-2.4.18-14.i586.rpm kernel-smp-2.4.18-14.athlon.rpm kernel-2.4.18-14.i686.rpm kernel-smp-2.4.18-14.i686.rpm kernel-BOOT-2.4.18-14.i386.rpm kernel-source-2.4.18-14.i386.rpm kernel-bigmem-2.4.18-14.i686.rpm kernel-uml-2.4.18-14.i686.rpm kernel-debug-2.4.18-14.i686.rpm Or, alternatively (same thing): http://afs.caspur.it/afs/italia/project/afs/rh80/ Andrei. ---------------------------------- >italia # Italian Public AFS Cell 193.204.5.9 #afs.caspur.it From adler@bnl.gov Fri Oct 4 13:04:18 2002 From: adler@bnl.gov (Stephen Adler) Date: 04 Oct 2002 08:04:18 -0400 Subject: [OpenAFS] rh8.0 kernel RPMs In-Reply-To: References: Message-ID: <1033733059.12281.1.camel@dhcp-21-1> And here is another source which I built.... oh well, I guess its better to have 2 independent builds rather than 0... http://ssadler.phy.bnl.gov/adler/openafs-rh80/ Cheers. Steve. On Fri, 2002-10-04 at 07:55, Andrei Maslennikov wrote: > > If somebody wants to give them a try, there's a set of kernel RPMs with > sys_call_table re-exported (I've built them yesterday; libafs 1.2.7 does > load with these): > > # ls /afs/italia/project/afs/rh80 > kernel-2.4.18-14.athlon.rpm kernel-doc-2.4.18-14.i386.rpm > kernel-2.4.18-14.i586.rpm kernel-smp-2.4.18-14.athlon.rpm > kernel-2.4.18-14.i686.rpm kernel-smp-2.4.18-14.i686.rpm > kernel-BOOT-2.4.18-14.i386.rpm kernel-source-2.4.18-14.i386.rpm > kernel-bigmem-2.4.18-14.i686.rpm kernel-uml-2.4.18-14.i686.rpm > kernel-debug-2.4.18-14.i686.rpm > > Or, alternatively (same thing): > http://afs.caspur.it/afs/italia/project/afs/rh80/ > > Andrei. > > ---------------------------------- > >italia # Italian Public AFS Cell > 193.204.5.9 #afs.caspur.it > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From warlord@MIT.EDU Fri Oct 4 14:43:13 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 04 Oct 2002 09:43:13 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: <87ofaaeiel.fsf@papadoc.bayour.com> References: <87ofaaeiel.fsf@papadoc.bayour.com> Message-ID: How long are your UDP timeouts? -derek Turbo Fredriksson writes: > I have a number of machines at home which I can log in to. > > If I login on multiple machines, the previous host looses > connection to the AFS file server. > > Example: > 1. Login in on host1. Homedir on AFS. > Works fine. > 2. Login in on host2. Homedir on AFS. > Works fine - BUT: host1 looses the connection > to the file server! > > > The firewall is a Linux machine, doing NAT (masquerading). > > Is this supposed to happen? > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From mitch@ccmr.cornell.edu Fri Oct 4 14:47:21 2002 From: mitch@ccmr.cornell.edu (Mitch Collinsworth) Date: Fri, 4 Oct 2002 09:47:21 -0400 (EDT) Subject: [OpenAFS] AFS Training ? In-Reply-To: <1033695973.25528.528.camel@apollo> Message-ID: This is exactly why I wrote the previous message. The class _will_ be on if enough people sign up, but if everyone waits to register until they know the class is on, the class won't happen. If you have someone who wants to take the class, please have them sign up and be counted. If the critical mass is "4 or 5", and we're at 2 today, your person plus the other one who contacted me yesterday off-list gets us to 4, then we're either there now, or in need of just one more. -Mitch On 3 Oct 2002, Elizabeth Ziph wrote: > if the class is on, we might send one person. > > elizabeth > > > On Thu, 2002-10-03 at 01:41, Mitch Collinsworth wrote: > > > > Following up to my own followup: There is currently only one person > > registered for the December class. One of my group would also like > > to attend, making a total of 2 so far. We couldn't get an exact > > answer from IBM as to what constitutes sufficient critical mass to > > be sure the class won't be cancelled, but it seems to be in the > > neighborhood of 4 or 5. Are there others here who might be interested > > in this? Write to me off-list and I can give you the address of the > > teacher if you want more direct info. My selfish motivation is in > > recruiting enough additional attendees to see the class not get > > canceled again. If you'd like to go but the December dates are bad, > > when is better? Maybe we can work with them in scheduling it for a > > time when we can succeed in achieving critical mass. > > > > It's been over a decade since I took this class, but it was a good > > class then and would be quite useful today even if little has changed > > in the presentation since then. > > > > -Mitch > > > > > > On Sun, 29 Sep 2002, Mitch Collinsworth wrote: > > > > > External web site is: > > > http://www7b.software.ibm.com/wsdd/education/enablement/curriculum/sw800.html > > > > > > A word of caution: Just because it's listed here doesn't mean it will > > > actually be held. The last class that was scheduled for Pittsburgh was > > > cancelled at the last minute due to insufficient number of registrants. > > > > > > There was supposed to be another one this fall in California (San Jose?). > > > It no longer seems to be on the schedule. I take it it was cancelled, too. > > > > > > -Mitch > > > > > > > > > On Sun, 29 Sep 2002, Daniel Clark/Cambridge/IBM wrote: > > > > > > > Paul Blackburn wrote: > > > > > Transarc used to run some excellent AFS administrator courses. > > > > > Does anyone know of AFS training available today? > > > > > > > > According to w3.education.ibm.com (internal IBM site, there is some > > > > external equivalent but I don't know what it is) Transarc - now "IBM > > > > Pittsburgh Lab" - still runs the "AFS Administration" course. It's course > > > > code SW800 and will next occur in Pittsburgh, PA 2002-12-10 to 2002-12-13. > > > > Below are the full details, which include a contact number/email to get > > > > more info and future course dates. I have taken this class and can vouch > > > > that it is excellent. My class was taught by someone who had been > > > > administering AFS since it was a research project at CMU, so in addition to > > > > access to deep technical knowledge there were also interesting historical > > > > asides. > > > > > > > > Course Details: AFS Administration > > > > > > > > 2002-12-10 to 2002-12-13 > > > > > > > > Course Code:SW800 > > > > Section:K8II > > > > > > > > Course Location: > > > > Room: TBA 2 > > > > IBM Pittsburgh Lab 9Fl > > > > 11 Stanwix Street > > > > Pittsburgh > > > > United States > > > > 15222 > > > > > > > > Course Contact: > > > > Tracy Linza > > > > linza at IBMUS > > > > 412-667-4477 > > > > TL 989-4477 > > > > > > > > Course Schedule: > > > > 2002-12-10 to 2002-12-13 > > > > 09:00:00 to 18:00:00 > > > > Last Day End Time: 17:30:00 > > > > > > > > Last Cancellation Date without penalty: > > > > 2002-11-25 > > > > > > > > > > > > Equipment Required: > > > > None > > > > > > > > Course Enrollments: > > > > Total Students Confirmed: 1 of 14 > > > > Total on Standby: 0 > > > > > > > > Additional Course Information: > > > > None > > > > > > > > Comments: > > > > None > > > > > > > > Location Specific Info: > > > > > > > > LOCATION: > > > > IBM Pittsburgh Lab > > > > 11 Stanwix Street > > > > 9th FL > > > > Pittsburgh, PA 15222 > > > > > > > > CONTACT: > > > > 412-667-4433 > > > > TL 989-4433 > > > > > > > > BADGES: > > > > See lobby receptionist on 9th Floor > > > > All visitors are required to sign-in > > > > (8:00am - 6:00pm) > > > > > > > > LOCAL HOTEL INFORMATION > > > > > > > > Pittsburgh Hilton > > > > 600 Commonwealth Place > > > > Gateway Center > > > > Pittsburgh, PA 15222 > > > > 412-391-4600 > > > > Ask for IBM/Transarc rate of $92 per night > > > > (Subject to change without notice) > > > > 5 minute walk to Lab > > > > > > > > Sheraton Hotel > > > > Carson & SMithfield Streets > > > > Pittsburgh, PA 15219 > > > > 412-261-2000 > > > > 5-10 minute subway ride to Lab > > > > Ask for IBM/Transarc rate of $116 per night > > > > (Subject to change without notice) > > > > > > > > > > > > DIRECTIONS > > > > > > > > FROM AIRPORT: > > > > * From Airport follow the signs toward Pittsburgh > > > > (Approx 15 miles) to the Fort Pitt Tunnel > > > > * Stay in the left lane. > > > > * After the tunnel, you will be on the Fort Pitt Bridge > > > > * Take the Boulevard of the Allies Exit > > > > * Proceed to Stanwix St and turn right. > > > > * Proceed one block to 11 Stanwix > > > > (Look for Blattner Bruner revolving sign) > > > > * Parking garage is in the building > > > > * Parking in the garage is $14 per day - student expense. > > > > > > > > -- > > > > Daniel Clark # Sys Admin & Release Engineer > > > > IBM > Lotus > Messaging Technology Group > > > > > > > > _______________________________________________ > > > > OpenAFS-info mailing list > > > > OpenAFS-info@openafs.org > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > -- > elizabeth ziph > 734.761.4689 > www.linuxbox.nu > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From klaas@northsailor.de Wed Oct 2 15:34:10 2002 From: klaas@northsailor.de (klaas hagemann) Date: Wed, 2 Oct 2002 16:34:10 +0200 Subject: [OpenAFS] scripts for automatic installation + client cache questions References: <003a01c26a0d$e1dd6fe0$2b03a8c0@mummert.priv> Message-ID: <007301c26a20$c6774c40$2b03a8c0@mummert.priv> ----- Original Message ----- From: "Derek Atkins" To: "Klaas Hagemann" Cc: Sent: Wednesday, October 02, 2002 3:17 PM Subject: Re: [OpenAFS] scripts for automatic installation + client cache questions > "Klaas Hagemann" writes: > > > Hello, > > > > i am currently trying to write scripts for an automatic setup for > > openafs-file-servers and dbms-servers. > > Therefor i use the bos exec command quite a lot. > > But when adding a new server, i have to restart all servers. > > So i want a "bos exec host "/etc/init.d/afs restart" > > But it ends up with a communication failure. Does someone have an idea for a > > workaround for this? > > No, because the bosserver get's killed before the command completes. > Is there any particular reason you don't use "bos restart -all -bosserver"? Thankys, i have not known this option yet. Thanks a lott, i think that is exactly for what i was looking for. Yes, RTFM sometimes help..... > > > Then i have got another question: > > what are the advances for an own partition for the client on > > /usr/vice/cache? > > Currently, i do not have a seperate partition for it and it works good. > > Basically, if your cache partition fills, AFS is screwed. The benefit > of having your own AFS cache partition is that if only AFS uses the > partition you are guaranteed that it will never fill to capacity. If > you share the cache partition, then you have to always worry about how > much space is left, because AFS will crash ungracefully in the face of > a full cache (or worse, it could destroy data). Ok, i thought of something like that. But there is no performance increase? Thanks, Klaas > > > Thanks for your answers > > Klaas > > -derek > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From jds@soltis.cc Wed Oct 2 22:11:28 2002 From: jds@soltis.cc (Jesus Delgado) Date: Wed, 2 Oct 2002 15:11:28 -0600 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 Message-ID: <20021002151128.M26033@soltis.cc> Hi: Problems when try the build openafs source rpm in redhat 8.0 the errors is the same with openafs-1.2.6 y openafs-1.2.7: Errors in openafs-1.2.7 .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) Processing files: openafs-krb5-1.2.7-rh7.3.1 error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey Requires: openafs = 1.2.7 RPM build errors: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey Errors with openafs-1.2.6 Requires: openafs = 1.2.6 openafs-client = 1.2.6 Obsoletes: openafs-client-compat Processing files: openafs-kpasswd-1.2.6-rh7.3.1 Finding Provides: /usr/lib/rpm/find-provides Finding Requires: /usr/lib/rpm/find-requires PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= 3.0.4-1 Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) Processing files: openafs-krb5-1.2.6-rh7.3.1 error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey Requires: openafs = 1.2.6 RPM build errors: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey Help me plase Regards. From warlord@MIT.EDU Fri Oct 4 15:29:17 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 04 Oct 2002 10:29:17 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <20021002151128.M26033@soltis.cc> References: <20021002151128.M26033@soltis.cc> Message-ID: RH8 is not supported by the RPMs yet. I need to find a RH Mirror to install RH8 so I can build RPMS and get the SPEC to work right. This particular problem that you get looks like it's not building aklog and asetkey properly. Most likely the issue is 'autoconf' being 2.53 instead of 2.13. -derek "Jesus Delgado" writes: > Hi: > > Problems when try the build openafs source rpm in redhat 8.0 > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > Errors in openafs-1.2.7 > > .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > 3.0.4-1 > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= 3.0.4-1 > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > Processing files: openafs-krb5-1.2.7-rh7.3.1 > error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > Requires: openafs = 1.2.7 > > > RPM build errors: > File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > Errors with openafs-1.2.6 > > Requires: openafs = 1.2.6 openafs-client = 1.2.6 > Obsoletes: openafs-client-compat > Processing files: openafs-kpasswd-1.2.6-rh7.3.1 > Finding Provides: /usr/lib/rpm/find-provides > Finding Requires: /usr/lib/rpm/find-requires > PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > 3.0.4-1 > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= 3.0.4-1 > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > Processing files: openafs-krb5-1.2.6-rh7.3.1 > error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > Requires: openafs = 1.2.6 > > > RPM build errors: > File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > Help me plase > > Regards. > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From dawson@fnal.gov Fri Oct 4 15:31:11 2002 From: dawson@fnal.gov (Troy Dawson) Date: Fri, 04 Oct 2002 09:31:11 -0500 Subject: [OpenAFS] Re: mandrake 9.0 segmentation fault Message-ID: <3D9DA62F.4030806@fnal.gov> This is just throwing my two cents along with my experience. I was able to recompile the 1.2.6 rpm's for Mandrake 9.0, and 8.2 without any problem other than turning off the kerberos, and taking out the SuidCells. (We already have a kerberos package with aklog in it, so we didn't need it, and I have no idea what the SuidCells does) I had started with the RedHat 7.3 srpm. I found that the first time I ran AFS, and the first time I went into an AFS area I had very long lags. I suppose this was it loading everything into the cache, but then after I was there, everything was as quick as afs normally is. The machines I had these run on were Mandrake 8.2 - Pentium 4 - 1.6 Ghz Mandrake 9.0 - Pentium III - 450 Mhz - two processors Both have stock kernels. Though I can't say everything has been perfect. Both of them seem to loose contact with the servers periodically, causing either long lags or a complete inability to use AFS. One of them (the Mandrake 9.0) will loose contact with the AFS server even though my redhat machine, on same switch, in same home area, doesn't. Troy Dawson p.s. If anyone wants more details, I can send them. -- __________________________________________________ Troy Dawson dawson@fnal.gov (630)840-6468 Fermilab ComputingDivision/OSS CSI Group __________________________________________________ From yumiceva@sc.edu Fri Oct 4 17:12:12 2002 From: yumiceva@sc.edu (Francisco Yumiceva) Date: Fri, 04 Oct 2002 12:12:12 -0400 Subject: [OpenAFS] volume disappeared Message-ID: <3D9DBDDC.2090202@sc.edu> Hi, One of my volumes disappeared today. I tried "bos salvage -sever myserver -all" but it didn't work. Here are the symptoms: vos listvol myserver ... user.white 536870924 RW 57 K On-line user.white.backup 536870926 BK 57 K On-line user.yumiceva 536870921 RW 1954701 K On-line **** Could not attach volume 536870923 **** Total volumes onLine 17 ; Total volumes offLine 1 ; Total busy 0 When I do "bos status myserver -long" I see this error: Instance backupusers, (type is cron) currently running normally. Auxiliary status is: run next at Sat Oct 5 01:00:00 2002. Process last started at Fri Oct 4 01:00:01 2002 (5 proc starts) Last exit at Fri Oct 4 01:00:05 2002 Last error exit at Fri Oct 4 01:00:05 2002, due to signal 13 Command 1 is '/usr/sbin/vos backupsys -prefix user -localauth' Command 2 is '1:00' I cannot acces the volumen user.yumiceva may be because something is wrong with the backup. Please, I need help with this. Thanks, Francisco -- _________________________________________________ Francisco Yumiceva High Energy Group - Dept. of Physics & Astronomy University of South Carolina phone: 803.7771438 http://www.slac.stanford.edu/~yumiceva _________________________________________________ From matt@slackers.net Fri Oct 4 17:20:24 2002 From: matt@slackers.net (Matthew N. Andrews) Date: Fri, 04 Oct 2002 09:20:24 -0700 Subject: [OpenAFS] Re: mandrake 9.0 segmentation fault References: <3D9DA62F.4030806@fnal.gov> Message-ID: <3D9DBFC8.1010304@slackers.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Troy Dawson wrote: | This is just throwing my two cents along with my experience. | I was able to recompile the 1.2.6 rpm's for Mandrake 9.0, and 8.2 | without any problem other than turning off the kerberos, and taking out | the SuidCells. (We already have a kerberos package with aklog in it, so | we didn't need it, and I have no idea what the SuidCells does) this is a list of cells from which you are willing to treat programs with the set uid bit as actualy being set uid. In particular this is essentially saying that you trust the administrators of that cell to be able to run things as root on your machine if they can run things at all. you should probably only place the cell(s) you administer(or those administered by the same people who administer your machine) in this file. ~ -Matt Andrews -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE9nb/IpLF3UzlwZVgRAte4AKDdczND9i2p5J90se55kFhdvDBwewCg3iq0 +GbxFKnIF/MrD61rycs28NI= =MByZ -----END PGP SIGNATURE----- From security@xauth.net Fri Oct 4 18:06:29 2002 From: security@xauth.net (Charles Clancy) Date: Fri, 4 Oct 2002 12:06:29 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <15773.16775.746446.362012@hszpc38.isz.ch> Message-ID: > > Try removing that option, and see if it works then. > > Unfortunately that doesn't have any impact, error messages in > /var/log/messages still look the same after an attempt to login in. > > I really don't have a clou what's going on. Because I tried the same > pam.d configuration on an Intel machine (with SuSE Linux 7.3, > openafs1.2.3) and it works as expected! Do you have any ideas what > else I could try out? Perhaps it's SSHd related rather than PAM related. I suggest running sshd in debug mode: # sshd -d -d -d -D Then, connect with a verbose client: $ ssh -v -v -v user@host Check the massive amounts of debug info for things that look inappropriate. I don't recall if you said so earlier -- but does your pam_afs.so work with other applications? Is your SuSE box running the same version of sshd? [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From security@xauth.net Fri Oct 4 18:10:06 2002 From: security@xauth.net (Charles Clancy) Date: Fri, 4 Oct 2002 12:10:06 -0500 (CDT) Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: Message-ID: > > I have a number of machines at home which I can log in to. > > > > If I login on multiple machines, the previous host looses > > connection to the AFS file server. > > > > Example: > > 1. Login in on host1. Homedir on AFS. > > Works fine. > > 2. Login in on host2. Homedir on AFS. > > Works fine - BUT: host1 looses the connection > > to the file server! > > > > > > The firewall is a Linux machine, doing NAT (masquerading). > > How long are your UDP timeouts? In my experience, I can get one client to work fine from behind a NAT by using long UDP timeouts. However, dispite what others have reported, I've never been able to get multiple clients to work from behind a NAT (using both IPF on Solaris and Win2K Server's built-in NAT router). Of course, you'll have even more trouble with your krb5 TGTs. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From warlord@MIT.EDU Fri Oct 4 18:15:54 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 04 Oct 2002 13:15:54 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: References: Message-ID: Charles Clancy writes: > Of course, you'll have even more trouble with your krb5 TGTs. Turn off addressing in krb5 -- works great (kinit -A) > [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From tim@umbc.edu Fri Oct 4 18:48:19 2002 From: tim@umbc.edu (Tim C.) Date: Fri, 4 Oct 2002 13:48:19 -0400 (EDT) Subject: [OpenAFS] volume disappeared In-Reply-To: <3D9DBDDC.2090202@sc.edu> Message-ID: > One of my volumes disappeared today. I tried "bos salvage -sever > myserver -all" but it didn't work. > Well hopefully that is supposed to be "-server". ;) But I would try this command: bos salvage -server myserver -partition /vicepa -volume user.yumiceva -salvagedirs -orphans remove That's the command I normally use. BUT...looking at what you've shown, it looks like the volume is online, so it's probably not bad. It will normally take a volume off-line if it needs salvaged. I'm guessing that VI 536870923 is the backup volume of the user. That should not affect accessing the actual volume. What error messages are you getting when you try to access the volume? I'm assuming it's mounted and you're trying to cd into it when you get these errors? As for the backup, if you'd like to fix that, here's the way I always use, which works as well as any other. Just log into myserver as root, and cd to the partition that the volume is on, and do an "rm V0536870923.vol". Make sure that volume's there first of course(and make sure you have the right volumeid ;). Once you've done that, then you can just do a vos backup user.yumiceva. I hope this helps you some, if not, try answering my above questions and sending back to the list. Thanks, Tim > Here are the symptoms: > vos listvol myserver > ... > user.white 536870924 RW 57 K On-line > user.white.backup 536870926 BK 57 K On-line > user.yumiceva 536870921 RW 1954701 K On-line > **** Could not attach volume 536870923 **** > > Total volumes onLine 17 ; Total volumes offLine 1 ; Total busy 0 > > When I do "bos status myserver -long" I see this error: > Instance backupusers, (type is cron) currently running normally. > Auxiliary status is: run next at Sat Oct 5 01:00:00 2002. > Process last started at Fri Oct 4 01:00:01 2002 (5 proc starts) > Last exit at Fri Oct 4 01:00:05 2002 > Last error exit at Fri Oct 4 01:00:05 2002, due to signal 13 > Command 1 is '/usr/sbin/vos backupsys -prefix user -localauth' > Command 2 is '1:00' > > I cannot acces the volumen user.yumiceva may be because something is > wrong with the backup. > > Please, I need help with this. > > Thanks, > Francisco > -- > _________________________________________________ > Francisco Yumiceva > High Energy Group - Dept. of Physics & Astronomy > University of South Carolina > phone: 803.7771438 > > http://www.slac.stanford.edu/~yumiceva > _________________________________________________ > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > ----------------------------------------------------------------------- Tim Craig These are my opinions and not my employers. :) OIT-Systems & Imaging Research Center tim@umbc.edu It's hard to be serious when you're naked. - Garfield ----------------------------------------------------------------------- From ckovacs@DEPAUW.EDU Fri Oct 4 21:55:58 2002 From: ckovacs@DEPAUW.EDU (Corey Kovacs) Date: Fri, 04 Oct 2002 15:55:58 -0500 Subject: [OpenAFS] butc error 22? Message-ID: <200210041555.59095.ckovacs@depauw.edu> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've seen mention of a butc error around but I cannot find anything describing what it means or a way to fix it. I've got a new tape unit, new tape and an otherwise clean backup but at the end of the backup I get an error message stating that butc can't close the tape etc. Anyone have any insight? Corey -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iD8DBQE9ngBeglw65kKkYY4RAiVWAJ4oc/74TRVEH4MKKaJnoUH2s3HKAACfVFKn tmR+G4+wG2xNwDwJ9vjeCiI= =XdrC -----END PGP SIGNATURE----- From andrei@caspur.it Fri Oct 4 23:40:34 2002 From: andrei@caspur.it (Andrei Maslennikov) Date: Fri, 4 Oct 2002 22:40:34 +0000 ( ) Subject: [OpenAFS] rh8.0: follow-up Message-ID: http://afs.caspur.it now contains a working "grand-unified" 1.2.7 client RPM. Supported are: rh72,73,80(NB). From warlord@MIT.EDU Fri Oct 4 23:43:08 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 04 Oct 2002 18:43:08 -0400 Subject: [OpenAFS] rh8.0: follow-up In-Reply-To: References: Message-ID: Well, www.openafs.org will hopefully, soon, have "official" RH8.0 RPMS. -derek Andrei Maslennikov writes: > http://afs.caspur.it now contains a working "grand-unified" > 1.2.7 client RPM. Supported are: rh72,73,80(NB). > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From yumiceva@sc.edu Sat Oct 5 00:45:21 2002 From: yumiceva@sc.edu (Francisco Yumiceva) Date: Fri, 04 Oct 2002 19:45:21 -0400 Subject: [OpenAFS] volume disappeared References: Message-ID: <3D9E2811.4070103@sc.edu> Hi, I removed the volume and I ran the salvage. Now, I got access to the volume but I lost many files. I guess the backup volume is gone after "rm V0536870923.vol" so bad :( because the nightly backup also failed: Last error exit at Fri Oct 4 01:00:05 2002, due to signal 13 I wonder if I would have been able to recover that volume or the only solution was to remove it?. No idea what caused the error in the backup. Thanks, Francisco > > Well hopefully that is supposed to be "-server". ;) But I would try this > command: > > bos salvage -server myserver -partition /vicepa -volume user.yumiceva -salvagedirs -orphans remove > > That's the command I normally use. BUT...looking at what you've shown, it > looks like the volume is online, so it's probably not bad. It will normally > take a volume off-line if it needs salvaged. I'm guessing that VI 536870923 is > the backup volume of the user. That should not affect accessing the actual > volume. What error messages are you getting when you try to access the volume? > I'm assuming it's mounted and you're trying to cd into it when you get these > errors? > > As for the backup, if you'd like to fix that, here's the way I always use, > which works as well as any other. Just log into myserver as root, and cd to > the partition that the volume is on, and do an "rm V0536870923.vol". Make sure > that volume's there first of course(and make sure you have the right volumeid > ;). Once you've done that, then you can just do a vos backup user.yumiceva. > > I hope this helps you some, if not, try answering my above questions and > sending back to the list. > > Thanks, > Tim > > >>Here are the symptoms: >>vos listvol myserver >>... >>user.white 536870924 RW 57 K On-line >>user.white.backup 536870926 BK 57 K On-line >>user.yumiceva 536870921 RW 1954701 K On-line >>**** Could not attach volume 536870923 **** >> >>Total volumes onLine 17 ; Total volumes offLine 1 ; Total busy 0 >> >>When I do "bos status myserver -long" I see this error: >>Instance backupusers, (type is cron) currently running normally. >> Auxiliary status is: run next at Sat Oct 5 01:00:00 2002. >> Process last started at Fri Oct 4 01:00:01 2002 (5 proc starts) >> Last exit at Fri Oct 4 01:00:05 2002 >> Last error exit at Fri Oct 4 01:00:05 2002, due to signal 13 >> Command 1 is '/usr/sbin/vos backupsys -prefix user -localauth' >> Command 2 is '1:00' >> >>I cannot acces the volumen user.yumiceva may be because something is >>wrong with the backup. >> >>Please, I need help with this. >> >>Thanks, >>Francisco >>-- -- _________________________________________________ Francisco Yumiceva High Energy Group - Dept. of Physics & Astronomy University of South Carolina phone: 803.7771438 http://www.slac.stanford.edu/~yumiceva _________________________________________________ From 6delgado@informatik.uni-hamburg.de Sat Oct 5 01:01:45 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Sat, 5 Oct 2002 02:01:45 +0200 Subject: [OpenAFS] volume disappeared In-Reply-To: <3D9E2811.4070103@sc.edu> References: <3D9E2811.4070103@sc.edu> Message-ID: <20021005000145.GA14081@taupan.ath.cx> --6c2NcOVqGQ03X4Wi Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! Francisco Yumiceva schrieb: > I removed the volume and I ran the salvage. Now, I got=20 > access to the volume but I lost many files. I guess the=20 > backup volume is gone after "rm V0536870923.vol" so bad :(=20 > because the nightly backup also failed: > Last error exit at Fri Oct 4 01:00:05 2002, due to signal 13 Yeah, with "-orphans attach" instead of "-orphans remove" you would have kept your data, but the directory structure was lost forever (i.e. the orphaned files and directories would have been attached to the mountpoint of your volume and named AFSORPHAN-1232423 or some such (i can't remember it exactly, had to do this once before)) > I wonder if I would have been able to recover that volume or=20 > the only solution was to remove it?. No idea what caused the=20 > error in the backup. I have a guess what might have caused the error. May i ask what version of OpenAFS you are using on which Operating System? > >bos salvage -server myserver -partition /vicepa -volume user.yumiceva=20 > >-salvagedirs -orphans remove Bad, bad, bad... I wonder why Tim C. didn't ask which OpenAFS Version and OS you were using... Well, a little consolation: Moving the attached orphans around is no fun at all and takes a lot of time... So restoring the tapes from yesterday is probably the better solution anyways. Ciao Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --6c2NcOVqGQ03X4Wi Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iEYEARECAAYFAj2eK+kACgkQCTmCEtF2zECAYACdGeVDF8Yi9lxq+PzwWH+JtVBi 4wEAn2nMwmZdgO27lvdqpaqdf/BbdBF6 =vvgg -----END PGP SIGNATURE----- --6c2NcOVqGQ03X4Wi-- From turbo@bayour.com Sat Oct 5 09:48:22 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 05 Oct 2002 10:48:22 +0200 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: References: Message-ID: <87d6qpuv8p.fsf@papadoc.bayour.com> >>>>> "Derek" == Derek Atkins writes: Derek> Charles Clancy writes: >> Of course, you'll have even more trouble with your krb5 TGTs. Derek> Turn off addressing in krb5 -- works great (kinit -A) I have the same problem (using krb5 TGTs), and I _DO_ have address less tickets.. Still no go. From warlord@MIT.EDU Sat Oct 5 14:52:25 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 05 Oct 2002 09:52:25 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: <87d6qpuv8p.fsf@papadoc.bayour.com> References: <87d6qpuv8p.fsf@papadoc.bayour.com> Message-ID: Turbo Fredriksson writes: > Derek> Turn off addressing in krb5 -- works great (kinit -A) > > I have the same problem (using krb5 TGTs), and I _DO_ have address less > tickets.. Still no go. Eh? aklog works fine from behind NAT using addressless tickets... Not _all_ apps will work, however. What in particular fails for you? -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From turbo@bayour.com Sat Oct 5 14:59:32 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 05 Oct 2002 15:59:32 +0200 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: References: <87d6qpuv8p.fsf@papadoc.bayour.com> Message-ID: <878z1dt29n.fsf@papadoc.bayour.com> Quoting Derek Atkins : > Turbo Fredriksson writes: > > > Derek> Turn off addressing in krb5 -- works great (kinit -A) > > > > I have the same problem (using krb5 TGTs), and I _DO_ have address less > > tickets.. Still no go. > > Eh? aklog works fine from behind NAT using addressless tickets... > Not _all_ apps will work, however. What in particular fails for > you? I never had any problems with aklog. I have problem with the second login on the second host disrupting the AFS traffic on the first host! From yumiceva@sc.edu Sat Oct 5 15:02:14 2002 From: yumiceva@sc.edu (Francisco Yumiceva) Date: Sat, 05 Oct 2002 10:02:14 -0400 Subject: [OpenAFS] volume disappeared References: <3D9E2811.4070103@sc.edu> <20021005000145.GA14081@taupan.ath.cx> Message-ID: <3D9EF0E6.5010206@sc.edu> Hi, >>I wonder if I would have been able to recover that volume or >>the only solution was to remove it?. No idea what caused the >>error in the backup. > > I have a guess what might have caused the error. > > May i ask what version of OpenAFS you are using on which Operating > System? The server where the problems appeared was running an old openafs (1.0.4) and it is a RH 6.2, the rest of servers and clients are RH7.2 with openafs 1.2.6. I have updated that server to 1.2.7. I hope this will fix the backup error. > Well, a little consolation: Moving the attached orphans around is no > fun at all and takes a lot of time... So restoring the tapes from > yesterday is probably the better solution anyways. :( yeah. Francisco -- _________________________________________________ Francisco Yumiceva High Energy Group - Dept. of Physics & Astronomy University of South Carolina phone: 803.7771438 http://www.slac.stanford.edu/~yumiceva _________________________________________________ From warlord@MIT.EDU Sat Oct 5 15:48:50 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 05 Oct 2002 10:48:50 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: <878z1dt29n.fsf@papadoc.bayour.com> References: <87d6qpuv8p.fsf@papadoc.bayour.com> <878z1dt29n.fsf@papadoc.bayour.com> Message-ID: Turbo Fredriksson writes: > I never had any problems with aklog. I have problem with the second login > on the second host disrupting the AFS traffic on the first host! What version of AFS are you running on your servers? I suppose I can test this using VMware.. I will at some point and see what I can see, but honestly it SHOULD work -- the servers are supposed to use client uuid to identify, and use the source ip:port to respond. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Sat Oct 5 15:52:19 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 05 Oct 2002 10:52:19 -0400 Subject: [OpenAFS] volume disappeared In-Reply-To: <3D9EF0E6.5010206@sc.edu> References: <3D9E2811.4070103@sc.edu> <20021005000145.GA14081@taupan.ath.cx> <3D9EF0E6.5010206@sc.edu> Message-ID: Francisco Yumiceva writes: > The server where the problems appeared was running an old openafs > (1.0.4) and it is a RH 6.2, the rest of servers and clients are RH7.2 > with openafs 1.2.6. I have updated that server to 1.2.7. I hope this > will fix the backup error. Ahh, this might have been the old CopyOnWrite bug.. If so, then moving to 1.2.7 _should_ fix it... -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From turbo@bayour.com Sat Oct 5 16:07:38 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 05 Oct 2002 17:07:38 +0200 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: References: <87d6qpuv8p.fsf@papadoc.bayour.com> <878z1dt29n.fsf@papadoc.bayour.com> Message-ID: <874rc0udol.fsf@papadoc.bayour.com> Quoting Derek Atkins : > Turbo Fredriksson writes: > > > I never had any problems with aklog. I have problem with the second login > > on the second host disrupting the AFS traffic on the first host! > > What version of AFS are you running on your servers? I suppose I can > test this using VMware.. I will at some point and see what I can see, > but honestly it SHOULD work -- the servers are supposed to use client > uuid to identify, and use the source ip:port to respond. 1.2.6 on both the server and client (even the win clients have 1.2.6). Since it's NAT, _ALL_ machines have the same IP/port (from the server's stand point any way). From warlord@MIT.EDU Sat Oct 5 16:30:57 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 05 Oct 2002 11:30:57 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: <874rc0udol.fsf@papadoc.bayour.com> References: <87d6qpuv8p.fsf@papadoc.bayour.com> <878z1dt29n.fsf@papadoc.bayour.com> <874rc0udol.fsf@papadoc.bayour.com> Message-ID: Turbo Fredriksson writes: > Since it's NAT, _ALL_ machines have the same IP/port (from the server's > stand point any way). No, all clients have the same IP. They do NOT have the same port (unless you misconfigred your NAT box).... If you specifically set up port-forwarding for port 7001 in your NAT box, then yes, you have shot yourself in the foot. However, if you let the ports float (i.e., if you let the NAT box choose an arbitrary port for every "connection") then it should work just fine. Assume you have a picture like this: A--\ ______ B---\___| NAT |-- AFS Server ... / ------ X--/ The AFS server will see 'A' as 'NAT:12345', 'B" as 'NAT:23456' and 'X' as 'NAT:23489' (just to throw out random numbers). FTR, I'm running two VMware guest machines behind NAT on this host and both can access AFS just fine. If you are having NAT problems it is almost assuredly a NAT configuration bug on your part. Note that Linux-2.4's NAT has hard-coded UDP timeouts -- you need to recompile your kernel to fix that. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From turbo@bayour.com Sat Oct 5 16:52:22 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 05 Oct 2002 17:52:22 +0200 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: References: <87d6qpuv8p.fsf@papadoc.bayour.com> <878z1dt29n.fsf@papadoc.bayour.com> <874rc0udol.fsf@papadoc.bayour.com> Message-ID: <87zntssx1l.fsf@papadoc.bayour.com> Quoting Derek Atkins : > Turbo Fredriksson writes: > > > Since it's NAT, _ALL_ machines have the same IP/port (from the server's > > stand point any way). > > No, all clients have the same IP. They do NOT have the same port > (unless you misconfigred your NAT box).... Right, sorry. > If you specifically set up > port-forwarding for port 7001 in your NAT box, then yes, you have shot > yourself in the foot. However, if you let the ports float (i.e., if > you let the NAT box choose an arbitrary port for every "connection") > then it should work just fine. No portforwarding, no specific port configuration so they 'float'. > If you are having NAT problems it is almost assuredly a NAT > configuration bug on your part. Note that Linux-2.4's NAT has > hard-coded UDP timeouts -- you need to recompile your kernel to fix > that. UDP timeouts... Haven't changed that, so I guess I'm running default values. Is this an issue on the firewall, the server or the client (how to change that on win?)? From warlord@MIT.EDU Sat Oct 5 17:03:37 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 05 Oct 2002 12:03:37 -0400 Subject: [OpenAFS] Multiple hosts behind firewall and AFS cell In-Reply-To: <87zntssx1l.fsf@papadoc.bayour.com> References: <87d6qpuv8p.fsf@papadoc.bayour.com> <878z1dt29n.fsf@papadoc.bayour.com> <874rc0udol.fsf@papadoc.bayour.com> <87zntssx1l.fsf@papadoc.bayour.com> Message-ID: Turbo Fredriksson writes: > > If you are having NAT problems it is almost assuredly a NAT > > configuration bug on your part. Note that Linux-2.4's NAT has > > hard-coded UDP timeouts -- you need to recompile your kernel to fix > > that. > > UDP timeouts... Haven't changed that, so I guess I'm running default > values. Is this an issue on the firewall, the server or the client > (how to change that on win?)? it is an issue on the NAT-firewall. How you change it depends on your particular firewall. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From schmitt@inf.ethz.ch Sat Oct 5 19:19:44 2002 From: schmitt@inf.ethz.ch (Marc Schmitt) Date: Sat, 05 Oct 2002 20:19:44 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 References: <15770.43001.206989.710003@hszpc38.isz.ch> Message-ID: <3D9F2D40.4050704@inf.ethz.ch> Hi Andi, Was the sshd version on the alpha machine built --with-afs? I`m seeing the problem you describe under RedHat 7.3 with openafs-1.2.7-rh7.3.1 and openssh-3.4p1-3 (what I changed between 3.4p1-2 and 3.4p1-3 is adding "--with-afs=/usr --with-kerberos4=/usr/athena" to the configure line, krb4 is version 1.2). If I use openssh-3.4p1-2, I get: Oct 5 19:35:14 otherhost sshd(pam_unix)[8281]: session opened for user testuser by (uid=0) If I use openssh-3.4p1-3, I get: Oct 5 19:47:42 otherhost pam_afs[15855]: AFS Authentication failed for user testuser. password was incorrect Oct 5 19:47:42 otherhost sshd(pam_unix)[15851]: check pass; user unknown Oct 5 19:47:42 otherhost sshd(pam_unix)[15851]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=somehost Looking at the debug output of sshd: With openssh-3.4p1-2: Oct 5 20:03:53 otherhost sshd[23253]: Failed none for testuser from 129.132.10.58 port 35551 Oct 5 20:03:53 otherhost sshd[23253]: debug3: mm_request_receive entering Oct 5 20:03:56 otherhost sshd[23253]: debug3: monitor_read: checking request 10 Oct 5 20:03:56 otherhost sshd[23253]: debug1: PAM Password authentication accepted for user "testuser" Oct 5 20:03:56 otherhost sshd[23253]: debug3: mm_answer_authpassword: sending result 1 Oct 5 20:03:56 otherhost sshd[23253]: debug3: mm_request_send entering: type 11 Oct 5 20:03:56 otherhost sshd[23253]: debug2: pam_acct_mgmt() = 0 Oct 5 20:03:56 otherhost sshd[23253]: Accepted password for testuser from 129.132.10.58 port 35551 Oct 5 20:03:56 otherhost sshd[23253]: debug1: monitor_child_preauth: testuser has been authenticated by privileged process and openssh-3.4p1-3: Oct 5 19:47:39 otherhost sshd[15851]: Failed none for testuser from 129.132.10.58 port 35528 Oct 5 19:47:39 otherhost sshd[15851]: debug3: mm_request_receive entering Oct 5 19:47:42 otherhost sshd[15851]: debug3: monitor_read: checking request 10 Oct 5 19:47:44 otherhost sshd[15851]: debug1: PAM Password authentication for "testuser" failed[7]: Authentication failure Oct 5 19:47:44 otherhost sshd[15851]: debug3: mm_answer_authpassword: sending result 0 Oct 5 19:47:44 otherhost sshd[15851]: debug3: mm_request_send entering: type 11 Oct 5 19:47:44 otherhost sshd[15851]: Failed password for testuser from 129.132.10.58 port 35528 PAM authentication fails... but why? Nothing has changed in /etc/pam.d/system-auth nor /etc/pam.d/sshd between the two tests. Looks like AFS support in OpenSSH bites pam AFS authentication... Regards, Marc Andreas Buechler wrote: > Hello, > > I just installed openafs 1.2.7 on a alpha machine. Everything worked fine > (rebuilding and installing the rpm's) and at the end I was told to change > the files cacheinfo and ThisCell. I changed both files, now I am able to > get tokens etc as root for any afs-user. To be able to login and get a > token automatically I changed /etc/pam.d/system-auth as discribed at the end of the > installation. > Does anybody have an idea why I still cant login via ssh as an afs-user? > I posted my sshd and system-auth pam-files at the end of this mail. > > Thanks for any help and sorry if this message was posted twice! > > Andi From 6delgado@informatik.uni-hamburg.de Sat Oct 5 22:34:37 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Sat, 5 Oct 2002 23:34:37 +0200 Subject: [OpenAFS] volume disappeared In-Reply-To: References: <3D9E2811.4070103@sc.edu> <20021005000145.GA14081@taupan.ath.cx> <3D9EF0E6.5010206@sc.edu> Message-ID: <20021005213437.GA13527@taupan.ath.cx> --azLHFNyN32YCQGCU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hiho! Derek Atkins schrieb: > Francisco Yumiceva writes: > > The server where the problems appeared was running an old openafs > > (1.0.4) and it is a RH 6.2, the rest of servers and clients are RH7.2 > > with openafs 1.2.6. I have updated that server to 1.2.7. I hope this > > will fix the backup error. > Ahh, this might have been the old CopyOnWrite bug.. If so, then moving > to 1.2.7 _should_ fix it... The description sounded very much like my Experiences with the CopyOnWrite bug on linux. And that's what my guess was. Upgrading to 1.2.5 or higher has seemingly fixed it for quite some time now... At least i have started to feel a lot more comfortable with OpenAFS on Linux. :) Cheerio Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --azLHFNyN32YCQGCU Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iEYEARECAAYFAj2fWu0ACgkQCTmCEtF2zEAaVACeIJ4SDYLIYnzDE31MvHOncc3Y bmwAn08E6DIm6Lo/bj1PZo3urHuIAoke =NQGN -----END PGP SIGNATURE----- --azLHFNyN32YCQGCU-- From fw@fwsystems.com Sun Oct 6 05:14:08 2002 From: fw@fwsystems.com (forrest whitcher) Date: Sun, 6 Oct 2002 00:14:08 -0400 Subject: [OpenAFS] Problem authenticating against (aix) Kerberos v 1.2.6 Message-ID: <20021006001408.73238c2e.fw@fwsystems.com> My kerberos admin server is an aix box, on updating it I found that (reportedly) valid afs tokens would still be issued as had worked before, however they didn't work for actual access. On reverting to kerberos 1.2.5 w/ xdr patch everything now works ok again. The other kdc's run Linux and there seem to be no problems there, both are updated to 1.2.6. This behavior was true for clients running both openafs 1.2.7 and the early release 1.0.3. I can't give much better diagnostics right now, as it's not easy to make changes to the kadmind service and still keep tings running smoothly forrest From fbo2@gmx.net Sun Oct 6 08:16:17 2002 From: fbo2@gmx.net (FBO) Date: Sun, 6 Oct 2002 09:16:17 +0200 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 Message-ID: <20021006071617.GA6094@fbo.no-ip.org> Hi, after updating to openafs 1.2.7 i found some processes never seen before: # pstree -p [snip] |-keventd(2)-+-afs_background(402) | |-afs_background(403) | |-afs_background(404) | |-afs_cachetrim(407) | |-afs_callback(393) | |-afs_checkserver(398) | |-afs_rxevent(392) | |-afs_rxlistener(391) | -afsd(397) [snip] Can someone tell what they do or what I can do with them? FBO From kolya@MIT.EDU Sun Oct 6 08:34:03 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Sun, 06 Oct 2002 03:34:03 -0400 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 Message-ID: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> > |-keventd(2)-+-afs_background(402) > [...] > > Can someone tell what they do or > what I can do with them? These are basically the same processes that you used to see as "afsd" before. I'm not sure why they're all displayed as children of keventd (maybe some function of the way Linux does kernel threads), if that's what you're asking. In short, they make AFS work -- process requests in the background, receive packets, and perform other miscellaneous tasks. There isn't much you can do with them, kind-of in the same way there isn't much you can do with, say, kflushd. -- kolya From nneul@umr.edu Sun Oct 6 15:39:29 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 06 Oct 2002 09:39:29 -0500 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 In-Reply-To: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> References: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> Message-ID: <1033915168.3299.1.camel@cessna.rollanet.org> This surprised me as well... I think sometime recently, they changed from being listed as afsd to being listed as specific names. They've always been there, just never dipsplayed that way before. On Sun, 2002-10-06 at 02:34, Nickolai Zeldovich wrote: > > |-keventd(2)-+-afs_background(402) > > [...] > > > > Can someone tell what they do or > > what I can do with them? > > These are basically the same processes that you used to see as "afsd" > before. I'm not sure why they're all displayed as children of keventd > (maybe some function of the way Linux does kernel threads), if that's > what you're asking. In short, they make AFS work -- process requests > in the background, receive packets, and perform other miscellaneous > tasks. There isn't much you can do with them, kind-of in the same > way there isn't much you can do with, say, kflushd. > > -- kolya > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From cg2v@andrew.cmu.edu Sun Oct 6 15:42:06 2002 From: cg2v@andrew.cmu.edu (Chaskiel M Grundman) Date: Sun, 06 Oct 2002 10:42:06 -0400 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 In-Reply-To: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> References: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> Message-ID: <17670000.1033915326@endicott> --On Sunday, October 06, 2002 03:34:03 -0400 Nickolai Zeldovich wrote: > I'm not sure why they're all displayed as children of keventd The almost-consensus of the various mailing list posts I read about how to properly create a truly user-process independent kernel thread was that 'daemonize()' doesn't really completely sever a kernel thread from it's user-process parent, and the only way to be sure was to use schedule_task() to make sure the thread's parent was keventd. From warlord@MIT.EDU Sun Oct 6 15:45:42 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 06 Oct 2002 10:45:42 -0400 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 In-Reply-To: <1033915168.3299.1.camel@cessna.rollanet.org> References: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> <1033915168.3299.1.camel@cessna.rollanet.org> Message-ID: It surprised me, but it does sort of change the FAQ from: Q: What are all these afsd processes (and how do I get rid of them) to Q: What are all these afs_* processes (and how do I get rid of them) ;) -derek Nathan Neulinger writes: > This surprised me as well... I think sometime recently, they changed > from being listed as afsd to being listed as specific names. They've > always been there, just never dipsplayed that way before. > > On Sun, 2002-10-06 at 02:34, Nickolai Zeldovich wrote: > > > |-keventd(2)-+-afs_background(402) > > > [...] > > > > > > Can someone tell what they do or > > > what I can do with them? > > > > These are basically the same processes that you used to see as "afsd" > > before. I'm not sure why they're all displayed as children of keventd > > (maybe some function of the way Linux does kernel threads), if that's > > what you're asking. In short, they make AFS work -- process requests > > in the background, receive packets, and perform other miscellaneous > > tasks. There isn't much you can do with them, kind-of in the same > > way there isn't much you can do with, say, kflushd. > > > > -- kolya > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > -- > > ------------------------------------------------------------ > Nathan Neulinger EMail: nneul@umr.edu > University of Missouri - Rolla Phone: (573) 341-4841 > Computing Services Fax: (573) 341-4216 > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From nneul@umr.edu Sun Oct 6 16:22:19 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 06 Oct 2002 10:22:19 -0500 Subject: [OpenAFS] Unknown processes after update to openafs 1.2.7 In-Reply-To: References: <200210060734.DAA23103@contents-vnder-pressvre.mit.edu> <1033915168.3299.1.camel@cessna.rollanet.org> Message-ID: <1033917739.1617.5.camel@cessna.rollanet.org> We might consider changing them from: 527 ? 00:00:01 afs_rxlistener 528 ? 00:00:00 afs_callback 529 ? 00:00:16 afs_rxevent 559 ? 00:00:02 afs_checkserver 560 ? 00:00:00 afs_background 561 ? 00:00:00 afs_background 565 ? 00:00:00 afs_background 566 ? 00:00:00 afs_background 567 ? 00:00:05 afs_background 569 ? 00:00:01 afs_cachetrim To the style more commonly used by ftpd, rsync, etc. afsd [rxlistener] afsd [callback] afsd [checkserver] afsd [background] .... That may be less confusing, and clearly indicates that they are spawned from afsd. Doesn't matter much to me though... -- Nathan On Sun, 2002-10-06 at 09:45, Derek Atkins wrote: > It surprised me, but it does sort of change the FAQ from: > > Q: What are all these afsd processes (and how do I get rid of them) > > to > > Q: What are all these afs_* processes (and how do I get rid of them) > > ;) > > -derek > > Nathan Neulinger writes: > > > This surprised me as well... I think sometime recently, they changed > > from being listed as afsd to being listed as specific names. They've > > always been there, just never dipsplayed that way before. > > > > On Sun, 2002-10-06 at 02:34, Nickolai Zeldovich wrote: > > > > |-keventd(2)-+-afs_background(402) > > > > [...] > > > > > > > > Can someone tell what they do or > > > > what I can do with them? > > > > > > These are basically the same processes that you used to see as "afsd" > > > before. I'm not sure why they're all displayed as children of keventd > > > (maybe some function of the way Linux does kernel threads), if that's > > > what you're asking. In short, they make AFS work -- process requests > > > in the background, receive packets, and perform other miscellaneous > > > tasks. There isn't much you can do with them, kind-of in the same > > > way there isn't much you can do with, say, kflushd. > > > > > > -- kolya > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > > > > ------------------------------------------------------------ > > Nathan Neulinger EMail: nneul@umr.edu > > University of Missouri - Rolla Phone: (573) 341-4841 > > Computing Services Fax: (573) 341-4216 > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From ian@assv.net Sun Oct 6 23:34:04 2002 From: ian@assv.net (Ian Delahorne) Date: 07 Oct 2002 00:34:04 +0200 Subject: [OpenAFS] Problems releasing root.cell Message-ID: Why am I getting this? ian@dominatrix .assv.net $ fs mkm /afs/.assv.net/cvs cvs ian@dominatrix .assv.net $ vos release root.cell Failed to reclone the RW volume 536870915 : Invalid cross-device link Error in vos release command. : Invalid cross-device link ian@dominatrix .assv.net $ vos exa 536870915 root.cell 536870915 RW 10 K On-line dominatrix.lackflicka.nu /vicepa RWrite 536870915 ROnly 0 Backup 0 MaxQuota 5000 K Creation Tue Sep 24 22:57:32 2002 Last Update Mon Oct 7 00:29:31 2002 3 accesses in the past day (i.e., vnode references) RWrite: 536870915 ROnly: 536870916 Backup: 536870917 number of sites -> 2 server dominatrix.lackflicka.nu partition /vicepa RW Site server dominatrix.lackflicka.nu partition /vicepa RO Site ian@dominatrix .assv.net $ vos status says that there are no active transactions. -- /Ian D ian@assv.net - www.assv.net From enrico@it.kth.se Mon Oct 7 11:41:38 2002 From: enrico@it.kth.se (Enrico Pelletta) Date: Mon, 07 Oct 2002 12:41:38 +0200 Subject: [OpenAFS] FreeBSD & OpenAFS Message-ID: <3DA164E2.2F781226@it.kth.se> Hi! I would like to create an AFS cell using OpenAFS and FreeBSD for the servers. By now, I'm just making some tests for learning, but I have not found much documentation/information about OpenAFS using FreeBSD, so I wonder if it's a good combination. Anybody know where I could get some more information about? Thanks, Enrico. -- Enrico Pelletta IT Universitetet System Group KTH (Royal Institute of Technology) Stockholm (S). From dfs17@cornell.edu Mon Oct 7 07:43:18 2002 From: dfs17@cornell.edu (Daniel Schmidt) Date: Mon, 7 Oct 2002 02:43:18 -0400 Subject: [OpenAFS] NOTE: Installer Bug OpenAFS for Windows 1.2.2 b Message-ID: Hi folks. I recently installed OpenAFS for Windows 1.2.2b (as DLed from www.openafs.org) on my Windows 2000 SP3 machine (hence I got the NT release; dunno if the 9X release has the same issues). I chose the default installation, Client, Control Center, and Docs, but no Server, and found an _extremely_ obnoxious bug: When this program installs itself, it edits the PATH environment variable and makes multiple registry entries, including some uninstall entries. _Every single entry_ referring to a needed DLL (including the uninstall DLLs) was miswritten - Not to mention the additions to the PATH statement. They _all_ pointed to "subdirectories of C:\Program Files\IBM\..." or something like that, a directory which OpenAFS did not create, much less install anything into - OpenAFS installed all files in %WINNT%\, but did not know they were there. The results were predictable. Immediate errors on startup about being unable to load the appropriate library, and my complete inability to uninstall any part of the software. Having figured this out after a fair amount of swearing, I edited the appropriate registry entries and verified that it was indeed functional. As a result I'm now somewhat less unhappy - But this _really_ needs to be fixed. It looks like, between the docs (IBM logos everywhere, does IBM mind?) and the registry entries, a lot of artifacts from the days when AFS was an IBM product still exist. Funny thing is, the 1.2.6 "unofficial" client-only install the kind folks at Cornell sent me a link to works just fine, and doesn't do this - Too bad it's not available at www.openafs.org :( The link is here BTW, in case you want to put it on the OpenAFS site: http://www.unc.edu/~sdw/OpenAFS_Client_126.exe I know that no one is really actively maintaining the OpenAFS distribution for Windows, and I don't expect that to change just 'cause of me - But since this is so extremely annoying (and since it should be so easy to correct), if someone who has access to these files could fix this, you'd be doing a big favor to anyone else who might download it. Thanks!! PS - I'm not subscribed to the OpenAFS info mailing list, and I swear I will trouble you no longer; I just figured someone might benefit from this knowledge. If you need to get in touch, feel free to drop me an e-mail. PPS - Derrick J Brashear - Do you remember me? CMU, '94, I lived on your hall! 1st floor 'Schlag, what a hole that was... Small world... (Hi Mitch! :) -- Daniel Schmidt dfs17@cornell.edu -------------------------------------------------- Department of Materials Science and Engineering Cornell University -------------------------------------------------- [Opinions expressed are my own exclusively] From mtawafig@optonline.com Mon Oct 7 12:46:11 2002 From: mtawafig@optonline.com (Muhsin Tawafig) Date: Mon, 7 Oct 2002 07:46:11 -0400 Subject: [OpenAFS] REDHAT 7.3 & openafs 1.2.7 rpms Message-ID: hi When seting up initial security the following message is recieved. openafs-1.2.7 from rpms. [root@h2 bin]# kas bizittech.com -noauth ka> list list: server or network not responding calling KAM_ListEntry any hints thanks From mike@bizittech.com Mon Oct 7 16:02:47 2002 From: mike@bizittech.com (mike@bizittech.com) Date: Mon, 7 Oct 2002 11:02:47 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> Message-ID: <014101c26e12$99441dc0$01000001@micron> hi I had the same problem .Use the source code and compile .I got better results . Thanks ----- Original Message ----- From: "Jesus Delgado" To: Sent: Wednesday, October 02, 2002 9:53 PM Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 > > ---------- Forwarded Message ----------- > Hi: > > Problems when try the build openafs source rpm in redhat 8.0 > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > Errors in openafs-1.2.7 > > .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > 3.0.4-1 > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= 3.0.4-1 > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > Processing files: openafs-krb5-1.2.7-rh7.3.1 > error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > Requires: openafs = 1.2.7 > > RPM build errors: > File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > Errors with openafs-1.2.6 > > Requires: openafs = 1.2.6 openafs-client = 1.2.6 > Obsoletes: openafs-client-compat > Processing files: openafs-kpasswd-1.2.6-rh7.3.1 > Finding Provides: /usr/lib/rpm/find-provides > Finding Requires: /usr/lib/rpm/find-requires > PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(CompressedFileNames) <= > 3.0.4-1 > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= 3.0.4-1 > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > Processing files: openafs-krb5-1.2.6-rh7.3.1 > error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > Requires: openafs = 1.2.6 > > RPM build errors: > File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > Help me plase > > Regards. > ------- End of Forwarded Message ------- > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From warlord@MIT.EDU Mon Oct 7 17:43:35 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 07 Oct 2002 12:43:35 -0400 Subject: [OpenAFS] REDHAT 7.3 & openafs 1.2.7 rpms In-Reply-To: References: Message-ID: Did you add your cell information to /usr/vice/etc/CellServDB? -derek "Muhsin Tawafig" writes: > hi > When seting up initial security the following message is recieved. > openafs-1.2.7 from rpms. > [root@h2 bin]# kas bizittech.com -noauth > ka> list > list: server or network not responding calling KAM_ListEntry > > any hints > > thanks > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Mon Oct 7 17:44:07 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 07 Oct 2002 12:44:07 -0400 Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 In-Reply-To: <014101c26e12$99441dc0$01000001@micron> References: <20021002151128.M26033@soltis.cc> <20021002195332.M26176@soltis.cc> <014101c26e12$99441dc0$01000001@micron> Message-ID: This is fixed in the "official" RH8.0 RPMS -derek writes: > hi > I had the same problem .Use the source code and compile .I got better > results . > Thanks > ----- Original Message ----- > From: "Jesus Delgado" > To: > Sent: Wednesday, October 02, 2002 9:53 PM > Subject: [OpenAFS] Problems in RedHat 8.0 openafs 1.2.6 y 1.2.7 > > > > > > ---------- Forwarded Message ----------- > > Hi: > > > > Problems when try the build openafs source rpm in redhat 8.0 > > the errors is the same with openafs-1.2.6 y openafs-1.2.7: > > > > Errors in openafs-1.2.7 > > > > .4.1eq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= > > 3.0.4-1 > > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > > rpmlib(CompressedFileNames) <= 3.0.4-1 > > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > > Processing files: openafs-krb5-1.2.7-rh7.3.1 > > error: File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > > error: File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > Requires: openafs = 1.2.7 > > > > RPM build errors: > > File not found: /var/tmp/openafs-1.2.7-root/usr/bin/aklog > > File not found: /var/tmp/openafs-1.2.7-root/usr/sbin/asetkey > > > > Errors with openafs-1.2.6 > > > > Requires: openafs = 1.2.6 openafs-client = 1.2.6 > > Obsoletes: openafs-client-compat > > Processing files: openafs-kpasswd-1.2.6-rh7.3.1 > > Finding Provides: /usr/lib/rpm/find-provides > > Finding Requires: /usr/lib/rpm/find-requires > > PreReq: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > rpmlib(CompressedFileNames) <= > > 3.0.4-1 > > Requires(rpmlib): rpmlib(PayloadFilesHavePrefix) <= 4.0-1 > > rpmlib(CompressedFileNames) <= 3.0.4-1 > > Requires: openafs libc.so.6 libc.so.6(GLIBC_2.0) libc.so.6(GLIBC_2.1) > > libc.so.6(GLIBC_2.3) libresolv.so.2 libresolv.so.2(GLIBC_2.2) > > Processing files: openafs-krb5-1.2.6-rh7.3.1 > > error: File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > > error: File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > Requires: openafs = 1.2.6 > > > > RPM build errors: > > File not found: /var/tmp/openafs-1.2.6-root/usr/bin/aklog > > File not found: /var/tmp/openafs-1.2.6-root/usr/sbin/asetkey > > > > Help me plase > > > > Regards. > > ------- End of Forwarded Message ------- > > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From security@xauth.net Mon Oct 7 22:24:50 2002 From: security@xauth.net (Charles Clancy) Date: Mon, 7 Oct 2002 16:24:50 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <3D9F2D40.4050704@inf.ethz.ch> Message-ID: If you compile --with-kerberos4 and --with-afs, OpenSSH should accept krb4 TGTs, krb4 passwords, or AFS tokens for authentication. OpenSSH will also grab a PAG for you and run krb_afslog() when you log in. They still need enabled in your sshd_config. PAM authentication and krb4 authentication in OpenSSH are completely independent. There's no reason why adding those options to ./configure would inhibit PAM from working. In fact, I've compiled and used both under the same sshd (though on Solaris). The only think I can possibly think of is that somehow there are library conflicts between the AFS and krb4 libraries statically linked into your OpenSSH, versus those statically linked to pam_afs.so, and things go wrong when OpenSSH (via libpam.so) dlopen's pam_afs.so. Do other modules work with your kerberos-enabled version of OpenSSH? In theory, if you have kerberos4 authentication with AFS support, you don't need PAM. They shouldn't be mutually exclusive, but if they are, it shouldn't matter, because you only need one or the other. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] On Sat, 5 Oct 2002, Marc Schmitt wrote: > Hi Andi, > > Was the sshd version on the alpha machine built --with-afs? > > I`m seeing the problem you describe under RedHat 7.3 with > openafs-1.2.7-rh7.3.1 and openssh-3.4p1-3 (what I changed between > 3.4p1-2 and 3.4p1-3 is adding "--with-afs=/usr > --with-kerberos4=/usr/athena" to the configure line, krb4 is version 1.2). > > If I use openssh-3.4p1-2, I get: > > Oct 5 19:35:14 otherhost sshd(pam_unix)[8281]: session opened for user > testuser by (uid=0) > > If I use openssh-3.4p1-3, I get: > > Oct 5 19:47:42 otherhost pam_afs[15855]: AFS Authentication failed for > user testuser. password was incorrect > Oct 5 19:47:42 otherhost sshd(pam_unix)[15851]: check pass; user unknown > Oct 5 19:47:42 otherhost sshd(pam_unix)[15851]: authentication failure; > logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=somehost > > Looking at the debug output of sshd: > > With openssh-3.4p1-2: > > Oct 5 20:03:53 otherhost sshd[23253]: Failed none for testuser from > 129.132.10.58 port 35551 > Oct 5 20:03:53 otherhost sshd[23253]: debug3: mm_request_receive entering > Oct 5 20:03:56 otherhost sshd[23253]: debug3: monitor_read: checking > request 10 > Oct 5 20:03:56 otherhost sshd[23253]: debug1: PAM Password > authentication accepted for user "testuser" > Oct 5 20:03:56 otherhost sshd[23253]: debug3: mm_answer_authpassword: > sending result 1 > Oct 5 20:03:56 otherhost sshd[23253]: debug3: mm_request_send entering: > type 11 > Oct 5 20:03:56 otherhost sshd[23253]: debug2: pam_acct_mgmt() = 0 > Oct 5 20:03:56 otherhost sshd[23253]: Accepted password for testuser > from 129.132.10.58 port 35551 > Oct 5 20:03:56 otherhost sshd[23253]: debug1: monitor_child_preauth: > testuser has been authenticated by privileged process > > and openssh-3.4p1-3: > > Oct 5 19:47:39 otherhost sshd[15851]: Failed none for testuser from > 129.132.10.58 port 35528 > Oct 5 19:47:39 otherhost sshd[15851]: debug3: mm_request_receive entering > Oct 5 19:47:42 otherhost sshd[15851]: debug3: monitor_read: checking > request 10 > Oct 5 19:47:44 otherhost sshd[15851]: debug1: PAM Password > authentication for "testuser" failed[7]: Authentication failure > Oct 5 19:47:44 otherhost sshd[15851]: debug3: mm_answer_authpassword: > sending result 0 > Oct 5 19:47:44 otherhost sshd[15851]: debug3: mm_request_send entering: > type 11 > Oct 5 19:47:44 otherhost sshd[15851]: Failed password for testuser from > 129.132.10.58 port 35528 > > PAM authentication fails... but why? Nothing has changed in > /etc/pam.d/system-auth nor /etc/pam.d/sshd between the two tests. > Looks like AFS support in OpenSSH bites pam AFS authentication... > > Regards, > Marc > > > Andreas Buechler wrote: > > Hello, > > > > I just installed openafs 1.2.7 on a alpha machine. Everything worked fine > > (rebuilding and installing the rpm's) and at the end I was told to change > > the files cacheinfo and ThisCell. I changed both files, now I am able to > > get tokens etc as root for any afs-user. To be able to login and get a > > token automatically I changed /etc/pam.d/system-auth as discribed at the end of the > > installation. > > Does anybody have an idea why I still cant login via ssh as an afs-user? > > I posted my sshd and system-auth pam-files at the end of this mail. > > > > Thanks for any help and sorry if this message was posted twice! > > > > Andi > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From cameron@ctc.com Mon Oct 7 23:41:59 2002 From: cameron@ctc.com (Frank J. Cameron) Date: 07 Oct 2002 18:41:59 -0400 Subject: [OpenAFS] RE: windows issues In-Reply-To: <20021003201102.B08239DC1@grand.central.org> References: <20021003201102.B08239DC1@grand.central.org> Message-ID: <1034030518.32300.16.camel@jsta6243.nsc.ctc.com> Take a look at the event log (Application log) for any AFS-related errors. Also, what error code did you get when klog failed? > Date: Thu, 03 Oct 2002 12:01:05 -0700 (MST) > From: David Bear > To: openafs-info@openafs.org > Subject: [OpenAFS] windows issues > > > strange happenings with win2k and openafs 1.2.2b. > > Worked fine yesterday. > > today, try to get tokens.. always fails. > > Then from cmd window issue: > > net stop "IBM AFS Client" > net start "IBM AFS Client" > > stops and starts successfully. Then klog .. > > works!!! Why? > > -- > David Bear > College of Public Programs/ASU > 480-965-8257 > ...the way is like water, going where nobody wants it to go From chris@chrisdos.com Tue Oct 8 04:05:29 2002 From: chris@chrisdos.com (Chris Dos) Date: Mon, 07 Oct 2002 21:05:29 -0600 Subject: [OpenAFS] Holy Grail of High Availability Message-ID: <3DA24B79.60102@chrisdos.com> I'm been looking at distributed files systems lately and I may have been under the wrong impression that OpenAFS or Coda could be the Holy Grail for High Availability for the hosting company that I work for. The part that worries me right now is the server replication. According to the documentation that I've been reading, the server replication is only good for volumes that don't see many files changing. So, replicating a database such as Oracle or MySQL that changes data often would be a bad idea, but web sites or mail might be good? Would it replcate the entire changed file, or just the pieces of the file that has changed. I'm looking at putting three high end terabyte servers next to each via Gigabit Ethernet, and having replication take place. Would the replicants be read only? So all the write changes still have to take place to one server. If that server goes down, will write changes go to a server that is still up and running. Also, how does the client know which server go to if there are three servers with identical data on the same subnet? Is there any type of load balancing going on to help distribute the load? Am I totally off my rocker in thinking AFS might be able to provide all these things? And if I am loony in thinking AFS or another distributed file system might be my holy grail, are there any other alternatives I should be looking at? Thank you for any insight you might be able to provide. I sincerely appreciate it. Chris Dos From security@xauth.net Tue Oct 8 05:08:04 2002 From: security@xauth.net (Charles Clancy) Date: Mon, 7 Oct 2002 23:08:04 -0500 (CDT) Subject: [OpenAFS] Holy Grail of High Availability In-Reply-To: <3DA24B79.60102@chrisdos.com> Message-ID: > So, replicating a database such as Oracle or MySQL that changes data > often would be a bad idea, Correct. > but web sites or mail might be good? Websites: probably. Mail spools: probably not. Websites are semi-static, but mail spools change way too frequently (see info on how replication works below). > Would it replcate the entire changed file, or just the pieces of the > file that has changed. In AFS, collections of directories are stored in abstract units called volumes. You can replicate volumes. Volume replicas are updated when the "vos release volume-name" command is run. An example scenario would be to have a volume for /afs/@cell/www/htdocs, and then make several replicas. If you change any files to your site, you'd need to release that volume, which would consequently release all changes to your site. > I'm looking at putting three high end terabyte servers next to each via > Gigabit Ethernet, and having replication take place. Would the > replicants be read only? There is a single RW volume, and its RO replicas are updated, usually by the person who just made changes to the RW volume, with the "vos release" command. > So all the write changes still have to take place to one server. The writes are made to the RW volume, and that volume can live on any of the servers. > If that server goes down, will write changes go to a server that is > still up and running. If that server goes down, you won't be able to write. It may take 30 seconds, or so (these values can be changed at compile time), for clients using the now down server to switch to one of the replicas. > Also, how does the client know which server go to if there are three > servers with identical data on the same subnet? Is there any type of > load balancing going on to help distribute the load? The clients generally pick one at random. I believe there is a hack that has them first look for servers on their own subnet first. > Am I totally off my rocker in thinking AFS might be able to provide all > these things? And if I am loony in thinking AFS or another distributed > file system might be my holy grail, are there any other alternatives I > should be looking at? AFS is a distributed file system. It works great for sharing files to user workstations, especially those which may have slow links. Generally the file system consists of a static set of shared application binaries, and users' home directories (which aren't replicated for various implementation reasons I can describe if you're interested). I don't think of AFS as a very good method of providing HA between high-speed servers. Its replication model just doesn't fit very well in that environment. It's much better at replicating [mostly] static data. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From warlord@MIT.EDU Tue Oct 8 05:32:07 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 08 Oct 2002 00:32:07 -0400 Subject: [OpenAFS] Holy Grail of High Availability In-Reply-To: References: Message-ID: Charles Clancy writes: > There is a single RW volume, and its RO replicas are updated, usually by > the person who just made changes to the RW volume, with the "vos release" > command. > > > So all the write changes still have to take place to one server. > > The writes are made to the RW volume, and that volume can live on any of > the servers. > > > If that server goes down, will write changes go to a server that is > > still up and running. > > If that server goes down, you won't be able to write. It may take 30 > seconds, or so (these values can be changed at compile time), for clients > using the now down server to switch to one of the replicas. Just to make it clear, if the server with the RW volume goes down, that's all she wrote. The other servers will NOT take over the RW responsibility. OTOH, if a RO site goes down, clients will switch over to another replication site. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From schmitt@inf.ethz.ch Tue Oct 8 11:32:23 2002 From: schmitt@inf.ethz.ch (Marc Schmitt) Date: Tue, 08 Oct 2002 12:32:23 +0200 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 References: Message-ID: <3DA2B437.5070209@inf.ethz.ch> Hi Charles, Thanks for your answer. Charles Clancy wrote: > If you compile --with-kerberos4 and --with-afs, OpenSSH should accept krb4 > TGTs, krb4 passwords, or AFS tokens for authentication. OpenSSH will also > grab a PAG for you and run krb_afslog() when you log in. They still need > enabled in your sshd_config. I have AFSTokenPassing and KerberosTgtPassing enabled. > > PAM authentication and krb4 authentication in OpenSSH are completely > independent. There's no reason why adding those options to ./configure > would inhibit PAM from working. In fact, I've compiled and used both > under the same sshd (though on Solaris). > > The only think I can possibly think of is that somehow there are library > conflicts between the AFS and krb4 libraries statically linked into your > OpenSSH, versus those statically linked to pam_afs.so, and things go wrong > when OpenSSH (via libpam.so) dlopen's pam_afs.so. What I found is that if I use use_klog in system-auth, it works. I changed it from auth sufficient /lib/security/pam_afs.krb.so try_first_pass ignore_uid 100 to auth sufficient /lib/security/pam_afs.krb.so try_first_pass ignore_uid 100 use_klog Does that make sense to you? > > Do other modules work with your kerberos-enabled version of OpenSSH? I don`t know exactly what you mean by other modules. > > In theory, if you have kerberos4 authentication with AFS support, you > don't need PAM. They shouldn't be mutually exclusive, but if they are, it > shouldn't matter, because you only need one or the other. What I have: - AFS cell with kaserver What I want to achieve is the following: - when logging into the cluster from a machine outside the cluster with ssh, I get prompted for the password, authenticating myself against kaserver, once logged in, I have a token in the AFS cell (the home directories are in AFS) - once inside the cluster, I want to be able to ssh from one machine to another machine inside the cluster w/o being prompted for a password and with my token being forwarded - logging in on the console (or XDM/GDM/KDM) of a cluster maschine athenticates me against kaserver and creates a token For that I need: - PAM_AFS - sshd with AFS support (and therefore kerberos4 support) Right? To come back to your statement about the statically linked libraries, which versions go well together? I.e. what versions of krb4 and OpenSSH are you using under Solaris? When I tried plain OpenSSH-3.4p1-2 from RedHat, by just enabling kerberos4 and afs, I didn`t get far (c.f. http://msgs.securepoint.com/cgi-bin/get/openssh-unix-dev-0207/392/1.html). Using the RPMs build by Jan Iven (/afs/cern.ch/project/linux/redhat/cern/updates/7.2.1/SRPMS/openssh-3.4p1-5.cern.src.rpm), which has some of those patches included, it started working. Anyway, I still have to use use_klog in system-auth, otherwhise I have the problem posted by Andi in the initial post. Regards, Marc From tino.schwarze@informatik.tu-chemnitz.de Tue Oct 8 12:27:50 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Tue, 8 Oct 2002 13:27:50 +0200 Subject: [OpenAFS] Holy Grail of High Availability In-Reply-To: <3DA24B79.60102@chrisdos.com>; from chris@chrisdos.com on Mon, Oct 07, 2002 at 09:05:29PM -0600 References: <3DA24B79.60102@chrisdos.com> Message-ID: <20021008132750.B14646@informatik.tu-chemnitz.de> On Mon, Oct 07, 2002 at 09:05:29PM -0600, Chris Dos wrote: > I'm been looking at distributed files systems lately and I may have been > under the wrong impression that OpenAFS or Coda could be the Holy Grail > for High Availability for the hosting company that I work for. The part > that worries me right now is the server replication. According to the > documentation that I've been reading, the server replication is only > good for volumes that don't see many files changing. So, replicating a > database such as Oracle or MySQL that changes data often would be a bad > idea, Replicating a database will not work this way - you circumvent all kinds of internal caches and integrity checks. Your database needs to support replication explicitly. BTW: There seems to be no holy grail with multiple RW replicas. You open a big can of worms when allowing concurrent writes on different servers. Bye, Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From mpb@est.ibm.com Tue Oct 8 14:15:23 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Tue, 08 Oct 2002 14:15:23 +0100 Subject: [OpenAFS] Holy Grail of High Availability References: <3DA24B79.60102@chrisdos.com> Message-ID: <3DA2DA6B.4000500@est.ibm.com> I am not sure what you mean by "the Holy Grail". AFS does have some good features that help provide a more highly available service than you would get with other software. For example, the AFS database servers which provide several key information services to AFS clients can be "replicated" in the sense that you can have multiple AFS db servers. A good number is three. If you have 3 AFS db servers for your cell then the services provided will continue even if one db server is out-of-service (perhaps for a maintenance upgrade). The data served from AFS _file_ servers can also be replicated and this works very well for what I would call "mostly static" data. Example: we have an AFS cell to share Linux and open source resources. This is reference data and mostly ReadOnly. So we have three fileservers in different countries with RO copies of data files (which are updated on a regular basis from the RW "master" using AFS "vos release" magic). We had a situation where one fileserver was disconnected and upgraded but users were still able to access the replicated files (automagically from the other fileservers). Users did not have to know one fileserver was down. They just continued to access the filesystem for that cell. If I had the resources, I would have two "cloned" fileservers at each site so that even if one was down the 2nd would continue to serve files to local users for that site. As for replicating ReadWrite data, that is not done in AFS. If you think about it, it's a pretty tough problem to solve: how to maintain the state of multiple RW copies of data across multiple servers in different networks? Another good feature of AFS is scalability. You can grow the number of database and/or file servers to meet your needs. A good example of this is where you could have a cluster of web servers serving data out of AFS. see also: http://web.archive.org/web/19961227000628/http://www.ncsa.uiuc.edu/InformationServers/Conferences/CERNwww94/www94.ncsa.html I have also run a mailsystem that delivered to mailboxes in /afs $HOMEs. It worked OK for me but it takes quite a bit of configuring and setup. You may be better off considering IMAP servers. I hope this helps. -- cheers paul http://acm.org/~mpb Chris Dos wrote: > I'm been looking at distributed files systems lately and I may have > been under the wrong impression that OpenAFS or Coda could be the Holy > Grail for High Availability for the hosting company that I work for. > The part that worries me right now is the server replication. > According to the documentation that I've been reading, the server > replication is only good for volumes that don't see many files > changing. So, replicating a database such as Oracle or MySQL that > changes data often would be a bad idea, but web sites or mail might be > good? Would it replcate the entire changed file, or just the pieces > of the file that has changed. I'm looking at putting three high end > terabyte servers next to each via Gigabit Ethernet, and having > replication take place. Would the replicants be read only? So all > the write changes still have to take place to one server. If that > server goes down, will write changes go to a server that is still up > and running. Also, how does the client know which server go to if > there are three servers with identical data on the same subnet? Is > there any type of load balancing going on to help distribute the load? > > Am I totally off my rocker in thinking AFS might be able to provide > all these things? And if I am loony in thinking AFS or another > distributed file system might be my holy grail, are there any other > alternatives I should be looking at? > > Thank you for any insight you might be able to provide. I sincerely > appreciate it. > > Chris Dos > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From lists@nick-andrew.net Tue Oct 8 14:29:37 2002 From: lists@nick-andrew.net (Nick Andrew) Date: Tue, 8 Oct 2002 23:29:37 +1000 Subject: [OpenAFS] Holy Grail of High Availability In-Reply-To: <20021008132750.B14646@informatik.tu-chemnitz.de> References: <3DA24B79.60102@chrisdos.com> <20021008132750.B14646@informatik.tu-chemnitz.de> Message-ID: <20021008132937.GA31433@xenu.tull.net> On Tue, Oct 08, 2002 at 01:27:50PM +0200, Tino Schwarze wrote: > Replicating a database will not work this way - you circumvent all kinds > of internal caches and integrity checks. Your database needs to support > replication explicitly. I should just point out that MySQL supports replication and transactional tables. With replication, each instance may be a slave of at most one master. That limits the topology, but still allows flexibility, e.g. - one server for updates and N servers for queries (star) - two update/query servers each slaved off the other (binary system) - N update/query servers each slaved off its neighbour (ring) Nick. From excds@kth.se Tue Oct 8 14:31:19 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 08 Oct 2002 15:31:19 +0200 Subject: [OpenAFS] Preventing principals from authenticating? Message-ID: <1034083879.571.3.camel@hybris> I've set up a user environment based on openAFS and Kerberos 5. Right now I'm trying to set up "exam"-accounts for programming exams and such. My problem is that I want to disable the regular accounts during the exams. The only rational way I can think of is to disable the users principal, but I can't seem to find any answers about that. Any ideas? /Daniel From warlord@MIT.EDU Tue Oct 8 14:36:26 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 08 Oct 2002 09:36:26 -0400 Subject: [OpenAFS] Preventing principals from authenticating? In-Reply-To: <1034083879.571.3.camel@hybris> References: <1034083879.571.3.camel@hybris> Message-ID: That's what I would suggest... I cannot think of anything else, either. -derek Daniel Sw=E4rd writes: > I've set up a user environment based on openAFS and Kerberos 5. Right > now I'm trying to set up "exam"-accounts for programming exams and such. > My problem is that I want to disable the regular accounts during the > exams. The only rational way I can think of is to disable the users > principal, but I can't seem to find any answers about that. >=20 > Any ideas? >=20 > /Daniel >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From tino.schwarze@informatik.tu-chemnitz.de Tue Oct 8 14:49:07 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Tue, 8 Oct 2002 15:49:07 +0200 Subject: [OpenAFS] Holy Grail of High Availability In-Reply-To: <20021008132937.GA31433@xenu.tull.net>; from lists@nick-andrew.net on Tue, Oct 08, 2002 at 11:29:37PM +1000 References: <3DA24B79.60102@chrisdos.com> <20021008132750.B14646@informatik.tu-chemnitz.de> <20021008132937.GA31433@xenu.tull.net> Message-ID: <20021008154907.E14646@informatik.tu-chemnitz.de> On Tue, Oct 08, 2002 at 11:29:37PM +1000, Nick Andrew wrote: > > Replicating a database will not work this way - you circumvent all kinds > > of internal caches and integrity checks. Your database needs to support > > replication explicitly. > I should just point out that MySQL supports replication and > transactional tables. With replication, each instance may be > a slave of at most one master. That limits the topology, but > still allows flexibility, e.g. Well, MySQL does support replication explicitly. It's not just sharing files. After looking at the MySQL docs, I don't see anything stating that actual files are shared. The replication slave has it's own set of files which it keeps in sync with the master. Bye, Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From excds@kth.se Tue Oct 8 15:19:49 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 08 Oct 2002 16:19:49 +0200 Subject: [OpenAFS] Preventing principals from authenticating? In-Reply-To: References: <1034083879.571.3.camel@hybris> Message-ID: <1034086794.571.5.camel@hybris> On Tue, 2002-10-08 at 15:36, Derek Atkins wrote: > That's what I would suggest... I cannot think of anything else, > either. How do I then prevent a principal from authenticating? /Daniel From james.perrin@man.ac.uk Tue Oct 8 15:36:17 2002 From: james.perrin@man.ac.uk (James S Perrin) Date: Tue, 08 Oct 2002 15:36:17 +0100 Subject: [OpenAFS] Drive sizes under Win32 Message-ID: <3DA2ED61.4090709@man.ac.uk> Hi, I've just installed OpenAFS 1.2.2b under win2000. I have come across a problem when trying to use Mozilla to read my mail on the drive mounting my afs volume. It won't let me download my mail as it says there is not enough room on the drive. Looking at the properties for the drive it reports size 0 bytes amd free 0 bytes. So i) can I get afs to report the size and free space onto windows or OT ii) can you tell mozilla not to check the file space, I've looked at all the prefs without luck. Regards James -- ----------------------------------------------------------------------------- James S. Perrin, | email: james.perrin@man.ac.uk Manchester Visualization Centre, | http://www.man.ac.uk/MVC/staff/perrin/ Kilburn Building, The University, | tel: +44 161 275 6945 Manchester, England. M13 9PL. | fax: +44 161 275 6800/6040 ----------------------------------------------------------------------------- "The test of intellect is the refusal to belabour the obvious" -Alfred Bester ----------------------------------------------------------------------------- From shadow@dementia.org Tue Oct 8 15:37:28 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 8 Oct 2002 10:37:28 -0400 (EDT) Subject: [OpenAFS] Preventing principals from authenticating? In-Reply-To: <1034086794.571.5.camel@hybris> Message-ID: On 8 Oct 2002, Daniel [ISO-8859-1] Swärd wrote: > On Tue, 2002-10-08 at 15:36, Derek Atkins wrote: > > That's what I would suggest... I cannot think of anything else, > > either. > > How do I then prevent a principal from authenticating? using krb5 or kaserver? with kaserver, run kas and setf (principal) -exp NOW with krb5, depends which, but with heimdal you can run kadmin and mod principal to do similat From security@xauth.net Tue Oct 8 16:14:49 2002 From: security@xauth.net (Charles Clancy) Date: Tue, 8 Oct 2002 10:14:49 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <3DA2B437.5070209@inf.ethz.ch> Message-ID: > > The only think I can possibly think of is that somehow there are > > library conflicts between the AFS and krb4 libraries statically linked > > into your OpenSSH, versus those statically linked to pam_afs.so, and > > things go wrong when OpenSSH (via libpam.so) dlopen's pam_afs.so. > > ... > > auth sufficient /lib/security/pam_afs.krb.so try_first_pass > ignore_uid 100 use_klog > > Does that make sense to you? If you tell pam_afs to "use_klog" then it's no longer calling the AFS libraries at run-time -- it just execvp's your klog binary. This would support the argument that sshd-with-AFS-support's linked in AFS libraries were causing a conflict for pam_afs, which presumably is calling the same AFS functions. > > Do other modules work with your kerberos-enabled version of OpenSSH? > > I don`t know exactly what you mean by other modules. pam_unix.so > What I want to achieve is the following: > - when logging into the cluster from a machine outside the cluster with > ssh, I get prompted for the password, authenticating myself against > kaserver, once logged in, I have a token in the AFS cell (the home > directories are in AFS) > - once inside the cluster, I want to be able to ssh from one machine to > another machine inside the cluster w/o being prompted for a password and > with my token being forwarded > - logging in on the console (or XDM/GDM/KDM) of a cluster maschine > athenticates me against kaserver and creates a token I have done exactly this for an AFS-based Beowulf cluster running LAM-MPI. > For that I need: > - PAM_AFS > - sshd with AFS support (and therefore kerberos4 support) > Right? In theory, you could do it all with sshd with krb4 and AFS support. If it doesn't get a TGT, sshd should ask for a password and do password-based krb4 authentication. Then, it should grab a PAG and an AFS token for you. If it does get a TGT or an AFS token, it should let you through without asking for your password. Check out openssh/auth-krb4.c for the fun details. To be honest, when I tried to implement this, I couldn't get it to work, so I cheated. I compiled OpenSSH with kerberos support (but NOT AFS support). Then, I used pam_afs.krb.so. In the user login script, I ran /usr/local/athena/bin/afslog. Since all the AFS stuff lives in an external binary (afslog), there are no conflicts with pam_afs. So, first login, no TGT is sent, and they are sent to pam_afs.krb for password authentication. Password is correct, they get an AFS token. The feature of pam_afs.krb is that you'll also end up with a krb4 TGT. Then, if you ssh into another cluster machine, your TGT will let you in without a password. The afslog in the login script then grabs an AFS token with your TGT. > To come back to your statement about the statically linked libraries, > which versions go well together? I.e. what versions of krb4 and OpenSSH > are you using under Solaris? Hmm... it's been almost two years since I did this. For security reasons, you wouldn't want to run those versions anyway. I wish I had some extra time -- If I did, I'd submit patches to fix OpenSSH's semi-broken AFS support, and maybe even include krb5-afs support. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] [ crypto ]---[ coordinated science lab ]---[ university of illinois ] From excds@kth.se Tue Oct 8 16:56:33 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 08 Oct 2002 17:56:33 +0200 Subject: [OpenAFS] Preventing principals from authenticating? In-Reply-To: References: Message-ID: <1034092593.851.1.camel@hybris> > > How do I then prevent a principal from authenticating? > > using krb5 or kaserver? with kaserver, run kas and > setf (principal) -exp NOW > > with krb5, depends which, but with heimdal you can run kadmin and > mod principal > to do similat I was looking at the "expire" option, but I wasn't sure that it was the correct answer... I'll explore it further. Thanks. /Daniel From dwb7@ccmr.cornell.edu Tue Oct 8 17:09:53 2002 From: dwb7@ccmr.cornell.edu (David Botsch) Date: Tue, 8 Oct 2002 12:09:53 -0400 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 Message-ID: <20021008160953.GI7397@domino.ccmr.cornell.edu> I wanted to reply to some of the comments that had been made about openssh and afs recently. OpenSSH can authenticate in several ways. Password authentication, rhosts authentication, kerberos authentication, and others. As of openssh-3.4p1, to my knowledge, you cannot actually authenticate with an afs token. You can only pass the token after authentication. With Kerberos, however, you may be able to authenticate with the tgt you already have. So, AFTER authentication (not before as used to be the case), openssh can pass kerberos TGTs and afs tokens. It will appropriately set a pagsh. You must compile openssh with the --with-afs --with-kerberos4 --with-kerberos5 (both client and server). I do not believe that token passing actually involves PAM (you would use PAM if you were doing password auth, but the process of doing a password auth with PAM would get you an afs token). fyi, openssh has a bug in the part of the code which sets the location of the ticket cache. It was depending on the error behavior of the mkstemp glibc function (and this error behavior has changed). This should only affect things like password auth and not ticket/token passing. -- ******************************** David William Botsch Consultant/Advisor II CCMR Computing Facility dwb7@ccmr.cornell.edu ******************************** From maldrich@reserveamerica.com Tue Oct 8 18:20:45 2002 From: maldrich@reserveamerica.com (Michael Aldrich) Date: Tue, 8 Oct 2002 13:20:45 -0400 Subject: [OpenAFS] Mount points on directories that have already been created Message-ID: <200210081320.45225.maldrich@reserveamerica.com> Hi, Is it possible to make a mount point under /afs after the directory has=20 already been created? For instance, if I have /afs/.dir1/dir2 and I want = to=20 make dir2 a mount point for volume test.volume, can this be acheived with= out=20 losing content that already exists in dir2? TIA Mike From warlord@MIT.EDU Tue Oct 8 19:43:09 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 08 Oct 2002 14:43:09 -0400 Subject: [OpenAFS] Mount points on directories that have already been created In-Reply-To: <200210081320.45225.maldrich@reserveamerica.com> References: <200210081320.45225.maldrich@reserveamerica.com> Message-ID: Michael Aldrich writes: > Hi, > Is it possible to make a mount point under /afs after the directory has > already been created? For instance, if I have /afs/.dir1/dir2 and I want to > make dir2 a mount point for volume test.volume, can this be acheived without > losing content that already exists in dir2? You need to rename dir2 first. An AFS mountpoint is really a "special symlink"[0]. It it not a "mount" as you think of it locally. You cannot "mount" a volume on top of an existing directory. So, no. > TIA > Mike -derek [0] Yes, you can actually create a mountpoint with "ln -s" if you provide the correct arguments! -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From m.w.ellwood@rl.ac.uk Tue Oct 8 20:43:16 2002 From: m.w.ellwood@rl.ac.uk (Mike W Ellwood) Date: Tue, 8 Oct 2002 20:43:16 +0100 (BST) Subject: [OpenAFS] RCallBackConnectBack messages? (Transarc 3.4d) Message-ID: I am getting a lot of the following, in my FileLog:- Tue Oct 8 17:47:50 2002 CB: RCallBack (zero fid probe in host.c) failed for host xxxxxxxx.7001 Tue Oct 8 19:13:44 2002 CB: RCallBack (zero fid probe in host.c) failed for host xxxxxxxx.7001 Tue Oct 8 19:24:21 2002 CB: RCallBack (zero fid probe in host.c) failed for host xxxxxxxx.7001 Tue Oct 8 19:50:01 2002 CB: RCallBack (zero fid probe in host.c) failed for host xxxxxxxx.7001 (hostids removed for security). What could this mean? This is a fairly old Transarc version (3.4d). Thanks, Mike Ellwood From Todd_Lewis@unc.edu Tue Oct 8 21:15:44 2002 From: Todd_Lewis@unc.edu (Todd M. Lewis) Date: Tue, 08 Oct 2002 16:15:44 -0400 Subject: [OpenAFS] Mount points on directories that have already been created References: <200210081320.45225.maldrich@reserveamerica.com> Message-ID: <3DA33CF0.2010906@email.unc.edu> Derek Atkins wrote: > Michael Aldrich writes: > > >>Hi, >>Is it possible to make a mount point under /afs after the directory has >>already been created? For instance, if I have /afs/.dir1/dir2 and I want to >>make dir2 a mount point for volume test.volume, can this be acheived without >>losing content that already exists in dir2? > > > You need to rename dir2 first. An AFS mountpoint is really a "special > symlink"[0]. It it not a "mount" as you think of it locally. You > cannot "mount" a volume on top of an existing directory. So, no. Also, you might want to look at the "up" utility to copy the contents of the original dir2 into the new volume, especially if you have lots of complicated ACLs burried down in that subtree. Up is sort of a recursive cp that also knows about and duplicates ACLs. It's obvious when you think about it, but to use "up" effectively, you must have sufficient read rights to all the data you're trying to copy. -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ From security@xauth.net Tue Oct 8 21:19:28 2002 From: security@xauth.net (Charles Clancy) Date: Tue, 8 Oct 2002 15:19:28 -0500 (CDT) Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: <20021008160953.GI7397@domino.ccmr.cornell.edu> Message-ID: > As of openssh-3.4p1, to my knowledge, you cannot actually authenticate > with an afs token. You can only pass the token after authentication. > With Kerberos, however, you may be able to authenticate with the tgt you > already have. Authentication methods defined in openssh-3.4p1/auth-krb4.c: int auth_krb4_password(Authctxt *authctxt, const char *password) int auth_krb4_tgt(Authctxt *authctxt, const char *string) int auth_afs_token(Authctxt *authctxt, const char *token_string) Though I've never tried to use the third one. ;) > So, AFTER authentication (not before as used to be the case), openssh > can pass kerberos TGTs and afs tokens. It will appropriately set a > pagsh. You must compile openssh with the --with-afs --with-kerberos4 > --with-kerberos5 (both client and server). It can do pure TGT stuff without --with-afs. You can do kaserver stuff without the --with-kerberos5. > I do not believe that token passing actually involves PAM (you would use > PAM if you were doing password auth, but the process of doing a password > auth with PAM would get you an afs token). Right. Token passing most certainly does not involve PAM. The module pam_afs.so can only do password-based authentication. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From warlord@MIT.EDU Tue Oct 8 22:00:40 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 08 Oct 2002 17:00:40 -0400 Subject: [OpenAFS] Mount points on directories that have already been created In-Reply-To: <3DA33CF0.2010906@email.unc.edu> References: <200210081320.45225.maldrich@reserveamerica.com> <3DA33CF0.2010906@email.unc.edu> Message-ID: "Todd M. Lewis" writes: > Also, you might want to look at the "up" utility to copy the contents > of the original dir2 into the new volume, especially if you have lots > of complicated ACLs burried down in that subtree. Up is sort of a > recursive cp that also knows about and duplicates ACLs. It's obvious > when you think about it, but to use "up" effectively, you must have > sufficient read rights to all the data you're trying to copy. Why not just use the "rename()" syscall? mv dir2 dir2.oldversion Much simpler! ;) -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From dwb7@ccmr.cornell.edu Tue Oct 8 22:16:30 2002 From: dwb7@ccmr.cornell.edu (David Botsch) Date: Tue, 8 Oct 2002 17:16:30 -0400 Subject: [OpenAFS] pam and openafs 1.2.7 for RH 7.2 In-Reply-To: ; from security@xauth.net on Tue, Oct 08, 2002 at 16:19:28 -0400 References: Message-ID: <20021008211630.GE8164@domino.ccmr.cornell.edu> Whil the auth_afs_token function is there, I believe it is misnamed. You will note that it is called from the do_authenticated1() function in session.c, which is called AFTER authentication takes place. The only purpose of this auth_afs_token() function seems to be to pass the token. On 2002.10.08 16:19 Charles Clancy wrote: > > As of openssh-3.4p1, to my knowledge, you cannot actually > authenticate > > with an afs token. You can only pass the token after authentication. > > With Kerberos, however, you may be able to authenticate with the tgt > you > > already have. > > Authentication methods defined in openssh-3.4p1/auth-krb4.c: > int auth_krb4_password(Authctxt *authctxt, const char > *password) > int auth_krb4_tgt(Authctxt *authctxt, const char *string) > int auth_afs_token(Authctxt *authctxt, const char > *token_string) > > Though I've never tried to use the third one. ;) > > > So, AFTER authentication (not before as used to be the case), > openssh > > can pass kerberos TGTs and afs tokens. It will appropriately set a > > pagsh. You must compile openssh with the --with-afs --with-kerberos4 > > --with-kerberos5 (both client and server). > > It can do pure TGT stuff without --with-afs. You can do kaserver > stuff > without the --with-kerberos5. > > > I do not believe that token passing actually involves PAM (you would > use > > PAM if you were doing password auth, but the process of doing a > password > > auth with PAM would get you an afs token). > > Right. Token passing most certainly does not involve PAM. The module > pam_afs.so can only do password-based authentication. > > [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] > > -- ******************************** David William Botsch Consultant/Advisor II CCMR Computing Facility dwb7@ccmr.cornell.edu ******************************** From kchen@MIT.EDU Wed Oct 9 03:50:10 2002 From: kchen@MIT.EDU (Kevin Chen) Date: Tue, 08 Oct 2002 22:50:10 -0400 Subject: [OpenAFS] Kerberos/AFS on Windows Message-ID: <3DA39962.7050602@mit.edu> About a month ago, I wrote the list to ask about Kerberos and AFS on Windows. The basic answer seemed to be to use ms2mit.exe to get Kerberos tickets, and use aklog.exe to get an AFS token. Two questions: 1. Is it possible to use an integrated login and use ms2mit.exe to get Kerberos tickets automatically, if the computer is not part of a domain? If so, how? I have asked OpenAFS to get tokens while logging into Windows, but that always fails: Integrated login failed: Authentication Server was unavailable (also see below) 2. I'm using the MIT binary version of Kerberos, which does not include aklog.exe. Where can I get it? I ran the version of Kerberos at ftp://ftp.cmf.nrl.navy.mil/pub/kerberos5 , though that doesn't seem to recognize the tickets I obtained with the MIT version, and gives the following message when I try to get tickets with it: Cannot contact any KDC for requested realm while logging in. Since it won't recognize my tickets, aklog.exe of course fails with: aklog: Couldn't get ATHENA.MIT.EDU AFS tickets: aklog: Ticket expired while getting AFS tickets I also tried running the klog.exe that came with OpenAFS. Is this the same thing? It asked me to enter my password, and said: Unable to authenticate to AFS because Authentication Server was unavailable. Using the GUI to obtain AFS tokens says: The AFS Client was unable to obtain tokens as kchen in cell athena.mit.edu. Error: 56 (Authentication Server was unavailable) The server is not unavailable, though, since AFS is working on the MIT-provided UNIX machines. Despite all these problems, I _am_ able to use AFS, but can only act as system:anyuser. -- Kevin Chen http://www.sneswhiz.com/ From turbo@bayour.com Wed Oct 9 06:27:50 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 09 Oct 2002 07:27:50 +0200 Subject: [OpenAFS] Kerberos/AFS on Windows In-Reply-To: <3DA39962.7050602@mit.edu> References: <3DA39962.7050602@mit.edu> Message-ID: <87n0poyyeh.fsf@papadoc.bayour.com> Quoting Kevin Chen : > 1. Is it possible to use an integrated login and use ms2mit.exe to get > Kerberos tickets automatically, if the computer is not part of a domain? > If so, how? I have asked OpenAFS to get tokens while logging into > Windows, but that always fails: > Integrated login failed: Authentication Server was unavailable > (also see below) Have a look at the MIT mailing list archive two weeks back. I've been doing quite a lot of writing on the subject, and eventually got it resolved. I notified the list on what to do to get it to work. There's also URL's on pages to read... From nemesis-lists@icequake.net Wed Oct 9 10:20:36 2002 From: nemesis-lists@icequake.net (Ryan Underwood) Date: Wed, 09 Oct 2002 09:20:36 +0000 Subject: [OpenAFS] Filesystem possibilities for /vicepa Message-ID: <20021009092040.F38C75DA3E@mail.icequake.net> Hello, Well, it seems that afscache works well enough on a loop-mounted ext2. However, I would like to use a journalling filesystem for the AFS filesystem itself. Does anyone have any experience/recommendations as to which ones get along with AFS? I can choose between ext3, JFS, XFS, and ReiserFS on Linux. A test install seems to have ReiserFS working acceptably (and fast!) underneath AFS, but I am concerned that the fsck utilities for these filesystems might not understand the AFS structure, and end up munging it. Just wanted to get some opinions before I bet the farm permanently on ReiserFS; thanks for any input. -- Ryan Underwood, , icq=10317253 From excds@kth.se Wed Oct 9 10:31:07 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 09 Oct 2002 11:31:07 +0200 Subject: [OpenAFS] AFS access rights and novell printer queues. Message-ID: <1034155867.454.14.camel@hybris> The users which will be using the Linux environment I've setup are going to have to print to Novell printer queues. To accompling that I'm using nprint (from ncpfs). The problem is that nprint in conjunction with lpd requires that the users have a ".nwclient" file in their homedirectory. The ".nwclient" is supposed to contain username/password for their Novell account. How can I make the file readable only to root on the clients, so lpd can read it? If the ACL is "system:anyuser rl" AFS ignores the Unix file rights (600) and the file is worldwide readable. Should I set up a separate usergroup for whatever user that runs lpd? /Daniel From adi@drcomp.erfurt.thur.de Wed Oct 9 10:37:16 2002 From: adi@drcomp.erfurt.thur.de (Adrian Knoth) Date: Wed, 9 Oct 2002 11:37:16 +0200 Subject: [OpenAFS] Filesystem possibilities for /vicepa In-Reply-To: <20021009092040.F38C75DA3E@mail.icequake.net> References: <20021009092040.F38C75DA3E@mail.icequake.net> Message-ID: <20021009093716.GA24618@drcomp.erfurt.thur.de> On Wed, Oct 09, 2002 at 09:20:36AM +0000, Ryan Underwood wrote: > Hello, Hi! > Does anyone have any experience/recommendations as to which ones get along > with AFS? I can choose between ext3, JFS, XFS, and ReiserFS on Linux. We are running /vicepa under reiserfs. ext3 is also possible, but we chose reiserfs because it is online-resizeable. So to say, we can increase the AFS-space without shutting down the server. > AFS, but I am concerned that the fsck utilities for these filesystems might > not understand the AFS structure, and end up munging it. This might be possible. If you'll really get a reiserfs-crash then you can be sure that there is trailing garbage at the end of your files. The salvager works well for us. We don't fsck the /vicepa on bootup. -- mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver Ein Zwilling kommt selten allein. From amar deep kumar" Amar deep kumar (kumaramar_sonu@rediffmail.com) 1. Why does the AFS client contacts server every time while reading from local disk cache? 2. If client has cached the file to local disk why it can not access it if we put the file server down? amardeep kumar barc,mumbai From 6delgado@informatik.uni-hamburg.de Wed Oct 9 12:30:03 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Wed, 9 Oct 2002 13:30:03 +0200 Subject: [OpenAFS] OpenAFS with MIT Kerberos >= 1.2.6 Message-ID: <20021009113003.GA5715@taupan.ath.cx> --Kj7319i9nmIyA2yE Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hiho! I'm using OpenAFS 1.2.7 with Kerberos 5 and after upgrading to the 1.2.6 Release of MIT Kerberos yesterday, the afsd started rejecting tokens. After diving into the Documentation (if all else fails, read the docs :) i disabled the "new style" of afs tokens in the [appdefaults] section of the krb5.conf file on all hosts as follows: [appdefaults] afs_krb5 =3D { MYREALM.DOM =3D { afs =3D false } } "MYREALM.DOM" is of course just an example. Apparently, Kerberos 1.2.6 is not only able to return the encrypted part of a Kerberos 5 Ticket as a Token to an "afs/*@*" principal but does so by default. The user has to disable it manually, if the AFS Server is unable to use the Token, which seems to be the case with my OpenAFS installation (1.2.7, compiled from unpatched sources, linked against MIT Kerberos 5 1.2.5) or my Kerberos Migration Kit (Version 1.3). Question: Is it/will it be possible to use this feature, rather then disabl= e it, with some Release of OpenAFS? Which one? How? I seem to be unable to find any docs about this, other than the short notice in the MIT Kerberos 5= source tree. It would be nice to get rid of Kerberos 4 and single DES in the long run. Kind regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --Kj7319i9nmIyA2yE Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEYEARECAAYFAj2kEzsACgkQCTmCEtF2zEBVuwCeO2kg+BEfaEGgadqL5wNFwVgK BOQAniF1RCzJlm4YWh7J7K7tg9lR2Mzd =u/oo -----END PGP SIGNATURE----- --Kj7319i9nmIyA2yE-- From nneul@umr.edu Wed Oct 9 13:17:06 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 09 Oct 2002 07:17:06 -0500 Subject: [OpenAFS] Filesystem possibilities for /vicepa In-Reply-To: <20021009093716.GA24618@drcomp.erfurt.thur.de> References: <20021009092040.F38C75DA3E@mail.icequake.net> <20021009093716.GA24618@drcomp.erfurt.thur.de> Message-ID: <1034165826.9230.4.camel@cessna.rollanet.org> On any platform using the namei interface for the file/vol servers, the data is normal files, and the file server doesn't need any special knowledge of the contents/structure. (i.e. linux) ext2/ext3/reiserfs all work fine for vice partitions ext2/ext3 work fine for cache partitions -- Nathan On Wed, 2002-10-09 at 04:37, Adrian Knoth wrote: > On Wed, Oct 09, 2002 at 09:20:36AM +0000, Ryan Underwood wrote: > > > Hello, > > Hi! > > > Does anyone have any experience/recommendations as to which ones get along > > with AFS? I can choose between ext3, JFS, XFS, and ReiserFS on Linux. > > We are running /vicepa under reiserfs. ext3 is also possible, but we chose > reiserfs because it is online-resizeable. So to say, we can increase > the AFS-space without shutting down the server. > > > AFS, but I am concerned that the fsck utilities for these filesystems might > > not understand the AFS structure, and end up munging it. > > This might be possible. If you'll really get a reiserfs-crash then you can > be sure that there is trailing garbage at the end of your files. > > The salvager works well for us. We don't fsck the /vicepa on bootup. > > > -- > mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver > > Ein Zwilling kommt selten allein. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From nneul@umr.edu Wed Oct 9 13:20:52 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 09 Oct 2002 07:20:52 -0500 Subject: [OpenAFS] Filesystem possibilities for /vicepa In-Reply-To: <1034165826.9230.4.camel@cessna.rollanet.org> References: <20021009092040.F38C75DA3E@mail.icequake.net> <20021009093716.GA24618@drcomp.erfurt.thur.de> <1034165826.9230.4.camel@cessna.rollanet.org> Message-ID: <1034166052.9230.6.camel@cessna.rollanet.org> er. fsck doesn't need any special knowledge... On Wed, 2002-10-09 at 07:17, Nathan Neulinger wrote: > On any platform using the namei interface for the file/vol servers, the > data is normal files, and the file server doesn't need any special > knowledge of the contents/structure. (i.e. linux) > > ext2/ext3/reiserfs all work fine for vice partitions > ext2/ext3 work fine for cache partitions > > -- Nathan > > On Wed, 2002-10-09 at 04:37, Adrian Knoth wrote: > > On Wed, Oct 09, 2002 at 09:20:36AM +0000, Ryan Underwood wrote: > > > > > Hello, > > > > Hi! > > > > > Does anyone have any experience/recommendations as to which ones get along > > > with AFS? I can choose between ext3, JFS, XFS, and ReiserFS on Linux. > > > > We are running /vicepa under reiserfs. ext3 is also possible, but we chose > > reiserfs because it is online-resizeable. So to say, we can increase > > the AFS-space without shutting down the server. > > > > > AFS, but I am concerned that the fsck utilities for these filesystems might > > > not understand the AFS structure, and end up munging it. > > > > This might be possible. If you'll really get a reiserfs-crash then you can > > be sure that there is trailing garbage at the end of your files. > > > > The salvager works well for us. We don't fsck the /vicepa on bootup. > > > > > > -- > > mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver > > > > Ein Zwilling kommt selten allein. > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > -- > > ------------------------------------------------------------ > Nathan Neulinger EMail: nneul@umr.edu > University of Missouri - Rolla Phone: (573) 341-4841 > Computing Services Fax: (573) 341-4216 > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From mrobo@ahpcrc.org Wed Oct 9 13:56:07 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Wed, 09 Oct 2002 07:56:07 -0500 Subject: [OpenAFS] Web Browsers Message-ID: <3DA42767.4090509@ahpcrc.org> I am running openafs-1.2.3-rh7.2.2 and I have been having problems with downloading using a web browser. I have tried Netscape 6, Mozilla 1.1, and Konqueror 2.2.2. All three behave exactly the same. When I down load something they will go through all the steps and show the progress. When the download reaches 98-99% the browser will crash and burn. This only happens when I download to AFS space. If I download to local space everything works fine. Has anyone else seen this behavior? Better yet does anyone know why this is happening? Even better does anyone know how to solve this problem? --Mike From schmitt@inf.ethz.ch Wed Oct 9 14:02:57 2002 From: schmitt@inf.ethz.ch (Marc Schmitt) Date: Wed, 09 Oct 2002 15:02:57 +0200 Subject: [OpenAFS] Web Browsers References: <3DA42767.4090509@ahpcrc.org> Message-ID: <3DA42901.6090104@inf.ethz.ch> Hi Michael, Could it be that you AFS cache is smaller than the file you are trying to download? Greetz Marc Michael Robokoff wrote: > I am running openafs-1.2.3-rh7.2.2 and I have been having problems with > downloading using a web browser. I have tried Netscape 6, Mozilla 1.1, > and Konqueror 2.2.2. All three behave exactly the same. When I down load > something they will go through all the steps and show the progress. When > the download reaches 98-99% the browser will crash and burn. This only > happens when I download to AFS space. If I download to local space > everything works fine. Has anyone else seen this behavior? Better yet > does anyone know why this is happening? Even better does anyone know how > to solve this problem? > > --Mike > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From nneul@umr.edu Wed Oct 9 14:27:51 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 9 Oct 2002 08:27:51 -0500 Subject: [OpenAFS] Web Browsers Message-ID: <2B45A04D8F18D947A400F0850CE3B53B060DB1@umr-mail7.umr.edu> That should not matter. Except in old (I think they solved that) versions of the arla client.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Marc Schmitt [mailto:schmitt@inf.ethz.ch]=20 > Sent: Wednesday, October 09, 2002 8:03 AM > To: Michael Robokoff > Cc: openafs > Subject: Re: [OpenAFS] Web Browsers >=20 >=20 > Hi Michael, >=20 > Could it be that you AFS cache is smaller than the file you=20 > are trying=20 > to download? >=20 > Greetz > Marc >=20 > Michael Robokoff wrote: > > I am running openafs-1.2.3-rh7.2.2 and I have been having=20 > problems with=20 > > downloading using a web browser. I have tried Netscape 6,=20 > Mozilla 1.1,=20 > > and Konqueror 2.2.2. All three behave exactly the same.=20 > When I down load=20 > > something they will go through all the steps and show the=20 > progress. When=20 > > the download reaches 98-99% the browser will crash and=20 > burn. This only=20 > > happens when I download to AFS space. If I download to local space=20 > > everything works fine. Has anyone else seen this behavior?=20 > Better yet=20 > > does anyone know why this is happening? Even better does=20 > anyone know how=20 > > to solve this problem? > >=20 > > --Mike > >=20 > >=20 > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > >=20 >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From sdw@email.unc.edu Wed Oct 9 14:34:08 2002 From: sdw@email.unc.edu (Scott D. Williams) Date: Wed, 09 Oct 2002 09:34:08 -0400 Subject: [OpenAFS] windows issues Message-ID: <5.1.0.14.0.20021009091613.00b9c368@imap.unc.edu> Hi David, Here at UNC we determined that "random" afsd_service.exe crashes (OpenAFS 1.2.6) were due to a dramatic increase in attacks on Microsoft Networking/NetBIOS ports (137, 138, 139). More specifically, it is believed these probes/attacks originate from remote hosts infected with the 'onaServ' worm. The attacker(s) were attempting to mount the 'C' drive of the OpenAFS windows client's loopback SMB server. This request gets flagged as a bad/malformed packet and often (but not always) causes the service to crash or misbehave. Exactly why the error handling varies among "identical" systems has not yet been addressed. These ports have been closed at the campus Internet router and this problem has disappeared. --Scott > Date: Thu, 03 Oct 2002 12:01:05 -0700 (MST) > From: David Bear > To: openafs-info@openafs.org > Subject: [OpenAFS] windows issues > > > strange happenings with win2k and openafs 1.2.2b. > > Worked fine yesterday. > > today, try to get tokens.. always fails. > > Then from cmd window issue: > > net stop "IBM AFS Client" > net start "IBM AFS Client" > > stops and starts successfully. Then klog .. > > works!!! Why? > > -- > David Bear > College of Public Programs/ASU > 480-965-8257 > ...the way is like water, going where nobody wants it to go From nog@MPA-Garching.MPG.DE Wed Oct 9 14:35:56 2002 From: nog@MPA-Garching.MPG.DE (Norbert Gruener) Date: Wed, 9 Oct 2002 15:35:56 +0200 Subject: [OpenAFS] Web Browsers In-Reply-To: <3DA42767.4090509@ahpcrc.org>; from mrobo@ahpcrc.org on Wed, Oct 09, 2002 at 07:56:07AM -0500 References: <3DA42767.4090509@ahpcrc.org> Message-ID: <20021009153556.B3140@nce-5.MPA-Garching.MPG.DE> On Wed, Oct 09 2002, Michael Robokoff wrote: > I am running openafs-1.2.3-rh7.2.2 and I have been having problems with > downloading using a web browser. I have tried Netscape 6, Mozilla 1.1, > and Konqueror 2.2.2. All three behave exactly the same. When I down load > something they will go through all the steps and show the progress. When > the download reaches 98-99% the browser will crash and burn. This only > happens when I download to AFS space. If I download to local space > everything works fine. Has anyone else seen this behavior? Better yet > does anyone know why this is happening? Even better does anyone know how > to solve this problem? What about the quota of the AFS volume and the quota of the "viceX" partition ? Is there enough disk space ? Cheers, Norbert -- Ceterum censeo | PGP encrypted mail preferred. Redmond esse delendam. | PGP Key at www.MPA-Garching.MPG.de/~nog/ From mrobo@ahpcrc.org Wed Oct 9 14:39:22 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Wed, 09 Oct 2002 08:39:22 -0500 Subject: [OpenAFS] Web Browsers References: <3DA42767.4090509@ahpcrc.org> <20021009153556.B3140@nce-5.MPA-Garching.MPG.DE> Message-ID: <3DA4318A.9020409@ahpcrc.org> --------------010000050503040707070305 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit The quotas and disk space are ok. Thanks for the idea though. I do appreciate the help. --Mike Norbert Gruener wrote: >On Wed, Oct 09 2002, Michael Robokoff wrote: > > >>I am running openafs-1.2.3-rh7.2.2 and I have been having problems with >>downloading using a web browser. I have tried Netscape 6, Mozilla 1.1, >>and Konqueror 2.2.2. All three behave exactly the same. When I down load >>something they will go through all the steps and show the progress. When >>the download reaches 98-99% the browser will crash and burn. This only >>happens when I download to AFS space. If I download to local space >>everything works fine. Has anyone else seen this behavior? Better yet >>does anyone know why this is happening? Even better does anyone know how >>to solve this problem? >> >> > >What about the quota of the AFS volume and the quota of the "viceX" >partition ? Is there enough disk space ? > >Cheers, > >Norbert > > --------------010000050503040707070305 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit The quotas and disk space are ok. Thanks for the idea though.
I do appreciate the help.

--Mike


Norbert Gruener wrote:
On Wed, Oct 09 2002, Michael Robokoff wrote:
  
I am running openafs-1.2.3-rh7.2.2 and I have been having problems with 
downloading using a web browser. I have tried Netscape 6, Mozilla 1.1, 
and Konqueror 2.2.2. All three behave exactly the same. When I down load 
something they will go through all the steps and show the progress. When 
the download reaches 98-99% the browser will crash and burn. This only 
happens when I download to AFS space. If I download to local space 
everything works fine. Has anyone else seen this behavior? Better yet 
does anyone know why this is happening? Even better does anyone know how 
to solve this problem?
    

What about the quota of the AFS volume and the quota of the "viceX"
partition ?   Is there enough disk space ?

Cheers,

Norbert
  
--------------010000050503040707070305-- From mrobo@ahpcrc.org Wed Oct 9 14:48:51 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Wed, 09 Oct 2002 08:48:51 -0500 Subject: [OpenAFS] Web Browsers References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> Message-ID: <3DA433C3.7020408@ahpcrc.org> Okay, I checked the cache and this is what I had: AFS using 73370 of the cache's available 100000 1K byte blocks. The file was about 4MB so it was larger than the cache. So I increased my cache by 10x to: 1000000 1K byte blocks. and re-tried the download. I noticed the cache usage did not increase much. AFS using 77294 of the cache's available 1000000 1K byte blocks. Then I noticed network activity continued when the browsers were hung. So I waited several minutes and the download eventually completed. It is strange that during that time I cannot stop the download or the browser without taking aggresive action. Yet it appears after it does finally complete the browser returns to normal. --Mike Marc Schmitt wrote: > Hi Michael, > > Could it be that you AFS cache is smaller than the file you are trying > to download? > > Greetz > Marc > > Michael Robokoff wrote: > >> I am running openafs-1.2.3-rh7.2.2 and I have been having problems >> with downloading using a web browser. I have tried Netscape 6, >> Mozilla 1.1, and Konqueror 2.2.2. All three behave exactly the same. >> When I down load something they will go through all the steps and >> show the progress. When the download reaches 98-99% the browser will >> crash and burn. This only happens when I download to AFS space. If I >> download to local space everything works fine. Has anyone else seen >> this behavior? Better yet does anyone know why this is happening? >> Even better does anyone know how to solve this problem? >> >> --Mike >> >> >> _______________________________________________ >> OpenAFS-info mailing list >> OpenAFS-info@openafs.org >> https://lists.openafs.org/mailman/listinfo/openafs-info >> > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From jlrobins@uncc.edu Wed Oct 9 14:56:06 2002 From: jlrobins@uncc.edu (James L Robinson) Date: Wed, 9 Oct 2002 09:56:06 -0400 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #843 - 16 msgs In-Reply-To: <20021009113201.4DE0A9D50@grand.central.org> References: <20021009113201.4DE0A9D50@grand.central.org> Message-ID: <200210090956.06732.jlrobins@uncc.edu> On Wednesday 09 October 2002 07:32 am, openafs-info-request@openafs.org w= rote: > How can I make the file readable only to root on the clients, so lpd ca= n > read it? If the ACL is "system:anyuser rl" AFS ignores the Unix file > rights (600) and the file is worldwide readable. Should I set up a > separate usergroup for whatever user that runs lpd? Not quite so simple. For some background WRT/ printing and AFS in general, check out: =09http://www.angelfire.com/hi/plutonic/afs-faq.html#sub2.12 The general problem is that LPD / whatever the printer spooler subsytem is isn't usually running with a token, i.e. authenticated to AFS in any way, and especially won't inherit the authentication token of the user. Folks solve similar issues on non-interactively-used locked-down server-type machines such as mail or web servers through installing a keytab onto the local disk of the server machine, then arranging it such that the startup script for the service will first create a PAG and authenticate to AFS using the information in the keytab. Then, said service runs authenticated in AFS's eyes, and can then be referenced by ACLs in AFS. We use this technique to deliver mail into AFS, as well as for webservers to be able to access one's public_html subdir. Complicating this issue is that AFS only supports ACLs on directories, not files, so if you need to give access to a single file in a dir to an authenticated entity, but not all files in said dir (such as the homedir)= , then you might work around that by creating a new subdir, moving the file(s) in question to the new subdir, adjusting the ACL on the subdir to grant the necessary access, then symlinking to the subdir/file from the original dir. Lastly, you then need to grant the look right to the principal in question on the original dir, so that they'll be able to read where the symlink points to. You could glue these two techniques together to get the action you desire. But, it would include dropping a root-owned mode 600 keytab file for your "printer" KA / PTS principal onto the local filesystem of all of your interactive client UNIX boxes. The keytab is relatively just as good as the password for that account, and if anyone broke root on any of those machines, they then have gained access to that keytab file, and can then authenticate themselves as "printer" in the eyes of AFS, and can subsequently mine your cell for all ~user/.novell/.novell-password files. Perhaps you could set up an intermediate non-interactively-used UNIX prin= t spooler box that has the keytab file as per above, but also acts as an LP= D spooler gateway for all of your Novell queues. Then the interactive UNIX = boxes don't need to have any keytabs -- they think that those print queues are remote LPD queues. This intermediary's LPD service runs authenticated via a keytab, and can then look at ~user/ and read files in ~user/.novell= / to yank the username and password as it spools the job to novell-land. Since this intermediary box is not general purpose, only admins should be able to log into it (by SSH), so the range of possibilities to have ro= ot cracked on the box and the keytab exposed should be greatly reduced. Lastly, by default AFS client <--> fileserver interactions for file data = is done in cleartext. Than can be changed to use some form of crypto (single DES?) by issuing an "fs setcrypt on" command after your LPD startup script obtains a token but before it performs the first interacti= on with the fileservers (i.e. before it starts up LPD). Since this file data involves passwords in your case, this would keep those passwords from flying around in cleartext as LPD reads 'em from AFS. But it would not help when the client user saves that file per se, so someone sniffing you= r AFS traffic could still possibly snake some cleartext passwords in this case. All that said, there may well be better, simpler ways to solve your probl= em other than stashing user passwords into the filespace. Good Luck. --=20 James Robinson Phone: (704) 687-4876 College of Information Technology FAX: (704) 687-3516 UNC Charlotte Email: jlrobins@uncc.edu Charlotte, NC 28223-0001 Director of Technology Services From warlord@MIT.EDU Wed Oct 9 14:54:24 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 09:54:24 -0400 Subject: [OpenAFS] AFS access rights and novell printer queues. In-Reply-To: <1034155867.454.14.camel@hybris> References: <1034155867.454.14.camel@hybris> Message-ID: lp_D_ needs it? Or lpr? If the former, you are out of luck. Are you really expecting the lpd to run in some authenticated PAG? How would it authenticate? What would stop some user from gaining root on a cluster machine and abusing that authentication? If it's the latter, and it's really lp_R_ that needs the file, then you just need to make sure the users are running in a PAG or that lpr is NOT setuid -- so it uses the user's authentication. Another choice you have it is setup a network lpr-queue that has its OWN netware-print password, so Unix people print to the lpr queue and it forwards on to the netware queue. -derek Daniel Sw=E4rd writes: > The users which will be using the Linux environment I've setup are going > to have to print to Novell printer queues. To accompling that I'm using > nprint (from ncpfs). The problem is that nprint in conjunction with lpd > requires that the users have a ".nwclient" file in their homedirectory. > The ".nwclient" is supposed to contain username/password for their > Novell account. >=20 > How can I make the file readable only to root on the clients, so lpd can > read it? If the ACL is "system:anyuser rl" AFS ignores the Unix file > rights (600) and the file is worldwide readable. Should I set up a > separate usergroup for whatever user that runs lpd? >=20 > /Daniel >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Wed Oct 9 14:59:27 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 09:59:27 -0400 Subject: [OpenAFS] OpenAFS with MIT Kerberos >= 1.2.6 In-Reply-To: <20021009113003.GA5715@taupan.ath.cx> References: <20021009113003.GA5715@taupan.ath.cx> Message-ID: Friedrich Delgado Friedrichs <6delgado@informatik.uni-hamburg.de> writes: > After diving into the Documentation (if all else fails, read the docs :) > i disabled the "new style" of afs tokens in the [appdefaults] section > of the krb5.conf file on all hosts as follows: The krb5 team specifically discussed this.. :) > Apparently, Kerberos 1.2.6 is not only able to return the encrypted part > of a Kerberos 5 Ticket as a Token to an "afs/*@*" principal but does so > by default. The user has to disable it manually, if the AFS Server is > unable to use the Token, which seems to be the case with my OpenAFS > installation (1.2.7, compiled from unpatched sources, linked against > MIT Kerberos 5 1.2.5) or my Kerberos Migration Kit (Version 1.3). This is correct. The krb5 work was finished before the AFS work... > Question: Is it/will it be possible to use this feature, rather then > disable it, with some Release of OpenAFS? Which one? How? I seem to > be unable to find any docs about this, other than the short notice > in the MIT Kerberos 5 source tree. This work is underway in the AFS tree. Some support for this, I believe, is on the main CVS head, but it is not ready for prime-time (I don't even know if it works, yet). > It would be nice to get rid of Kerberos 4 and single DES in the long > run. Agreed. > Kind regards > Friedel -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Wed Oct 9 14:58:17 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 9 Oct 2002 09:58:17 -0400 (EDT) Subject: [OpenAFS] OpenAFS with MIT Kerberos >= 1.2.6 In-Reply-To: <20021009113003.GA5715@taupan.ath.cx> Message-ID: On Wed, 9 Oct 2002, Friedrich Delgado Friedrichs wrote: > Question: Liar. There's more than one question here ;-) > Is it/will it be possible to use this feature, rather then disable it, > with some Release of OpenAFS? Yes > Which one? Don't know yet. > How? Well, the only client mod you will need is a "fixed" aklog assuming your clients already have v5 kinit. > It would be nice to get rid of Kerberos 4 and single DES in the long > run. Only Kerberos 4 will be able to be axed; The single DES liability will still be present, at least at this stage. From warlord@MIT.EDU Wed Oct 9 15:01:05 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 10:01:05 -0400 Subject: [OpenAFS] Web Browsers In-Reply-To: <2B45A04D8F18D947A400F0850CE3B53B060DB1@umr-mail7.umr.edu> References: <2B45A04D8F18D947A400F0850CE3B53B060DB1@umr-mail7.umr.edu> Message-ID: Yea, but this is openafs-1.2.3 -- this problem might still exist. Does it still happen if you upgrade your client to 1.2.7? -derek "Neulinger, Nathan" writes: > That should not matter. Except in old (I think they solved that) > versions of the arla client. > > -- Nathan > > > -----Original Message----- > > From: Marc Schmitt [mailto:schmitt@inf.ethz.ch] > > Sent: Wednesday, October 09, 2002 8:03 AM > > To: Michael Robokoff > > Cc: openafs > > Subject: Re: [OpenAFS] Web Browsers > > > > > > Hi Michael, > > > > Could it be that you AFS cache is smaller than the file you > > are trying > > to download? > > > > Greetz > > Marc > > > > Michael Robokoff wrote: > > > I am running openafs-1.2.3-rh7.2.2 and I have been having > > problems with > > > downloading using a web browser. I have tried Netscape 6, > > Mozilla 1.1, > > > and Konqueror 2.2.2. All three behave exactly the same. > > When I down load > > > something they will go through all the steps and show the > > progress. When > > > the download reaches 98-99% the browser will crash and > > burn. This only > > > happens when I download to AFS space. If I download to local space > > > everything works fine. Has anyone else seen this behavior? > > Better yet > > > does anyone know why this is happening? Even better does > > anyone know how > > > to solve this problem? > > > > > > --Mike -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From nneul@umr.edu Wed Oct 9 15:09:11 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 9 Oct 2002 09:09:11 -0500 Subject: [OpenAFS] Web Browsers Message-ID: <2B45A04D8F18D947A400F0850CE3B53B060DB3@umr-mail7.umr.edu> Old versions of the "arla" client. I don't believe AFS/OpenAFS _EVER_ had a problem with files larger than the cache.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Derek Atkins [mailto:warlord@MIT.EDU]=20 > Sent: Wednesday, October 09, 2002 9:01 AM > To: Neulinger, Nathan > Cc: Marc Schmitt; Michael Robokoff; openafs > Subject: Re: [OpenAFS] Web Browsers >=20 >=20 > Yea, but this is openafs-1.2.3 -- this problem might still exist. > Does it still happen if you upgrade your client to 1.2.7? >=20 > -derek >=20 > "Neulinger, Nathan" writes: >=20 > > That should not matter. Except in old (I think they solved that) > > versions of the arla client.=20 > >=20 > > -- Nathan > >=20 > > > -----Original Message----- > > > From: Marc Schmitt [mailto:schmitt@inf.ethz.ch]=20 > > > Sent: Wednesday, October 09, 2002 8:03 AM > > > To: Michael Robokoff > > > Cc: openafs > > > Subject: Re: [OpenAFS] Web Browsers > > >=20 > > >=20 > > > Hi Michael, > > >=20 > > > Could it be that you AFS cache is smaller than the file you=20 > > > are trying=20 > > > to download? > > >=20 > > > Greetz > > > Marc > > >=20 > > > Michael Robokoff wrote: > > > > I am running openafs-1.2.3-rh7.2.2 and I have been having=20 > > > problems with=20 > > > > downloading using a web browser. I have tried Netscape 6,=20 > > > Mozilla 1.1,=20 > > > > and Konqueror 2.2.2. All three behave exactly the same.=20 > > > When I down load=20 > > > > something they will go through all the steps and show the=20 > > > progress. When=20 > > > > the download reaches 98-99% the browser will crash and=20 > > > burn. This only=20 > > > > happens when I download to AFS space. If I download to=20 > local space=20 > > > > everything works fine. Has anyone else seen this behavior?=20 > > > Better yet=20 > > > > does anyone know why this is happening? Even better does=20 > > > anyone know how=20 > > > > to solve this problem? > > > >=20 > > > > --Mike >=20 > --=20 > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available >=20 From shadow@dementia.org Wed Oct 9 15:11:49 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 9 Oct 2002 10:11:49 -0400 (EDT) Subject: [OpenAFS] Web Browsers In-Reply-To: <2B45A04D8F18D947A400F0850CE3B53B060DB3@umr-mail7.umr.edu> Message-ID: On Wed, 9 Oct 2002, Neulinger, Nathan wrote: > Old versions of the "arla" client. I don't believe AFS/OpenAFS _EVER_ > had a problem with files larger than the cache. One version of OpenAFS did on Linux only. I don't remember which but it was probably 1.2.1 or earlier. -D From excds@kth.se Wed Oct 9 15:25:28 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 09 Oct 2002 16:25:28 +0200 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #843 - 16 msgs In-Reply-To: <200210090956.06732.jlrobins@uncc.edu> References: <20021009113201.4DE0A9D50@grand.central.org> <200210090956.06732.jlrobins@uncc.edu> Message-ID: <1034173528.454.23.camel@hybris> > Perhaps you could set up an intermediate non-interactively-used UNIX print > spooler box that has the keytab file as per above, but also acts as an LPD > spooler gateway for all of your Novell queues. Then the interactive UNIX boxes > don't need to have any keytabs -- they think that those print queues are > remote LPD queues. This intermediary's LPD service runs authenticated > via a keytab, and can then look at ~user/ and read files in ~user/.novell/ > to yank the username and password as it spools the job to novell-land. > Since this intermediary box is not general purpose, only admins should > be able to log into it (by SSH), so the range of possibilities to have root > cracked on the box and the keytab exposed should be greatly reduced. If I set up a remove printer-server, how do I forward information about which user is spooling the job? I need that in a filter script with nprint. > Lastly, by default AFS client <--> fileserver interactions for file data is > done in cleartext. Than can be changed to use some form of crypto > (single DES?) by issuing an "fs setcrypt on" command after your LPD > startup script obtains a token but before it performs the first interaction > with the fileservers (i.e. before it starts up LPD). Since this file data > involves passwords in your case, this would keep those passwords from > flying around in cleartext as LPD reads 'em from AFS. But it would not > help when the client user saves that file per se, so someone sniffing your > AFS traffic could still possibly snake some cleartext passwords in this > case. I've set all workstation afs-clients to use encrypted file transactions. Does that still put the ".nwclient"-files as risk? /Daniel From excds@kth.se Wed Oct 9 15:30:47 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 09 Oct 2002 16:30:47 +0200 Subject: [OpenAFS] AFS access rights and novell printer queues. In-Reply-To: References: <1034155867.454.14.camel@hybris> Message-ID: <1034173847.450.30.camel@hybris> On Wed, 2002-10-09 at 15:54, Derek Atkins wrote: > lp_D_ needs it? Or lpr? If the former, you are out of luck. Are you > really expecting the lpd to run in some authenticated PAG? How would > it authenticate? What would stop some user from gaining root on a > cluster machine and abusing that authentication? Nothing I guess. > If it's the latter, and it's really lp_R_ that needs the file, then > you just need to make sure the users are running in a PAG or that lpr > is NOT setuid -- so it uses the user's authentication. I can change to lprng if it's better and can use authentication from the printing user. Does lprng use the same style of printer filters as lpd? > Another choice you have it is setup a network lpr-queue that has its > OWN netware-print password, so Unix people print to the lpr queue and > it forwards on to the netware queue. Setting up a remote printer queue with a _single_ netware-password is not an option... All the students here have sort of a "print-quota"... Otherwise I wouldn't be having these problems at all. Whoever said bureacracy made life easier? /Daniel From rlink+@pitt.edu Wed Oct 9 15:40:02 2002 From: rlink+@pitt.edu (Ray Link) Date: Wed, 09 Oct 2002 10:40:02 -0400 (EDT) Subject: [OpenAFS] Web Browsers In-Reply-To: <3DA433C3.7020408@ahpcrc.org> References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> <3DA433C3.7020408@ahpcrc.org> Message-ID: On Wed, 9 Oct 2002, Michael Robokoff wrote: > noticed the cache usage did not increase much. AFS using 77294 of the > cache's available 1000000 1K byte blocks. Then I noticed network > activity continued when the browsers were hung. So I waited several minutes > and the download eventually completed. You mentioned that you tried Netscape, Mozilla and Konqueror, so I shall assume you are running on some variant UNIX. As far as I know, all of these browsers download files to a temporary location (/tmp or the like) and then copy the fully-downloaded file to the destination directory you specified. What is most likely happening is (this happens to me all the time) the download progress meter only shows 99%, and then the browser is hanging as it copies the completely downloaded file into AFS space. Easy way to check: Switch to an xterm and try to ls the file while the browser is hung. Odds are, it doesn't yet exist yet, because the move is still ocurring. ==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ==== For some reason I was confusing "SubGenius" with "GNU" there. - The Cube, Forum 3000 From mrobo@ahpcrc.org Wed Oct 9 15:50:14 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Wed, 09 Oct 2002 09:50:14 -0500 Subject: [OpenAFS] Web Browsers References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> <3DA433C3.7020408@ahpcrc.org> Message-ID: <3DA44226.3010007@ahpcrc.org> --------------030107090503000009060302 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Yes, That does appear to be what is happening. Thanks for the information. --Mike Ray Link wrote: >On Wed, 9 Oct 2002, Michael Robokoff wrote: > > > >>noticed the cache usage did not increase much. AFS using 77294 of the >>cache's available 1000000 1K byte blocks. Then I noticed network >>activity continued when the browsers were hung. So I waited several minutes >>and the download eventually completed. >> >> > >You mentioned that you tried Netscape, Mozilla and Konqueror, so I shall >assume you are running on some variant UNIX. As far as I know, all of >these browsers download files to a temporary location (/tmp or the like) >and then copy the fully-downloaded file to the destination directory >you specified. What is most likely happening is (this happens to me >all the time) the download progress meter only shows 99%, and then >the browser is hanging as it copies the completely downloaded file into >AFS space. > >Easy way to check: Switch to an xterm and try to ls the file while the >browser is hung. Odds are, it doesn't yet exist yet, because the move >is still ocurring. > >==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ==== > >For some reason I was confusing "SubGenius" with "GNU" there. > - The Cube, Forum 3000 > >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > > --------------030107090503000009060302 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Yes, That does appear to be what is happening.

Thanks for the information.

--Mike


Ray Link wrote:
On Wed, 9 Oct 2002, Michael Robokoff wrote:

  
noticed the cache usage did not increase much. AFS using 77294 of the
cache's available 1000000 1K byte blocks. Then I noticed network
activity continued when the browsers were hung. So I waited several minutes
and the download eventually completed.
    

You mentioned that you tried Netscape, Mozilla and Konqueror, so I shall
assume you are running on some variant UNIX.  As far as I know, all of
these browsers download files to a temporary location (/tmp or the like)
and then copy the fully-downloaded file to the destination directory
you specified.  What is most likely happening is (this happens to me
all the time) the download progress meter only shows 99%, and then
the browser is hanging as it copies the completely downloaded file into
AFS space.

Easy way to check:  Switch to an xterm and try to ls the file while the
browser is hung.  Odds are, it doesn't yet exist yet, because the move
is still ocurring.

==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ====

For some reason I was confusing "SubGenius" with "GNU" there.
        - The Cube, Forum 3000

_______________________________________________
OpenAFS-info mailing list
OpenAFS-info@openafs.org
https://lists.openafs.org/mailman/listinfo/openafs-info
  
--------------030107090503000009060302-- From warlord@MIT.EDU Wed Oct 9 15:47:39 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 10:47:39 -0400 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #843 - 16 msgs In-Reply-To: <1034173528.454.23.camel@hybris> References: <20021009113201.4DE0A9D50@grand.central.org> <200210090956.06732.jlrobins@uncc.edu> <1034173528.454.23.camel@hybris> Message-ID: Daniel Sw=E4rd writes: > If I set up a remove printer-server, how do I forward information about > which user is spooling the job? I need that in a filter script with > nprint. User kerberized lpr? You're using AFS -- therefore you already have Kerberos! ;) > I've set all workstation afs-clients to use encrypted file transactions. > Does that still put the ".nwclient"-files as risk? It helps a bit from network-spoofing, but that doesn't help with system:anyuser files. Similarly, it doesn't help in the case of a random user gaining the priviledges of the local lpd (through whatever means the lpd gains those priviledges). > /Daniel -derek --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Wed Oct 9 15:45:13 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 10:45:13 -0400 Subject: [OpenAFS] Web Browsers In-Reply-To: <3DA433C3.7020408@ahpcrc.org> References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> <3DA433C3.7020408@ahpcrc.org> Message-ID: Michael Robokoff writes: > Okay, I checked the cache and this is what I had: > AFS using 73370 of the cache's available 100000 1K byte blocks. > The file was about 4MB so it was larger than the cache. So I increased my Eh? 100,000 1K blocks is a 100MB cache 4MB = 4000K == 4000 1K byte blocks So your cache was fine.. > cache by 10x to: 1000000 1K byte blocks. and re-tried the download. I > noticed the cache usage did not increase much. AFS using 77294 of the > cache's available 1000000 1K byte blocks. Then I noticed network > activity continued when the browsers were hung. So I waited several minutes > and the download eventually completed. It is strange that during that > time I > cannot stop the download or the browser without taking aggresive action. > Yet it appears after it does finally complete the browser returns to normal. Note that AFS uses write-back caching.. It will wire out the data to the server at "close()". How fast is your network link between your client and your AFS server? If it's a slower link (like a Cablemodem) then writing out 4MB can take a bit of time. > --Mike -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From mrobo@ahpcrc.org Wed Oct 9 15:59:44 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Wed, 09 Oct 2002 09:59:44 -0500 Subject: [OpenAFS] Web Browsers References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> <3DA433C3.7020408@ahpcrc.org> Message-ID: <3DA44460.4070900@ahpcrc.org> --------------000505060806080904010103 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit > > >>Okay, I checked the cache and this is what I had: >>AFS using 73370 of the cache's available 100000 1K byte blocks. >>The file was about 4MB so it was larger than the cache. So I increased my >> >> > >Eh? 100,000 1K blocks is a 100MB cache 4MB = 4000K == 4000 1K byte blocks >So your cache was fine.. > D' oh! Sorry, sometimes I just don't think. Anyway that would explain the change from 73370 to 77294 Roughly 4MB right? >>cache by 10x to: 1000000 1K byte blocks. and re-tried the download. I >>noticed the cache usage did not increase much. AFS using 77294 of the >>cache's available 1000000 1K byte blocks. Then I noticed network >>activity continued when the browsers were hung. So I waited several minutes >>and the download eventually completed. It is strange that during that >>time I >>cannot stop the download or the browser without taking aggresive action. >>Yet it appears after it does finally complete the browser returns to normal. >> >> > >Note that AFS uses write-back caching.. It will wire out the data to >the server at "close()". How fast is your network link between your >client and your AFS server? If it's a slower link (like a Cablemodem) >then writing out 4MB can take a bit of time. > > I have 100MB to my desktop that is through a switch to the 100MB subnet the AFS server is on. We have had performance issues all along. Maybe it is time for me to dig in and see if I can increase performance at all. I have no reason to believe the issue is the network. I do believe it has something to do with the AFS servers themselves. Do you have any suggestions on how to do that? --Mike --------------000505060806080904010103 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit
Okay, I checked the cache and this is what I had:
AFS using 73370 of the cache's available 100000 1K byte blocks.
The file was about 4MB so it was larger than the cache. So I increased my
    

Eh?  100,000 1K blocks is a 100MB cache  4MB = 4000K == 4000 1K byte blocks
So your cache was fine..
D' oh! Sorry, sometimes I just don't think. Anyway that would explain the change
from 73370 to 77294 Roughly 4MB right? 
cache by 10x to: 1000000 1K byte blocks. and re-tried the download. I
noticed the cache usage did not increase much. AFS using 77294 of the
cache's available 1000000 1K byte blocks. Then I noticed network
activity continued when the browsers were hung. So I waited several minutes
and the download eventually completed. It is strange that during that
time I
cannot stop the download or the browser without taking aggresive action.
Yet it appears after it does finally complete the browser returns to normal.
    

Note that AFS uses write-back caching..  It will wire out the data to
the server at "close()".  How fast is your network link between your
client and your AFS server?  If it's a slower link (like a Cablemodem)
then writing out 4MB can take a bit of time.
  
I have 100MB to my desktop that is through a switch to the 100MB subnet the
AFS server is on. We have had performance issues all along. Maybe it is time
for me to dig in and see if I can increase performance at all. I have no reason to
believe the issue is the network. I do believe it has something to do with the
AFS servers themselves.

Do you have any suggestions on how to do that?

--Mike --------------000505060806080904010103-- From warlord@MIT.EDU Wed Oct 9 15:54:37 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 10:54:37 -0400 Subject: [OpenAFS] AFS access rights and novell printer queues. In-Reply-To: <1034173847.450.30.camel@hybris> References: <1034155867.454.14.camel@hybris> <1034173847.450.30.camel@hybris> Message-ID: Daniel Sw=E4rd writes: > > If it's the latter, and it's really lp_R_ that needs the file, then > > you just need to make sure the users are running in a PAG or that lpr > > is NOT setuid -- so it uses the user's authentication. >=20 > I can change to lprng if it's better and can use authentication from the > printing user. Does lprng use the same style of printer filters as lpd? Pretty much, yes. lprng uses /etc/printcap, but it does provide a few extra items. > > Another choice you have it is setup a network lpr-queue that has its > > OWN netware-print password, so Unix people print to the lpr queue and > > it forwards on to the netware queue. >=20 > Setting up a remote printer queue with a _single_ netware-password is > not an option... All the students here have sort of a "print-quota"... > Otherwise I wouldn't be having these problems at all. Why can't you enforce the print quotas on the unix side? Perhaps they get two quotas, they can print X pages from Linux and Y pages from netware? > Whoever said bureacracy made life easier? Eh, I tend to consider bureacracy as an error and route around it ;) > /Daniel -derek --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Wed Oct 9 16:12:42 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 09 Oct 2002 11:12:42 -0400 Subject: [OpenAFS] Web Browsers In-Reply-To: <3DA44460.4070900@ahpcrc.org> References: <3DA42767.4090509@ahpcrc.org> <3DA42901.6090104@inf.ethz.ch> <3DA433C3.7020408@ahpcrc.org> <3DA44460.4070900@ahpcrc.org> Message-ID: Michael Robokoff writes: > D' oh! Sorry, sometimes I just don't think. Anyway that would explain > the change > from 73370 to 77294 Roughly 4MB right? Yep. :) > I have 100MB to my desktop that is through a switch to the 100MB subnet the > AFS server is on. We have had performance issues all along. Maybe it is time > for me to dig in and see if I can increase performance at all. I have > no reason to > believe the issue is the network. I do believe it has something to do > with the > AFS servers themselves. > > Do you have any suggestions on how to do that? Unfortunately no. :( > --Mike -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From rmdyer@uncc.edu Wed Oct 9 16:26:47 2002 From: rmdyer@uncc.edu (Rodney M Dyer) Date: Wed, 09 Oct 2002 11:26:47 -0400 Subject: [OpenAFS] windows issues In-Reply-To: <5.1.0.14.0.20021009091613.00b9c368@imap.unc.edu> Message-ID: <5.1.0.14.0.20021009111659.0279e638@coeimap2.uncc.edu> Mr. Williams, We've had the same issue here at UNC Charlotte. We are running Transarc's AFS 3.6 v2.32 (Patch 4). We are seeing random afsd_service.exe crashes on our Windows XP machines. A couple of weeks ago we found extensive probing of NetBIOS ports from outside our campus gateway. We disabled the NetBIOS at the gateway and the level of AFS crashes went way down. We still have crashes however because we found other probing coming from compromised machines within our own network. This is a bad thing. We don't want to keep NetBIOS disabled at the router because we actually use Microsoft networking in some cases from the internet. In other cases we run Samba servers for access to AFS filespace for people who don't use the AFS client. Can anyone solve this problem with AFSd being unstable on Windows clients? Help is appeciated. Thanks, Rodney Rodney M. Dyer PC Systems Programmer College of Engineering Computing Services University of North Carolina at Charlotte Email rmdyer@uncc.edu Phone (704)687-3518 Help Desk Line (704)687-3150 FAX (704)687-2352 Office 267 Smith Building At 09:34 AM 10/9/2002 -0400, you wrote: >Hi David, >Here at UNC we determined that "random" afsd_service.exe crashes (OpenAFS >1.2.6) were due to a dramatic increase in attacks on Microsoft >Networking/NetBIOS ports (137, 138, 139). More specifically, it is >believed these probes/attacks originate from remote hosts infected with >the 'onaServ' worm. > >The attacker(s) were attempting to mount the 'C' drive of the OpenAFS >windows client's loopback SMB server. This request gets flagged as a >bad/malformed packet and often (but not always) causes the service to >crash or misbehave. Exactly why the error handling varies among >"identical" systems has not yet been addressed. > >These ports have been closed at the campus Internet router and this >problem has disappeared. > >--Scott > > > Date: Thu, 03 Oct 2002 12:01:05 -0700 (MST) > > From: David Bear > > To: openafs-info@openafs.org > > Subject: [OpenAFS] windows issues > > > > > > strange happenings with win2k and openafs 1.2.2b. > > > > Worked fine yesterday. > > > > today, try to get tokens.. always fails. > > > > Then from cmd window issue: > > > > net stop "IBM AFS Client" > > net start "IBM AFS Client" > > > > stops and starts successfully. Then klog .. > > > > works!!! Why? > > > > -- > > David Bear > > College of Public Programs/ASU > > 480-965-8257 > > ...the way is like water, going where nobody wants it to go > >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info From Todd_Lewis@unc.edu Wed Oct 9 17:07:59 2002 From: Todd_Lewis@unc.edu (Todd M. Lewis) Date: Wed, 09 Oct 2002 12:07:59 -0400 Subject: [OpenAFS] Mount points on directories that have already been created References: <200210081320.45225.maldrich@reserveamerica.com> <3DA33CF0.2010906@email.unc.edu> Message-ID: <3DA4545F.5090009@email.unc.edu> Derek Atkins wrote: > "Todd M. Lewis" writes: > > >>Also, you might want to look at the "up" utility to copy the contents >>of the original dir2 into the new volume, especially if you have lots >>of complicated ACLs burried down in that subtree. Up is sort of a >>recursive cp that also knows about and duplicates ACLs. It's obvious >>when you think about it, but to use "up" effectively, you must have >>sufficient read rights to all the data you're trying to copy. > > > Why not just use the "rename()" syscall? > > mv dir2 dir2.oldversion > > Much simpler! ;) That's right, use mv for the first step. Then you: * create the new volume * mount it as dir2 * use "up" to copy the original dir2's contents -- including subdirectories and the ACLs burried therein -- to the new dir2. I thought the original problem was to keep the directory structure and ACLs as they were, but to turn the dir2 directory into a mountpoint for a new volume. Unless I'm missing something, the above steps are the easiest way to do that. -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ From kb44@rz.uni-karlsruhe.de Wed Oct 9 17:43:56 2002 From: kb44@rz.uni-karlsruhe.de (=?iso-8859-1?Q?Rubino_Gei=DF?=) Date: Wed, 9 Oct 2002 18:43:56 +0200 Subject: [OpenAFS] Web Browsers In-Reply-To: <3DA433C3.7020408@ahpcrc.org> Message-ID: <00ba01c26fb3$210a56b0$a8d80d81@info.unikarlsruhe.de> Strange: 100000 * 1K == 100 * 1000K ~~ 100M Which is obviously less than 4MB Did you mean 4GB or was the cache size never the problem. In the case you meant 4GB instead of 4MB, then you "correctly" will experience a freeze of your browser: AFS implements write on close. That is, all data is guaranteed to be written on the server disk as soon as the client operating system returns successfully from close(). In the meantime nothing is guaranteed. On most occasions you don't "feel" this fact. But if you write a lot of data, say > 100MB, from a fast source to a not equally fast server / network you will get a significant pause at the time of closing this file. The problem is, most applications do not anticipate that close will take some time, so that multithreading is not always introduced to get the gui responsive. > Okay, I checked the cache and this is what I had: > AFS using 73370 of the cache's available 100000 1K byte > blocks. The file was about 4MB so it was larger than the > cache. So I increased my cache by 10x to: 1000000 1K byte > blocks. and re-tried the download. I noticed the cache usage > did not increase much. AFS using 77294 of the cache's > available 1000000 1K byte blocks. Then I noticed network > activity continued when the browsers were hung. So I waited > several minutes and the download eventually completed. It is > strange that during that > time I > cannot stop the download or the browser without taking > aggresive action. Yet it appears after it does finally > complete the browser returns to normal. > From m1esb00@frb.gov Thu Oct 10 12:24:13 2002 From: m1esb00@frb.gov (E.Spencer B.) Date: Thu, 10 Oct 2002 07:24:13 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs Message-ID: I'm having a discussion with my co-workers about open-afs. We are aware of the ACL limitations with afs (as far as setting them on directories and not files). My question is can open-afs on a Solaris 2.6 or higher box make use of Solaris ACLs within the open-afs environment using the setfacl and getfacl commands? Many, many, many thanks to all you hard working gals/guys out there in advance. --E.Spencer B. From m1esb00@frb.gov Wed Oct 9 21:25:16 2002 From: m1esb00@frb.gov (E.Spencer B.) Date: Wed, 9 Oct 2002 16:25:16 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs Message-ID: I'm having a discussion with my co-workers about open-afs. We are aware of the ACL limitations with afs (as far as setting them on directories and not files). My question is can open-afs on a Solaris 2.6 or higher box make use of Solaris ACLs within the open-afs environment using the setfacl and getfacl commands? Many, many, many thanks to all you hard working gals/guys out there in advance. --E.Spencer B. From julius.l.campbell@jpl.nasa.gov Thu Oct 10 00:40:42 2002 From: julius.l.campbell@jpl.nasa.gov (Julius L. Campbell) Date: Wed, 09 Oct 2002 16:40:42 -0700 Subject: [OpenAFS] afsweb Message-ID: <5.1.0.14.2.20021009163413.0179be68@mail2.jpl.nasa.gov> Anyone built/integrated the src/afsweb stuff in a recent version of openafs (solaris) src? I'm trying to integrate openafs 1.2.6 afsweb stuff with apache 2.x (or any other version of apache). We want the authentication mechanism promised by the afsweb stuff when web browsers try to access ACL'ed pages in afs space. Julius Campbell From cameron@ctcnsc.org Thu Oct 10 02:15:14 2002 From: cameron@ctcnsc.org (Frank J. Cameron) Date: 09 Oct 2002 21:15:14 -0400 Subject: [OpenAFS] Re: AFS access rights and novell printer queues In-Reply-To: <20021009113202.F2A599D39@grand.central.org> References: <20021009113202.F2A599D39@grand.central.org> Message-ID: <1034212514.32301.26.camel@localhost.localdomain> You might investigate one of these client pieces instead of nprint. I haven't used either of these. From: NETWORK WORLD NEWSLETTER: DAVE KEARNS on NOVELL NETWARE 10/08/02 The SCO Group, formerly Caldera, has a product called "NetWare for Linux" which includes a Linux client for the NetWare network (see: http://www.caldera.com/support/docs/openlinux/netware/utilities/). This is a full-featured NetWare client. While not 100% identical to the latest versions of Novell's NetWare clients for the Windows platforms, it's close to 98% feature complete (I haven't actually discovered a feature that's missing, but I'm told that there are some). While the SCO client is intended primarily for SCO's OpenLinux distribution, there's a more generic Linux client, also. It's called the "Now-well" Client for Linux and was developed by Erwin Preuner. It's available at http://now-well.sourceforge.net/linux/now-well/ but [disclaimer] I haven't tried it so I've no information as to its ease of use or reliability. As always, try this in the lab first. > From: Daniel =?ISO-8859-1?Q?Sw=E4rd?= > To: openafs > Date: 09 Oct 2002 11:31:07 +0200 > Subject: [OpenAFS] AFS access rights and novell printer queues. > > The users which will be using the Linux environment I've setup are going > to have to print to Novell printer queues. To accompling that I'm using > nprint (from ncpfs). The problem is that nprint in conjunction with lpd > requires that the users have a ".nwclient" file in their homedirectory. > The ".nwclient" is supposed to contain username/password for their > Novell account. > > How can I make the file readable only to root on the clients, so lpd can > read it? If the ACL is "system:anyuser rl" AFS ignores the Unix file > rights (600) and the file is worldwide readable. Should I set up a > separate usergroup for whatever user that runs lpd? > > /Daniel From mrobo@ahpcrc.org Thu Oct 10 15:12:21 2002 From: mrobo@ahpcrc.org (Michael Robokoff) Date: Thu, 10 Oct 2002 09:12:21 -0500 Subject: [OpenAFS] vos listaddrs Message-ID: <3DA58AC5.8020101@ahpcrc.org> Hello all! I just ran the "vos listaddrs" command on some of my servers and the only server listed is a new server I just brought up. I was wondering why all the servers are not listed? Do they need to be? --Mike From rlink+@pitt.edu Thu Oct 10 15:41:00 2002 From: rlink+@pitt.edu (Ray Link) Date: Thu, 10 Oct 2002 10:41:00 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs Message-ID: On Thu, 10 Oct 2002, E.Spencer B. wrote: > I'm having a discussion with my co-workers about open-afs. We are aware > of the ACL limitations with afs (as far as setting them on directories and > not files). My question is can open-afs on a Solaris 2.6 or higher box > make use of Solaris ACLs within the open-afs environment using the setfacl > and getfacl commands? No, Solaris ACLs are UFS-only. When attempting to use Solaris ACLs within AFS, the acl(2) syscall fails with ENOSYS. According to errno.h, that translates to "Unsupported file system operation". Since AFS runs on multiple platforms, this wouldn't buy you much anyways if it worked. What would happen to someone with, say, a Linux client that has no notion of Solaris ACLs? ==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ==== "Everytime you declare main() as returning void - somewhere a little baby cries. So please, do it for the children." -- Daniel Fox From deengert@anl.gov Thu Oct 10 16:27:24 2002 From: deengert@anl.gov (Douglas E. Engert) Date: Thu, 10 Oct 2002 10:27:24 -0500 Subject: [OpenAFS] ACLs and open-afs References: Message-ID: <3DA59C5C.73395CDE@anl.gov> "E.Spencer B." wrote: > > I'm having a discussion with my co-workers about open-afs. We are aware > of the ACL limitations with afs (as far as setting them on directories and > not files). Actually it has turned out to be a blessing. There are very few situations where in AFS you need to have an ACL on a file. In those situations, you put the file in its own directory. This greatly simplifies the situations. The OSF DCE with DFS which was based on AFS, does allow ACLs on each file, and three ACLs on a directory! (One for the directory, one for new files created in the directory, and one for new directories created in the directory.) My question is can open-afs on a Solaris 2.6 or higher box > make use of Solaris ACLs within the open-afs environment using the setfacl > and getfacl commands? Interesting question. > > Many, many, many thanks to all you hard working gals/guys out there in > advance. > > --E.Spencer B. > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 From valerio@cns.nyu.edu Thu Oct 10 16:36:58 2002 From: valerio@cns.nyu.edu (Valerio Luccio) Date: Thu, 10 Oct 2002 11:36:58 -0400 Subject: [OpenAFS] AFS Server on Apple Xserve Message-ID: <3DA59E9A.3060103@cns.nyu.edu> I apologize if I send this on two lists, but I'm getting desperate. I'm trying to install OpenAFS on an Apple Xserve (running OS 10.2). The client part works without a hitch, but the server is driving me nuts (I no problem installing it on my RedHat). My current stumbling point is the "/vicepxx" partition: after managing to get the Xserve to mount the disk where I wanted (the standard tools will mount the disk under "/Volumes..."), I still can't get the volumeserver to see it (I've tried formatting it as both HFS and UFS). Here's what I get with different tools: : mount /dev/disk4 on /vicepa (local) : df /vicepa Filesystem 512-blocks Used Avail Capacity Mounted on /dev/disk4 233777984 8 222089088 0% /vicepa : disktool -l ***Disk Appeared ('disk4',Mountpoint = '/vicepa', fsType = 'ufs', volName = 'VICE') Yet .... : vos create koura.cns.nyu.edu /vicepa root.afs -cell fmri.nyu.edu -noauth vos : partition /vicepa does not exist on the server : vos listp koura.cns.nyu.edu -noauth The partitions on the server are: Total: 0 Has anyone out there gotten a server to run on Mac OS X Server ? Thanks, -- Valerio Luccio (212) 998-8736 Center For Neural Science 4 Washington Place, Room 935 New York University New York, NY 10003 "In an open world, who needs windows or gates?" From rees@umich.edu Thu Oct 10 17:48:20 2002 From: rees@umich.edu (Jim Rees) Date: Thu, 10 Oct 2002 12:48:20 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: "Douglas E. Engert", Thu, 10 Oct 2002 10:27:24 CDT Message-ID: <20021010164820.59EA1207CB@citi.umich.edu> Actually it has turned out to be a blessing. There are very few situations where in AFS you need to have an ACL on a file. Allow me to vehemently disagree. Lack of file acls is one of the greatest misfeatures of afs. Take a look at your home directory for an example. Lots of little tiny files and directories, some of which must be world readable, some of which must not. My own home dir is a nightmare of symlinks. Same thing for ~/.ssh. And not having a separate "initial file acl" on directories means if I want my home directory readable (so I can login without tokens) I run the risk of having files like .Xauthority pop up, world readable, opening a huge security hole. DCE got a few things right, and this is one of them. From m1esb00@frb.gov Thu Oct 10 18:10:03 2002 From: m1esb00@frb.gov (E.Spencer B.) Date: Thu, 10 Oct 2002 13:10:03 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: Message-ID: On Thu, 10 Oct 2002, Ray Link wrote: > On Thu, 10 Oct 2002, E.Spencer B. wrote: > > > I'm having a discussion with my co-workers about open-afs. We are aware > > of the ACL limitations with afs (as far as setting them on directories and > > not files). My question is can open-afs on a Solaris 2.6 or higher box > > make use of Solaris ACLs within the open-afs environment using the setfacl > > and getfacl commands? > > No, Solaris ACLs are UFS-only. When attempting to use Solaris ACLs > within AFS, the acl(2) syscall fails with ENOSYS. According to errno.h, > that translates to "Unsupported file system operation". Sorry to hear this, has anyone tried to mod this behavior? > > Since AFS runs on multiple platforms, this wouldn't buy you much anyways > if it worked. What would happen to someone with, say, a Linux client > that has no notion of Solaris ACLs? Well, with Solaris ACLs and non-Solaris ACL interpreters like Linux, the Solaris ACLs are honored (permissions granted or not granted depending on the Solaris ACL), but you cannot set them from non-Solaris ACL interpreters like Linux from an NFS mounted Solaris exported filesystem. Thanks again for the help, E>Spencer>B From shadow@dementia.org Thu Oct 10 19:04:33 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 14:04:33 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <20021010164820.59EA1207CB@citi.umich.edu> Message-ID: On Thu, 10 Oct 2002, Jim Rees wrote: > Actually it has turned out to be a blessing. There are very few situations > where in AFS you need to have an ACL on a file. > > Allow me to vehemently disagree. Lack of file acls is one of the greatest > misfeatures of afs. [] > DCE got a few things right, and this is one of them. I have to say I agree with Jim on this one. I wish I had time to work on something like this, but sadly AFS isn't my full-time job:-) From rlink+@pitt.edu Thu Oct 10 19:20:39 2002 From: rlink+@pitt.edu (Ray Link) Date: Thu, 10 Oct 2002 14:20:39 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: References: Message-ID: On Thu, 10 Oct 2002, E.Spencer B. wrote: > > No, Solaris ACLs are UFS-only. When attempting to use Solaris ACLs > > Sorry to hear this, has anyone tried to mod this behavior? I'm guessing that it would take a change to Solaris itself. I'd assume that the acl(2) call goes "Is this a UFS filesystem?", sees that it's not, and returns an error. (However, this is just a hypothesis. The last Solaris sources we had were for 2.5.1.) > Well, with Solaris ACLs and non-Solaris ACL interpreters like Linux, the > Solaris ACLs are honored (permissions granted or not granted depending on > the Solaris ACL), but you cannot set them from non-Solaris ACL > interpreters like Linux from an NFS mounted Solaris exported filesystem. That's fine for Linux with an ACL interpreter, but since anyone can set up an AFS client and access your cell, what's to stop them from not using the ACL interpreter? What's to stop someone from using a platform that doesn't even have a Solaris ACL interpreter? Without the interpreter, all they need is access to the directory, and their machine doesn't care about any additional file-level restrictions. My point is, file-level ACLs are something that would need to be implemented within AFS, not tacked on via vendor-specific mechanisms. Actually doing so, however, is a completely different matter. One has to consider how to deal with older clients that don't grok file ACLs, among other things. It would completely change the internal workings of AFS. That said, I don't forsee it happening anytime soon. (But I could be wrong; I'm not an AFS developer.) ==== Ray Link === University of Pittsburgh CSSD === rlink@pitt.edu ==== For some reason I was confusing "SubGenius" with "GNU" there. - The Cube, Forum 3000 From kolya@MIT.EDU Thu Oct 10 19:34:22 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Thu, 10 Oct 2002 14:34:22 -0400 Subject: [OpenAFS] ACLs and open-afs Message-ID: <200210101834.OAA16591@contents-vnder-pressvre.mit.edu> > I'm guessing that it would take a change to Solaris itself. I'd assume > that the acl(2) call goes "Is this a UFS filesystem?", sees that it's > not, and returns an error. No; the acl syscall actually uses the getsecattr and setsecattr vnode ops to access the underlying ACL. Solaris tends to be pretty modular. The problem with implementing getsecattr and setsecattr calls for AFS is that the permission bits that those calls assume are different from the rlidwka permission bits in AFS. You could try to map the rlidwka bits into thet unix-style rwx bits, but what's the point? You wouldn't be able to usefully map them back, when the user tries to change them with setfacl. -- kolya From sdevine@msu.edu Thu Oct 10 20:38:59 2002 From: sdevine@msu.edu (Steve Devine) Date: 10 Oct 2002 15:38:59 -0400 Subject: [OpenAFS] Ldap & AFS Message-ID: <1034278739.28442.28.camel@jax.cl.msu.edu> Is there any work being done on a LDAP interface to AFS for user database inquirys? /sd Steve Devine Michigan State University From shadow@dementia.org Thu Oct 10 20:42:34 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 15:42:34 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: <1034278739.28442.28.camel@jax.cl.msu.edu> Message-ID: On 10 Oct 2002, Steve Devine wrote: > Is there any work being done on a LDAP interface to AFS for user > database inquirys? I would posit this isn't AFS's problem, but as it happens I know the guy in the office next to me did something to allow LDAP queries of the PTS database. Is that what you want? From sdevine@msu.edu Thu Oct 10 20:52:22 2002 From: sdevine@msu.edu (Steve Devine) Date: 10 Oct 2002 15:52:22 -0400 Subject: [OpenAFS] Ldap & AFS In-Reply-To: References: Message-ID: <1034279542.28442.32.camel@jax.cl.msu.edu> On Thu, 2002-10-10 at 15:42, Derrick J Brashear wrote: > On 10 Oct 2002, Steve Devine wrote: > > > Is there any work being done on a LDAP interface to AFS for user > > database inquirys? > > I would posit this isn't AFS's problem, but as it happens I know the guy > in the office next to me did something to allow LDAP queries of the PTS > database. Is that what you want? Yes it is. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Steve Devine Core Systems Michigan State University 110 Computer Center East Lansing, MI 48824-1042 1-517-355-4500 (x242) From deengert@anl.gov Thu Oct 10 22:32:46 2002 From: deengert@anl.gov (Douglas E. Engert) Date: Thu, 10 Oct 2002 16:32:46 -0500 Subject: [OpenAFS] ACLs and open-afs References: Message-ID: <3DA5F1FE.A052495A@anl.gov> Derrick J Brashear wrote: > > On Thu, 10 Oct 2002, Jim Rees wrote: > > > Actually it has turned out to be a blessing. There are very few situations > > where in AFS you need to have an ACL on a file. > > > > Allow me to vehemently disagree. Lack of file acls is one of the greatest > > misfeatures of afs. > [] > > DCE got a few things right, and this is one of them. > > I have to say I agree with Jim on this one. I wish I had time to work on > something like this, but sadly AFS isn't my full-time job:-) Its not my full time job either. We tried DCE/DFS as an AFS replacement, and it never did catch on Its gone now. Complex ACLs was just one of the problems. Well I guess we can disagree. If the ACLs where on AFS some might use them. BUT the problems of access rights to a home directory in AFS is a problem, and it is aggravated by the way the systems access it during login. This has been a pet peeve of mine, which has never be resolved. During login (or sshd, or whatever) the local system tries to access a home directory in AFS without a token. Thus the top level directory needs to be at least "l" to follow a symlink to the "rl" directory with world readable dot files. (And as Jim points out this can be a mess.) I would argue that if the login daemon obtained a token for the user before ever looking at the home directory, the home directory would not need to be "l" and could be protected the way it should be. The token represents the network user, the Kerbeors/AFS principal, which had been authenticated via a Kerberos authentication, or a password to the host and to the file server. At this point the token can be used, for AFS access, even though the local unix UID or home directory has not been determined. One place where this would help is with the .k5login file. It is used to determine that the Kerberos principal can use the local UNIX account because the PW.entry->homedir->.k5login and the .k5login lists the name of the principal. With current systems this test is done early before a token is obtained, but if a token for the user was obtained before this, the .k5login could be in the home directory only readable by the user. So if you realy want to improve the access controls on the home directory, get the system deamons, and PAM exits to get the token early. > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 From leifj@it.su.se Thu Oct 10 22:33:18 2002 From: leifj@it.su.se (Leif Johansson) Date: Thu, 10 Oct 2002 23:33:18 +0200 Subject: [OpenAFS] Ldap & AFS References: <1034279542.28442.32.camel@jax.cl.msu.edu> Message-ID: <3DA5F21E.60206@it.su.se> Steve Devine wrote: > On Thu, 2002-10-10 at 15:42, Derrick J Brashear wrote: > >>On 10 Oct 2002, Steve Devine wrote: >> >> >>>Is there any work being done on a LDAP interface to AFS for user >>>database inquirys? >> >>I would posit this isn't AFS's problem, but as it happens I know the guy >>in the office next to me did something to allow LDAP queries of the PTS >>database. Is that what you want? > > Yes it is. me too! From shadow@dementia.org Thu Oct 10 23:25:46 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 18:25:46 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: <3DA5F21E.60206@it.su.se> Message-ID: On Thu, 10 Oct 2002, Leif Johansson wrote: > >>>Is there any work being done on a LDAP interface to AFS for user > >>>database inquirys? > >> > >>I would posit this isn't AFS's problem, but as it happens I know the guy > >>in the office next to me did something to allow LDAP queries of the PTS > >>database. Is that what you want? > > > > Yes it is. > > me too! I'm sure he's getting tired of me asking and then forgetting the answer, so this time I swear I will find out what the deal is and share the info. From shadow@dementia.org Thu Oct 10 23:59:58 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 18:59:58 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: <3DA5F21E.60206@it.su.se> Message-ID: > >>>Is there any work being done on a LDAP interface to AFS for user > >>>database inquirys? > >> > >>I would posit this isn't AFS's problem, but as it happens I know the guy > >>in the office next to me did something to allow LDAP queries of the PTS > >>database. Is that what you want? > > > > Yes it is. > > me too! The license on it matches the OpenLDAP license, which might mean it's been contributed or is intended to be, but I don't ask questions, lest someone decide to play politics. The license as it is lets me, so here it is: /afs/andrew.cmu.edu/usr/shadow/back-pts.tar.gz The README inside explains how it works. From openafs@leffler.org Fri Oct 11 00:29:38 2002 From: openafs@leffler.org (=?iso-8859-1?Q?Bj=F6rn?= Leffler) Date: Fri, 11 Oct 2002 01:29:38 +0200 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? Message-ID: <3DA60D62.B8942ECD@leffler.org> I have just set up my own AFS server + cell at home and would like to connect as a client from my university. My problem is that the administrators refuse to add my cell to their CellServDB file and thus fs doesn't find my cell when trying to mkmount. Is it still possible to mount/use the cell ? Not necessarily mounted in /afs/my_cellname, but in my (/afs...) $HOME directory. I don't mind personally modifying the source code as long as I know it's possible and doesn't generate any nasty secondary effects. Looking through the source code, I found an environment variable called AFSCONF, which fs uses if the standard CellServDB is not found. Could this be a hint to the solution ? I use openafs 1.2.7 at home and the university uses 1.2.5 Bjorn Leffler From shadow@dementia.org Fri Oct 11 00:32:08 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 19:32:08 -0400 (EDT) Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: <3DA60D62.B8942ECD@leffler.org> Message-ID: On Fri, 11 Oct 2002, [iso-8859-1] Björn Leffler wrote: > I have just set up my own AFS server + cell at home and would like to > connect as a client from my university. My problem is that the > administrators refuse to add my cell to their CellServDB file and thus > fs doesn't find my cell when trying to mkmount. > > Is it still possible to mount/use the cell ? Not necessarily mounted in > /afs/my_cellname, but in my (/afs...) $HOME directory. > > I don't mind personally modifying the source code as long as I know it's > possible and doesn't generate any nasty secondary effects. if you can modify source, how can you not "own" CellServDB? Get them to enable -afsdb (or enable it yourself) and publish DNS info for your cell. > Looking through the source code, I found an environment variable called > AFSCONF, which fs uses if the standard CellServDB is not found. Could > this be a hint to the solution ? well, once you cram a cell into the kernel you're good, so you could do that as root (fs newcell the cell, then fs mkm and then on any machine where it's been fs newcell'd the mount point would work) From shadow@dementia.org Fri Oct 11 00:34:52 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 19:34:52 -0400 (EDT) Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: <3DA60D62.B8942ECD@leffler.org> Message-ID: > I use openafs 1.2.7 at home and the university uses 1.2.5 If they use the grand.central.org CellServDB, perhaps you should just register your cell and they'll pick it up for you. From openafs@leffler.org Fri Oct 11 01:18:20 2002 From: openafs@leffler.org (=?iso-8859-1?Q?Bj=F6rn?= Leffler) Date: Fri, 11 Oct 2002 02:18:20 +0200 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? References: Message-ID: <3DA618CC.DC24A824@leffler.org> I'm a normal user (not root) and I know they don't use DNS for cell info. They have promised this for the next upgrade. Does this mean it's impossible right now ? Derrick J Brashear wrote: > On Fri, 11 Oct 2002, [iso-8859-1] Björn Leffler wrote: > > > I have just set up my own AFS server + cell at home and would like to > > connect as a client from my university. My problem is that the > > administrators refuse to add my cell to their CellServDB file and thus > > fs doesn't find my cell when trying to mkmount. > > > > Is it still possible to mount/use the cell ? Not necessarily mounted in > > /afs/my_cellname, but in my (/afs...) $HOME directory. > > > > I don't mind personally modifying the source code as long as I know it's > > possible and doesn't generate any nasty secondary effects. > > if you can modify source, how can you not "own" CellServDB? > > Get them to enable -afsdb (or enable it yourself) and publish DNS info for > your cell. > > > Looking through the source code, I found an environment variable called > > AFSCONF, which fs uses if the standard CellServDB is not found. Could > > this be a hint to the solution ? > > well, once you cram a cell into the kernel you're good, so you could do > that as root (fs newcell the cell, then fs mkm and then on any machine > where it's been fs newcell'd the mount point would work) > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From jwarr@us.ibm.com Fri Oct 11 02:43:19 2002 From: jwarr@us.ibm.com (Judy Warren) Date: Thu, 10 Oct 2002 21:43:19 -0400 Subject: [OpenAFS] Ldap & AFS In-Reply-To: Message-ID: What about the other way around -- has anyone done anything (or know of anyone who has done anything) to get AFS to query LDAP for user authentication? Kind of a LDAP substitute for a kas/Kerberos server... and maybe also a substitute for a pts server. Thanks, --Judy Derrick J Brashear cc: Sent by: Subject: Re: [OpenAFS] Ldap & AFS openafs-info-admin@ openafs.org 10/10/2002 06:59 PM > >>>Is there any work being done on a LDAP interface to AFS for user > >>>database inquirys? > >> > >>I would posit this isn't AFS's problem, but as it happens I know the guy > >>in the office next to me did something to allow LDAP queries of the PTS > >>database. Is that what you want? > > > > Yes it is. > > me too! The license on it matches the OpenLDAP license, which might mean it's been contributed or is intended to be, but I don't ask questions, lest someone decide to play politics. The license as it is lets me, so here it is: /afs/andrew.cmu.edu/usr/shadow/back-pts.tar.gz The README inside explains how it works. _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info From kenh@cmf.nrl.navy.mil Fri Oct 11 03:24:26 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Thu, 10 Oct 2002 22:24:26 -0400 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: Your message of "Fri, 11 Oct 2002 02:18:20 +0200." <3DA618CC.DC24A824@leffler.org> Message-ID: <200210110224.g9B2OVgB012903@ginger.cmf.nrl.navy.mil> >I'm a normal user (not root) and I know they don't use DNS for cell info. >They have promised this for the next upgrade. The next upgrade of _what_? It's not like they have to change anything in AFS to add those DNS records (unless their version of BIND is >10 years old). --Ken From nemesis-lists@icequake.net Fri Oct 11 04:39:45 2002 From: nemesis-lists@icequake.net (Ryan Underwood) Date: Fri, 11 Oct 2002 03:39:45 +0000 Subject: [OpenAFS] kernel 2.2.22? Message-ID: <20021011033948.A74405DA3F@mail.icequake.net> Anyone using OpenAFS with the recently released 2.2.22 kernel? # ls /afs/icequake.net README adm pub tmp users # mkdir /afs/icequake.net/dm mkdir: cannot create directory `/afs/icequake.net/dm': File exists (strace: mkdir("/afs/icequake.net/dm", 0777) = -1 EEXIST (File exists)) # touch /afs/icequake.net/dm touch: creating `/afs/icequake.net/dm': No such file or directory Erm? OpenAFS client and modules-source debian v1.2.3final2-6 (woody).Kernel is 2.2.22 with -ow1 and -ide05042001 patches. The same operations are fine on all other machines I have set up, but they are all running 2.4 kernels. Reading files is no problem, nor editing existing files; I just can't create new files or directories. -- Ryan Underwood, , icq=10317253 From shadow@dementia.org Fri Oct 11 04:41:23 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 10 Oct 2002 23:41:23 -0400 (EDT) Subject: [OpenAFS] kernel 2.2.22? In-Reply-To: <20021011033948.A74405DA3F@mail.icequake.net> Message-ID: On Fri, 11 Oct 2002, Ryan Underwood wrote: > > Anyone using OpenAFS with the recently released 2.2.22 kernel? If you want to run a modern 2.2 kernel, consider a modern OpenAFS. It was a 1.2.3 bug. > # ls /afs/icequake.net > README adm pub tmp users > > # mkdir /afs/icequake.net/dm > mkdir: cannot create directory `/afs/icequake.net/dm': File exists > > (strace: mkdir("/afs/icequake.net/dm", 0777) = -1 EEXIST (File exists)) > > # touch /afs/icequake.net/dm > touch: creating `/afs/icequake.net/dm': No such file or directory > > Erm? OpenAFS client and modules-source debian v1.2.3final2-6 (woody).Kernel > is 2.2.22 with -ow1 and -ide05042001 patches. > > The same operations are fine on all other machines I have set up, but they > are all running 2.4 kernels. Reading files is no problem, nor editing existing > files; I just can't create new files or directories. From tino.schwarze@informatik.tu-chemnitz.de Fri Oct 11 07:37:51 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Fri, 11 Oct 2002 08:37:51 +0200 Subject: [OpenAFS] AFS Server on Apple Xserve In-Reply-To: <3DA59E9A.3060103@cns.nyu.edu>; from valerio@cns.nyu.edu on Thu, Oct 10, 2002 at 11:36:58AM -0400 References: <3DA59E9A.3060103@cns.nyu.edu> Message-ID: <20021011083751.A17687@informatik.tu-chemnitz.de> On Thu, Oct 10, 2002 at 11:36:58AM -0400, Valerio Luccio wrote: > : vos create koura.cns.nyu.edu /vicepa root.afs -cell fmri.nyu.edu > -noauth > vos : partition /vicepa does not exist on the server Try using "a" instead of /vicepa... (Just a wild guess. I seem to remember that this has been a problem somewhere but I might be wrong.) > : vos listp koura.cns.nyu.edu -noauth > The partitions on the server are: This is odd though. Try creating an empty file "AlwaysAttach" in /vicepa and see if that works (restart the fileserver afterwards, e.g. "bos restart koura fs"). MacOS X is not officially known to work as a server though. HTH! Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From alan@sunwave.com Fri Oct 11 09:54:33 2002 From: alan@sunwave.com (Alan Meadows) Date: Fri, 11 Oct 2002 01:54:33 -0700 Subject: [OpenAFS] OpenAFS on Debian, Help? Message-ID: <5.1.0.14.2.20021011014500.02008950@63.193.232.67> Hi there, I've been trying to install the debian packages from openafs.org off and on when I have spare time and I always encounter the same barrier which stops me from successfully installing OpenAFS. I have tried following "configuration-transcript.txt.gz" to the letter and various other approaches but I always seem to get stuck in the same place. Below is what happens when I run afs-newcell. Am I doing something silly? Should I not be using afs-newcell? Now, my goal is to get OpenAFS working with the openafs-kpasswd package, before I move onto krb5, but I receive the same error message (see below) either way: "FSYNC_clientInit temporary failure (will retry): Connection refused" Thanks in advance, Alan Meadows alan@sunwave.com # afs-newcell Do you meet these requirements? [y/n] y If the fileserver is not running, this may hang for 30 seconds. /etc/init.d/openafs-fileserver stop Stopping AFS Server: bos: failed to shutdown servers (communications failure (-1)) bos: can't wait for processes to shutdown (communications failure (-1)) bosserver. What administrative principal should be used? meadows echo \>protgp.com >/etc/openafs/server/CellServDB /etc/init.d/openafs-fileserver start Starting AFS Server: bosserver. bos addhost karl karl -localauth ||true bos adduser karl meadows -localauth pt_util: /var/lib/openafs/db/prdb.DB0: Bad UBIK_MAGIC. Is 0 should be 354545 Ubik Version is: 2.0 Error while creating system:administrators: Entry for id already exists pt_util: Ubik Version number changed during execution. Old Version = 2.0, new version = 33554432.0 bos create karl ptserver simple /usr/lib/openafs/ptserver -localauth bos create karl vlserver simple /usr/lib/openafs/vlserver -localauth bos create karl fs fs -cmd /usr/lib/openafs/fileserver -cmd /usr/lib/openafs/volserver -cmd /usr/lib/openafs/salvager -localauth Waiting for database elections: done. vos create karl a root.afs -localauth FSYNC_clientInit temporary failure (will retry): Connection refused FSYNC_clientInit temporary failure (will retry): Connection refused FSYNC_clientInit temporary failure (will retry): Connection refused FSYNC_clientInit temporary failure (will retry): Connection refused Could not fetch the list of partitions from the server Possible communication failure Possible communication failure Failed: 65280 bos shutdown karl -localauth bos delete karl fs -localauth bos delete karl vlserver -localauth bos delete karl ptserver -localauth rm /var/lib/openafs/db/prdb* bos removeuser karl meadows -localauth From nemesis-lists@icequake.net Fri Oct 11 10:08:01 2002 From: nemesis-lists@icequake.net (Ryan Underwood) Date: Fri, 11 Oct 2002 09:08:01 +0000 Subject: [OpenAFS] kinit/aklog for windows? Message-ID: <20021011090802.502605DA3F@mail.icequake.net> I know this question has been beaten to death before, but what are the current alternatives for windows clients on a kaserver-less network? So far I see: 1) kdc slave running on the afs dbserver machine 2) udp port-forwarder on the afs dbserver machine Has any work been done towards MIT-krb integration on the windows port? -- Ryan Underwood, , icq=10317253 From excds@kth.se Fri Oct 11 11:52:39 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 11 Oct 2002 12:52:39 +0200 Subject: [OpenAFS] OpenAFS on Debian, Help? In-Reply-To: <5.1.0.14.2.20021011014500.02008950@63.193.232.67> References: <5.1.0.14.2.20021011014500.02008950@63.193.232.67> Message-ID: <1034333564.451.1.camel@hybris> > vos create karl a root.afs -localauth > FSYNC_clientInit temporary failure (will retry): Connection refused > FSYNC_clientInit temporary failure (will retry): Connection refused > FSYNC_clientInit temporary failure (will retry): Connection refused > FSYNC_clientInit temporary failure (will retry): Connection refused > Could not fetch the list of partitions from the server > Possible communication failure > Possible communication failure > Failed: 65280 Are you sure you've entered the correct IP in CellServDB if your cell isn't registered? /Daniel From leifj@it.su.se Fri Oct 11 12:15:22 2002 From: leifj@it.su.se (Leif Johansson) Date: Fri, 11 Oct 2002 13:15:22 +0200 Subject: [OpenAFS] Ldap & AFS References: Message-ID: <3DA6B2CA.4040504@it.su.se> Judy Warren wrote: > > > > > What about the other way around -- has anyone done anything (or know of > anyone who has done anything) to get AFS to query LDAP for user > authentication? Kind of a LDAP substitute for a kas/Kerberos server... > and maybe also a substitute for a pts server. > I thought about this and it was discussed at the LISA 2002 AFS workshop but the consensus seems to be that although it would not be extremely difficult to modify pts (I was looking at milko pts btw) most people would be able to do what they need to do (usually some kind of account synchronization) if pts allowed for storing some kind of extra metadata along with the principal. For instance if you could stick the LDAP dn in the pts record indicating both that the entry has been synchronized with the directory and also indicating the equivalence. Maybe you need some kind of timestamp-thingy aswell. leifj From amar deep kumar" On my machine fs quota command shows negative percentage used of the volume quota.can any body help me in sorting out this problem amardeep kumar barc,mumbai From ian@assv.net Fri Oct 11 12:59:03 2002 From: ian@assv.net (Ian Delahorne) Date: 11 Oct 2002 13:59:03 +0200 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: References: Message-ID: Derrick J Brashear writes: > > I use openafs 1.2.7 at home and the university uses 1.2.5 > > If they use the grand.central.org CellServDB, perhaps you should just > register your cell and they'll pick it up for you. They (nada.kth.se) have their own cellservdb that only has entries relevant to education. Plus they block incoming AFS from !KTH-nets. -- /Ian D ian@assv.net - www.assv.net From nneul@umr.edu Fri Oct 11 13:50:04 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 11 Oct 2002 07:50:04 -0500 Subject: [OpenAFS] kinit/aklog for windows? In-Reply-To: <20021011090802.502605DA3F@mail.icequake.net> References: <20021011090802.502605DA3F@mail.icequake.net> Message-ID: <1034340604.32295.1.camel@cessna.rollanet.org> You can run krb524d anywhere, you just have to run a recent enough kerberos build that supports locating the krb524d server independently of the kdc. Ideally, you should run with the token-file + keytab patch, as it simplifies things tremendously. It lets you have JUST a keytab file for the afs principal on your krb524 server machine. -- Nathan On Fri, 2002-10-11 at 04:08, Ryan Underwood wrote: > I know this question has been beaten to death before, but what are the current > alternatives for windows clients on a kaserver-less network? So far I see: > > 1) kdc slave running on the afs dbserver machine > 2) udp port-forwarder on the afs dbserver machine > > Has any work been done towards MIT-krb integration on the windows port? > > -- > Ryan Underwood, , icq=10317253 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From jlrobins@uncc.edu Fri Oct 11 14:47:38 2002 From: jlrobins@uncc.edu (James L Robinson) Date: Fri, 11 Oct 2002 09:47:38 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <20021011014601.3A90E9C4C@grand.central.org> References: <20021011014601.3A90E9C4C@grand.central.org> Message-ID: <200210110947.38569.jlrobins@uncc.edu> On Thursday 10 October 2002 09:46 pm, rlink+@pitt.edu wrote: > The problem with implementing getsecattr and setsecattr calls for AFS > is that the permission bits that those calls assume are different from > the rlidwka permission bits in AFS. You could try to map the rlidwka > bits into thet unix-style rwx bits, but what's the point? You wouldn't > be able to usefully map them back, when the user tries to change them > with setfacl. This is the general problem of different ACL implementations. Mapping from one ACL schema to another, also attmepting to take into account the UNIX mode bits is difficult / impossible to handle without some sort of information loss. For some real fun, check out the NFS4 working group mailing lists at http://www.nfs4.org/ for some 'lively' discussions on th= is subject. In a nutshell, NFSv4 will speak on-the-wire ACLs that very close= ly (or mabye nearly 100%) model NTFS ACLs. They've got the forward and reverse mapping between these and UNIX mode bits laid down, but the folks who want to 'do the right thing' for implementing a NFSv4 server on UNIXen which support POSIX filesystem ACLs may or may not be able to produce a functional mapping that will allow them to ultimately just defer to the fileserver's underlying filesystem's ACL model, which would be a real win for those fileservers that also happen to be NFSv3 servers. Add to that mix their other juicy issue of principal names being either X.500 names or K5 principal names and the desire to allow for a server to deal with both correctly, and you've got a complex system on your hands. That said, how many AFS sites out there are keeping an eye on NFSv4? K5 (er, well, GSS) support out of the box. ACLs. Heterogenous support. Multivendor support and opensource implementations. We love AFS, but have a love / hate relationship with the Win32 support, as I bet a lot of sites do. Somebody could make a good bit of cash selling support to universities by producing a commercial Win32 client. --=20 James Robinson Phone: (704) 687-4876 College of Information Technology FAX: (704) 687-3516 UNC Charlotte Email: jlrobins@uncc.edu Charlotte, NC 28223-0001 Director of Technology Services From shadow@dementia.org Fri Oct 11 15:16:47 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 10:16:47 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: <3DA6B2CA.4040504@it.su.se> Message-ID: On Fri, 11 Oct 2002, Leif Johansson wrote: > I thought about this and it was discussed at the LISA 2002 AFS workshop The one that's in 3 weeks? ;-) From shadow@dementia.org Fri Oct 11 15:18:25 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 10:18:25 -0400 (EDT) Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: Message-ID: On 11 Oct 2002, Ian Delahorne wrote: > Derrick J Brashear writes: > > > > I use openafs 1.2.7 at home and the university uses 1.2.5 > > > > If they use the grand.central.org CellServDB, perhaps you should just > > register your cell and they'll pick it up for you. > > They (nada.kth.se) have their own cellservdb that only has entries > relevant to education. Plus they block incoming AFS from !KTH-nets. Sure, one too many times they got hosed by clients which could source AFS udp traffic and not receive the replies bringing down their servers. I vaguely recall hearing about it when it happened. From shadow@dementia.org Fri Oct 11 15:22:22 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 10:22:22 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <200210110947.38569.jlrobins@uncc.edu> Message-ID: On Fri, 11 Oct 2002, James L Robinson wrote: > Add to that mix their other juicy issue of principal names being either > X.500 names or K5 principal names and the desire to allow for > a server to deal with both correctly, and you've got a complex > system on your hands. Realize that eventually we need to consider how to handle this problem for AFS, though in a slightly different scope due to PTS. > with the Win32 support, as I bet a lot of sites do. Somebody could > make a good bit of cash selling support to universities by producing > a commercial Win32 client. Someone did (well, for NT/2000/XP) and to be honest I still have no idea why they're quitting the business. From ian@assv.net Fri Oct 11 15:25:25 2002 From: ian@assv.net (Ian Delahorne) Date: 11 Oct 2002 16:25:25 +0200 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: References: Message-ID: Derrick J Brashear writes: > On 11 Oct 2002, Ian Delahorne wrote: > > > Derrick J Brashear writes: > > > > > > I use openafs 1.2.7 at home and the university uses 1.2.5 > > > > > > If they use the grand.central.org CellServDB, perhaps you should just > > > register your cell and they'll pick it up for you. > > > > They (nada.kth.se) have their own cellservdb that only has entries > > relevant to education. Plus they block incoming AFS from !KTH-nets. > > Sure, one too many times they got hosed by clients which could source AFS > udp traffic and not receive the replies bringing down their servers. I heard some rumor about this being fixed in OpenAFS, true? -- /Ian D ian@assv.net - www.assv.net From shadow@dementia.org Fri Oct 11 15:29:35 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 10:29:35 -0400 (EDT) Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: Message-ID: On 11 Oct 2002, Ian Delahorne wrote: > > > They (nada.kth.se) have their own cellservdb that only has entries > > > relevant to education. Plus they block incoming AFS from !KTH-nets. > > > > Sure, one too many times they got hosed by clients which could source AFS > > udp traffic and not receive the replies bringing down their servers. > > I heard some rumor about this being fixed in OpenAFS, true? 1.2.7 is the first release whose fileservers have the necessary changes, though the athena.mit.edu cell has been running with the patches for quite some time. My understanding is (quite some time ago) one problem was found and fixed, and other than that it's been stable and reliable. -D From ian@assv.net Fri Oct 11 15:54:39 2002 From: ian@assv.net (Ian Delahorne) Date: 11 Oct 2002 16:54:39 +0200 Subject: [OpenAFS] How to mount a cell that's not in CellServDB ? In-Reply-To: References: Message-ID: Derrick J Brashear writes: > > > > They (nada.kth.se) have their own cellservdb that only has entries > > > > relevant to education. Plus they block incoming AFS from !KTH-nets. > > > > > > Sure, one too many times they got hosed by clients which could source AFS > > > udp traffic and not receive the replies bringing down their servers. > > > > I heard some rumor about this being fixed in OpenAFS, true? > > 1.2.7 is the first release whose fileservers have the necessary changes, > though the athena.mit.edu cell has been running with the patches for quite > some time. My understanding is (quite some time ago) one problem was found > and fixed, and other than that it's been stable and reliable. Ok, good to know. -- /Ian D ian@assv.net - www.assv.net From leifj@it.su.se Fri Oct 11 16:24:28 2002 From: leifj@it.su.se (Leif Johansson) Date: Fri, 11 Oct 2002 17:24:28 +0200 Subject: [OpenAFS] Ldap & AFS References: Message-ID: <3DA6ED2C.8020906@it.su.se> Derrick J Brashear wrote: > On Fri, 11 Oct 2002, Leif Johansson wrote: > > >>I thought about this and it was discussed at the LISA 2002 AFS workshop oops.. that should hav been 2001 From craigev@us.ibm.com Thu Oct 10 18:44:07 2002 From: craigev@us.ibm.com (Craig Everhart) Date: Thu, 10 Oct 2002 13:44:07 -0400 Subject: [OpenAFS] ACLs and open-afs Message-ID: On Thursday, 10/10/2002 at 01:10 AST, "E.Spencer B." wrote: > On Thu, 10 Oct 2002, Ray Link wrote: > > > > No, Solaris ACLs are UFS-only. When attempting to use Solaris ACLs > > within AFS, the acl(2) syscall fails with ENOSYS. According to errno.h, > > that translates to "Unsupported file system operation". > > Sorry to hear this, has anyone tried to mod this behavior? (appropriate disclaimers inserted) Solaris ACLs are different from AFS ACLs. The permission bits are different, for one. The callers of setfacl() and getfacl() wouldn't know how to format the request to make it all into an AFS ACL (or to turn the AFS ACL into a Solaris ACL for display). You wouldn't want it to try, even, since it couldn't get it right, and you don't want to be making security decisions based on inaccurate information. > > Since AFS runs on multiple platforms, this wouldn't buy you much anyways > > if it worked. What would happen to someone with, say, a Linux client > > that has no notion of Solaris ACLs? > > > Well, with Solaris ACLs and non-Solaris ACL interpreters like Linux, the > Solaris ACLs are honored (permissions granted or not granted depending on > the Solaris ACL), but you cannot set them from non-Solaris ACL > interpreters like Linux from an NFS mounted Solaris exported filesystem. You're always working with the back-most file system's understanding of access control. So, yes, for a Solaris local filesystem, this is Solaris with its ACL interpretation, even if the access to that filesystem is being granted via NFS. For AFS, the AFS filesystem format (including ACL format) is inherently its own (and not the same of its host's native filesystem), including the understanding of the users and groups who may be named on an ACL, the permissions that may be granted or restricted on an ACL, the evaluation-order rules, interactions with umask(), and so forth. So you'd expect that the clients would assist in carrying out the AFS filesystem's security structure. This isn't the same as Solaris ACLs, so it seems a mis-match to expect that Solaris ACL-viewing and ACL-editing tools would be applicable to AFS ACLs, even though they both use the same spelling of the acronym ACL. Craig Craig Everhart From Brent.A.Johnson@jpl.nasa.gov Fri Oct 11 01:42:54 2002 From: Brent.A.Johnson@jpl.nasa.gov (Brent Johnson) Date: Thu, 10 Oct 2002 17:42:54 -0700 Subject: [OpenAFS] ACLs and open-afs References: <20021010164820.59EA1207CB@citi.umich.edu> Message-ID: <3DA61E8E.2040105@jpl.nasa.gov> Jim, Jim Rees wrote: > Actually it has turned out to be a blessing. There are very few situations > where in AFS you need to have an ACL on a file. > >Allow me to vehemently disagree. Lack of file acls is one of the greatest >misfeatures of afs. > >Take a look at your home directory for an example. Lots of little tiny >files and directories, some of which must be world readable, some of which >must not. My own home dir is a nightmare of symlinks. Same thing for >~/.ssh. And not having a separate "initial file acl" on directories means >if I want my home directory readable (so I can login without tokens) I run >the risk of having files like .Xauthority pop up, world readable, opening a >huge security hole. > Just for my info, why is this a huge security hole? -Brent > >DCE got a few things right, and this is one of them. >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > > -- Brent A. Johnson JPL File Services Engineer Jet Propulsion Laboratory Telephone: 4-2138 or 818-354-2138 Pager: 1-800-759-8888 PIN=1256866 From troy@scl.ameslab.gov Fri Oct 11 02:09:26 2002 From: troy@scl.ameslab.gov (Troy Benjegerdes) Date: Thu, 10 Oct 2002 20:09:26 -0500 Subject: [OpenAFS] IP acl problem?? Message-ID: <3DA624C6.40803@scl.ameslab.gov> Okay.. this is interesting.. I have a cell with a server running solaris with IBM afs 3.6, and one running debian with the debian openafs 1.2.3final2-6 version. I have a directory with the following acl: sh-2.05b$ fs la . Access list for . is Normal rights: web:host rlidwka web rlidwk system:administrators rlidwka system:anyuser rl backup rl Members of web:host (id: -212) are: 147.155.137.222 147.155.137.30 If the volume is hosted on the solaris IBM AFS server, the IP acls work correctly. If I 'vos move' the volume to the debian server, they no longer work. What's going on here? (please 'cc' me on replies) From shadow@dementia.org Fri Oct 11 18:08:54 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 13:08:54 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <3DA61E8E.2040105@jpl.nasa.gov> Message-ID: On Thu, 10 Oct 2002, Brent Johnson wrote: > >if I want my home directory readable (so I can login without tokens) I run > >the risk of having files like .Xauthority pop up, world readable, opening a > >huge security hole. > > > > Just for my info, why is this a huge security hole? Watch as I connect to your X display and grab all the kesytrokes. From 6delgado@informatik.uni-hamburg.de Fri Oct 11 18:11:00 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Fri, 11 Oct 2002 19:11:00 +0200 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <3DA61E8E.2040105@jpl.nasa.gov> References: <20021010164820.59EA1207CB@citi.umich.edu> <3DA61E8E.2040105@jpl.nasa.gov> Message-ID: <20021011171100.GA20115@taupan.ath.cx> --1yeeQ81UyVL57Vl7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hiho! Brent Johnson schrieb: >>I run the risk of having files like .Xauthority pop up, world >>readable, opening a huge security hole. > Just for my info, why is this a huge security hole? Everybody who can read your .Xauthority file can connect to your running X-Session (remote or local) which means that he can display your desktop contents and observe every keystroke you type (i.e. log your ssh/afs/Kerberos passwords) if the XFree Ports are open (TCP Port 6000 and above). Depending on how your X-Server and other involved Software is configured, this opens your account to the whole wide world (worst case) or at least (!) to anybody who can log on to your machine. Since xauth and some other software check if ~/.Xauthority is a symlink in some cases, it is not as easily possible to use a symlink pointing to e.g. ~/.restricted/.Xauthority or something. On the other hand, i don't see a problem with having "system:anyuser l" on $HOME and putting world readable files in $HOME/.readable ("system:anyuser" rl) and symlink them to the appropriate places. Your $HOME should definitely *not* be world-readable in afs. There's too much stuff in there that is intended to remain private. Regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --1yeeQ81UyVL57Vl7 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEUEARECAAYFAj2nBiQACgkQCTmCEtF2zEBKWgCWKqd/sgzgMu2F5dB5Rt+Vffj7 kwCgq/4HFvsmMMutDST12XjqCXKnA3E= =vgxp -----END PGP SIGNATURE----- --1yeeQ81UyVL57Vl7-- From shadow@dementia.org Fri Oct 11 18:16:44 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 13:16:44 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <20021011171100.GA20115@taupan.ath.cx> Message-ID: On Fri, 11 Oct 2002, Friedrich Delgado Friedrichs wrote: > Everybody who can read your .Xauthority file can connect to your > running X-Session (remote or local) which means that he can display > your desktop contents and observe every keystroke you type (i.e. log > your ssh/afs/Kerberos passwords) if the XFree Ports are open (TCP Port > 6000 and above). Depending on how your X-Server and other involved > Software is configured, this opens your account to the whole wide > world (worst case) or at least (!) to anybody who can log on to your > machine. > > Since xauth and some other software check if ~/.Xauthority is a > symlink in some cases, it is not as easily possible to use a symlink > pointing to e.g. ~/.restricted/.Xauthority or something. Of course the thing you're all neglecting is the bit where unless you have your AFS traffic encrypted, you already screwed yourself by having .Xauthority in AFS. OpenSSH used to get it right (put it in the local filesystem) but managing local files is hard, and OpenSSH went shopping. From 6delgado@informatik.uni-hamburg.de Fri Oct 11 18:34:06 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Fri, 11 Oct 2002 19:34:06 +0200 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: References: <20021011171100.GA20115@taupan.ath.cx> Message-ID: <20021011173406.GA21826@taupan.ath.cx> --FL5UXtIhxfXey3p5 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hiho! Derrick J Brashear schrieb: > Of course the thing you're all neglecting is the bit where unless you have > your AFS traffic encrypted, you already screwed yourself by having > .Xauthority in AFS. Hm. What is harder, breaking AFS traffic encryption or guessing xauth cookies? Might be worth a research... Regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --FL5UXtIhxfXey3p5 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEYEARECAAYFAj2nC44ACgkQCTmCEtF2zEA2qgCfdaXXePoWseXhB1ZjY65zVzrl LdIAoJJ9vD6kvxeFC7gpdV5ozsEBpPJ0 =KxHj -----END PGP SIGNATURE----- --FL5UXtIhxfXey3p5-- From shadow@dementia.org Fri Oct 11 18:36:33 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 13:36:33 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <20021011173406.GA21826@taupan.ath.cx> Message-ID: On Fri, 11 Oct 2002, Friedrich Delgado Friedrichs wrote: > Hiho! > > Derrick J Brashear schrieb: > > Of course the thing you're all neglecting is the bit where unless you have > > your AFS traffic encrypted, you already screwed yourself by having > > .Xauthority in AFS. > > Hm. What is harder, breaking AFS traffic encryption or guessing xauth > cookies? Might be worth a research... Not really. Both suck. If you're going to spend time you might as well not shoot fish in a barrel. -D From chas@cmf.nrl.navy.mil Fri Oct 11 18:40:40 2002 From: chas@cmf.nrl.navy.mil (chas williams) Date: Fri, 11 Oct 2002 13:40:40 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: Your message of "Fri, 11 Oct 2002 19:34:06 +0200." <20021011173406.GA21826@taupan.ath.cx> Message-ID: <200210111740.g9BHeegB023230@ginger.cmf.nrl.navy.mil> In message <20021011173406.GA21826@taupan.ath.cx>,Friedrich Delgado Friedrichs writes: >Hm. What is harder, breaking AFS traffic encryption or guessing xauth >cookies? Might be worth a research... it would be easier to just snoop the nfs traffic used on most networks. From ramus@es.net Fri Oct 11 19:02:27 2002 From: ramus@es.net (Joseph E Ramus) Date: Fri, 11 Oct 2002 11:02:27 -0700 Subject: [OpenAFS] AFS Training Needed Message-ID: <3DA71233.E9C8F4BE@es.net> We have 2 people in need of AFS Training. We have a conflict with the Dec 2002 dates so we can not go then. We have registered for classes twice and they were both cancelled. A class in early 2003 would work for us. We would send 2 people. Perhaps direct contact with the Teacher will help get a class with enough people. Please send contact information for the Teacher to me so we can contact him/her directly. ------------------------------------------------------------------------ | Joe Ramus ESnet, LBNL, Berkeley, CA (510) 486-8683 ramus@es.net | ------------------------------------------------------------------------ From barrows@email.arc.nasa.gov Fri Oct 11 19:29:35 2002 From: barrows@email.arc.nasa.gov (Lester Barrows) Date: Fri, 11 Oct 2002 11:29:35 -0700 Subject: [OpenAFS] AFS Training Needed In-Reply-To: <3DA71233.E9C8F4BE@es.net> References: <3DA71233.E9C8F4BE@es.net> Message-ID: <200210111129.35328.barrows@email.arc.nasa.gov> We actually have a similar issue, there are potentially two or three peop= le=20 who would like to attend the training. It would be strongly preferred by=20 management if it were somewhere closer to the SV area however. I'd seen o= n=20 this list that a course was cancelled in San Jose. Perhaps if we have eno= ugh=20 people in the area wanting the course, we could make it worth their while= to=20 hold it there again? Regards, Lester Barrows Asani Solutions, LLC Code IC Systems Group NASA Ames Research Center Voice: 650-604-2639 "Jura rapelcgvba vf bhgynjrq, bayl bhgynjf jvyy unir cevinpl." On Friday 11 October 2002 11:02 am, Joseph E Ramus wrote: > We have 2 people in need of AFS Training. > > We have a conflict with the Dec 2002 dates so we can not go then. > We have registered for classes twice and they were both cancelled. > > A class in early 2003 would work for us. > We would send 2 people. > > Perhaps direct contact with the Teacher will help get a class > with enough people. Please send contact information for the > Teacher to me so we can contact him/her directly. > > -----------------------------------------------------------------------= - > > | Joe Ramus ESnet, LBNL, Berkeley, CA (510) 486-8683 ramus@es.net = | > > -----------------------------------------------------------------------= - > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From kchamb@us.ibm.com Fri Oct 11 21:02:18 2002 From: kchamb@us.ibm.com (Kelly Chambers) Date: Fri, 11 Oct 2002 16:02:18 -0400 Subject: [OpenAFS] AFS Training Needed Message-ID: Lester and Joe - I forwarded your email to our IBM AFS course instructor, Jennifer Ricciuti. She has responded with the email below saying that she'd be happy to work with you and others to arrange for a course in 2003 that meets your scheduling needs. Feel free to contact Jennifer directly (jricciut@us.ibm.com) to discuss further. Thanks, Kelly Kelly Chambers Manager, AFS Product Support IBM Pittsburgh Lab kchamb@us.ibm.com 412-667-6930 - (T/L 989-6930) ----- Forwarded by Kelly Chambers/Pittsburgh/IBM on 10/11/02 03:58 PM ----- Jennifer Ricciuti To: Kelly Chambers/Pittsburgh/IBM 10/11/02 03:47 PM cc: From: Jennifer Ricciuti/Pittsburgh/IBM@IBMUS Subject: Re: [OpenAFS] AFS Training Needed(Document link: Kelly Chambers) Hi Kelly, I have yet to schedule any classes for 2003. Since there does seem to be a demand for the class perhaps I can schedule something in either January or February. I did notice that the enrollment picked up for the December course and then fell. You can give my name and email to those who may be interested. Perhaps I can work with all to schedule something in Pittsburgh. It seems that we lately have only been getting a few people enrolled and we must cancel due to low enrollment. If I can work with a number of people and sync up all our schedules we can have the class. Regards, Jennifer Jennifer Ricciuti Advisory I/T Specialist WebSphere Training and Technical Enablement Pittsburgh, PA 15222 Phone: (412) 667-6957 Tie Line: 989-6957 From nemesis-lists@icequake.net Fri Oct 11 23:05:22 2002 From: nemesis-lists@icequake.net (Ryan Underwood) Date: Fri, 11 Oct 2002 22:05:22 +0000 Subject: [OpenAFS] kernel 2.2.22? References: Message-ID: <20021011220525.E750F5DA3E@mail.icequake.net> > > Anyone using OpenAFS with the recently released 2.2.22 kernel? > > If you want to run a modern 2.2 kernel, consider a modern OpenAFS. It was > a 1.2.3 bug. Yep, that was it. Compiled the modules 1.2.6 from testing, and all seems to be well. -- Ryan Underwood, , icq=10317253 From tim@umbc.edu Sat Oct 12 02:16:24 2002 From: tim@umbc.edu (Tim C.) Date: Fri, 11 Oct 2002 21:16:24 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: <3DA6B2CA.4040504@it.su.se> Message-ID: > I thought about this and it was discussed at the LISA 2002 AFS workshop > but the consensus seems to be that although it would not be extremely > difficult to modify pts (I was looking at milko pts btw) most people > would be able to do what they need to do (usually some kind of account > synchronization) if pts allowed for storing some kind of extra metadata > along with the principal. For instance if you could stick the LDAP dn > in the pts record indicating both that the entry has been synchronized > with the directory and also indicating the equivalence. Maybe you need > some kind of timestamp-thingy aswell. > Unfortunately I was unable to attend the conference. However, I do have some opinions on this. :^} Having the pts information stored in an LDAP server would provide a signifigant benifit. One is the ability to integrate with a larger system. We have spent a significant amount of money building a replicated ldap server setup. It would be great to be able to use that to control the AFS pts information. Also it would be very helpful to have all the information in one place. You mentioned that it would suffice to store a dn in the pts entry, however that still requires that you have to create both entries. However, if it was in LDAP, then you would only have to create one entry. This would also make use of all of the interfaces out there already for Ldap. You've already stated that it shouldn't be too dificult to make ldap be used for the pt database, but the pt database couldn't be used for account management. So it might be a good option to look farther into. Maybe not nececarily as a default(cause some people don't want to have to have an ldap server ;), but it would be good as an option. Just my two cents. Any one else agree, disagree, have other ideas on this? Tim ----------------------------------------------------------------------- Tim Craig These are my opinions and not my employers. :) OIT-Systems & Imaging Research Center tim@umbc.edu It's hard to be serious when you're naked. - Garfield ----------------------------------------------------------------------- From kolya@MIT.EDU Sat Oct 12 02:38:14 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Fri, 11 Oct 2002 21:38:14 -0400 Subject: [OpenAFS] Ldap & AFS Message-ID: <200210120138.VAA21901@contents-vnder-pressvre.mit.edu> > Unfortunately I was unable to attend the conference. However, I do have some > opinions on this. :^} Having the pts information stored in an LDAP server > would provide a signifigant benifit. One is the ability to integrate with a > larger system. We have spent a significant amount of money building a > replicated ldap server setup. It would be great to be able to use that to > control the AFS pts information. Also it would be very helpful to have all > the information in one place. I'm not familiar with LDAP, but it seems like with the right schema, writing an LDAP-backed ptserver (translator, in effect) should be very simple. You just implement the dozen or so calls that ptserver provides as simple lookups in the LDAP database, and you should be done. If your LDAP back-end provides some way for users to create their own groups, you might even be able to not implement user groups in the ptserver, and have users use the LDAP interface instead. -- kolya From shadow@dementia.org Sat Oct 12 02:40:56 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 11 Oct 2002 21:40:56 -0400 (EDT) Subject: [OpenAFS] Ldap & AFS In-Reply-To: Message-ID: On Fri, 11 Oct 2002, Tim C. wrote: > Unfortunately I was unable to attend the conference. However, I do have some > opinions on this. :^} Having the pts information stored in an LDAP server > would provide a signifigant benifit. One is the ability to integrate with a > larger system. We have spent a significant amount of money building a > replicated ldap server setup. It would be great to be able to use that to > control the AFS pts information. Also it would be very helpful to have all the > information in one place. Yeah, whereas you can throw any tired old piece of crap into service as an AFS dbserver and let it replicate pts, and it's almost free ;-) > You've already stated that it shouldn't be too dificult to make ldap be used > for the pt database, but the pt database couldn't be used for account > management. i argued before and do still that it's not that simple, because the ptserver is optimized to be used by the fileserver, particularly the CPS operations, so unless you're very careful how you do this, you'll be sad. i will confess to not having looked terribly hard at the effort needed to do it, because i find ldap to be unnecessarily complex, and because i find that it's just not easier to take a system that isn't simple (afs) and involve in it a system which is more complicated and as it seems to me, less stable (openldap as deployed at carnegie mellon). i may be being unfair, or we may just have bad luck. my opinion is that something which uses pt_util, ptclient, or some combination of tools to manage the ptserver database based on operations to the ldap server would be less painful than a ptserver ldap backend, but again, my opinion. > Just my two cents. Any one else agree, disagree, have other ideas on this? how you run your systems is your business, so i'm not going to tell you "you're wrong". if someone writes the necessary support it will 99.9% likely be integrated, basically as long as it doesn't break non-ldap-pts people From shirsch@adelphia.net Sat Oct 12 14:59:48 2002 From: shirsch@adelphia.net (Steven N. Hirsch) Date: Sat, 12 Oct 2002 09:59:48 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs In-Reply-To: Message-ID: On Fri, 11 Oct 2002, Derrick J Brashear wrote: > > with the Win32 support, as I bet a lot of sites do. Somebody could > > make a good bit of cash selling support to universities by producing > > a commercial Win32 client. > > Someone did (well, for NT/2000/XP) and to be honest I still have no idea > why they're quitting the business. Are you speaking of IBM/Transarc? They are quitting because it's not an "ooh, wow" hype-filled endeavor that's guaranteed to produce earnings (either real or virtual) next quarter and every quarter thereafter. Cynical? Me? From leg+@andrew.cmu.edu Fri Oct 11 18:09:06 2002 From: leg+@andrew.cmu.edu (Lawrence Greenfield) Date: Fri, 11 Oct 2002 13:09:06 -0400 Subject: [OpenAFS] windows explorer not auto-refreshing Message-ID: <200210111709.g9BH96cX003809@smtp6.andrew.cmu.edu> I've been playing around with the OpenAFS client and redirecting "My Documents" to my AFS home directory. I've successfully done this by setting the redirect to the UNC name \\%machinename%-AFS\ALL\ANDREW.CMU.EDU\USR\%user%\MYDOCS I have the AFS network provider installed and it is successfully getting tokens for me when I log in. All seems good BUT if I do "Start... My Documents" and then open a subfolder, the subfolder is in a weird state. It only shows changes when I refresh the folder---if I create a new folder, it doesn't show up until I hit F5. My machine is a fully patched Windows XP. I'm running a very recent OpenAFS---later then the most recent installer available. My DC is a Windows .net server, but I doubt this is causing the problem. Larry From rhino_tom@hotmail.com Sat Oct 12 02:01:15 2002 From: rhino_tom@hotmail.com (Tom Reinhart) Date: Fri, 11 Oct 2002 18:01:15 -0700 Subject: [OpenAFS] Hidden directories in AFS? Message-ID: Hello, I have a question about the use of ACLs. In conventional Unix, I can set a directory to "drwx--x--x" permissions and then create subdirectories which users can access by name. This is useful because no one can access files they don't know the name of. However, I've just migrated to a new system that uses OpenAFS, and I can't figure out a way to accomplish this. I tried the obvious thing of setting the ACL to just "r", but apparently without the "l" permission, nothing else works. Is there any other way to do this? Thanks, Tom _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com From rra@stanford.edu Sat Oct 12 17:44:41 2002 From: rra@stanford.edu (Russ Allbery) Date: Sat, 12 Oct 2002 09:44:41 -0700 Subject: [OpenAFS] Hidden directories in AFS? In-Reply-To: ("Tom Reinhart"'s message of "Fri, 11 Oct 2002 18:01:15 -0700") References: Message-ID: Tom Reinhart writes: > In conventional Unix, I can set a directory to "drwx--x--x" permissions > and then create subdirectories which users can access by name. This is > useful because no one can access files they don't know the name of. > However, I've just migrated to a new system that uses OpenAFS, and I > can't figure out a way to accomplish this. I tried the obvious thing of > setting the ACL to just "r", but apparently without the "l" permission, > nothing else works. Is there any other way to do this? No. I'm afraid AFS doesn't support this. -- Russ Allbery (rra@stanford.edu) From hotz@jpl.nasa.gov Sun Oct 13 22:39:17 2002 From: hotz@jpl.nasa.gov (Henry B. Hotz) Date: Sun, 13 Oct 2002 14:39:17 -0700 Subject: [OpenAFS] pam_afs or KfM for auto-authentication on OSX Message-ID: Both of the subject methods *should* allow you to auto-authenticate on login on MacOS X. What's recommended? AFAICT the pam module isn't built on OSX. Anyone tried to make it work? I haven't got it working yet, but the native Kerberos implementation should get me a K4 tgt. Then I should be able to do the OpenAFS equivalent to afslog to convert that to a token (whatever the equivalent is). Anyone gotten this to work? While I'm at it, I'm curious: does everyone rely on the guru's who made the package or does anyone actually install OpenAFS on OSX from source? Make install doesn't put anything in /Library/StartupItems/ like it needs to. -- The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From akosut@stanford.edu Sun Oct 13 23:08:11 2002 From: akosut@stanford.edu (Alexei Kosut) Date: Sun, 13 Oct 2002 15:08:11 -0700 Subject: [OpenAFS] pam_afs or KfM for auto-authentication on OSX In-Reply-To: References: Message-ID: <20021013220811.GA3987@stanford.edu> On Sun, Oct 13, 2002 at 02:39:17PM -0700, Henry B. Hotz wrote: > Both of the subject methods *should* allow you to auto-authenticate > on login on MacOS X. What's recommended? Take a look at the openafs-devel and port-darwin list archives at . There's been a lot of discussion about this issue in the last month or two. The short answer is that Mac OS X 10.2 can't use PAM for loginwindow authentication, so you pretty much have to use the Apple-provided (KfM-based) Kerberos authentication mechanism. With Mac OS X 10.1 (and 10.0, I suppose), you can probably get the PAM loginwindow authenticator (from the Darwin sources) to work, but I'm not aware of anyone who's done this. I assume you were asking about 10.2, though. > AFAICT the pam module isn't built on OSX. Anyone tried to make it work? I think David Botsch was able to get the AFS PAM modules compiled and working for SSH authentication. > I haven't got it working yet, but the native Kerberos implementation > should get me a K4 tgt. Then I should be able to do the OpenAFS > equivalent to afslog to convert that to a token (whatever the > equivalent is). Anyone gotten this to work? Yes. You can use aklog () to get an AFS token from KfM credentials, whether the credentials were obtained at login time or afterwards. If you want AFS tokens avaiblale at login time (e.g., for home directories in AFS), that's a little more complex. Again, the port-darwin archives have some discussion and information on getting this to work. > While I'm at it, I'm curious: does everyone rely on the guru's who > made the package or does anyone actually install OpenAFS on OSX from > source? Make install doesn't put anything in /Library/StartupItems/ > like it needs to. I sometimes install OpenAFS from source, but I've never used make install. I usually start with what an installer (either the official OpenAFS package or a custom local installer) installs and then copy new files from "make dest" to the right place by hand. -- Alexei Kosut From hotz@jpl.nasa.gov Sun Oct 13 23:45:32 2002 From: hotz@jpl.nasa.gov (Henry B. Hotz) Date: Sun, 13 Oct 2002 15:45:32 -0700 Subject: [OpenAFS] pam_afs or KfM for auto-authentication on OSX In-Reply-To: <20021013220811.GA3987@stanford.edu> References: <20021013220811.GA3987@stanford.edu> Message-ID: At 3:08 PM -0700 10/13/02, Alexei Kosut wrote: >On Sun, Oct 13, 2002 at 02:39:17PM -0700, Henry B. Hotz wrote: >> Both of the subject methods *should* allow you to auto-authenticate >> on login on MacOS X. What's recommended? > >Take a look at the openafs-devel and port-darwin list archives at Thanks! -- The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From amar deep kumar" Hello, fs listquota command shows negative percentage used while the partition is housing AFS is Only 60 % full output shows -142% of the volume used. amardeep amardeep kumar barc,mumbai From amar deep kumar" This is a multipart mime message --Next_1034569979---0-202.54.124.179-6907 Content-type: text/plain; format=flowed Content-Disposition: inline Note: Forwarded message attached -- Orignal Message -- From: "amar deep kumar" To: OpenAFS-info@openafs.org Subject: [OpenAFS] (no subject) amardeep kumar barc,mumbai --Next_1034569979---0-202.54.124.179-6907 Content-type: message/rfc822 MIME-Version: 1.0 Message-ID: <20021014043314.12122.qmail@webmail2.rediffmail.com> From: "amar deep kumar" To: OpenAFS-info@openafs.org Content-type: text/plain; format=flowed Content-Disposition: inline Subject: [OpenAFS] (no subject) Hello, fs listquota command shows negative percentage used while the partition is housing AFS is Only 60 % full output shows -142% of the volume used. amardeep amardeep kumar barc,mumbai _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info --Next_1034569979---0-202.54.124.179-6907-- From leifj@it.su.se Mon Oct 14 10:34:09 2002 From: leifj@it.su.se (Leif Johansson) Date: Mon, 14 Oct 2002 11:34:09 +0200 Subject: [OpenAFS] Ldap & AFS References: Message-ID: <3DAA8F91.6020806@it.su.se> Derrick J Brashear wrote: > On Fri, 11 Oct 2002, Tim C. wrote: > > i argued before and do still that it's not that simple, because the > ptserver is optimized to be used by the fileserver, particularly the CPS > operations, so unless you're very careful how you do this, you'll be sad. > This is an important point. However having worked with ldap for some time my opinion is that most of the arguments below are the result of misinformation. LDAP is neither complex or unstable or slow. I have seen these claims often enough and they quite often stem from bad experiences with particular deployments. It may well be that pts is a special case when redirection to an external service is not a good idea. I confess that I don't know enough about pts to tell. I do know that based on the milko pts code it would be relatively easy to implement a generic backend-structure and an ldap backend. Whether the end-result would be good/better/good enough is another story. Personally I believe that pts together with nss_ldap are two of the applications which requires finished udp support in ldap to really make it work well. Unless you have this your biggest implementation issue will be connection management. > i will confess to not having looked terribly hard at the effort needed to > do it, because i find ldap to be unnecessarily complex, and because i find > that it's just not easier to take a system that isn't simple (afs) and > involve in it a system which is more complicated and as it seems to me, > less stable (openldap as deployed at carnegie mellon). i may be being > unfair, or we may just have bad luck. > my opinion is that something which uses pt_util, ptclient, or some > combination of tools to manage the ptserver database based on operations > to the ldap server would be less painful than a ptserver ldap backend, but > again, my opinion. > I disagree. Most organizations who deploy ldap these days do it because of the large-scale management benefits. Again, having said that I tend to prefer disconnected publishing of data from my ldap-server (i.e I prefer building /etc/passwd to using nss_ldap). The reason for that may on the other hand be just as much based on the genetic conservative outlook of a long-time sysadmin as Dereks distrust of ldap :-) Who can tell! > how you run your systems is your business, so i'm not going to tell you > "you're wrong". if someone writes the necessary support it will 99.9% > likely be integrated, basically as long as it doesn't break non-ldap-pts > people Whomever gets into this (imho) needs to build a backend-layer into pts which allows for multiple independent backends. You probably need name- spaces to separate foo-groups from pts groups (you don't need to worry about two system:administrators for instance). You probably need to assume that the backend services are under the same administrative control as the pts-server to make your security analysis easier. And you need to do very smart connection management to your backend services. Cheers leifj From rmdyer@uncc.edu Mon Oct 14 14:37:08 2002 From: rmdyer@uncc.edu (Rodney M Dyer) Date: Mon, 14 Oct 2002 09:37:08 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: References: Message-ID: <5.1.0.14.0.20021014092917.01325df8@coeimap2.uncc.edu> At 09:59 AM 10/12/2002 -0400, you wrote: >On Fri, 11 Oct 2002, Derrick J Brashear wrote: > > > > with the Win32 support, as I bet a lot of sites do. Somebody could > > > make a good bit of cash selling support to universities by producing > > > a commercial Win32 client. > > > > Someone did (well, for NT/2000/XP) and to be honest I still have no idea > > why they're quitting the business. > >Are you speaking of IBM/Transarc? They are quitting because it's not an >"ooh, wow" hype-filled endeavor that's guaranteed to produce earnings >(either real or virtual) next quarter and every quarter thereafter. > >Cynical? Me? I'm with you. My feeling is that they really didn't know what they had, or could not figure out how to make money at it. Poor IBM, they made the only filesystem that rolls right over any other filesystem created by Microsoft, Novell, or Sun's NFS, and what did they do? They just dropped it. I would hate to be the top level manager that made that decision! Rodney Rodney M. Dyer PC Systems Programmer College of Engineering Computing Services University of North Carolina at Charlotte Email rmdyer@uncc.edu Phone (704)687-3518 Help Desk Line (704)687-3150 FAX (704)687-2352 Office 267 Smith Building >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info From J Michael Mosley Mon Oct 14 15:04:11 2002 From: J Michael Mosley (J Michael Mosley) Date: Mon, 14 Oct 2002 10:04:11 -0400 (EDT) Subject: [OpenAFS] ACLs and open-afs Message-ID: <200210141404.g9EE4E408569@ms-sm2.uncc.edu> That's fine. Mike > Delivered-To: openafs-info@openafs.org > X-Sender: rmdyer@coeimap2.uncc.edu (Unverified) > To: openafs-info@openafs.org > From: Rodney M Dyer > Subject: Re: [OpenAFS] ACLs and open-afs > Mime-Version: 1.0 > X-BeenThere: openafs-info@openafs.org > X-Mailman-Version: 2.0.4 > List-Help: > List-Post: > List-Subscribe: , > List-Id: OpenAFS Info/Discussion > List-Unsubscribe: , > List-Archive: > Date: Mon, 14 Oct 2002 09:37:08 -0400 > > At 09:59 AM 10/12/2002 -0400, you wrote: > >On Fri, 11 Oct 2002, Derrick J Brashear wrote: > > > > > > with the Win32 support, as I bet a lot of sites do. Somebody could > > > > make a good bit of cash selling support to universities by producing > > > > a commercial Win32 client. > > > > > > Someone did (well, for NT/2000/XP) and to be honest I still have no idea > > > why they're quitting the business. > > > >Are you speaking of IBM/Transarc? They are quitting because it's not an > >"ooh, wow" hype-filled endeavor that's guaranteed to produce earnings > >(either real or virtual) next quarter and every quarter thereafter. > > > >Cynical? Me? > > I'm with you. My feeling is that they really didn't know what they had, or > could not figure out how to make money at it. Poor IBM, they made the only > filesystem that rolls right over any other filesystem created by Microsoft, > Novell, or Sun's NFS, and what did they do? They just dropped it. I would > hate to be the top level manager that made that decision! > > Rodney > > Rodney M. Dyer > PC Systems Programmer > College of Engineering Computing Services > University of North Carolina at Charlotte > Email rmdyer@uncc.edu > Phone (704)687-3518 > Help Desk Line (704)687-3150 > FAX (704)687-2352 > Office 267 Smith Building > > > > > >_______________________________________________ > >OpenAFS-info mailing list > >OpenAFS-info@openafs.org > >https://lists.openafs.org/mailman/listinfo/openafs-info > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info ------------------------------------- Mike Mosley Email: jmmosley@uncc.edu Systems Software Developer Phone: (704) 687-3522 College of Engineering, UNC-Charlotte Fax: (704) 687-2352 From mimiller@ncsa.uiuc.edu Mon Oct 14 15:42:05 2002 From: mimiller@ncsa.uiuc.edu (Michael Miller) Date: Mon, 14 Oct 2002 09:42:05 -0500 Subject: [OpenAFS] need help with an install Message-ID: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> I hope this is the right list to ask for help with installtion. If not, please point me in the right direction. I have installed openafs on a fresh install of Redhat 7.2. The command I issued was: apt-get install openafs-kernel openafs-krb5 openafs-client openafs-devel openafs-kpasswd openafs openafs-compat This appeared to run fine. I was also instructed to install these files in /usr/vice/etc/modload/ libafs-2.4.9-21-athlon.mp.o libafs-2.4.9-21-i386.o libafs-2.4.9-21-i686.ep.o libafs-2.4.9-31.mp.o libafs-2.4.9-21-athlon.o libafs-2.4.9-21-i586.mp.o libafs-2.4.9-21-i686.mp.o libafs-2.4.9-31.o libafs-2.4.9-21-i386.mp.o libafs-2.4.9-21-i586.o libafs-2.4.9-21-i686.o But when I try to start afs thus: /etc/init.d/afs start The following error occurs: AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not starting AFS. I find it odd that afs is looking for a file that appears to be an older version of what is there. I'm doing this from a set of instructions that are not step by step and being a newbie to this and various other linux related things I'm not sure what I need to do. Where do I go for help? Thanx, Michael Miller System Engineer Visualization Technology Support Computing and Data Management National Center for Supercomputing Applications University of Illinois - UC "If you're clear in your vision and trust the people in your team with clear objectives, they will invariably do their best to achieve everything desired, and usually deliver everything you could have hoped for and even more." -Paul Debevec From ian@assv.net Mon Oct 14 15:51:31 2002 From: ian@assv.net (Ian Delahorne) Date: 14 Oct 2002 16:51:31 +0200 Subject: [OpenAFS] need help with an install In-Reply-To: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> References: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> Message-ID: Michael Miller writes: > AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not > starting AFS. > > I find it odd that afs is looking for a file that appears to be an > older version of what is there. I'm doing this from a set of > instructions that are not step by step and being a newbie to this and > various other linux related things I'm not sure what I need to do. It's looking for the version that your kernel is (In effect, the output of uname -r) -- /Ian D ian@assv.net - www.assv.net From rees@umich.edu Mon Oct 14 16:38:05 2002 From: rees@umich.edu (Jim Rees) Date: Mon, 14 Oct 2002 11:38:05 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: Derrick J Brashear, Fri, 11 Oct 2002 13:16:44 EDT Message-ID: <20021014153806.E2156207CA@citi.umich.edu> By the way, the workaround for the .Xauthority problem is this: % cat ~/.ssh/environment XAUTHORITY=/tmp/Xauthority4905 The correct fix, of course, is acls on files. From Todd_Lewis@unc.edu Mon Oct 14 18:57:31 2002 From: Todd_Lewis@unc.edu (Todd M. Lewis) Date: Mon, 14 Oct 2002 13:57:31 -0400 Subject: [OpenAFS] Re: ACLs and open-afs References: <20021014153806.E2156207CA@citi.umich.edu> Message-ID: <3DAB058B.4080303@email.unc.edu> For that to work, doesn't your ~/.ssh directory have to be at least system:anyuser rl? Is that safe? (I'm assuming the "4905" on the end is your uid; others would have something appropriately different. Is that right?) -- Todd_Lewis@unc.edu Jim Rees wrote: > By the way, the workaround for the .Xauthority problem is this: > > % cat ~/.ssh/environment > XAUTHORITY=/tmp/Xauthority4905 > > The correct fix, of course, is acls on files. From warlord@MIT.EDU Mon Oct 14 21:04:34 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 14 Oct 2002 16:04:34 -0400 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: <20021011173406.GA21826@taupan.ath.cx> References: <20021011171100.GA20115@taupan.ath.cx> <20021011173406.GA21826@taupan.ath.cx> Message-ID: Friedrich Delgado Friedrichs <6delgado@informatik.uni-hamburg.de> writes: > Derrick J Brashear schrieb: > > Of course the thing you're all neglecting is the bit where unless you have > > your AFS traffic encrypted, you already screwed yourself by having > > .Xauthority in AFS. > > Hm. What is harder, breaking AFS traffic encryption or guessing xauth > cookies? Might be worth a research... Who has to break encryption? If your homedir is "system:anyyser rl" then I can just read the file. The real answer is that SSH should be modified (or configured) to create a random .Xauthority file in /tmp (or /tmp/$USER) > Regards > Friedel -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Mon Oct 14 21:07:39 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 14 Oct 2002 16:07:39 -0400 Subject: [OpenAFS] need help with an install In-Reply-To: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> References: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> Message-ID: Are you sure you installed the RH7.2 versions of the RPMS? -derek Michael Miller writes: > I was also instructed to install these files in /usr/vice/etc/modload/ > > libafs-2.4.9-21-athlon.mp.o libafs-2.4.9-21-i386.o > libafs-2.4.9-21-i686.ep.o libafs-2.4.9-31.mp.o > libafs-2.4.9-21-athlon.o libafs-2.4.9-21-i586.mp.o > libafs-2.4.9-21-i686.mp.o libafs-2.4.9-31.o > libafs-2.4.9-21-i386.mp.o libafs-2.4.9-21-i586.o libafs-2.4.9-21-i686.o > > But when I try to start afs thus: > > /etc/init.d/afs start > > The following error occurs: > > AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not > starting AFS. > > I find it odd that afs is looking for a file that appears to be an > older version of what is there. I'm doing this from a set of > instructions that are not step by step and being a newbie to this and > various other linux related things I'm not sure what I need to do. > > Where do I go for help? > > Thanx, > > Michael Miller > System Engineer > Visualization Technology Support > Computing and Data Management > National Center for Supercomputing Applications > University of Illinois - UC > > "If you're clear in your vision and trust the people in your team with > clear objectives, they will invariably do their best to achieve > everything desired, and usually deliver everything you could have > hoped for and even more." -Paul Debevec > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From ian@assv.net Mon Oct 14 21:27:58 2002 From: ian@assv.net (Ian Delahorne) Date: 14 Oct 2002 22:27:58 +0200 Subject: [OpenAFS] need help with an install In-Reply-To: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> References: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> Message-ID: Michael Miller writes: > I hope this is the right list to ask for help with installtion. If > not, please point me in the right direction. > > I have installed openafs on a fresh install of Redhat 7.2. The > command I issued was: > > apt-get install openafs-kernel openafs-krb5 openafs-client > openafs-devel openafs-kpasswd openafs openafs-compat apt-get on an RH system? Is this possible? (no, I haven't used RH since 7.0) -- /Ian D ian@assv.net - www.assv.net From 6delgado@informatik.uni-hamburg.de Mon Oct 14 21:47:06 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Mon, 14 Oct 2002 22:47:06 +0200 Subject: [OpenAFS] ACLs and open-afs In-Reply-To: References: <20021011171100.GA20115@taupan.ath.cx> <20021011173406.GA21826@taupan.ath.cx> Message-ID: <20021014204706.GC5444@taupan.ath.cx> --bKyqfOwhbdpXa4YI Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! Derek Atkins schrieb: > Friedrich Delgado Friedrichs <6delgado@informatik.uni-hamburg.de> writes: > > Derrick J Brashear schrieb: > > > Of course the thing you're all neglecting is the bit where unless you= have > > > your AFS traffic encrypted, you already screwed yourself by having > > > .Xauthority in AFS. > > Hm. What is harder, breaking AFS traffic encryption or guessing xauth > > cookies? Might be worth a research... > Who has to break encryption? If your homedir is "system:anyyser rl" > then I can just read the file. I think the point here was, that even *if* the homedir is "system:anyuser l" or less, *and* afs Traffic is transmitted via an untrusted network, somebody could snoop the afs traffic and get the file contents. This is where encryption starts to be of any concern at all. If the directory is "system:anyuser rl", encryption is of course pointless. > The real answer is that SSH should be modified (or configured) to > create a random .Xauthority file in /tmp (or /tmp/$USER) Which is of course possible. Ceterum censeo, there are too many client programs that store sensible data in $HOME, that rely on unix file protection. Therefore, $HOME should never be "rl" for anybody other than the user and "system:administrators". This cannot be solved by *one* program doing the right thing with respect to afs acls. The alternative would be to patch or reconfigure every client program that stores sensible data in $HOME. gpg, pgp, ssh, bash and possibly some others come to mind here. Just my 2=A2 Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --bKyqfOwhbdpXa4YI Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEYEARECAAYFAj2rLUoACgkQCTmCEtF2zEAKygCdGIQZQvEGyciYgdXCSgGaqV9f xokAoLSsJshuU21wzxeISp5BNLy9R4J2 =OJjO -----END PGP SIGNATURE----- --bKyqfOwhbdpXa4YI-- From reuter@rzg.mpg.de Tue Oct 15 09:13:17 2002 From: reuter@rzg.mpg.de (Hartmut Reuter) Date: Tue, 15 Oct 2002 10:13:17 +0200 Subject: [OpenAFS] ACLs and open-afs References: <20021011171100.GA20115@taupan.ath.cx> <20021011173406.GA21826@taupan.ath.cx> <20021014204706.GC5444@taupan.ath.cx> Message-ID: <3DABCE1D.2000000@rzg.mpg.de> The problem of restricting access to files in directories with rl-rights = for system:anyuser could be solved by a different implementation in the=20 fileserver: We did this for MR-AFS in the way that the mode-bits for=20 "other" restrict the access for system:anyuser. The problem here is that = users have been told too long that the mode-bits for "group" and "other" = are worthless in AFS and they mostly ares set randomly. Therefore we=20 require the fileserver to be started with an option "-modebits" in order = to enable this feature. This could easily be implemented in OpenAFS as well. Hartmut Friedrich Delgado Friedrichs wrote: > Hi! >=20 > Derek Atkins schrieb: >=20 >>Friedrich Delgado Friedrichs <6delgado@informatik.uni-hamburg.de> write= s: >> >>>Derrick J Brashear schrieb: >>> >>>>Of course the thing you're all neglecting is the bit where unless you= have >>>>your AFS traffic encrypted, you already screwed yourself by having >>>>.Xauthority in AFS. >>> >>>Hm. What is harder, breaking AFS traffic encryption or guessing xauth >>>cookies? Might be worth a research... >> >>Who has to break encryption? If your homedir is "system:anyyser rl" >>then I can just read the file. >=20 > I think the point here was, that even *if* the homedir is > "system:anyuser l" or less, *and* afs Traffic is transmitted via an > untrusted network, somebody could snoop the afs traffic and get the > file contents. This is where encryption starts to be of any concern at > all. >=20 > If the directory is "system:anyuser rl", encryption is of course > pointless. >=20 >=20 >>The real answer is that SSH should be modified (or configured) to >>create a random .Xauthority file in /tmp (or /tmp/$USER) >=20 > Which is of course possible. >=20 > Ceterum censeo, there are too many client programs that store sensible > data in $HOME, that rely on unix file protection. Therefore, $HOME > should never be "rl" for anybody other than the user and > "system:administrators". >=20 > This cannot be solved by *one* program doing the right thing with > respect to afs acls. >=20 > The alternative would be to patch or reconfigure every client program > that stores sensible data in $HOME. gpg, pgp, ssh, bash and possibly > some others come to mind here. >=20 > Just my 2=A2 > Friedel --=20 ----------------------------------------------------------------- Hartmut Reuter e-mail reuter@rzg.mpg.de phone +49-89-3299-1328 RZG (Rechenzentrum Garching) fax +49-89-3299-1301 Computing Center of the Max-Planck-Gesellschaft (MPG) and the Institut fuer Plasmaphysik (IPP) ----------------------------------------------------------------- From mike@bizittech.com Tue Oct 15 12:55:23 2002 From: mike@bizittech.com (mike@bizittech.com) Date: Tue, 15 Oct 2002 07:55:23 -0400 Subject: [OpenAFS] need help with an install References: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> Message-ID: <003d01c27441$c1dc9430$0f37a8c0@micron> hi I faced the same problem with the rpms . I found that just compiling the source code and installing would get better results . Thanks ----- Original Message ----- From: "Derek Atkins" To: "Michael Miller" Cc: Sent: Monday, October 14, 2002 4:07 PM Subject: Re: [OpenAFS] need help with an install > Are you sure you installed the RH7.2 versions of the RPMS? > > -derek > > Michael Miller writes: > > > I was also instructed to install these files in /usr/vice/etc/modload/ > > > > libafs-2.4.9-21-athlon.mp.o libafs-2.4.9-21-i386.o > > libafs-2.4.9-21-i686.ep.o libafs-2.4.9-31.mp.o > > libafs-2.4.9-21-athlon.o libafs-2.4.9-21-i586.mp.o > > libafs-2.4.9-21-i686.mp.o libafs-2.4.9-31.o > > libafs-2.4.9-21-i386.mp.o libafs-2.4.9-21-i586.o libafs-2.4.9-21-i686.o > > > > But when I try to start afs thus: > > > > /etc/init.d/afs start > > > > The following error occurs: > > > > AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not > > starting AFS. > > > > I find it odd that afs is looking for a file that appears to be an > > older version of what is there. I'm doing this from a set of > > instructions that are not step by step and being a newbie to this and > > various other linux related things I'm not sure what I need to do. > > > > Where do I go for help? > > > > Thanx, > > > > Michael Miller > > System Engineer > > Visualization Technology Support > > Computing and Data Management > > National Center for Supercomputing Applications > > University of Illinois - UC > > > > "If you're clear in your vision and trust the people in your team with > > clear objectives, they will invariably do their best to achieve > > everything desired, and usually deliver everything you could have > > hoped for and even more." -Paul Debevec > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From broschi@id.ethz.ch Tue Oct 15 14:09:02 2002 From: broschi@id.ethz.ch (Erwin Broschinski) Date: Tue, 15 Oct 2002 15:09:02 +0200 (MEST) Subject: [OpenAFS] vos listaddrs In-Reply-To: <3DA58AC5.8020101@ahpcrc.org> Message-ID: Found the same thing in 1.2.6 for sun4x_58. Its fixed in 1.2.7 ;^)) Erwin On 10-Oct-2002 Michael Robokoff wrote: | Hello all! I just ran the "vos listaddrs" command on some of my servers | and the only server listed is a new server I just brought up. I was | wondering why all the servers are not listed? Do they need to be? | | --Mike | | | _______________________________________________ | OpenAFS-info mailing list | OpenAFS-info@openafs.org | https://lists.openafs.org/mailman/listinfo/openafs-info From warlord@MIT.EDU Tue Oct 15 14:25:34 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 09:25:34 -0400 Subject: [OpenAFS] need help with an install In-Reply-To: <003d01c27441$c1dc9430$0f37a8c0@micron> References: <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> <003d01c27441$c1dc9430$0f37a8c0@micron> Message-ID: I'll ask you the same question: are you sure you used the right RPM for your version of Red Hat? I only ask because I _DO_ compile the RPMs for each version, and I _DO_ compile for each released kernel. I'm looking at openafs-kernel-1.2.7-rh7.2.1.i386.rpm right now and it most certainly DOES have libafs-2.4.7-10-i386.o -derek writes: > hi > I faced the same problem with the rpms . I found that just compiling the > source code and > installing would get better results . > Thanks > ----- Original Message ----- > From: "Derek Atkins" > To: "Michael Miller" > Cc: > Sent: Monday, October 14, 2002 4:07 PM > Subject: Re: [OpenAFS] need help with an install > > > > Are you sure you installed the RH7.2 versions of the RPMS? > > > > -derek > > > > Michael Miller writes: > > > > > I was also instructed to install these files in /usr/vice/etc/modload/ > > > > > > libafs-2.4.9-21-athlon.mp.o libafs-2.4.9-21-i386.o > > > libafs-2.4.9-21-i686.ep.o libafs-2.4.9-31.mp.o > > > libafs-2.4.9-21-athlon.o libafs-2.4.9-21-i586.mp.o > > > libafs-2.4.9-21-i686.mp.o libafs-2.4.9-31.o > > > libafs-2.4.9-21-i386.mp.o libafs-2.4.9-21-i586.o > libafs-2.4.9-21-i686.o > > > > > > But when I try to start afs thus: > > > > > > /etc/init.d/afs start > > > > > > The following error occurs: > > > > > > AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not > > > starting AFS. > > > > > > I find it odd that afs is looking for a file that appears to be an > > > older version of what is there. I'm doing this from a set of > > > instructions that are not step by step and being a newbie to this and > > > various other linux related things I'm not sure what I need to do. > > > > > > Where do I go for help? > > > > > > Thanx, > > > > > > Michael Miller > > > System Engineer > > > Visualization Technology Support > > > Computing and Data Management > > > National Center for Supercomputing Applications > > > University of Illinois - UC > > > > > > "If you're clear in your vision and trust the people in your team with > > > clear objectives, they will invariably do their best to achieve > > > everything desired, and usually deliver everything you could have > > > hoped for and even more." -Paul Debevec > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Tue Oct 15 15:01:24 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 10:01:24 -0400 Subject: [OpenAFS] need help with an install In-Reply-To: <5.1.0.14.2.20021015084158.00bdf958@pop.ncsa.uiuc.edu> References: <003d01c27441$c1dc9430$0f37a8c0@micron> <5.1.0.14.2.20021014093153.0207d4d0@pop.ncsa.uiuc.edu> <003d01c27441$c1dc9430$0f37a8c0@micron> <5.1.0.14.2.20021015084158.00bdf958@pop.ncsa.uiuc.edu> Message-ID: Please CC all your responses to openafs-info.... Michael Miller writes: > Derek, > > Thanks, I got the module files from a separate download according to > the directions I was given. Is there some reason the apt-get command > I issued would not get me libafs-2.4.7-10-i386.o? Here's the command > again: > > apt-get install openafs-kernel openafs-krb5 openafs-client > openafs-devel openafs-kpasswd openafs openafs-compat As I asked before (and you STILL have not answered), are you SURE you installed the correct VERSION of OpenAFS? What does this give you: rpm -q openafs-kernel I've never used apt-get for Red Hat, so I have absolutely no idea what it's going to do. > Shouldn't this install the libafs-2.4.7-10-i386.o file properly? If > not, is there a way to extract a single file from the rpm? It would -- ONLY IF IT PULLED IN THE RH7.2 VERSION. If it pulled in the RH7.3 RPMs, then no, it wouldn't install that file. And no, you should not try to extract a single file from the RPM -- in fact, you should install the openafs-kernel RPMs wholesale because you need the proper configuration files in place. > Sorry for the newbie questions, but I'm still pretty green here... It would help if you actually answered the questions I was asking rather than continuing to explain your problem. I know what your problem is -- I'm trying to verify my belief. > thanx -derek > MYK > At 09:25 AM 10/15/2002 -0400, you wrote: > >I'll ask you the same question: are you sure you used the right RPM > >for your version of Red Hat? I only ask because I _DO_ compile the > >RPMs for each version, and I _DO_ compile for each released kernel. > >I'm looking at openafs-kernel-1.2.7-rh7.2.1.i386.rpm right now and it > >most certainly DOES have libafs-2.4.7-10-i386.o > > > >-derek > > > > writes: > > > > > hi > > > I faced the same problem with the rpms . I found that just compiling the > > > source code and > > > installing would get better results . > > > Thanks > > > ----- Original Message ----- > > > From: "Derek Atkins" > > > To: "Michael Miller" > > > Cc: > > > Sent: Monday, October 14, 2002 4:07 PM > > > Subject: Re: [OpenAFS] need help with an install > > > > > > > > > > Are you sure you installed the RH7.2 versions of the RPMS? > > > > > > > > -derek > > > > > > > > Michael Miller writes: > > > > > > > > > I was also instructed to install these files in /usr/vice/etc/modload/ > > > > > > > > > > libafs-2.4.9-21-athlon.mp.o libafs-2.4.9-21-i386.o > > > > > libafs-2.4.9-21-i686.ep.o libafs-2.4.9-31.mp.o > > > > > libafs-2.4.9-21-athlon.o libafs-2.4.9-21-i586.mp.o > > > > > libafs-2.4.9-21-i686.mp.o libafs-2.4.9-31.o > > > > > libafs-2.4.9-21-i386.mp.o libafs-2.4.9-21-i586.o > > > libafs-2.4.9-21-i686.o > > > > > > > > > > But when I try to start afs thus: > > > > > > > > > > /etc/init.d/afs start > > > > > > > > > > The following error occurs: > > > > > > > > > > AFS module /usr/vice/etc/modload/libafs-2.4.7-10.o does not exist. Not > > > > > starting AFS. > > > > > > > > > > I find it odd that afs is looking for a file that appears to be an > > > > > older version of what is there. I'm doing this from a set of > > > > > instructions that are not step by step and being a newbie to this and > > > > > various other linux related things I'm not sure what I need to do. > > > > > > > > > > Where do I go for help? > > > > > > > > > > Thanx, > > > > > > > > > > Michael Miller > > > > > System Engineer > > > > > Visualization Technology Support > > > > > Computing and Data Management > > > > > National Center for Supercomputing Applications > > > > > University of Illinois - UC > > > > > > > > > > "If you're clear in your vision and trust the people in your team with > > > > > clear objectives, they will invariably do their best to achieve > > > > > everything desired, and usually deliver everything you could have > > > > > hoped for and even more." -Paul Debevec > > > > > > > > > > _______________________________________________ > > > > > OpenAFS-info mailing list > > > > > OpenAFS-info@openafs.org > > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > > -- > > > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > > > Member, MIT Student Information Processing Board (SIPB) > > > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > > > warlord@MIT.EDU PGP key available > > > > _______________________________________________ > > > > OpenAFS-info mailing list > > > > OpenAFS-info@openafs.org > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > >-- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > Thanx, > > Michael Miller > System Engineer > Visualization Technology Support > Computing and Data Management > National Center for Supercomputing Applications > University of Illinois - UC > > "If you're clear in your vision and trust the people in your team with > clear objectives, they will invariably do their best to achieve > everything desired, and usually deliver everything you could have > hoped for and even more." -Paul Debevec > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From Benjamin.Chardi.Marco@cern.ch Tue Oct 15 15:04:32 2002 From: Benjamin.Chardi.Marco@cern.ch (Benjamin Chardi Marco) Date: Tue, 15 Oct 2002 16:04:32 +0200 (CEST) Subject: [OpenAFS] AFS client cache investigation Message-ID: Dear friends, I am making an investigation about fine-tuning afs client cache manager and I need your help. The afs configuration parameters that I use are cache size, chunk size and stat . I control them from afsd program and I follow these steps to change the afs configuration; 1-Stop afs /etc/rc.d/init.d/afs stop 2-Change afsd parameters in initiation script /etc/sysconfig/afs 3-Clean the cache, delete all the files in /usr/vice/cache/ 4-Star afs /etc/rc.d/init.d/afs start For each afs configuration I run a test script. It selects randomly one of 80000 files that are in different servers and copy it. This random selection is repeated 200000 times to be sure that the local cache is full. When the script ends from afsmonitor program I get the number of files found in local cache and number of files not found during the script work. I use the ratio between this parameters (number of files found in local cache divided by number of files not found in local cache = dcacheHits/dcacheMisses) like a test parameter: I follow the evolution of this ratio when I change the afs configuration parameters like cache size, chunck size and stat. For variations of cache size (256MB ? 1GB) and chunk size (2^12 - 2^28), the evolution of this ratio was logical. If I increase this configuration parameters the ratio is going up (it means that I found more files in local cache and I make less calls to the servers). It is logical because if I have bigger cache size I can store locally more files and I find more files locally->the ratio grows. The problem comes when we study the stat parameter (with cache size = 1GB and chunk size = 2^18 fixed). If I increase the stat parameter this ratio is going down!!! I do not understand why the ratio is going down???. If I have more stat entries to allocate in memory machine's the status of the files in cache directory, this ratio must go up!! Is this a logical result?. Is my test script not good to study the start parameter? . Waiting for an answer. B Chardi. From aleahy@knox.edu Tue Oct 15 15:45:29 2002 From: aleahy@knox.edu (Andrew Leahy) Date: Tue, 15 Oct 2002 10:45:29 -0400 Subject: [OpenAFS] Some beginner questions Message-ID: <3DAC2A09.95FFFCDA@knox.edu> Hello, I've been reading through the "Quick Beginnings" documentation and have a couple of questions about how AFS operates: 2. Can non-interactive scripts access AFS space? For instance, is it possible for root or a generic user to run commands from cron which access AFS space? I don't see how these scripts would obtain tokens without someone manually entering in a password at some point. 1. Can a volume mount point be contained within a subdirectory of another volume? In all of the examples covered in the "Quick Beginnings" documentation, great care is taken to place a mounted volume immediately below the root level of another volume--e.g., in "Storing AFS Binaries in AFS", the sequence of commands is: vos create machine partition systemname vos create machine partition systemname.usr vos create machine partition systemname.usr.afsws fs mkmount -dir /afs/.cell/systemname -vol sysname fs mkmount -dir /afs/.cell/systemname/usr -vol sysname.usr fs mkmount -dir /afs/.cell/systemname/usr/afsws -vol sysname.usr.afsws As far as I can tell, the systemname and systemname.usr volumes don't contain anything except other volumes. Why not just mkdir /afs/.cell/systemname mkdir /afs/.cell/systemname/usr vos create machine partition systemname.usr.afsws fs mkmount -dir /afs/.cell/systemname/usr/afsws -vol sysname.usr.afsws Are there good reasons for creating such a hierarchy of empty volumes? I'd like to create a set of user volumes which reside in /afs/cell/home/employee or /afs/cell/home/student and I'm curious if I should create home, home.employee, and home.student volumes as well. Thanks for your help. Andrew Leahy From J Michael Mosley Tue Oct 15 15:56:27 2002 From: J Michael Mosley (J Michael Mosley) Date: Tue, 15 Oct 2002 10:56:27 -0400 (EDT) Subject: [OpenAFS] ka-forwarder Message-ID: <200210151456.g9FEuU428592@ms-sm2.uncc.edu> Our site is attempting to get ka-forwarder up and running to replace kaserver on our AFS db servers. This is one of our last tasks in migrating our site to K5. We initially ran it as follows: ./ka-forwarder kdc1 kdc2 We were then able to sucessfully klog from our Solaris and Linux clients. Our Windows XP clients failed however. We discovered that the XP clients were trying to talk to ka-forwarder on port 750 rather than 7004. We determined from the source that it is possible to run mutiple ka-forwarders on different ports so we cranked up a second instance as follows: ./ka-forwarder -p 750 kdc1/7004 kdc2/7004 Unfortunately, the XP klog still fails. Doing a rough network snoop of the session, it appears that ka-forwarder receives the request from the XP client but never responds. Does anybody have an idea as to what we are doing wrong here? Thanks, Mike ------------------------------------- Mike Mosley Email: jmmosley@uncc.edu Systems Software Developer Phone: (704) 687-3522 College of Engineering, UNC-Charlotte Fax: (704) 687-2352 From warlord@MIT.EDU Tue Oct 15 15:55:36 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 10:55:36 -0400 Subject: [OpenAFS] Some beginner questions In-Reply-To: <3DAC2A09.95FFFCDA@knox.edu> References: <3DAC2A09.95FFFCDA@knox.edu> Message-ID: Andrew Leahy writes: > Hello, > > I've been reading through the "Quick Beginnings" documentation and have > a couple of questions about how AFS operates: > > 2. Can non-interactive scripts access AFS space? For instance, is it > possible for root or a generic user to run commands from cron which > access AFS space? I don't see how these scripts would obtain tokens > without someone manually entering in a password at some point. Sort of. You can use (relatively insecure) IP ACLs.. Or you can use a "keytab" based system (where the server running the long-job stores a password in a file readable only by root and obtains a token for AFS using that keytab). > 1. Can a volume mount point be contained within a subdirectory of > another volume? In all of the examples covered in the "Quick Beginnings" > documentation, great care is taken to place a mounted volume immediately > below the root level of another volume--e.g., in "Storing AFS Binaries > in AFS", the sequence of commands is: Yes, a volume mount point can be contained within a subdirectory. > As far as I can tell, the systemname and systemname.usr volumes don't > contain anything except other volumes. Why not just > > mkdir /afs/.cell/systemname > mkdir /afs/.cell/systemname/usr > vos create machine partition systemname.usr.afsws > fs mkmount -dir /afs/.cell/systemname/usr/afsws -vol sysname.usr.afsws The reason for this is that you have to clone "volumes", not "directories". The deeper your directories, the more of the hierarchy will be affected every time you release the volume, and the more often you need to release it because there are more places you can add a volume. > Are there good reasons for creating such a hierarchy of empty volumes? > I'd like to create a set of user volumes which reside in > /afs/cell/home/employee or /afs/cell/home/student and I'm curious if I > should create home, home.employee, and home.student volumes as well. If you just create a 'home' volume with subdirectories of employee and student, then anytime you add ANY homedir you will have to re-release the "home volume. On the other hand, if you have separate volumes for home.employee and home.student, then you only need to release the apropriate sub-volume when you add a new homedir. Granted, this all assumes you use multiple servers and replication, but there is little reason NOT to do so ;) > Thanks for your help. > > Andrew Leahy -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Tue Oct 15 15:58:50 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 10:58:50 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: <200210151456.g9FEuU428592@ms-sm2.uncc.edu> Message-ID: On Tue, 15 Oct 2002, J Michael Mosley wrote: > > Our site is attempting to get ka-forwarder up and running to replace kaserver on > our AFS db servers. This is one of our last tasks in migrating our site to K5. > > We initially ran it as follows: > > ./ka-forwarder kdc1 kdc2 > > We were then able to sucessfully klog from our Solaris and Linux clients. Our > Windows XP clients failed however. We discovered that the XP clients were > trying to talk to ka-forwarder on port 750 rather than 7004. We determined > from the source that it is possible to run mutiple ka-forwarders on different > ports so we cranked up a second instance as follows: > > ./ka-forwarder -p 750 kdc1/7004 kdc2/7004 well, ka-forwarder forward kaserver traffic, and port 750 is krb4 kdc traffic, so this isn't what you want. i'm not sure that you can do what you want. From shadow@dementia.org Tue Oct 15 16:14:36 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 11:14:36 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: <200210151512.g9FFCo400097@ms-sm2.uncc.edu> Message-ID: You need to reply to the list, and not me. On Tue, 15 Oct 2002, J Michael Mosley wrote: > Derrick, > > kaserver normally listens on 750 and 88 in addtion to 7004. Why would > ka-forwarder care? ports don't matter. protocols do. ka-forwarder doesn't parse or speak the krb4 udp protocol. From warlord@MIT.EDU Tue Oct 15 16:26:56 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 11:26:56 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: References: Message-ID: The KAServer runs TWO protocols, the RX-KAS protocol and the KRB4 protocol. It listens on port 7004 for the RX-KAS protocol, and it listens on ports 750 and 88 for the KRB4 protocol (NOTE: I have no idea why it listens on port 88 -- that's specifically the krb5 port). The ka-forwarder ONLY FORWARDS the RX-KAS protocol. It does not understand the krb4 protocol. If the win clients are using the krb4 protocol, then perhaps you should point them directly to your KDC. -derek Derrick J Brashear writes: > You need to reply to the list, and not me. > > On Tue, 15 Oct 2002, J Michael Mosley wrote: > > > Derrick, > > > > kaserver normally listens on 750 and 88 in addtion to 7004. Why would > > ka-forwarder care? > > ports don't matter. protocols do. ka-forwarder doesn't parse or speak the > krb4 udp protocol. > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kenh@cmf.nrl.navy.mil Tue Oct 15 16:31:52 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Tue, 15 Oct 2002 11:31:52 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: Your message of "15 Oct 2002 11:26:56 EDT." Message-ID: <200210151531.g9FFVqgB028670@ginger.cmf.nrl.navy.mil> >The KAServer runs TWO protocols, the RX-KAS protocol and the KRB4 >protocol. It listens on port 7004 for the RX-KAS protocol, and it >listens on ports 750 and 88 for the KRB4 protocol (NOTE: I have no >idea why it listens on port 88 -- that's specifically the krb5 port). As an aside, I was always under the impression that ports 88 and 750 were _both_ the "Kerberos_ port, and there was never a specific Kerberos protocol assigned to each one. I still have V5 clients that contact my KDC on port 750 for some weird reason >If the win clients are using the krb4 protocol, then perhaps you >should point them directly to your KDC. Sadly, that's not possible (at least, I never figured out how). Yes, you can add your KDCs to your CellServDB for that cell, but that has it's own problems. --Ken From warlord@MIT.EDU Tue Oct 15 16:42:00 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 11:42:00 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: <200210151531.g9FFVqgB028670@ginger.cmf.nrl.navy.mil> References: <200210151531.g9FFVqgB028670@ginger.cmf.nrl.navy.mil> Message-ID: Ken Hornstein writes: > >If the win clients are using the krb4 protocol, then perhaps you > >should point them directly to your KDC. > > Sadly, that's not possible (at least, I never figured out how). Yes, you > can add your KDCs to your CellServDB for that cell, but that has it's > own problems. We need better krb5 support for windows.. aklog.exe et al. I hope that aklog and asetkey can eventually be added into the openafs source tree (perhaps with a configure switch to turn the functionality on). This would be especially useful when krb5-tokens appear in OpenAFS. > --Ken -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Tue Oct 15 16:43:01 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 11:43:01 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: Message-ID: On 15 Oct 2002, Derek Atkins wrote: > We need better krb5 support for windows.. aklog.exe et al. I hope > that aklog and asetkey can eventually be added into the openafs source > tree (perhaps with a configure switch to turn the functionality on). > This would be especially useful when krb5-tokens appear in OpenAFS. The big problem is the configure glue to detecting krb5. If someone contributes some, we can do it. From kenh@cmf.nrl.navy.mil Tue Oct 15 16:51:47 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Tue, 15 Oct 2002 11:51:47 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: Your message of "15 Oct 2002 11:42:00 EDT." Message-ID: <200210151551.g9FFplgB029105@ginger.cmf.nrl.navy.mil> >> >If the win clients are using the krb4 protocol, then perhaps you >> >should point them directly to your KDC. >> >> Sadly, that's not possible (at least, I never figured out how). Yes, you >> can add your KDCs to your CellServDB for that cell, but that has it's >> own problems. > >We need better krb5 support for windows.. aklog.exe et al. I hope >that aklog and asetkey can eventually be added into the openafs source >tree (perhaps with a configure switch to turn the functionality on). I'm all for that. Except that currently under Windows, the lack of the 524 library is problematic. --Ken From warlord@MIT.EDU Tue Oct 15 16:53:11 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 11:53:11 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: <200210151551.g9FFplgB029105@ginger.cmf.nrl.navy.mil> References: <200210151551.g9FFplgB029105@ginger.cmf.nrl.navy.mil> Message-ID: Ken Hornstein writes: > I'm all for that. Except that currently under Windows, the lack of the > 524 library is problematic. I thought 524 was part of KfW, no? > --Ken -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Tue Oct 15 16:53:52 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 11:53:52 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: References: Message-ID: Derrick J Brashear writes: > The big problem is the configure glue to detecting krb5. If someone > contributes some, we can do it. Why can't you just grab the configure magic out of the Openafs SRPM? -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Tue Oct 15 16:55:02 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 11:55:02 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: Message-ID: On 15 Oct 2002, Derek Atkins wrote: > Derrick J Brashear writes: > > > The big problem is the configure glue to detecting krb5. If someone > > contributes some, we can do it. > > Why can't you just grab the configure magic out of the Openafs SRPM? Does it deal with Heimdal? The other thing is right now I don't have time to test, either. From kenh@cmf.nrl.navy.mil Tue Oct 15 16:56:43 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Tue, 15 Oct 2002 11:56:43 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: Your message of "15 Oct 2002 11:53:11 EDT." Message-ID: <200210151556.g9FFuhgB029253@ginger.cmf.nrl.navy.mil> >> I'm all for that. Except that currently under Windows, the lack of the >> 524 library is problematic. > >I thought 524 was part of KfW, no? There's a k524init.exe included, but the critical 524 library function is _not_ included (at least, that's what Paul Hill told me at MIT a few weeks ago). You'll have to get the details from him about it. --Ken From mimiller@ncsa.uiuc.edu Tue Oct 15 18:34:49 2002 From: mimiller@ncsa.uiuc.edu (Michael Miller) Date: Tue, 15 Oct 2002 12:34:49 -0500 Subject: [OpenAFS] Need Help with Install Message-ID: <5.1.0.14.2.20021015123308.01864ba8@pop.ncsa.uiuc.edu> Thanks to everyone who sent info. I was able to get it working by upgrading my kernel to 2.4.9-34 and compiling the module. :-) Thanx, Michael Miller System Engineer Visualization Technology Support Computing and Data Management National Center for Supercomputing Applications University of Illinois - UC "If you're clear in your vision and trust the people in your team with clear objectives, they will invariably do their best to achieve everything desired, and usually deliver everything you could have hoped for and even more." -Paul Debevec From warlord@MIT.EDU Tue Oct 15 21:48:25 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 16:48:25 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: References: Message-ID: Derrick J Brashear writes: > > Why can't you just grab the configure magic out of the Openafs SRPM? > > Does it deal with Heimdal? Probably not, but does that matter for now? Is it really that bad to have optional code that only compiles against MIT-krb5? > The other thing is right now I don't have time to test, either. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Tue Oct 15 22:00:39 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 17:00:39 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: Message-ID: On 15 Oct 2002, Derek Atkins wrote: > Derrick J Brashear writes: > > > > Why can't you just grab the configure magic out of the Openafs SRPM? > > > > Does it deal with Heimdal? > > Probably not, but does that matter for now? Is it really that bad > to have optional code that only compiles against MIT-krb5? As a Heimdal user, I have to vote yes. :-) Though, if a complete patch to integrate it as is shows up, great. I'm just not volunteering to work on it, because just now I'm too busy. It's not helping that in one case (future Linux cliient-side integration) the kernel people don't seem to be offering much feedback in the way of what it will take to get our needs in the kernel addressed. From warlord@MIT.EDU Tue Oct 15 22:07:00 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 15 Oct 2002 17:07:00 -0400 Subject: [OpenAFS] ka-forwarder In-Reply-To: References: Message-ID: Derrick J Brashear writes: > Though, if a complete patch to integrate it as is shows up, great. I'm > just not volunteering to work on it, because just now I'm too busy. It's I'll think about it (in my copious spare time)... > not helping that in one case (future Linux cliient-side integration) the > kernel people don't seem to be offering much feedback in the way of what > it will take to get our needs in the kernel addressed. Well, we've got a workaround right now, don't we? ;) -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Tue Oct 15 22:17:42 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 15 Oct 2002 17:17:42 -0400 (EDT) Subject: [OpenAFS] ka-forwarder In-Reply-To: Message-ID: On 15 Oct 2002, Derek Atkins wrote: > Derrick J Brashear writes: > > not helping that in one case (future Linux cliient-side integration) the > > kernel people don't seem to be offering much feedback in the way of what > > it will take to get our needs in the kernel addressed. > > Well, we've got a workaround right now, don't we? ;) Yes, but that doesn't mean we should let ourserves get screwed all-around. Particularly, the ideal case is that current 2.4 kernels and particularly RedHat get one hook, and 2.5 kernels and whenever interesting pullups from 2.5 to 2.4 happen get another. -D From nneul@umr.edu Wed Oct 16 03:20:50 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 15 Oct 2002 21:20:50 -0500 Subject: [OpenAFS] ka-forwarder In-Reply-To: References: <200210151551.g9FFplgB029105@ginger.cmf.nrl.navy.mil> Message-ID: <1034734850.31707.18.camel@cessna.rollanet.org> At various times (dunno if it's still the case) the binary distributions of KfW have not included krb524.dll. -- Nathan On Tue, 2002-10-15 at 10:53, Derek Atkins wrote: > Ken Hornstein writes: > > > I'm all for that. Except that currently under Windows, the lack of the > > 524 library is problematic. > > I thought 524 was part of KfW, no? > > > --Ken > > -derek > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From somkar@in.ibm.com Wed Oct 16 12:44:14 2002 From: somkar@in.ibm.com (Omkar Sathe) Date: Wed, 16 Oct 2002 17:14:14 +0530 Subject: [OpenAFS] sys_call_table for RH8.0 kernel Message-ID: Hi - Can someone please point to a tested patch for exporting sys_call_table for RH8.0 kernel ? regards omkar sathe IBM India, Pune Lab. From warlord@MIT.EDU Wed Oct 16 14:58:27 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 16 Oct 2002 09:58:27 -0400 Subject: [OpenAFS] sys_call_table for RH8.0 kernel In-Reply-To: References: Message-ID: Check out the RH8.0 SRPM on www.openafs.org -derek "Omkar Sathe" writes: > Hi - > > Can someone please point to a tested patch for exporting sys_call_table for > RH8.0 kernel ? > > regards > omkar sathe > IBM India, Pune Lab. > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From TayloG@NORTHAMERICA.Stortek.com Wed Oct 16 00:18:45 2002 From: TayloG@NORTHAMERICA.Stortek.com (Taylor, Garry) Date: Tue, 15 Oct 2002 17:18:45 -0600 Subject: [OpenAFS] File System timeouts Message-ID: <456F8F30E3004D4A98961473AE5748D5C49EA4@nor-msg2> Good afternoon; Anyone out there know if AFS (Andrew File System) has a variable or other timeout which can be modified or altered in order to extend this timeout parameter for response time between the volumes and the client and/or AFS Master DB. We have a situation where a customer is utilizing AFS and it seems that if the volume is not seen by the client for several seconds, the AFS volume goes into a "restructuring mode" (modified FSCK) to rebuild them. Since this is the apparent case, I would wonder if the server had dual HBA's as to whether the server would failover quickly enough to prevent this in case of an HBA failure or the resetting of a controller within the disk sub-system. Garry Taylor Technical System Specialist Phoenix,Arizona 85016 602.840.4844 x405 Storage Tek Information made Powerful From rhino_tom@hotmail.com Wed Oct 16 04:04:46 2002 From: rhino_tom@hotmail.com (Tom Reinhart) Date: Tue, 15 Oct 2002 20:04:46 -0700 Subject: [OpenAFS] (no subject) Message-ID: >>In conventional Unix, I can set a directory to "drwx--x--x" permissions >>and then create subdirectories which users can access by name. This is >>useful because no one can access files they don't know the name of. >>However, I've just migrated to a new system that uses OpenAFS, and I >>can't figure out a way to accomplish this. I tried the obvious thing of >>setting the ACL to just "r", but apparently without the "l" permission, >>nothing else works. Is there any other way to do this? > >No. I'm afraid AFS doesn't support this. That's rather unfortunate as it makes it very difficult to work the way I want to. One thing I wanted to do was share files with unauthenticated users in other cells without exposing them to the whole world. Although ACLs are useful, I've noticed that AFS has some serious limitations compared to normal Unix filesystem permissions. Does anyone know what the thinking was behind these decisions? Here's a couple of things I would do differently (could these be considered feature requests?) 1) Restore the ability to have "hidden" directories, for example, by paying attention to the "r" and "x" permissions on directories, or by creating a new ACL that could be used in place of "l" (maybe "s" for seek?). Also, some equivalent to the "t" directore mode bit would be useful (allowing users to create delete files, but only if they are the owner) 2) The per-directory limitation on permissions is quite onerous, especially considering that AFS already stores the mode bits. Would it be possible to make the AFS server pay more attention to the Unix chmod permissions on individual files? The user bits would restrict the user from reading/writing their own files, the "other" bits would limit the system:an"yser" account, and the "group" bits would limit the other users that are explicitly mentioned in the ACL. These mode bits would be subtractive to permissions, i.e. no one would have more permissions than the ACL granted. This would allow me, for example, to give system:anyuser "rl" access in my home directory, while still restricting certain dotfiles that I don't want people to see, without having to put symlinks for half my files. I think these changes would make AFS a lot more acceptable to people accustomed to working with most other Unix filesystems. Tom _________________________________________________________________ Get faster connections -- switch to MSN Internet Access! http://resourcecenter.msn.com/access/plans/default.asp From rhino_tom@hotmail.com Wed Oct 16 05:02:34 2002 From: rhino_tom@hotmail.com (Tom Reinhart) Date: Tue, 15 Oct 2002 21:02:34 -0700 Subject: [OpenAFS] ACLs and open-afs Message-ID: >The problem of restricting access to files in directories with rl-rights = > >for system:anyuser could be solved by a different implementation in the=20 >fileserver: We did this for MR-AFS in the way that the mode-bits for=20 >"other" restrict the access for system:anyuser. The problem here is that = > >users have been told too long that the mode-bits for "group" and "other" = > >are worthless in AFS and they mostly ares set randomly. Therefore we=20 >require the fileserver to be started with an option "-modebits" in order = > >to enable this feature. > >This could easily be implemented in OpenAFS as well. I'm reading this discussion with interest, especially after having posted essentially the same suggestion in another thread (See subject: "Hidden directories"). I think having more "unix-like" filesystem semantics would be a very good thing, at least as much as possible given the limitations of a networked filesystem. I also agree that per-file ACLs are overkill in terms of the design of AFS, especially when the existing mode bits could be reused for much of the same purpose without any large architectural changes to AFS. One thing I would point out about the way you are doing it, is that forcing the AFS admin to use a global flag to enable modebits probably would not be acceptable in large cells with tens of thousands of user, it would be an upgrade, not to mention educational nightmare. A better way to enable this functionality would be for this to be a per-user profile flag. Then, backwards compatibility with old AFS behaviorwould be the default, but users who are aware of and want this new functionality would execute a command to enable the modebits for directories they own. Alternately, modebits could be enabled per-directory if that led to an easier implementation, although I think per-user would be more friendly. Tom _________________________________________________________________ Get a speedy connection with MSN Broadband.  Join now! http://resourcecenter.msn.com/access/plans/freeactivation.asp From jjneely@pams.ncsu.edu Wed Oct 16 14:39:20 2002 From: jjneely@pams.ncsu.edu (Jack Neely) Date: Wed, 16 Oct 2002 09:39:20 -0400 Subject: [OpenAFS] sys_call_table for RH8.0 kernel In-Reply-To: ; from somkar@in.ibm.com on Wed, Oct 16, 2002 at 05:14:14PM +0530 References: Message-ID: <20021016093920.A5409@anduril.pams.ncsu.edu> --7AUc2qLy4jB3hD7Z Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Oct 16, 2002 at 05:14:14PM +0530, Omkar Sathe wrote: > Hi - > > Can someone please point to a tested patch for exporting sys_call_table for > RH8.0 kernel ? > > regards > omkar sathe > IBM India, Pune Lab. > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > Edit the RHL kernel spec file to include this patch...say somewhere around patch # 10050. It needs to be toward the end. Jack -- Jack Neely Linux Realm Kit Administration and Development PAMS Computer Operations at NC State University GPG Fingerprint: 1917 5AC1 E828 9337 7AA4 EA6B 213B 765F 3B6A 5B89 --7AUc2qLy4jB3hD7Z Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="linux-2.4.18-sys_call_table.patch" diff -ru kernel-2.4.18-old/linux/kernel/ksyms.c kernel-2.4.18/linux/kernel/ksyms.c --- kernel-2.4.18-old/linux/kernel/ksyms.c 2002-10-08 15:17:21.000000000 -0400 +++ kernel-2.4.18/linux/kernel/ksyms.c 2002-10-08 15:25:06.000000000 -0400 @@ -522,6 +522,9 @@ EXPORT_SYMBOL(simple_strtoull); EXPORT_SYMBOL(system_utsname); /* UTS data */ EXPORT_SYMBOL(uts_sem); /* UTS semaphore */ +#ifndef __mips__ +EXPORT_SYMBOL(sys_call_table); +#endif EXPORT_SYMBOL(machine_restart); EXPORT_SYMBOL(machine_halt); EXPORT_SYMBOL(machine_power_off); --7AUc2qLy4jB3hD7Z-- From shadow@dementia.org Wed Oct 16 15:23:32 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 16 Oct 2002 10:23:32 -0400 (EDT) Subject: [OpenAFS] File System timeouts In-Reply-To: <456F8F30E3004D4A98961473AE5748D5C49EA4@nor-msg2> Message-ID: On Tue, 15 Oct 2002, Taylor, Garry wrote: > Good afternoon; > > Anyone out there know if AFS (Andrew File System) has a variable or other > timeout which can be modified or altered in order to extend this timeout > parameter for response time between the volumes and the client and/or AFS > Master DB. We have a situation where a customer is utilizing AFS and it > seems that if the volume is not seen by the client for several seconds, the > AFS volume goes into a "restructuring mode" (modified FSCK) to rebuild them. This sounds like it might be something your customer is doing themselves, as opposed to something OpenAFS does by default. Either that or they've misled about some of the interaction. > Since this is the apparent case, I would wonder if the server had dual HBA's > as to whether the server would failover quickly enough to prevent this in > case of an HBA failure or the resetting of a controller within the disk > sub-system. From daniel_clark@us.ibm.com Wed Oct 16 15:49:04 2002 From: daniel_clark@us.ibm.com (Daniel Clark/Cambridge/IBM) Date: Wed, 16 Oct 2002 10:49:04 -0400 Subject: [OpenAFS] Some beginner questions In-Reply-To: Message-ID: > > 2. Can non-interactive scripts access AFS space? For instance, is it > > possible for root or a generic user to run commands from cron which > > access AFS space? I don't see how these scripts would obtain tokens > > without someone manually entering in a password at some point. > > Sort of. You can use (relatively insecure) IP ACLs.. Or you can use > a "keytab" based system (where the server running the long-job stores > a password in a file readable only by root and obtains a token for AFS > using that keytab). Another option is OpenPBS [1] and Password Storage and Retrieval (PSR) [2], where you encrypt your AFS password with a public key and put it in your home directory, and trusted machine(s) which have the private key on local disk then decrypt your password and run your job. MIT uses a variant of this [3] [4] that uses their own code (see [5] sections III and IV) instead of PSR. [1] http://www.openpbs.org/ [2] http://www.lam-mpi.org/software/psr/ [3] http://web.mit.edu/longjobs/www/ [4] http://mit.edu/longjobs-dev/notebook/ [5] http://web.mit.edu/longjobs-dev/doc/netsec.txt -- Daniel Clark # Sys Admin & Release Engineer IBM > Lotus > Messaging Technology Group From rees@umich.edu Wed Oct 16 16:17:21 2002 From: rees@umich.edu (Jim Rees) Date: Wed, 16 Oct 2002 11:17:21 -0400 Subject: [OpenAFS] (no subject) In-Reply-To: "Tom Reinhart", Tue, 15 Oct 2002 20:04:46 PDT Message-ID: <20021016151721.8CB32207D3@citi.umich.edu> Depending on obscure file names for access control seems like a bad idea to me, especially when there are other mechanisms available. Implementing unreadable directories would require a major protocol change, because lookups would have to be done on the server instead of on the client. This is how nfs works. Instead of caching whole directories, the client would have to cache directory entries. The protocol would become much chattier. Per-file permissions based on the mode bits might make sense, and it's obviously possible if mrafs does it. I think I would do it on a per-volume basis, which would be much easier than per-user. From chas@cmf.nrl.navy.mil Wed Oct 16 16:52:20 2002 From: chas@cmf.nrl.navy.mil (chas williams) Date: Wed, 16 Oct 2002 11:52:20 -0400 Subject: [OpenAFS] (no subject) In-Reply-To: Your message of "Wed, 16 Oct 2002 11:17:21 EDT." <20021016151721.8CB32207D3@citi.umich.edu> Message-ID: <200210161552.g9GFqJgB017830@ginger.cmf.nrl.navy.mil> In message <20021016151721.8CB32207D3@citi.umich.edu>,Jim Rees writes: >Per-file permissions based on the mode bits might make sense, and it's >obviously possible if mrafs does it. I think I would do it on a per-volume the simplest form of this (which would seem to fix problems for most people i imagine) would be to interpret perm modes without world bits as meaning that system:anyuser and system:authuser should be ignored for this particular file. perhaps group perm bits would allow/disallow system:authuser. From sdevine@msu.edu Wed Oct 16 17:06:20 2002 From: sdevine@msu.edu (Steve Devine) Date: 16 Oct 2002 12:06:20 -0400 Subject: [OpenAFS] kas question Message-ID: <1034784381.1596.36.camel@jax.cl.msu.edu> All I am tring to create a test database server and a test cell. I have followed the directions as closely as possible yet I still encounter this trouble. I cant get past the section about creating user afs and admin. I created the cellname using ./bos setcellname Then I created the server instances and started the servers. ./bos create -server yada-yada.msu.edu -instance kaserver -type simple -cmd /usr/afs/bin/kaserver -cell systest -noauth etc .. etc Every thing seems ok then when I run: ./kas -cell systest -noauth kas:interactive: cell name not found Can't expand cell name It wont let me create afs or admin users. When I look for the processes the servers are running. ps -ef |grep server root 834 2 0 08:36 ? 00:00:00 [afs_checkserver] root 1066 1 0 08:48 ? 00:00:00 /usr/afs/bin/bosserver -noauth root 1132 1066 0 08:54 ? 00:00:00 /usr/afs/bin/kaserver root 1134 1066 0 08:55 ? 00:00:00 /usr/afs/bin/buserver root 1136 1066 0 08:55 ? 00:00:00 /usr/afs/bin/ptserver root 1138 1066 0 08:55 ? 00:00:00 /usr/afs/bin/vlserver root 1360 1305 0 12:02 pts/2 00:00:00 grep server ./bos listhosts yada-yada -noauth gives me : Cell name is systest Host 1 is yada-yada A more on ThisCell: systest ANy ideas? I have tried this on two machines one Linux Redhat 7.2 and the other Solaris 8. Same issue. Thanks -- Steve Devine Core Systems Michigan State University From warlord@MIT.EDU Wed Oct 16 17:27:23 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 16 Oct 2002 12:27:23 -0400 Subject: [OpenAFS] kas question In-Reply-To: <1034784381.1596.36.camel@jax.cl.msu.edu> References: <1034784381.1596.36.camel@jax.cl.msu.edu> Message-ID: Did you add your cell information to /usr/vice/etc/CellServDB? -derek Steve Devine writes: > All > I am tring to create a test database server and a test cell. I have > followed the directions as closely as possible yet I still encounter > this trouble. > I cant get past the section about creating user afs and admin. > I created the cellname using ./bos setcellname > Then I created the server instances and started the servers. > ./bos create -server yada-yada.msu.edu -instance kaserver -type simple > -cmd /usr/afs/bin/kaserver -cell systest -noauth > etc .. etc > Every thing seems ok then when I run: > ./kas -cell systest -noauth > kas:interactive: cell name not found Can't expand cell name > It wont let me create afs or admin users. > > When I look for the processes the servers are running. > ps -ef |grep server > > root 834 2 0 08:36 ? 00:00:00 [afs_checkserver] > root 1066 1 0 08:48 ? 00:00:00 /usr/afs/bin/bosserver > -noauth > root 1132 1066 0 08:54 ? 00:00:00 /usr/afs/bin/kaserver > root 1134 1066 0 08:55 ? 00:00:00 /usr/afs/bin/buserver > root 1136 1066 0 08:55 ? 00:00:00 /usr/afs/bin/ptserver > root 1138 1066 0 08:55 ? 00:00:00 /usr/afs/bin/vlserver > root 1360 1305 0 12:02 pts/2 00:00:00 grep server > > > ./bos listhosts yada-yada -noauth gives me : > Cell name is systest > Host 1 is yada-yada > > A more on ThisCell: > systest > ANy ideas? I have tried this on two machines one Linux Redhat 7.2 and > the other Solaris 8. Same issue. > Thanks > -- > Steve Devine > Core Systems > Michigan State University > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From sdevine@msu.edu Wed Oct 16 18:38:24 2002 From: sdevine@msu.edu (Steve Devine) Date: 16 Oct 2002 13:38:24 -0400 Subject: [OpenAFS] kas question In-Reply-To: References: <1034784381.1596.36.camel@jax.cl.msu.edu> Message-ID: <1034789904.1596.39.camel@jax.cl.msu.edu> Derek Thanks you were right on the money ..I had it in /usr/afs/etc/CellServDB but not /usr/vice/etc/CellServDB? /sd On Wed, 2002-10-16 at 12:27, Derek Atkins wrote: > Did you add your cell information to /usr/vice/etc/CellServDB? > > -derek > > Steve Devine writes: > > > All > > I am tring to create a test database server and a test cell. I have > > followed the directions as closely as possible yet I still encounter > > this trouble. > > I cant get past the section about creating user afs and admin. > > I created the cellname using ./bos setcellname > > Then I created the server instances and started the servers. > > ./bos create -server yada-yada.msu.edu -instance kaserver -type simple > > -cmd /usr/afs/bin/kaserver -cell systest -noauth > > etc .. etc > > Every thing seems ok then when I run: > > ./kas -cell systest -noauth > > kas:interactive: cell name not found Can't expand cell name > > It wont let me create afs or admin users. > > > > When I look for the processes the servers are running. > > ps -ef |grep server > > > > root 834 2 0 08:36 ? 00:00:00 [afs_checkserver] > > root 1066 1 0 08:48 ? 00:00:00 /usr/afs/bin/bosserver > > -noauth > > root 1132 1066 0 08:54 ? 00:00:00 /usr/afs/bin/kaserver > > root 1134 1066 0 08:55 ? 00:00:00 /usr/afs/bin/buserver > > root 1136 1066 0 08:55 ? 00:00:00 /usr/afs/bin/ptserver > > root 1138 1066 0 08:55 ? 00:00:00 /usr/afs/bin/vlserver > > root 1360 1305 0 12:02 pts/2 00:00:00 grep server > > > > > > ./bos listhosts yada-yada -noauth gives me : > > Cell name is systest > > Host 1 is yada-yada > > > > A more on ThisCell: > > systest > > ANy ideas? I have tried this on two machines one Linux Redhat 7.2 and > > the other Solaris 8. Same issue. > > Thanks > > -- > > Steve Devine > > Core Systems > > Michigan State University > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Steve Devine Core Systems Michigan State University From mike@bizittech.com Thu Oct 17 01:59:15 2002 From: mike@bizittech.com (mike@bizittech.com) Date: Wed, 16 Oct 2002 20:59:15 -0400 Subject: [OpenAFS] Tokens that do not expire Message-ID: <003601c27578$6aaf3db0$01000001@ast> This is a multi-part message in MIME format. ------=_NextPart_000_0033_01C27556.E32E1300 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hi Is it possible to issue for certain users (process runners ) tokens that = does not expire . Thanks ------=_NextPart_000_0033_01C27556.E32E1300 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
hi
Is it possible to issue for certain = users (process=20 runners ) tokens that does not expire .
 
Thanks
------=_NextPart_000_0033_01C27556.E32E1300-- From warlord@MIT.EDU Thu Oct 17 03:14:01 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 16 Oct 2002 22:14:01 -0400 Subject: [OpenAFS] Tokens that do not expire In-Reply-To: <003601c27578$6aaf3db0$01000001@ast> References: <003601c27578$6aaf3db0$01000001@ast> Message-ID: No, I do not believe so. But you can obtain new tokens before the old ones expire.. -derek writes: > hi > Is it possible to issue for certain users (process runners ) tokens that does not expire . > > Thanks -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 10:06:59 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 11:06:59 +0200 Subject: [OpenAFS] krb5-Problems Message-ID: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv> Hi, i have strange problems with the krb5-integration. Here is what i did: on my kdc (mit 1.2.6) : kadmin.local -e des-cbc-crc:v4 ank -randkey afs/mydomain.de ktadd -k afskeytab afs/mydomain.de then on my system control machine: asetkey add afskeytab afs/mydomain.de I watched carefully for the key version number, this one is correct. I can do an kinit and aklog aklog -d does not show any errors, i get an afs-token successfully. But when i do "vos listvldb" for examle, I get "Could not access the VLDB for attributes rxk: ticket contained unknown key version number" although my user is in the user-list. When i want to access the afs-filespace i get: "ct 17 09:08:41 installed kernel: afs: Tokens for user of AFS id 2 for cell mydomain.de are discarded (rxkad error=19270408)" When i want to list the keys using "bos listkeys localhost" i get: "bos: ticket contained unknown key version number error encountered while listing keys" On the other hand, it works fine with the -localauth-function: # bos listkeys localhost -localauth # key 3 has cksum 260487344 # Keys last changed on Thu Oct 17 10:56:43 2002. There has been such a problem before on this list, but i could not figure out the solution. Any help is welcome. Klaas From kerberos@northsailor.de Thu Oct 17 11:56:56 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 12:56:56 +0200 Subject: [OpenAFS] Adresses of afs-file-servers Message-ID: <048101c275cb$ea651860$2b03a8c0@mummert.priv> Hi, how are the adresses of the afs file-servers stored in afs? Is the IP-adress or the dns name stored? How does the system handle DNS-Alias-names? Klaas From TedAnderson@mindspring.com Thu Oct 17 13:30:40 2002 From: TedAnderson@mindspring.com (Ted Anderson) Date: Thu, 17 Oct 2002 08:30:40 -0400 Subject: [OpenAFS] Some beginner questions References: Message-ID: <3DAEAD70.3030402@mindspring.com> On 10/16/2002 10:49, Daniel Clark/Cambridge/IBM wrote: >>>2. Can non-interactive scripts access AFS space? ... > Another option is OpenPBS [1] and Password Storage and Retrieval (PSR) > [2], where you encrypt your AFS password with a public key and put it > in your home directory, and trusted machine(s) which have the private > key on local disk then decrypt your password and run your job. MIT > uses a variant of this [3] [4] that uses their own code (see [5] > sections III and IV) instead of PSR. > > [1] http://www.openpbs.org/ > [2] http://www.lam-mpi.org/software/psr/ > [3] http://web.mit.edu/longjobs/www/ > [4] http://mit.edu/longjobs-dev/notebook/ > [5] http://web.mit.edu/longjobs-dev/doc/netsec.txt This seemed like a really good set of references, so I added them to the AFS FAQ in the AFSLore Wiki[1]. Ted Anderson [1] https://grand.central.org/twiki/bin/view/AFSLore/AdminFAQ#3_08_How_can_I_run_daemons_with_ From warlord@MIT.EDU Thu Oct 17 14:03:09 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 09:03:09 -0400 Subject: [OpenAFS] krb5-Problems In-Reply-To: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv> References: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv> Message-ID: Try: ktadd -e des-cbc-crc:v4 -k afskeytab afs/mydomain.de -derek "Klaas Hagemann" writes: > Hi, > > i have strange problems with the krb5-integration. > Here is what i did: > on my kdc (mit 1.2.6) : > kadmin.local -e des-cbc-crc:v4 > ank -randkey afs/mydomain.de > ktadd -k afskeytab afs/mydomain.de > > then on my system control machine: > asetkey add afskeytab afs/mydomain.de > I watched carefully for the key version number, this one is correct. > > I can do an kinit and aklog > aklog -d does not show any errors, i get an afs-token successfully. > > But when i do "vos listvldb" for examle, I get > "Could not access the VLDB for attributes > rxk: ticket contained unknown key version number" > although my user is in the user-list. > > When i want to access the afs-filespace i get: > "ct 17 09:08:41 installed kernel: afs: Tokens for user of AFS id 2 for cell > mydomain.de are discarded (rxkad error=19270408)" > > When i want to list the keys using "bos listkeys localhost" i get: > "bos: ticket contained unknown key version number error encountered while > listing keys" > > On the other hand, it works fine with the -localauth-function: > # bos listkeys localhost -localauth > # key 3 has cksum 260487344 > # Keys last changed on Thu Oct 17 10:56:43 2002. > > There has been such a problem before on this list, but i could not figure > out the solution. > Any help is welcome. > > Klaas > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 17 14:03:33 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 09:03:33 -0400 Subject: [OpenAFS] Adresses of afs-file-servers In-Reply-To: <048101c275cb$ea651860$2b03a8c0@mummert.priv> References: <048101c275cb$ea651860$2b03a8c0@mummert.priv> Message-ID: It uses IP Address and Server UUID. -derek "Klaas Hagemann" writes: > Hi, > > how are the adresses of the afs file-servers stored in afs? > Is the IP-adress or the dns name stored? How does the system handle > DNS-Alias-names? > > Klaas > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 14:52:54 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 15:52:54 +0200 Subject: [OpenAFS] krb5-Problems References: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv> Message-ID: <049e01c275e4$96ba9a00$2b03a8c0@mummert.priv> Hi Derek, thanks for your answer, it did not help, maybe we had some other network problem (they started to switch arount the dns-domains in our testing-envirmoment. Now i want to set up the AFS-Cell again and get the following error while using asetkey: # asetkey add 6 afskeytab afs/mydomain.de asetkey: unknown RPC error (-1765328160) while parsing AFS principal. I have no ideas what this could be about (the bosserver still runs with the "noauth" - flag. Thanks Klaas ----- Original Message ----- From: "Derek Atkins" To: "Klaas Hagemann" Cc: Sent: Thursday, October 17, 2002 3:03 PM Subject: Re: [OpenAFS] krb5-Problems > Try: > > ktadd -e des-cbc-crc:v4 -k afskeytab afs/mydomain.de > > -derek > > "Klaas Hagemann" writes: > > > Hi, > > > > i have strange problems with the krb5-integration. > > Here is what i did: > > on my kdc (mit 1.2.6) : > > kadmin.local -e des-cbc-crc:v4 > > ank -randkey afs/mydomain.de > > ktadd -k afskeytab afs/mydomain.de > > > > then on my system control machine: > > asetkey add afskeytab afs/mydomain.de > > I watched carefully for the key version number, this one is correct. > > > > I can do an kinit and aklog > > aklog -d does not show any errors, i get an afs-token successfully. > > > > But when i do "vos listvldb" for examle, I get > > "Could not access the VLDB for attributes > > rxk: ticket contained unknown key version number" > > although my user is in the user-list. > > > > When i want to access the afs-filespace i get: > > "ct 17 09:08:41 installed kernel: afs: Tokens for user of AFS id 2 for cell > > mydomain.de are discarded (rxkad error=19270408)" > > > > When i want to list the keys using "bos listkeys localhost" i get: > > "bos: ticket contained unknown key version number error encountered while > > listing keys" > > > > On the other hand, it works fine with the -localauth-function: > > # bos listkeys localhost -localauth > > # key 3 has cksum 260487344 > > # Keys last changed on Thu Oct 17 10:56:43 2002. > > > > There has been such a problem before on this list, but i could not figure > > out the solution. > > Any help is welcome. > > > > Klaas > > > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From rjaeckel@bu.edu Thu Oct 17 15:03:51 2002 From: rjaeckel@bu.edu (Roland Jaeckel) Date: Thu, 17 Oct 2002 10:03:51 -0400 Subject: [OpenAFS] Windows AFS client -> UNIX Message-ID: Hi, Putting files from WinNT to UNIX always sets new files to 777 when transferred through the AFS client. Does anyone have a suggestion how to avoid that and set a different default? Any help is appreciated. Roland -------------------------------- Roland Jaeckel Networked Information Systems Office of Information Technology Boston University rjaeckel@bu.edu *** 617-358-0034 From shadow@dementia.org Thu Oct 17 15:06:31 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 17 Oct 2002 10:06:31 -0400 (EDT) Subject: [OpenAFS] krb5-Problems In-Reply-To: <049e01c275e4$96ba9a00$2b03a8c0@mummert.priv> Message-ID: On Thu, 17 Oct 2002, Klaas Hagemann wrote: > Hi Derek, > > thanks for your answer, it did not help, maybe we had some other network > problem (they started to switch arount the dns-domains in our > testing-envirmoment. > Now i want to set up the AFS-Cell again and get the following error while > using asetkey: > > # asetkey add 6 afskeytab afs/mydomain.de > asetkey: unknown RPC error (-1765328160) while parsing AFS principal. > > I have no ideas what this could be about (the bosserver still runs with the > "noauth" - flag. KRB5_SAM_UNSUPPORTED = -1765328160, "Bad SAM flags in obtain_sam_padata" I don't know what this means. From warlord@MIT.EDU Thu Oct 17 15:16:57 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 10:16:57 -0400 Subject: [OpenAFS] krb5-Problems In-Reply-To: <049e01c275e4$96ba9a00$2b03a8c0@mummert.priv> References: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv> <049e01c275e4$96ba9a00$2b03a8c0@mummert.priv> Message-ID: Well: --> grep 1765328160 /usr/athena/include/krb5.h #define KRB5_CONFIG_NODEFREALM (-1765328160L) So, are you sure your krb5.conf is setup properly? -derek "Klaas Hagemann" writes: > Hi Derek, > > thanks for your answer, it did not help, maybe we had some other network > problem (they started to switch arount the dns-domains in our > testing-envirmoment. > Now i want to set up the AFS-Cell again and get the following error while > using asetkey: > > # asetkey add 6 afskeytab afs/mydomain.de > asetkey: unknown RPC error (-1765328160) while parsing AFS principal. > > I have no ideas what this could be about (the bosserver still runs with the > "noauth" - flag. > > Thanks Klaas > > > ----- Original Message ----- > From: "Derek Atkins" > To: "Klaas Hagemann" > Cc: > Sent: Thursday, October 17, 2002 3:03 PM > Subject: Re: [OpenAFS] krb5-Problems > > > > Try: > > > > ktadd -e des-cbc-crc:v4 -k afskeytab afs/mydomain.de > > > > -derek > > > > "Klaas Hagemann" writes: > > > > > Hi, > > > > > > i have strange problems with the krb5-integration. > > > Here is what i did: > > > on my kdc (mit 1.2.6) : > > > kadmin.local -e des-cbc-crc:v4 > > > ank -randkey afs/mydomain.de > > > ktadd -k afskeytab afs/mydomain.de > > > > > > then on my system control machine: > > > asetkey add afskeytab afs/mydomain.de > > > I watched carefully for the key version number, this one is correct. > > > > > > I can do an kinit and aklog > > > aklog -d does not show any errors, i get an afs-token successfully. > > > > > > But when i do "vos listvldb" for examle, I get > > > "Could not access the VLDB for attributes > > > rxk: ticket contained unknown key version number" > > > although my user is in the user-list. > > > > > > When i want to access the afs-filespace i get: > > > "ct 17 09:08:41 installed kernel: afs: Tokens for user of AFS id 2 for > cell > > > mydomain.de are discarded (rxkad error=19270408)" > > > > > > When i want to list the keys using "bos listkeys localhost" i get: > > > "bos: ticket contained unknown key version number error encountered > while > > > listing keys" > > > > > > On the other hand, it works fine with the -localauth-function: > > > # bos listkeys localhost -localauth > > > # key 3 has cksum 260487344 > > > # Keys last changed on Thu Oct 17 10:56:43 2002. > > > > > > There has been such a problem before on this list, but i could not > figure > > > out the solution. > > > Any help is welcome. > > > > > > Klaas > > > > > > > > > > > > _______________________________________________ > > > OpenAFS-info mailing list > > > OpenAFS-info@openafs.org > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 15:28:51 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 16:28:51 +0200 Subject: [OpenAFS] krb5-Problems References: <047701c275bc$8db8dfc0$2b03a8c0@mummert.priv><049e01c275e4$96ba9a00$2b03a8c0@mummert.priv> Message-ID: <04b501c275e9$8d8db7a0$2b03a8c0@mummert.priv> .... i tried another version of asetkey from the tu-chemnitz, and this one told it to me in plaintext.... thanks a lot!! Klaas ----- Original Message ----- From: "Derek Atkins" To: "Klaas Hagemann" Cc: Sent: Thursday, October 17, 2002 4:16 PM Subject: Re: [OpenAFS] krb5-Problems > Well: > > --> grep 1765328160 /usr/athena/include/krb5.h > #define KRB5_CONFIG_NODEFREALM (-1765328160L) > > So, are you sure your krb5.conf is setup properly? > > -derek > > "Klaas Hagemann" writes: > > > Hi Derek, > > > > thanks for your answer, it did not help, maybe we had some other network > > problem (they started to switch arount the dns-domains in our > > testing-envirmoment. > > Now i want to set up the AFS-Cell again and get the following error while > > using asetkey: > > > > # asetkey add 6 afskeytab afs/mydomain.de > > asetkey: unknown RPC error (-1765328160) while parsing AFS principal. > > > > I have no ideas what this could be about (the bosserver still runs with the > > "noauth" - flag. > > > > Thanks Klaas > > > > > > ----- Original Message ----- > > From: "Derek Atkins" > > To: "Klaas Hagemann" > > Cc: > > Sent: Thursday, October 17, 2002 3:03 PM > > Subject: Re: [OpenAFS] krb5-Problems > > > > > > > Try: > > > > > > ktadd -e des-cbc-crc:v4 -k afskeytab afs/mydomain.de > > > > > > -derek > > > > > > "Klaas Hagemann" writes: > > > > > > > Hi, > > > > > > > > i have strange problems with the krb5-integration. > > > > Here is what i did: > > > > on my kdc (mit 1.2.6) : > > > > kadmin.local -e des-cbc-crc:v4 > > > > ank -randkey afs/mydomain.de > > > > ktadd -k afskeytab afs/mydomain.de > > > > > > > > then on my system control machine: > > > > asetkey add afskeytab afs/mydomain.de > > > > I watched carefully for the key version number, this one is correct. > > > > > > > > I can do an kinit and aklog > > > > aklog -d does not show any errors, i get an afs-token successfully. > > > > > > > > But when i do "vos listvldb" for examle, I get > > > > "Could not access the VLDB for attributes > > > > rxk: ticket contained unknown key version number" > > > > although my user is in the user-list. > > > > > > > > When i want to access the afs-filespace i get: > > > > "ct 17 09:08:41 installed kernel: afs: Tokens for user of AFS id 2 for > > cell > > > > mydomain.de are discarded (rxkad error=19270408)" > > > > > > > > When i want to list the keys using "bos listkeys localhost" i get: > > > > "bos: ticket contained unknown key version number error encountered > > while > > > > listing keys" > > > > > > > > On the other hand, it works fine with the -localauth-function: > > > > # bos listkeys localhost -localauth > > > > # key 3 has cksum 260487344 > > > > # Keys last changed on Thu Oct 17 10:56:43 2002. > > > > > > > > There has been such a problem before on this list, but i could not > > figure > > > > out the solution. > > > > Any help is welcome. > > > > > > > > Klaas > > > > > > > > > > > > > > > > _______________________________________________ > > > > OpenAFS-info mailing list > > > > OpenAFS-info@openafs.org > > > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > > > -- > > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > > Member, MIT Student Information Processing Board (SIPB) > > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > > warlord@MIT.EDU PGP key available > > > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From aleahy@knox.edu Thu Oct 17 16:17:50 2002 From: aleahy@knox.edu (Andrew Leahy) Date: Thu, 17 Oct 2002 11:17:50 -0400 Subject: [OpenAFS] Linux kernels oops with openafs? Message-ID: <3DAED49E.9FD4B873@knox.edu> This is a multi-part message in MIME format. --------------E5D5EA556B1BAC01FAB34051 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hello, I've been working to install an openafs server for the first time (RH Linux 7.2/kernel 2.4.9-34/Openafs 1.2.6) and I've been seeing some kernel oopses. (See the attached file.) I'm not certain what is causing this, but I've been writing a script (also attached) to automate the basic configuration of the openafs server. The script loads and unloads the libopenafs modules and starts up the servers a couple of times. The script seems to work fine (in the sense that I can see what I should see in /afs when it's done), but would, say, loading and unloading the libopenafs modules cause problems? The only overt symptom of the problem is that when it happens it's impossible to kill the afsd processes short of a reboot. I've also been experiencing problems where I can authenticate successfully against the kaserver from another client, but I can't see anything in /afs on the client. (In fact, I've never been able to see anything in /afs from the client system. I don't know if this is related.) Does anybody know what to make of this? Thanks for your help. Andrew Leahy --------------E5D5EA556B1BAC01FAB34051 Content-Type: text/plain; charset=us-ascii; name="openafs-oops.txt" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="openafs-oops.txt" Oct 16 16:20:56 pc14341 kernel: WARM shutting down of: CB... afs... BkG... CTrunc... AFSDB... RxEvent... RxListener... Oct 16 16:26:37 pc14341 kernel: Starting AFS cache scan...found 0 non-empty cache files (0%%). Oct 16 16:29:51 pc14341 kernel: IPUT Bad refCount 0 on inode 0xcc99e000 Oct 16 16:29:51 pc14341 kernel: Unable to handle kernel paging request at virtual address ffffffff Oct 16 16:29:51 pc14341 kernel: printing eip: Oct 16 16:29:51 pc14341 kernel: cc8c0b68 Oct 16 16:29:51 pc14341 kernel: *pde = 00001063 Oct 16 16:29:51 pc14341 kernel: *pte = 00000000 Oct 16 16:29:51 pc14341 kernel: Oops: 0002 Oct 16 16:29:51 pc14341 kernel: Kernel 2.4.9-34 Oct 16 16:29:51 pc14341 kernel: CPU: 0 Oct 16 16:29:51 pc14341 kernel: EIP: 0010:[] Tainted: PF Oct 16 16:29:51 pc14341 kernel: EFLAGS: 00010286 Oct 16 16:29:51 pc14341 kernel: EIP is at osi_Panic [libafs-2.4.9-34-i386] 0x28 Oct 16 16:29:51 pc14341 kernel: eax: 00000028 ebx: cc99e000 ecx: 00000007 edx: cbfe5090 Oct 16 16:29:51 pc14341 kernel: esi: cc99e000 edi: cc8e4e20 ebp: cc8e4dec esp: c3c09efc Oct 16 16:29:51 pc14341 kernel: ds: 0018 es: 0018 ss: 0018 Oct 16 16:29:51 pc14341 kernel: Process umount (pid: 1948, stackpage=c3c09000) Oct 16 16:29:51 pc14341 kernel: Stack: cc8ca045 cc8dabc0 00000000 cc99e000 cc99e010 c1691450 c1691484 c2dcd120 Oct 16 16:29:51 pc14341 kernel: c0142790 cc99e000 cc99e000 c2dcd120 c2dcd120 cc8e4e20 cc8e4dec c94b0800 Oct 16 16:29:51 pc14341 kernel: c2dcd120 c0136d5f c2dcd120 c2dcd120 c3c09f88 00000000 c4a17000 08053bd0 Oct 16 16:29:51 pc14341 kernel: Call Trace: [] osi_iput [libafs-2.4.9-34-i386] 0x29 Oct 16 16:29:51 pc14341 kernel: [] __insmod_libafs-2.4.9-34-i386_S.rodata_L2024 [libafs-2.4.9-34-i386] 0x3dc0 Oct 16 16:29:51 pc14341 kernel: [dput+236/364] dput [kernel] 0xec Oct 16 16:29:51 pc14341 kernel: [] dput [kernel] 0xec Oct 16 16:29:51 pc14341 kernel: [] afs_sops [libafs-2.4.9-34-i386] 0x0 Oct 16 16:29:51 pc14341 kernel: [] afs_file_system [libafs-2.4.9-34-i386] 0x0 Oct 16 16:29:51 pc14341 kernel: [kill_super+91/324] kill_super [kernel] 0x5b Oct 16 16:29:51 pc14341 kernel: [] kill_super [kernel] 0x5b Oct 16 16:29:51 pc14341 kernel: [path_release+39/48] path_release [kernel] 0x27 Oct 16 16:29:51 pc14341 kernel: [] path_release [kernel] 0x27 Oct 16 16:29:51 pc14341 kernel: [do_umount+176/204] do_umount [kernel] 0xb0 Oct 16 16:29:51 pc14341 kernel: [] do_umount [kernel] 0xb0 Oct 16 16:29:51 pc14341 kernel: [sys_umount+201/228] sys_umount [kernel] 0xc9 Oct 16 16:29:51 pc14341 kernel: [] sys_umount [kernel] 0xc9 Oct 16 16:29:51 pc14341 kernel: [sys_oldumount+11/16] sys_oldumount [kernel] 0xb Oct 16 16:29:51 pc14341 kernel: [] sys_oldumount [kernel] 0xb Oct 16 16:29:51 pc14341 kernel: [system_call+51/56] system_call [kernel] 0x33 Oct 16 16:29:51 pc14341 kernel: [] system_call [kernel] 0x33 Oct 16 16:29:51 pc14341 kernel: Oct 16 16:29:51 pc14341 kernel: Oct 16 16:29:51 pc14341 kernel: Code: c6 05 ff ff ff ff 2a c3 55 57 56 53 56 8b 7c 24 1c 83 ff 01 --------------E5D5EA556B1BAC01FAB34051 Content-Type: text/plain; charset=us-ascii; name="script.txt" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="script.txt" #!/bin/sh # # Set up some basic variables # THISSYS= THISIP= THISCELL= THISNAME= THISDRV= THISPASS= SRCDIR= RHRLS= # # Install the basic RPM's # cd ${SRCDIR}/${RHRLS} rpm -Uvh openafs-1.2.6-rh7.2.1.i386.rpm rpm -Uvh openafs-kernel-1.2.6-rh7.2.1.i386.rpm rpm -Uvh openafs-client-1.2.6-rh7.2.1.i386.rpm ## ## Client Configuration ## # Set the AFS cache (for the cachemanager) to a larger size # cat < /usr/vice/etc/cacheinfo /afs:/usr/vice/cache:2000000 EOF echo "Don't Worry! I'm changing the cache size in cacheinfo to 2 GB" echo "" echo "Don't Worry! I'm ignoring authentication for now" # Configure ThisCell file (for the client) # cat < /usr/vice/etc/ThisCell $THISCELL EOF # Configure CellServDB file (for the client) # cat <> /usr/vice/etc/CellServDB >$THISCELL #$THISNAME $THISIP #$THISSYS EOF ## ## Authentication configuration stuff for PAM, etc. would go here !!!!!! ## ## ## Install and configure the server ## # Install the server RPM # rpm -Uvh openafs-server-1.2.6-rh7.2.1.i386.rpm # Configure and start the afs server # echo "Don't Worry! I'm modifying /etc/sysconfig/afs to turn AFS_SERVER on" echo "" cp -f $SRCDIR/config/sysconfig-afs-server /etc/sysconfig/afs MODNAME=`/usr/vice/etc/afsmodname` /sbin/insmod -f /usr/vice/etc/modload/$MODNAME # Make and mount the appropriate vicepX partitions # /sbin/mke2fs $THISDRV /bin/mkdir /vicepa /bin/cat <> /etc/fstab $THISDRV /vicepa ext2 defaults 0 2 EOF /bin/mount -a # start and configure the BOS server # /usr/afs/bin/bosserver -noauth & /usr/bin/bos setcellname $THISSYS $THISCELL -noauth # # configure the other (non-fileserver) processes on this server # # # the authentication server . . . /usr/bin/bos create $THISSYS kaserver simple /usr/afs/bin/kaserver \ -cell $THISCELL -noauth # the backup server . . . /usr/bin/bos create $THISSYS buserver simple /usr/afs/bin/kaserver \ -cell $THISCELL -noauth # the protection server . . . /usr/bin/bos create $THISSYS ptserver simple /usr/afs/bin/ptserver \ -cell $THISCELL -noauth # the volumne location server /usr/bin/bos create $THISSYS vlserver simple /usr/afs/bin/vlserver \ -cell $THISCELL -noauth # Create the initial afs and admin accounts in AFS # /usr/sbin/kas create -name afs -initial_password $THISPASS -noauth /usr/sbin/kas create -name admin -initial_password $THISPASS -noauth /usr/sbin/kas setfields -name admin -flags ADMIN -noauth /usr/bin/bos adduser $THISSYS admin -cell $THISCELL -noauth /usr/bin/bos addkey $THISSYS -key $THISPASS -kvno 0 -cell $THISCELL -noauth echo "about to pts createuser . . . sleeping 10 seconds" sleep 10 # Configure group membership for admin # /usr/bin/pts createuser -name admin -cell $THISCELL -noauth /usr/bin/pts adduser -user admin -group system:administrators \ -cell $THISCELL -noauth # restart the database servers to take advantage of the new key # /usr/bin/bos restart -server $THISSYS -all -cell $THISCELL -noauth sleep 2 # # Start file server processes # /usr/bin/bos create $THISSYS fs fs /usr/afs/bin/fileserver \ /usr/afs/bin/volserver /usr/afs/bin/salvager \ -cell $THISCELL -noauth echo "performing vos create command . . . sleeping 10 seconds" sleep 10 # Create the root AFS volume root.afs # /usr/sbin/vos create $THISSYS /vicepa root.afs \ -cell $THISCELL -noauth # # Start the update server processes # /usr/bin/bos create $THISSYS upserver simple \ "/usr/afs/bin/upserver -crypt /usr/afs/etc" \ -cell $THISCELL -noauth ## ## Restart the servers here: afsd must function to issue fs commands ## echo "restarting servers . . . sleeping 4 seconds" sleep 4 # kill all the afs processes # kill -9 `ps ax | grep afs | awk '{print $1}'` sleep 2 # make sure they are really dead # kill -9 `ps ax | grep afs | awk '{print $1}'` sleep 2 /sbin/rmmod `/sbin/lsmod | grep libafs | awk '{print $1}'` /etc/rc.d/init.d/afs start klog admin -password $THISPASS # # Configure a skeletal AFS structure--including access control # # access control and replication for the root filesystem # /usr/bin/fs setacl /afs system:anyuser rl /usr/sbin/vos addsite $THISSYS /vicepa root.afs /usr/sbin/vos release root.afs /usr/bin/fs checkvolumes # Create and configure the read-only copy of the root cell volume # /usr/sbin/vos create $THISSYS /vicepa root.cell /usr/bin/fs mkmount /afs/$THISCELL root.cell /usr/bin/fs setacl /afs/$THISCELL system:anyuser rl # Create and configure a (hidden) read-write copy of the root cell # /usr/bin/fs mkmount /afs/.$THISCELL root.cell -rw /usr/sbin/vos addsite $THISSYS /vicepa root.cell /usr/sbin/vos release root.cell /usr/bin/fs checkvolumes # Create and configure a home filesystem # /usr/sbin/vos create $THISSYS /vicepa root.home /usr/bin/fs mkmount /afs/${THISCELL}/home root.home /usr/bin/fs setacl /afs/${THISCELL}/home system:authuser rl # Create and configure a shared filesystem # /usr/sbin/vos create $THISSYS /vicepa root.shared /usr/bin/fs mkmount /afs/${THISCELL}/shared root.shared /usr/bin/fs setacl /afs/${THISCELL}/shared system:anyuser rl # # What to do next? protection groups, users . . . exit --------------E5D5EA556B1BAC01FAB34051-- From shadow@dementia.org Thu Oct 17 16:30:56 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 17 Oct 2002 11:30:56 -0400 (EDT) Subject: [OpenAFS] Linux kernels oops with openafs? In-Reply-To: <3DAED49E.9FD4B873@knox.edu> Message-ID: Does the sysconfig/afs file you copy in while configuring the servers have AFS_CLIENT=on or whatever? Try not enabling it until you have root.afs created on running fileservers. *or* run afsd with -dynroot. From tim@umbc.edu Thu Oct 17 16:33:00 2002 From: tim@umbc.edu (Tim C.) Date: Thu, 17 Oct 2002 11:33:00 -0400 (EDT) Subject: [OpenAFS] Windows AFS client -> UNIX In-Reply-To: Message-ID: > Putting files from WinNT to UNIX always sets new files to 777 when > transferred through the AFS client. > Does anyone have a suggestion how to avoid that and set a different default? > Any help is appreciated. > There's really not any way around it. Having it set to 777 is just how windows handles files, and really has nothing to do with AFS. Like if you have a partition shared between windows and linux, the files that you write in windows are all 777. Besides, in AFS, a most of the unix permissions don't have any meaning(with the exception of the x bit, and the user bits. :^} Tim ----------------------------------------------------------------------- Tim Craig These are my opinions and not my employers. :) OIT-Systems & Imaging Research Center tim@umbc.edu It's hard to be serious when you're naked. - Garfield ----------------------------------------------------------------------- From warlord@MIT.EDU Thu Oct 17 16:34:00 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 11:34:00 -0400 Subject: [OpenAFS] Linux kernels oops with openafs? In-Reply-To: <3DAED49E.9FD4B873@knox.edu> References: <3DAED49E.9FD4B873@knox.edu> Message-ID: You cannot rmmod libafs until you actually start afsd. you are effectively running: insmod libafs rmmod libafs Which is known to "Not Work". Instead of "rmmod libafs; /etc/init.d/afs start" why not just "afsd"? -derek Andrew Leahy writes: > Hello, > > I've been working to install an openafs server for the first time (RH > Linux 7.2/kernel 2.4.9-34/Openafs 1.2.6) and I've been seeing some > kernel oopses. (See the attached file.) > > I'm not certain what is causing this, but I've been writing a script > (also attached) to automate the basic configuration of the openafs > server. The script loads and unloads the libopenafs modules and starts > up the servers a couple of times. The script seems to work fine (in the > sense that I can see what I should see in /afs when it's done), but > would, say, loading and unloading the libopenafs modules cause problems? > > The only overt symptom of the problem is that when it happens it's > impossible to kill the afsd processes short of a reboot. I've also been > experiencing problems where I can authenticate successfully against the > kaserver from another client, but I can't see anything in /afs on the > client. (In fact, I've never been able to see anything in /afs from the > client system. I don't know if this is related.) > > Does anybody know what to make of this? > > Thanks for your help. > > Andrew LeahyOct 16 16:20:56 pc14341 kernel: WARM shutting down of: CB... afs... BkG... CTrunc... AFSDB... RxEvent... RxListener... > Oct 16 16:26:37 pc14341 kernel: Starting AFS cache scan...found 0 non-empty cache files (0%%). > Oct 16 16:29:51 pc14341 kernel: IPUT Bad refCount 0 on inode 0xcc99e000 > Oct 16 16:29:51 pc14341 kernel: Unable to handle kernel paging request at virtual address ffffffff > Oct 16 16:29:51 pc14341 kernel: printing eip: > Oct 16 16:29:51 pc14341 kernel: cc8c0b68 > Oct 16 16:29:51 pc14341 kernel: *pde = 00001063 > Oct 16 16:29:51 pc14341 kernel: *pte = 00000000 > Oct 16 16:29:51 pc14341 kernel: Oops: 0002 > Oct 16 16:29:51 pc14341 kernel: Kernel 2.4.9-34 > Oct 16 16:29:51 pc14341 kernel: CPU: 0 > Oct 16 16:29:51 pc14341 kernel: EIP: 0010:[] Tainted: PF > Oct 16 16:29:51 pc14341 kernel: EFLAGS: 00010286 > Oct 16 16:29:51 pc14341 kernel: EIP is at osi_Panic [libafs-2.4.9-34-i386] 0x28 > Oct 16 16:29:51 pc14341 kernel: eax: 00000028 ebx: cc99e000 ecx: 00000007 edx: cbfe5090 > Oct 16 16:29:51 pc14341 kernel: esi: cc99e000 edi: cc8e4e20 ebp: cc8e4dec esp: c3c09efc > Oct 16 16:29:51 pc14341 kernel: ds: 0018 es: 0018 ss: 0018 > Oct 16 16:29:51 pc14341 kernel: Process umount (pid: 1948, stackpage=c3c09000) > Oct 16 16:29:51 pc14341 kernel: Stack: cc8ca045 cc8dabc0 00000000 cc99e000 cc99e010 c1691450 c1691484 c2dcd120 > Oct 16 16:29:51 pc14341 kernel: c0142790 cc99e000 cc99e000 c2dcd120 c2dcd120 cc8e4e20 cc8e4dec c94b0800 > Oct 16 16:29:51 pc14341 kernel: c2dcd120 c0136d5f c2dcd120 c2dcd120 c3c09f88 00000000 c4a17000 08053bd0 > Oct 16 16:29:51 pc14341 kernel: Call Trace: [] osi_iput [libafs-2.4.9-34-i386] 0x29 > Oct 16 16:29:51 pc14341 kernel: [] __insmod_libafs-2.4.9-34-i386_S.rodata_L2024 [libafs-2.4.9-34-i386] 0x3dc0 > Oct 16 16:29:51 pc14341 kernel: [dput+236/364] dput [kernel] 0xec > Oct 16 16:29:51 pc14341 kernel: [] dput [kernel] 0xec > Oct 16 16:29:51 pc14341 kernel: [] afs_sops [libafs-2.4.9-34-i386] 0x0 > Oct 16 16:29:51 pc14341 kernel: [] afs_file_system [libafs-2.4.9-34-i386] 0x0 > Oct 16 16:29:51 pc14341 kernel: [kill_super+91/324] kill_super [kernel] 0x5b > Oct 16 16:29:51 pc14341 kernel: [] kill_super [kernel] 0x5b > Oct 16 16:29:51 pc14341 kernel: [path_release+39/48] path_release [kernel] 0x27 > Oct 16 16:29:51 pc14341 kernel: [] path_release [kernel] 0x27 > Oct 16 16:29:51 pc14341 kernel: [do_umount+176/204] do_umount [kernel] 0xb0 > Oct 16 16:29:51 pc14341 kernel: [] do_umount [kernel] 0xb0 > Oct 16 16:29:51 pc14341 kernel: [sys_umount+201/228] sys_umount [kernel] 0xc9 > Oct 16 16:29:51 pc14341 kernel: [] sys_umount [kernel] 0xc9 > Oct 16 16:29:51 pc14341 kernel: [sys_oldumount+11/16] sys_oldumount [kernel] 0xb > Oct 16 16:29:51 pc14341 kernel: [] sys_oldumount [kernel] 0xb > Oct 16 16:29:51 pc14341 kernel: [system_call+51/56] system_call [kernel] 0x33 > Oct 16 16:29:51 pc14341 kernel: [] system_call [kernel] 0x33 > Oct 16 16:29:51 pc14341 kernel: > Oct 16 16:29:51 pc14341 kernel: > Oct 16 16:29:51 pc14341 kernel: Code: c6 05 ff ff ff ff 2a c3 55 57 56 53 56 8b 7c 24 1c 83 ff 01 > #!/bin/sh > # > # Set up some basic variables > # > > THISSYS= > THISIP= > THISCELL= > THISNAME= > THISDRV= > THISPASS= > SRCDIR= > RHRLS= > > # > # Install the basic RPM's > # > cd ${SRCDIR}/${RHRLS} > rpm -Uvh openafs-1.2.6-rh7.2.1.i386.rpm > rpm -Uvh openafs-kernel-1.2.6-rh7.2.1.i386.rpm > rpm -Uvh openafs-client-1.2.6-rh7.2.1.i386.rpm > > ## > ## Client Configuration > ## > # Set the AFS cache (for the cachemanager) to a larger size > # > cat < /usr/vice/etc/cacheinfo > /afs:/usr/vice/cache:2000000 > EOF > > echo "Don't Worry! I'm changing the cache size in cacheinfo to 2 GB" > echo "" > echo "Don't Worry! I'm ignoring authentication for now" > > # Configure ThisCell file (for the client) > # > cat < /usr/vice/etc/ThisCell > $THISCELL > EOF > > # Configure CellServDB file (for the client) > # > cat <> /usr/vice/etc/CellServDB > >$THISCELL #$THISNAME > $THISIP #$THISSYS > EOF > > ## > ## Authentication configuration stuff for PAM, etc. would go here !!!!!! > ## > > ## > ## Install and configure the server > ## > # Install the server RPM > # > > rpm -Uvh openafs-server-1.2.6-rh7.2.1.i386.rpm > > # Configure and start the afs server > # > echo "Don't Worry! I'm modifying /etc/sysconfig/afs to turn AFS_SERVER on" > echo "" > > cp -f $SRCDIR/config/sysconfig-afs-server /etc/sysconfig/afs > MODNAME=`/usr/vice/etc/afsmodname` > /sbin/insmod -f /usr/vice/etc/modload/$MODNAME > > # Make and mount the appropriate vicepX partitions > # > /sbin/mke2fs $THISDRV > > /bin/mkdir /vicepa > /bin/cat <> /etc/fstab > $THISDRV /vicepa ext2 defaults 0 2 > EOF > > /bin/mount -a > > # start and configure the BOS server > # > /usr/afs/bin/bosserver -noauth & > /usr/bin/bos setcellname $THISSYS $THISCELL -noauth > > # > # configure the other (non-fileserver) processes on this server > # > > # > # the authentication server . . . > /usr/bin/bos create $THISSYS kaserver simple /usr/afs/bin/kaserver \ > -cell $THISCELL -noauth > > # the backup server . . . > /usr/bin/bos create $THISSYS buserver simple /usr/afs/bin/kaserver \ > -cell $THISCELL -noauth > > # the protection server . . . > /usr/bin/bos create $THISSYS ptserver simple /usr/afs/bin/ptserver \ > -cell $THISCELL -noauth > > # the volumne location server > /usr/bin/bos create $THISSYS vlserver simple /usr/afs/bin/vlserver \ > -cell $THISCELL -noauth > > # Create the initial afs and admin accounts in AFS > # > /usr/sbin/kas create -name afs -initial_password $THISPASS -noauth > /usr/sbin/kas create -name admin -initial_password $THISPASS -noauth > /usr/sbin/kas setfields -name admin -flags ADMIN -noauth > /usr/bin/bos adduser $THISSYS admin -cell $THISCELL -noauth > /usr/bin/bos addkey $THISSYS -key $THISPASS -kvno 0 -cell $THISCELL -noauth > > echo "about to pts createuser . . . sleeping 10 seconds" > sleep 10 > > # Configure group membership for admin > # > /usr/bin/pts createuser -name admin -cell $THISCELL -noauth > /usr/bin/pts adduser -user admin -group system:administrators \ > -cell $THISCELL -noauth > > # restart the database servers to take advantage of the new key > # > /usr/bin/bos restart -server $THISSYS -all -cell $THISCELL -noauth > > sleep 2 > # > # Start file server processes > # > /usr/bin/bos create $THISSYS fs fs /usr/afs/bin/fileserver \ > /usr/afs/bin/volserver /usr/afs/bin/salvager \ > -cell $THISCELL -noauth > > echo "performing vos create command . . . sleeping 10 seconds" > sleep 10 > > # Create the root AFS volume root.afs > # > /usr/sbin/vos create $THISSYS /vicepa root.afs \ > -cell $THISCELL -noauth > > # > # Start the update server processes > # > /usr/bin/bos create $THISSYS upserver simple \ > "/usr/afs/bin/upserver -crypt /usr/afs/etc" \ > -cell $THISCELL -noauth > > ## > ## Restart the servers here: afsd must function to issue fs commands > ## > > echo "restarting servers . . . sleeping 4 seconds" > sleep 4 > > # kill all the afs processes > # > kill -9 `ps ax | grep afs | awk '{print $1}'` > sleep 2 > > # make sure they are really dead > # > kill -9 `ps ax | grep afs | awk '{print $1}'` > sleep 2 > /sbin/rmmod `/sbin/lsmod | grep libafs | awk '{print $1}'` > > /etc/rc.d/init.d/afs start > klog admin -password $THISPASS > > # > # Configure a skeletal AFS structure--including access control > # > > # access control and replication for the root filesystem > # > /usr/bin/fs setacl /afs system:anyuser rl > /usr/sbin/vos addsite $THISSYS /vicepa root.afs > /usr/sbin/vos release root.afs > /usr/bin/fs checkvolumes > > # Create and configure the read-only copy of the root cell volume > # > /usr/sbin/vos create $THISSYS /vicepa root.cell > /usr/bin/fs mkmount /afs/$THISCELL root.cell > /usr/bin/fs setacl /afs/$THISCELL system:anyuser rl > > # Create and configure a (hidden) read-write copy of the root cell > # > /usr/bin/fs mkmount /afs/.$THISCELL root.cell -rw > /usr/sbin/vos addsite $THISSYS /vicepa root.cell > /usr/sbin/vos release root.cell > /usr/bin/fs checkvolumes > > # Create and configure a home filesystem > # > /usr/sbin/vos create $THISSYS /vicepa root.home > /usr/bin/fs mkmount /afs/${THISCELL}/home root.home > /usr/bin/fs setacl /afs/${THISCELL}/home system:authuser rl > > # Create and configure a shared filesystem > # > /usr/sbin/vos create $THISSYS /vicepa root.shared > /usr/bin/fs mkmount /afs/${THISCELL}/shared root.shared > /usr/bin/fs setacl /afs/${THISCELL}/shared system:anyuser rl > > # > # What to do next? protection groups, users . . . > > exit > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 16:48:29 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 17:48:29 +0200 Subject: [OpenAFS] krb5 migration Problems Message-ID: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> Hi, i still have the same problems using kerberos V authentication for Openafs. I installed a totally knew openafs-installation. I set up the bosserver with the server processes, everything works fine. I created the kerberos-ticket with kadmin-local -e des-cbc-crc:v4 and ktadd -e des-cbc-crc:v4 as described in the previos mails. asetkey works without problems, kvno is set right. root and admin are added to the UserList (bos adduser, pts createuser, pts adduser system:administrator), worked fine. But then i restart the bosserver without the noauth-flag I kinit as admin and do aklog successfully. I got afs-tokens with user ID 1. when i want to do "pts listentries" i get the following again: pts: ticket contained unknown key version number ; unable to list entries I am not allowed to change the rights for root.afs (/afs) and do not get access, although the volume is created. Thanks Klaas From warlord@MIT.EDU Thu Oct 17 16:52:47 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 11:52:47 -0400 Subject: [OpenAFS] krb5 migration Problems In-Reply-To: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> Message-ID: What do you get from: klist -k -e -f afskeytab klist -e Also, what version of krb5 are you running? -derek "Klaas Hagemann" writes: > Hi, > > i still have the same problems using kerberos V authentication for Openafs. > I installed a totally knew openafs-installation. > I set up the bosserver with the server processes, everything works fine. > I created the kerberos-ticket with > kadmin-local -e des-cbc-crc:v4 and > ktadd -e des-cbc-crc:v4 > as described in the previos mails. > > asetkey works without problems, kvno is set right. > root and admin are added to the UserList (bos adduser, pts createuser, pts > adduser system:administrator), worked fine. > But then i restart the bosserver without the noauth-flag > I kinit as admin and do aklog successfully. I got afs-tokens with user ID 1. > when i want to do "pts listentries" i get the following again: > > pts: ticket contained unknown key version number ; unable to list entries > > I am not allowed to change the rights for root.afs (/afs) and do not get > access, although the volume is created. > > Thanks > Klaas > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From aleahy@knox.edu Thu Oct 17 17:11:17 2002 From: aleahy@knox.edu (Andrew Leahy) Date: Thu, 17 Oct 2002 12:11:17 -0400 Subject: [OpenAFS] Linux kernels oops with openafs? References: <3DAED49E.9FD4B873@knox.edu> Message-ID: <3DAEE125.AF50A2DC@knox.edu> Derek Atkins wrote: > > You cannot rmmod libafs until you actually start afsd. you are effectively > running: > > insmod libafs > rmmod libafs > > Which is known to "Not Work". Instead of "rmmod libafs; > /etc/init.d/afs start" why not just "afsd"? I think both responses are pointing toward the same problem. I have a follow-up question which may clear things up for me: Is libafs only used by afsd? That is, is it necessary to run MODNAME=`/usr/vice/etc/afsmodname` /sbin/insmod -f /usr/vice/etc/modload/$MODNAME prior to doing the various bits of server configuration, or can I just ditch it. Then kill the various server commands and run /etc/rc.d/init.d/afs start (with server and client options set to on) once I have root.afs set up and need to run commands from fs and afsd? Thanks for your help. Andrew Leahy From kerberos@northsailor.de Thu Oct 17 17:12:03 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 18:12:03 +0200 Subject: [OpenAFS] krb5 migration Problems References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> Message-ID: <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> > What do you get from: > > klist -k -e -f afskeytab This option (-e -f does not work, sorry.. )dmzs2:/tmp # klist -e -k -t afskeytab Keytab name: FILE:afskeytab KVNO Timestamp Principal ---- ----------------- ----------------------------------------------------- --- 3 10/17/02 18:01:24 afs/mydomain.de@MYDOMAIN.DE (DES cbc mode with CRC-32) > klist -e dmzs2:/tmp # klist -e Ticket cache: FILE:/tmp/krb5cc_0 Default principal: admin@MYDOMAIN.DE Valid starting Expires Service principal 10/17/02 18:03:09 10/18/02 04:03:07 krbtgt/MYDOMAIN.DE@MYDOMAIN.DE Etype (skey, tkt): Triple DES cbc mode with HMAC/sha1, DES cbc mode with CRC-32 10/17/02 18:03:11 10/18/02 04:03:07 afs/mydomain.de@MYDOMAIN.DE Etype (skey, tkt): DES cbc mode with CRC-32, DES cbc mode with CRC-32 > > Also, what version of krb5 are you running? I use MIT-Kerberos, Version 1.2.6 > -derek > > "Klaas Hagemann" writes: > > > Hi, > > > > i still have the same problems using kerberos V authentication for Openafs. > > I installed a totally knew openafs-installation. > > I set up the bosserver with the server processes, everything works fine. > > I created the kerberos-ticket with > > kadmin-local -e des-cbc-crc:v4 and > > ktadd -e des-cbc-crc:v4 > > as described in the previos mails. > > > > asetkey works without problems, kvno is set right. > > root and admin are added to the UserList (bos adduser, pts createuser, pts > > adduser system:administrator), worked fine. > > But then i restart the bosserver without the noauth-flag > > I kinit as admin and do aklog successfully. I got afs-tokens with user ID 1. > > when i want to do "pts listentries" i get the following again: > > > > pts: ticket contained unknown key version number ; unable to list entries > > > > I am not allowed to change the rights for root.afs (/afs) and do not get > > access, although the volume is created. > > > > Thanks > > Klaas > > > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 17 17:34:06 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 12:34:06 -0400 Subject: [OpenAFS] krb5 migration Problems In-Reply-To: <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> Message-ID: "Klaas Hagemann" writes: > This option (-e -f does not work, sorry.. Sorry.. -t was the option you wanted (you did want I wanted!) [snip] Ok, your klist output looks fine, however.... > > Also, what version of krb5 are you running? > I use MIT-Kerberos, Version 1.2.6 This is your problem. Did you configure your KDC, as detailed in the kerberos documentation, to issue the "old-style" AFS tickets? -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 17:42:55 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 18:42:55 +0200 Subject: [OpenAFS] krb5 migration Problems References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv><04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> Message-ID: <050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> > "Klaas Hagemann" writes: > > > This option (-e -f does not work, sorry.. > > Sorry.. -t was the option you wanted (you did want I wanted!) > > [snip] > > Ok, your klist output looks fine, however.... > > > > Also, what version of krb5 are you running? > > I use MIT-Kerberos, Version 1.2.6 > > This is your problem. Did you configure your KDC, as detailed in the > kerberos documentation, to issue the "old-style" AFS tickets? I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if that is what you mean.... otherwise please give me a short hint. Klaas > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 17 17:50:50 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 12:50:50 -0400 Subject: [OpenAFS] Linux kernels oops with openafs? In-Reply-To: <3DAEE125.AF50A2DC@knox.edu> References: <3DAED49E.9FD4B873@knox.edu> <3DAEE125.AF50A2DC@knox.edu> Message-ID: libafs is used by afsd and by the client-side apps (for token storage). On the server-side, libafs is only used by the inode-based fileserver, which does not exist for linux. -derek Andrew Leahy writes: > Derek Atkins wrote: > > > > You cannot rmmod libafs until you actually start afsd. you are effectively > > running: > > > > insmod libafs > > rmmod libafs > > > > Which is known to "Not Work". Instead of "rmmod libafs; > > /etc/init.d/afs start" why not just "afsd"? > > I think both responses are pointing toward the same problem. I have a > follow-up question which may clear things up for me: Is libafs only > used by afsd? That is, is it necessary to run > > MODNAME=`/usr/vice/etc/afsmodname` > /sbin/insmod -f /usr/vice/etc/modload/$MODNAME > > prior to doing the various bits of server configuration, or can I just > ditch it. Then kill the various server commands and run > > /etc/rc.d/init.d/afs start > > (with server and client options set to on) once I have root.afs set up > and need to run commands from fs and afsd? > > Thanks for your help. > > Andrew Leahy > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 17 17:52:20 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 12:52:20 -0400 Subject: [OpenAFS] krb5 migration Problems In-Reply-To: <050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> <050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> Message-ID: "Klaas Hagemann" writes: > > This is your problem. Did you configure your KDC, as detailed in the > > kerberos documentation, to issue the "old-style" AFS tickets? > > I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if that > is what you mean.... > otherwise please give me a short hint. No, that is not what I mean. The hint is "Search the docs for "AFS" because the 1.2.6 release has special support for v5-based tokens". I don't know anything more than that. Read the krb5 release notes and other documentation. > Klaas -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 18:11:43 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 19:11:43 +0200 Subject: [OpenAFS] krb5 migration Problems References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv><04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv><050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> Message-ID: <051201c27600$466fba00$2b03a8c0@mummert.priv> Hi Derek, I found the hints (README in /src/krb524/), i tried it but it does not help. this depends on the krb524-server, i use? I still have an old krb5 1.2.5 server and with this one it is the same. Or is the Master-Server the main point? I will try it at the kerberos Mailing-List. Klaas > "Klaas Hagemann" writes: > > > > This is your problem. Did you configure your KDC, as detailed in the > > > kerberos documentation, to issue the "old-style" AFS tickets? > > > > I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if that > > is what you mean.... > > otherwise please give me a short hint. > > No, that is not what I mean. The hint is "Search the docs for "AFS" > because the 1.2.6 release has special support for v5-based tokens". I > don't know anything more than that. Read the krb5 release notes and > other documentation. > > > Klaas > > -derek > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From warlord@MIT.EDU Thu Oct 17 18:17:55 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 13:17:55 -0400 Subject: [OpenAFS] krb5 migration Problems In-Reply-To: <051201c27600$466fba00$2b03a8c0@mummert.priv> References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> <050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> <051201c27600$466fba00$2b03a8c0@mummert.priv> Message-ID: I dont know, sorry. Maybe Sam Hartman can chime in here? -derek "Klaas Hagemann" writes: > Hi Derek, > > I found the hints (README in /src/krb524/), i tried it but it does not help. > this depends on the krb524-server, i use? > I still have an old krb5 1.2.5 server and with this one it is the same. > Or is the Master-Server the main point? > I will try it at the kerberos Mailing-List. > > Klaas > > > "Klaas Hagemann" writes: > > > > > > This is your problem. Did you configure your KDC, as detailed in the > > > > kerberos documentation, to issue the "old-style" AFS tickets? > > > > > > I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if > that > > > is what you mean.... > > > otherwise please give me a short hint. > > > > No, that is not what I mean. The hint is "Search the docs for "AFS" > > because the 1.2.6 release has special support for v5-based tokens". I > > don't know anything more than that. Read the krb5 release notes and > > other documentation. > > > > > Klaas > > > > -derek > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From kerberos@northsailor.de Thu Oct 17 18:23:50 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Thu, 17 Oct 2002 19:23:50 +0200 Subject: [OpenAFS] krb5 migration Problems References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv><04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv><050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> Message-ID: <052401c27602$031dec20$2b03a8c0@mummert.priv> Derek, thanks a lot for your help, i have my master-server still on krb5-1.2.4 and tried this one. It works perfect, although it still does not work on krb5-1.2.6 But i will find this out. Do you want to get informed then? Klaas > "Klaas Hagemann" writes: > > > > This is your problem. Did you configure your KDC, as detailed in the > > > kerberos documentation, to issue the "old-style" AFS tickets? > > > > I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if that > > is what you mean.... > > otherwise please give me a short hint. > > No, that is not what I mean. The hint is "Search the docs for "AFS" > because the 1.2.6 release has special support for v5-based tokens". I > don't know anything more than that. Read the krb5 release notes and > other documentation. > > > Klaas > > -derek > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From warlord@MIT.EDU Thu Oct 17 18:30:10 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 13:30:10 -0400 Subject: [OpenAFS] krb5 migration Problems In-Reply-To: <052401c27602$031dec20$2b03a8c0@mummert.priv> References: <04cd01c275f4$a3e29240$2b03a8c0@mummert.priv> <04f901c275f7$eeb35fe0$2b03a8c0@mummert.priv> <050401c275fc$3f0e37e0$2b03a8c0@mummert.priv> <052401c27602$031dec20$2b03a8c0@mummert.priv> Message-ID: You might as well send mail to openafs-info so everyone knows the answer (and it will go into the archives for future reference). -derek "Klaas Hagemann" writes: > Derek, > > thanks a lot for your help, > i have my master-server still on krb5-1.2.4 and tried this one. > It works perfect, although it still does not work on krb5-1.2.6 > But i will find this out. > Do you want to get informed then? > > Klaas > > > > "Klaas Hagemann" writes: > > > > > > This is your problem. Did you configure your KDC, as detailed in the > > > > kerberos documentation, to issue the "old-style" AFS tickets? > > > > > > I used kadmin.local -e des-cbc-crc:v4 when creating the principal, if > that > > > is what you mean.... > > > otherwise please give me a short hint. > > > > No, that is not what I mean. The hint is "Search the docs for "AFS" > > because the 1.2.6 release has special support for v5-based tokens". I > > don't know anything more than that. Read the krb5 release notes and > > other documentation. > > > > > Klaas > > > > -derek > > > > -- > > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > > Member, MIT Student Information Processing Board (SIPB) > > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > > warlord@MIT.EDU PGP key available > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From hrs@mathematik.uni-stuttgart.de Thu Oct 17 23:11:43 2002 From: hrs@mathematik.uni-stuttgart.de (Heiko Schulz) Date: Fri, 18 Oct 2002 00:11:43 +0200 (CEST) Subject: [OpenAFS] kernel 2.4.19 problem Message-ID: <200210172211.g9HMBh7G028438@vwin.mathematik.uni-stuttgart.de> Hi, has somebody experience with openafs and kernel 2.4.19? With kernel 2.4.18 and openafs 1.2.3 I had no problems. Also with kernel 2.4.19 openafs works well, only in /afs I get a "stale nfs file handle". I tried the same with openafs 1.2.7 and kernel 2.4.19 - no change. Thanks a lot in advance for good ideas. Heiko Schulz -- Dr. Heiko Schulz Fachbereich Mathematik Systemadministration Pfaffenwaldring 57 Universität Stuttgart Tel. : (0711) 685 5344 Fax : (0711) 685 5348 E-Mail : schulz@mathematik.uni-stuttgart.de From warlord@MIT.EDU Fri Oct 18 01:13:34 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 17 Oct 2002 20:13:34 -0400 Subject: [OpenAFS] kernel 2.4.19 problem In-Reply-To: <200210172211.g9HMBh7G028438@vwin.mathematik.uni-stuttgart.de> References: <200210172211.g9HMBh7G028438@vwin.mathematik.uni-stuttgart.de> Message-ID: Is this a 2.4.19 from kernel.org, or a 2.4.19 with a lot of patches for some particular distribution? -derek Heiko Schulz writes: > Hi, > > has somebody experience with openafs and kernel 2.4.19? > > With kernel 2.4.18 and openafs 1.2.3 I had no problems. Also with > kernel 2.4.19 openafs works well, only in /afs I get a "stale nfs file > handle". I tried the same with openafs 1.2.7 and kernel 2.4.19 - no change. > > Thanks a lot in advance for good ideas. > > Heiko Schulz > > > -- > Dr. Heiko Schulz > Fachbereich Mathematik > Systemadministration > Pfaffenwaldring 57 > Universität Stuttgart > > Tel. : (0711) 685 5344 > Fax : (0711) 685 5348 > E-Mail : schulz@mathematik.uni-stuttgart.de > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From vsrikanth@in.ibm.com Fri Oct 18 01:20:20 2002 From: vsrikanth@in.ibm.com (Srikanth Vishwanathan) Date: Thu, 17 Oct 2002 20:20:20 -0400 Subject: [OpenAFS] kernel 2.4.19 problem Message-ID: > kernel 2.4.19 openafs works well, only in /afs I get a "stale nfs file > handle". I tried the same with openafs 1.2.7 and kernel 2.4.19 - no change. I belive this has been fixed by the following code change in afs_linux_dentry_revalidate: /* If it is the AFS root, then there's no chance it needs revalidating */ if (vcp == afs_globalVp) { bad_dentry = 0; goto done; } From kerberos@northsailor.de Fri Oct 18 11:47:14 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Fri, 18 Oct 2002 12:47:14 +0200 Subject: [OpenAFS] Problems in stopping the afs-client Message-ID: <006901c27693$baf53f60$2b03a8c0@mummert.priv> Hi, i have problems in stopping the AFS-Client in the new Version (1.2.7) The libafs-module is always in use, so that i cannot rmmod it. As far as i can see it are there no processes running on /afs/. I am using suse linux 8.1, 2,4,19. Klaas From 6delgado@informatik.uni-hamburg.de Fri Oct 18 12:04:39 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Fri, 18 Oct 2002 13:04:39 +0200 Subject: [6delgado@informatik.uni-hamburg.de: [OpenAFS] OpenAFS with MIT Kerberos >= 1.2.6] Message-ID: <20021018110438.GA30627@taupan.ath.cx> --QKdGvSO+nmPlgiQ/ Content-Type: multipart/mixed; boundary="7JfCtLOvnd9MIVvH" Content-Disposition: inline --7JfCtLOvnd9MIVvH Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! The configuration example mentioned in this mail might help with Migrating OpenAFS to Kerberos 1.2.6. Kind regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --7JfCtLOvnd9MIVvH Content-Type: message/rfc822 Content-Disposition: inline Received: from localhost ([127.0.0.1]) by abrasax.taupan.ath.cx with esmtp (Exim 3.36 #1 (Debian)) id 17zF5n-0001VD-00 for ; Wed, 09 Oct 2002 13:33:31 +0200 Received: from rzdspc2.informatik.uni-hamburg.de [134.100.9.62] by localhost with IMAP (fetchmail-5.9.11) for friedel@localhost (single-drop); Wed, 09 Oct 2002 13:33:31 +0200 (CEST) Received: from rzdspc1.informatik.uni-hamburg.de (root@rzdspc1.informatik.uni-hamburg.de [134.100.9.61]) by rzdspc2.informatik.uni-hamburg.de (8.12.6/8.12.6) with ESMTP id g99BVOIx026392 for <6delgado@informatik.uni-hamburg.de>; Wed, 9 Oct 2002 13:31:24 +0200 (CEST) Received: from grand.central.org (GRAND.CENTRAL.ORG [128.2.194.109]) by rzdspc1.informatik.uni-hamburg.de (8.12.6/8.12.6) with ESMTP id g99BVJtk004929 for <6delgado@informatik.uni-hamburg.de>; Wed, 9 Oct 2002 13:31:19 +0200 (CEST) Received: from grand.central.org (localhost.localdomain [127.0.0.1]) by grand.central.org (Postfix) with ESMTP id 24B959D4E; Wed, 9 Oct 2002 07:31:05 -0400 (EDT) Delivered-To: openafs-info@openafs.org Received: from mailout08.sul.t-online.com (mailout08.sul.t-online.com [194.25.134.20]) by grand.central.org (Postfix) with ESMTP id AF92F9D39 for ; Wed, 9 Oct 2002 07:30:23 -0400 (EDT) Received: from fwd02.sul.t-online.de by mailout08.sul.t-online.com with smtp id 17zF2g-000353-0G; Wed, 09 Oct 2002 13:30:18 +0200 Received: from abrasax.taupan.ath.cx (520097860562-0001@[217.80.9.253]) by fmrl02.sul.t-online.com with esmtp id 17zF2S-24toOWC; Wed, 9 Oct 2002 13:30:04 +0200 Received: from friedel by abrasax.taupan.ath.cx with local (Exim 3.36 #1 (Debian)) id 17zF2R-0001V4-00 for ; Wed, 09 Oct 2002 13:30:03 +0200 From: Friedrich Delgado Friedrichs <6delgado@informatik.uni-hamburg.de> To: openafs-info@openafs.org Message-ID: <20021009113003.GA5715@taupan.ath.cx> Reply-To: 6delgado@informatik.uni-hamburg.de Mail-Followup-To: openafs-info@openafs.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Kj7319i9nmIyA2yE" Content-Disposition: inline User-Agent: Mutt/1.4i X-Gotcha: For what reason exactly are you reading this header, huh? X-Disclaimer: This is not an automatically generated header. X-Sender: 520097860562-0001@t-dialin.net Subject: [OpenAFS] OpenAFS with MIT Kerberos >= 1.2.6 Sender: openafs-info-admin@openafs.org Errors-To: openafs-info-admin@openafs.org X-BeenThere: openafs-info@openafs.org X-Mailman-Version: 2.0.4 Precedence: bulk List-Help: List-Post: List-Subscribe: , List-Id: OpenAFS Info/Discussion List-Unsubscribe: , List-Archive: Date: Wed, 9 Oct 2002 13:30:03 +0200 X-Virus-Scanned: by AMaViS-perl11-milter (http://amavis.org/) X-Spam-Status: No, hits=-9.2 required=5.0 tests=KNOWN_MAILING_LIST,PGP_SIGNATURE_2,SPAM_PHRASE_01_02, USER_AGENT,USER_AGENT_MUTT version=2.41 X-Spam-Level: --Kj7319i9nmIyA2yE Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hiho! I'm using OpenAFS 1.2.7 with Kerberos 5 and after upgrading to the 1.2.6 Release of MIT Kerberos yesterday, the afsd started rejecting tokens. After diving into the Documentation (if all else fails, read the docs :) i disabled the "new style" of afs tokens in the [appdefaults] section of the krb5.conf file on all hosts as follows: [appdefaults] afs_krb5 =3D { MYREALM.DOM =3D { afs =3D false } } "MYREALM.DOM" is of course just an example. Apparently, Kerberos 1.2.6 is not only able to return the encrypted part of a Kerberos 5 Ticket as a Token to an "afs/*@*" principal but does so by default. The user has to disable it manually, if the AFS Server is unable to use the Token, which seems to be the case with my OpenAFS installation (1.2.7, compiled from unpatched sources, linked against MIT Kerberos 5 1.2.5) or my Kerberos Migration Kit (Version 1.3). Question: Is it/will it be possible to use this feature, rather then disabl= e it, with some Release of OpenAFS? Which one? How? I seem to be unable to find any docs about this, other than the short notice in the MIT Kerberos 5= source tree. It would be nice to get rid of Kerberos 4 and single DES in the long run. Kind regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --Kj7319i9nmIyA2yE Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEYEARECAAYFAj2kEzsACgkQCTmCEtF2zEBVuwCeO2kg+BEfaEGgadqL5wNFwVgK BOQAniF1RCzJlm4YWh7J7K7tg9lR2Mzd =u/oo -----END PGP SIGNATURE----- --Kj7319i9nmIyA2yE-- _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info --7JfCtLOvnd9MIVvH-- --QKdGvSO+nmPlgiQ/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEUEARECAAYFAj2v6sYACgkQCTmCEtF2zEDr3QCUDogULtLy+T0zGeEZGvjtWp4G TQCgmVZHH91jrqgVGnhSg4K+iPZeLo8= =tb6n -----END PGP SIGNATURE----- --QKdGvSO+nmPlgiQ/-- From warlord@MIT.EDU Fri Oct 18 13:50:49 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 18 Oct 2002 08:50:49 -0400 Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: <006901c27693$baf53f60$2b03a8c0@mummert.priv> References: <006901c27693$baf53f60$2b03a8c0@mummert.priv> Message-ID: Did you try "umount /afs" before you rmmod? -derek "Klaas Hagemann" writes: > Hi, > > i have problems in stopping the AFS-Client in the new Version (1.2.7) > The libafs-module is always in use, so that i cannot rmmod it. > As far as i can see it are there no processes running on /afs/. > I am using suse linux 8.1, 2,4,19. > > Klaas > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Fri Oct 18 13:54:54 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 08:54:54 -0400 (EDT) Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: Message-ID: On 18 Oct 2002, Derek Atkins wrote: > Did you try "umount /afs" before you rmmod? Proper shutdown order is umount /afs /usr/vice/etc/afsd -shutdown rmmod (afs module) > "Klaas Hagemann" writes: > > > Hi, > > > > i have problems in stopping the AFS-Client in the new Version (1.2.7) > > The libafs-module is always in use, so that i cannot rmmod it. > > As far as i can see it are there no processes running on /afs/. > > I am using suse linux 8.1, 2,4,19. > > > > Klaas > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From Andrei Maslennikov Fri Oct 18 16:56:12 2002 From: Andrei Maslennikov (Andrei Maslennikov) Date: Fri, 18 Oct 2002 15:56:12 +0000 ( ) Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: Message-ID: "Klaas Hagemann" writes: > > i have problems in stopping the AFS-Client in the new Version (1.2.7) > The libafs-module is always in use, so that i cannot rmmod it. > As far as i can see it are there no processes running on /afs/. > I am using suse linux 8.1, 2,4,19. > It might be that the old problem with "umount /afs" that we have signalled to Transarc a couple of years may still be around. At that time we have noted that, if the following sequence of events occurs: 1) AFS is started on the client that has its clock not in sync with that of the servers; 2) Our post-start script (invoked from within AFS) adjusts the clock of the client to that of servers without waiting until afsd does it by itself. then, if we try to "unmount /afs", this command hangs for the time equal to that of the initial time shift between the client and servers. If no activity inside /afs occurs between its start and the attempt to unmount, there are no delays. The workaround is pretty simple, as it is enough to sync the client and servers' clocks *BEFORE* afsd was started. We added it to our afsclient rpm (see a 3-line script below), and since then have never worried about it. That we observed in 1998-1999, and I thought it was ironed out by Transarc. Clearly, if the problem is still there, it has to be solved in a more systematic way. Andrei. NB: The script obviously makes sense only if CellServDB is used on the client (not "-afsdb"). [root@main ~]# cat /usr/vice/etc/settime.sh #!/bin/sh # # andrei@caspur.it - 1999 # # This sets the client's clock in sync with that of AFS server(s). # Hopefully at least one server declared in CellServDB # will respond... # # read cell < /usr/vice/etc/ThisCell awk -v cell=$cell 'BEGIN{incell=0; cell=">"cell; nsrv=0} { if($1==cell) { getline; incell=1 } if(incell && substr($1,1,1)==">") { incell=0 } if(incell) { nsrv++; srv[nsrv]=$1 } } END{ for(i=1;i<=nsrv;i++) { com="/usr/afsws/etc/ntp -sf "srv[i]" >/dev/null 2>&1"; system(com) } }' /usr/vice/etc/CellServDB From rees@umich.edu Fri Oct 18 17:06:18 2002 From: rees@umich.edu (Jim Rees) Date: Fri, 18 Oct 2002 12:06:18 -0400 Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: Andrei Maslennikov, Fri, 18 Oct 2002 15:56:12 -0000 Message-ID: <20021018160618.4199B207D5@citi.umich.edu> I think the default for afsd should be changed to "-nosettime", and a new option "-settime" should be introduced for those who need it. Afs has no business messing with the clock. Opinions? From danno@internet2.edu Fri Oct 18 17:08:04 2002 From: danno@internet2.edu (Dan Pritts) Date: Fri, 18 Oct 2002 12:08:04 -0400 Subject: [OpenAFS] Tokens that do not expire In-Reply-To: References: <003601c27578$6aaf3db0$01000001@ast> Message-ID: <20021018160804.GA24931@mail.internet2.edu> and there are scripts out there that will reauthenticate periodically so that you don't have to do it by hand. "reauth" comes to mind. also, I recall something from umich called "longrun". This of course *requires* either a hardcoded password in a reauthentication script or some other file-based method of obtaining the tokens (such as a kerberos srvtab/keytab). On Wed, Oct 16, 2002 at 10:14:01PM -0400, Derek Atkins wrote: > No, I do not believe so. But you can obtain new tokens before the old > ones expire.. > > -derek > > writes: > > > hi > > Is it possible to issue for certain users (process runners ) tokens that does not expire . > > > > Thanks > > -- > Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory > Member, MIT Student Information Processing Board (SIPB) > URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH > warlord@MIT.EDU PGP key available > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info danno -- dan pritts danno@internet2.edu systems administrator 734/352-4953 office internet2 734/546-4423 mobile From danno@internet2.edu Fri Oct 18 17:12:02 2002 From: danno@internet2.edu (Dan Pritts) Date: Fri, 18 Oct 2002 12:12:02 -0400 Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: <20021018160618.4199B207D5@citi.umich.edu> References: <20021018160618.4199B207D5@citi.umich.edu> Message-ID: <20021018161202.GC24931@mail.internet2.edu> On Fri, Oct 18, 2002 at 12:06:18PM -0400, Jim Rees wrote: > I think the default for afsd should be changed to "-nosettime", and a new > option "-settime" should be introduced for those who need it. Afs has no > business messing with the clock. > > Opinions? That seems like a reasonable default. Complaining about the clock is one thing, changing it is another. danno -- dan pritts danno@internet2.edu systems administrator 734/352-4953 office internet2 734/546-4423 mobile From kenh@cmf.nrl.navy.mil Fri Oct 18 17:13:02 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Fri, 18 Oct 2002 12:13:02 -0400 Subject: [OpenAFS] Tokens that do not expire In-Reply-To: Your message of "Fri, 18 Oct 2002 12:08:04 EDT." <20021018160804.GA24931@mail.internet2.edu> Message-ID: <200210181613.g9IGD2gB017903@ginger.cmf.nrl.navy.mil> >and there are scripts out there that will reauthenticate periodically >so that you don't have to do it by hand. "reauth" comes to >mind. also, I recall something from umich called "longrun". > >This of course *requires* either a hardcoded password in a >reauthentication script or some other file-based method of obtaining >the tokens (such as a kerberos srvtab/keytab). One additional thing to consider ... a ticket which never expires is equivalant to a hardcoded password/Kerberos keytab, so it's not like a never-expiring ticket gains you much in the way of security ... --Ken From Andrei Maslennikov Fri Oct 18 18:21:06 2002 From: Andrei Maslennikov (Andrei Maslennikov) Date: Fri, 18 Oct 2002 17:21:06 +0000 ( ) Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: <20021018161202.GC24931@mail.internet2.edu> Message-ID: On Fri, 18 Oct 2002, Dan Pritts wrote: > On Fri, Oct 18, 2002 at 12:06:18PM -0400, Jim Rees wrote: > > I think the default for afsd should be changed to "-nosettime", and a new > > option "-settime" should be introduced for those who need it. Afs has no > > business messing with the clock. > > > > Opinions? > > That seems like a reasonable default. > > Complaining about the clock is one thing, changing it is another. > Hmm. Clearly one of the base things with AFS is that all clients must be working in sync between each other, and with the servers. Apart from the obvious authentication problems (famous error "clocks are badly skewed"), mismatch in wallclock may lead to unpredictable results in the distributed environment. A classical example is that of "make" that has to be run on client A that has a clock behind that of client B where the sources are actually being modified. So I dissent from the idea to eliminate or disable by default the built-in syncro mechanisms (which, by the way, work). It is true that other means may be used for syncronization, but then two services (afs and, say, ntpd) should necessarily be maintained together instead of one (afs) on every host involved. If one starts to use ntpd on client and runs afsd with "-nosettime" (option normally used only on servers), then it is essential to make sure that servers run ntpd as well - which is not always the case. I.e.: switch this option in afsd, and you are suddenly before a lot more issues to manage... Andrei. From shadow@dementia.org Fri Oct 18 18:25:06 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 13:25:06 -0400 (EDT) Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: Message-ID: On Fri, 18 Oct 2002, Andrei Maslennikov wrote: > but then two services (afs and, say, ntpd) should necessarily > be maintained together instead of one (afs) on every host involved. > If one starts to use ntpd on client and runs afsd with "-nosettime" > (option normally used only on servers), then it is essential > to make sure that servers run ntpd as well - which is not always > the case. I.e.: switch this option in afsd, and you are suddenly > before a lot more issues to manage... We could integrate an ntp client, but that's been tried before. Something smarter though not cleaner would be to determine if ntp was running. From pittmed@pittmed.pitt.edu Fri Oct 18 18:36:22 2002 From: pittmed@pittmed.pitt.edu (Computers in Medicine) Date: Fri, 18 Oct 2002 13:36:22 -0400 Subject: [OpenAFS] Can't Load OpenAFS 1.2.7 Client Under RH 7.3 / Kernel 2.4.18-17.7.x Message-ID: <002a01c276cc$e0be5090$0280000a@pelican> This is a multi-part message in MIME format. ------=_NextPart_000_0027_01C276AB.59403320 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I was running OpenAFS 1.2.6 Under Red Hat 7.3 with kernel 2.4.18.10 with = no problems. Yesterday I upgraded to kernel 2.4.18-17.7.x using the Red = Hat RPMs. I then tried to build OpenAFS 1.2.7 as follows ./configure --with-linux-kernel-headers=3D/usr/src/linux-2.4.18-17.7.x make cp src/libafs/MODLOAD-2.4.18-17.7.x-SP/libafs-2.4.18-17.7.x.o \ /usr/vice/etc/modload /usr/vice/etc/makesymtable /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o When I tried to start afs using /etc/rc.d/init.d/afs start I got the = following error Found libafs-2.4.18-17.7.x.o from SymTable... Loading... Failed to load AFS client, not starting AFS services. I tracked this error down to the following line in /etc/rc.d/initd/afs = in the function load_clinet() /sbin/insmod ${PREFIX:+-P $PREFIX} -f -m $MODLOADDIR/$LIBAFS > \ $MODLOADDIR/libafs.map 2>&1 Removing the stderr redirection at the end now yields this error message = then I try /etc/rc.d/init.d/afs start Found libafs-2.4.18-17.7.x.o from SymTable... Loading... /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o: unresolved symbol = sys_call_table /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. Failed to load AFS client, not starting AFS services. So my question is how can I get OpenAFS working again? Did I do = something wrong? This procedure has always worked before when building = modules for new kernels. Any help would be greatly appreciated. ------=_NextPart_000_0027_01C276AB.59403320 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I was running OpenAFS 1.2.6 = Under Red Hat=20 7.3 with kernel 2.4.18.10 with no problems.  Yesterday I upgraded = to kernel=20 2.4.18-17.7.x using the Red Hat RPMs.  I then tried to build = OpenAFS 1.2.7=20 as follows
 
./configure=20 --with-linux-kernel-headers=3D/usr/src/linux-2.4.18-17.7.x

make
 
cp=20 src/libafs/MODLOAD-2.4.18-17.7.x-SP/libafs-2.4.18-17.7.x.o = \
 /usr/vice/etc/modload

/usr/vice/etc/makesymtable=20 /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o
 
When I tried to start afs using /etc/rc.d/init.d/afs start I got = the=20 following error
 
Found libafs-2.4.18-17.7.x.o from SymTable... Loading...
Failed to load AFS client, not starting AFS services.
I tracked this error down to the following line in = /etc/rc.d/initd/afs in=20 the function load_clinet()
 
/sbin/insmod ${PREFIX:+-P $PREFIX} -f -m $MODLOADDIR/$LIBAFS > = \
$MODLOADDIR/libafs.map 2>&1
 
Removing the stderr redirection at the end now yields this error = message=20 then I try /etc/rc.d/init.d/afs start
 
Found libafs-2.4.18-17.7.x.o from SymTable...=20 Loading...

/usr/vice/etc/modload/libafs-2.4.18-17.7.x.o: = unresolved=20 symbol = sys_call_table
/usr/vice/etc/modload/libafs-2.4.18-17.7.x.o:
Hint: = You are trying to load a module without a GPL compatible=20 license
      and it has unresolved = symbols. =20 Contact the module supplier for
      = assistance,=20 only they can help you.
 
Failed to load AFS client, not starting AFS services.
 
So my question is how can I get OpenAFS working again?  Did I = do=20 something wrong?  This procedure has always worked before when = building=20 modules for new kernels.  Any help would be greatly = appreciated.
 
 
 
 
 
------=_NextPart_000_0027_01C276AB.59403320-- From shadow@dementia.org Fri Oct 18 18:41:00 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 13:41:00 -0400 (EDT) Subject: [OpenAFS] Can't Load OpenAFS 1.2.7 Client Under RH 7.3 / Kernel 2.4.18-17.7.x In-Reply-To: <002a01c276cc$e0be5090$0280000a@pelican> Message-ID: On Fri, 18 Oct 2002, Computers in Medicine wrote: > I was running OpenAFS 1.2.6 Under Red Hat 7.3 with kernel 2.4.18.10 > with no problems. Yesterday I upgraded to kernel 2.4.18-17.7.x using > the Red Hat RPMs. I then tried to build OpenAFS 1.2.7 as follows Is this a kernel update for RedHat 7.3? > /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o: unresolved symbol sys_call_table That's... very special. > So my question is how can I get OpenAFS working again? Did I do > something wrong? This procedure has always worked before when building > modules for new kernels. Any help would be greatly appreciated. Yes, but it's all politics. Anyhow, you have 3 choices: -rebuild their kernel exporting sys_call_table -reinstall an older kernel which isn't so anal -use the Redhat 8.0 SRPM from OpenAFS 1.2.7 to build your kernel module From warlord@MIT.EDU Fri Oct 18 18:46:44 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 18 Oct 2002 13:46:44 -0400 Subject: [OpenAFS] Can't Load OpenAFS 1.2.7 Client Under RH 7.3 / Kernel 2.4.18-17.7.x In-Reply-To: References: Message-ID: Derrick J Brashear writes: > Is this a kernel update for RedHat 7.3? Yes, this is the new kernel update released yesterday... > > /usr/vice/etc/modload/libafs-2.4.18-17.7.x.o: unresolved symbol sys_call_table > > That's... very special. > > > So my question is how can I get OpenAFS working again? Did I do > > something wrong? This procedure has always worked before when building > > modules for new kernels. Any help would be greatly appreciated. > > Yes, but it's all politics. Anyhow, you have 3 choices: > -rebuild their kernel exporting sys_call_table > -reinstall an older kernel which isn't so anal > -use the Redhat 8.0 SRPM from OpenAFS 1.2.7 to build your kernel module I suspect that ALL the new RH kernels have this particular patch.. Maybe this weekend I'll build a new set of 1.2.7 RPMs that include this patch and build against the new kernels. Derrick, are there any plans to commit this RH fix to CVS? I haven't seen any commit messages about it. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Fri Oct 18 18:58:25 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 13:58:25 -0400 (EDT) Subject: [OpenAFS] Can't Load OpenAFS 1.2.7 Client Under RH 7.3 / Kernel 2.4.18-17.7.x In-Reply-To: Message-ID: On 18 Oct 2002, Derek Atkins wrote: > > Yes, but it's all politics. Anyhow, you have 3 choices: > > -rebuild their kernel exporting sys_call_table > > -reinstall an older kernel which isn't so anal > > -use the Redhat 8.0 SRPM from OpenAFS 1.2.7 to build your kernel module > > I suspect that ALL the new RH kernels have this particular patch.. > Maybe this weekend I'll build a new set of 1.2.7 RPMs that include > this patch and build against the new kernels. > > Derrick, are there any plans to commit this RH fix to CVS? I haven't > seen any commit messages about it. The configure changes introduced need more broad testing, is the remaining issue. From tipparam@yahoo.com Fri Oct 18 19:02:40 2002 From: tipparam@yahoo.com (Venkat Tipparam) Date: Fri, 18 Oct 2002 11:02:40 -0700 (PDT) Subject: [OpenAFS] OpenAFS on Windows 2000 Message-ID: <20021018180240.89300.qmail@web40901.mail.yahoo.com> Has any one successfully installed OpenAFS on Windows 2000? I have installed OpenAFS 1.2.2b for Windows NT/2000 and it hangs while trying configure servers. My directory structure looks like this after installation: C:\Program Files\IBM\AFS |--Server | |--usr | | |--afs | | | |--bin | | | |--etc | | | |--local | | | |--logs I have built the latest version from the source and after some debugging it appears that bosserver is spawning processes with incorrect path. It is trying to spawn processes from Serverbin and Server\bin directories rather than Server\usr\afs\bin. I have created Serverbin under AFS and bin under AFS\Server and copied files from AFS\Server\usr\afs\bin and it worked fine. Also there seems to be problems with canonical to local path conversions. The installation worked with the following directory structure: C:\Program Files\IBM\AFS |--Server | |--usr | | |--afs | | | |--bin | | | |--etc | | | |--local | | | |--logs | |--bin |--Serverbin |--Serveretc |--Serverlocal |--Serverlogs Is this a known issue in OpenAFS for Windows? Thanks in advance for your help. Venkat. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com From aleahy@knox.edu Fri Oct 18 19:04:04 2002 From: aleahy@knox.edu (Andrew Leahy) Date: Fri, 18 Oct 2002 14:04:04 -0400 Subject: [OpenAFS] Why is /afs empty? Message-ID: <3DB04D14.9070701@knox.edu> Hello, I'm pulling my hair out trying to figure this out: I have a test set-up consisting of one AFS client/server and a separate AFS client. On the server, I can see into /afs with no problem--everything that should be there is there: [root@pc14341 home]# ls /afs/my.domain.com/ home shared However, on the client, /afs is empty--nothing appears when you list the contents. Everything else on the client system--including the three configuration files in /usr/vice/etc--appears to be fine and other AFS services don't have a problem: [root@feddual config]# /etc/rc.d/init.d/afs start Found libafs-2.4.7-10-i686.o from SymTable... Loading... Starting AFS services..... afsd: All AFS daemons started. [root@feddual config]# ls /afs [root@feddual config]# ls -axl /afs total 6 drwxrwxrwx 2 root root 2048 Oct 18 13:16 . drwxr-xr-x 20 root root 4096 Oct 18 13:43 .. [root@feddual config]# klog admin Password: [root@feddual config]# tokens Tokens held by the Cache Manager: User's (AFS ID 1) tokens for afs@my.domain.com [Expires Oct 19 15:12] --End of list-- [root@feddual config]# ls /afs [root@feddual config]# vos listvldb VLDB entries for all servers root.afs RWrite: 536870912 ROnly: 536870913 number of sites -> 2 server pc14341.my.domain.com partition /vicepa RW Site server pc14341.my.domain.com partition /vicepa RO Site root.cell RWrite: 536870915 ROnly: 536870916 number of sites -> 2 server pc14341.my.domain.com partition /vicepa RW Site server pc14341.my.domain.com partition /vicepa RO Site root.home RWrite: 536870918 number of sites -> 1 server pc14341.my.domain.com partition /vicepa RW Site root.shared RWrite: 536870921 number of sites -> 1 server pc14341.my.domain.com partition /vicepa RW Site Total entries: 4 Am I missing something obvious here? Does anybody have suggestions for what could be causing this? The client system is a RH 7.2 system with Openafs 1.2.6. Thanks for your help. Andrew Leahy P.S. Hmmm, just noticed this error on the server: [root@pc14341 home]# ls -axl /afs ls: /afs/.: Stale NFS file handle total 6 drwxr-xr-x 21 root root 4096 Oct 18 13:15 .. drwxrwxrwx 2 root root 2048 Oct 18 13:16 my.domain.com Any explanations for this? From shadow@dementia.org Fri Oct 18 19:11:56 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 14:11:56 -0400 (EDT) Subject: [OpenAFS] OpenAFS on Windows 2000 In-Reply-To: <20021018180240.89300.qmail@web40901.mail.yahoo.com> Message-ID: On Fri, 18 Oct 2002, Venkat Tipparam wrote: > Has any one successfully installed OpenAFS on Windows > 2000? I have installed OpenAFS 1.2.2b for Windows > NT/2000 and it hangs while trying configure servers. Don't configure the servers. The bug was fixed after 1.2.2b but as you see we don't have newer binary builds currently. From tipparam@yahoo.com Fri Oct 18 19:24:16 2002 From: tipparam@yahoo.com (Venkat Tipparam) Date: Fri, 18 Oct 2002 11:24:16 -0700 (PDT) Subject: [OpenAFS] OpenAFS on Windows 2000 In-Reply-To: Message-ID: <20021018182416.34586.qmail@web40909.mail.yahoo.com> Is the fix available in 1.2.7? I have built it from the 1.2.7 source and still had a similar problem. Thanks, Venkat. --- Derrick J Brashear wrote: > On Fri, 18 Oct 2002, Venkat Tipparam wrote: > > > Has any one successfully installed OpenAFS on > Windows > > 2000? I have installed OpenAFS 1.2.2b for Windows > > NT/2000 and it hangs while trying configure > servers. > > Don't configure the servers. The bug was fixed after > 1.2.2b but as you see > we don't have newer binary builds currently. > __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com From dawson@fnal.gov Fri Oct 18 19:51:45 2002 From: dawson@fnal.gov (Troy Dawson) Date: Fri, 18 Oct 2002 13:51:45 -0500 Subject: [OpenAFS] More Info - RedHat 7.3 with new 2.4.18-17 kernel Message-ID: <3DB05841.1030007@fnal.gov> Howdy, Incase this helps anyone, or saves anyone some time. I have RedHat 7.3, and updated to their latest errata kernel (2.4.18-17.7.x). I did what was already said. I first recompiled the 7.3 rpm's hopeing that RedHat didn't mess too much with this kernel. As you already know, they did, and I got the same error already shown when loading the module ---------- /usr/vice/etc/modload/libafs-2.4.18-17.7.x-i686.mp.o: unresolved symbol sys_call_table /usr/vice/etc/modload/libafs-2.4.18-17.7.x-i686.mp.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. ---------- So I then recompiled the 8.0 rpm's, double checking to make sure that patch was in there and would complile. Well, here's the error now that you get when you try to load in the module. ------------- /usr/vice/etc/modload/libafs-2.4.18-17.7.x-i686.mp.o: unresolved symbol kallsyms_symbol_to_address /usr/vice/etc/modload/libafs-2.4.18-17.7.x-i686.mp.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. ------------ I hope this helps someone. On a side note. I'm pretty sure some official people from OpenAFS have complained to RedHat, but is there anything that some of us users can do to let them know that they should stop doing things like this, just because OpenAFS isn't GPL'ed? I'm sure it's breaking more things than AFS, but for me this is the only thing that I'm seeing. Troy Dawson -- __________________________________________________ Troy Dawson dawson@fnal.gov (630)840-6468 Fermilab ComputingDivision/OSS CSI Group __________________________________________________ From danno@internet2.edu Fri Oct 18 20:36:26 2002 From: danno@internet2.edu (Dan Pritts) Date: Fri, 18 Oct 2002 15:36:26 -0400 Subject: [OpenAFS] More Info - RedHat 7.3 with new 2.4.18-17 kernel In-Reply-To: <3DB05841.1030007@fnal.gov> References: <3DB05841.1030007@fnal.gov> Message-ID: <20021018193626.GA8976@mail.internet2.edu> > Hint: You are trying to load a module without a GPL compatible license > and it has unresolved symbols. Contact the module supplier for > assistance, only they can help you. I had this same problem with win4lin's kernel module, but I don't really know what they did to fix it, they just pointed me to a newer download. If i recall correctly, the bottom line i was that certain system calls are no longer exposed in the kernel to modules that do not declare themselves to be GPL'd. The way win4lin seems to have dealt with this is to release its code as two kernel modules, one which has all the interaction with the rest of the kernel, and is GPL'd. > On a side note. I'm pretty sure some official people from OpenAFS have > complained to RedHat, but is there anything that some of us users can do to > let them know that they should stop doing things like this, just because > OpenAFS isn't GPL'ed? I'm sure it's breaking more things than AFS, but for > me this is the only thing that I'm seeing. FWIW I believe it is not Red Hat's doing, but Linus/the kernel team. As much as I hate M$, this kind of stuff from GPL fanatics really lends credence to M$'s anti-open-source "infectious licensing" crap. danno -- dan pritts danno@internet2.edu systems administrator 734/352-4953 office internet2 734/546-4423 mobile From shadow@dementia.org Fri Oct 18 20:40:55 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 15:40:55 -0400 (EDT) Subject: [OpenAFS] More Info - RedHat 7.3 with new 2.4.18-17 kernel In-Reply-To: <20021018193626.GA8976@mail.internet2.edu> Message-ID: On Fri, 18 Oct 2002, Dan Pritts wrote: > If i recall correctly, the bottom line i was that certain system calls > are no longer exposed in the kernel to modules that do not declare > themselves to be GPL'd. The GPL issue isn't the problem. The sys_call_table export is. > FWIW I believe it is not Red Hat's doing, but Linus/the kernel team. As far as 2.4.18/2.4.19, you believe wrong. It's easy to verify. Download one from ftp.kernel.org, and note that sys_call_table is exported. > As much as I hate M$, this kind of stuff from GPL fanatics really > lends credence to M$'s anti-open-source "infectious licensing" crap. Your rage may be well-directed but ill-justified per above. From sdevine@msu.edu Fri Oct 18 21:05:23 2002 From: sdevine@msu.edu (Steve Devine) Date: 18 Oct 2002 16:05:23 -0400 Subject: [OpenAFS] Why is /afs empty? In-Reply-To: <3DB04D14.9070701@knox.edu> References: <3DB04D14.9070701@knox.edu> Message-ID: <1034971523.5526.24.camel@jax.cl.msu.edu> Have you released root.afs & root.cell ? /sd On Fri, 2002-10-18 at 14:04, Andrew Leahy wrote: > > Hello, > > I'm pulling my hair out trying to figure this out: I have a test set-up > consisting of one AFS client/server and a separate AFS client. On the > server, I can see into /afs with no problem--everything that should be > there is there: > > [root@pc14341 home]# ls /afs/my.domain.com/ > home shared > > However, on the client, /afs is empty--nothing appears when you list the > contents. Everything else on the client system--including the three > configuration files in /usr/vice/etc--appears to be fine and other AFS > services don't have a problem: > > [root@feddual config]# /etc/rc.d/init.d/afs start > Found libafs-2.4.7-10-i686.o from SymTable... Loading... > Starting AFS services..... > afsd: All AFS daemons started. > [root@feddual config]# ls /afs > [root@feddual config]# ls -axl /afs > total 6 > drwxrwxrwx 2 root root 2048 Oct 18 13:16 . > drwxr-xr-x 20 root root 4096 Oct 18 13:43 .. > [root@feddual config]# klog admin > Password: > [root@feddual config]# tokens > > Tokens held by the Cache Manager: > > User's (AFS ID 1) tokens for afs@my.domain.com [Expires Oct 19 15:12] > --End of list-- > [root@feddual config]# ls /afs > [root@feddual config]# vos listvldb > VLDB entries for all servers > > root.afs > RWrite: 536870912 ROnly: 536870913 > number of sites -> 2 > server pc14341.my.domain.com partition /vicepa RW Site > server pc14341.my.domain.com partition /vicepa RO Site > > root.cell > RWrite: 536870915 ROnly: 536870916 > number of sites -> 2 > server pc14341.my.domain.com partition /vicepa RW Site > server pc14341.my.domain.com partition /vicepa RO Site > > root.home > RWrite: 536870918 > number of sites -> 1 > server pc14341.my.domain.com partition /vicepa RW Site > > root.shared > RWrite: 536870921 > number of sites -> 1 > server pc14341.my.domain.com partition /vicepa RW Site > > Total entries: 4 > > > Am I missing something obvious here? Does anybody have suggestions for > what could be causing this? The client system is a RH 7.2 system with > Openafs 1.2.6. > > Thanks for your help. > > Andrew Leahy > > P.S. Hmmm, just noticed this error on the server: > > [root@pc14341 home]# ls -axl /afs > ls: /afs/.: Stale NFS file handle > total 6 > drwxr-xr-x 21 root root 4096 Oct 18 13:15 .. > drwxrwxrwx 2 root root 2048 Oct 18 13:16 my.domain.com > > Any explanations for this? > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > -- Steve Devine Core Systems Michigan State University From dawson@fnal.gov Fri Oct 18 21:16:44 2002 From: dawson@fnal.gov (Troy Dawson) Date: Fri, 18 Oct 2002 15:16:44 -0500 Subject: [OpenAFS] More Info - RedHat 7.3 with new 2.4.18-17 kernel References: <3DB05841.1030007@fnal.gov> <20021018193626.GA8976@mail.internet2.edu> Message-ID: <3DB06C2C.3030809@fnal.gov> Dan Pritts wrote: >>On a side note. I'm pretty sure some official people from OpenAFS have >>complained to RedHat, but is there anything that some of us users can do to >>let them know that they should stop doing things like this, just because >>OpenAFS isn't GPL'ed? I'm sure it's breaking more things than AFS, but for >>me this is the only thing that I'm seeing. > > > FWIW I believe it is not Red Hat's doing, but Linus/the kernel team. > I believe you are right. I was thinking this was redhat because in my search I was seraching for RedHat and sys_call_table. So I was thinking this was redhat even though it said quite plainly this was in Linux-streams. This is a little blurb from Petr Vandrovec to Brian Bidulock on the 9th of October. > And I believe that export symbols should NOT be _GPL_ONLY: before > (non-GPL) export of syscall_table was available, non-GPL modules were > able to hook syscalls, and when _GPL_ONLY was introduced into kernel > it was promised that we'll never make currently provided functionality > GPL-only (as far as I remember). Obviously Petr is on our side. But I wasn't able to find why they were starting to take these things out in the first place other than some ways to execute malisious code, but those letters were about 2 years old. Anyway, it does get a little frustrating. Troy -- __________________________________________________ Troy Dawson dawson@fnal.gov (630)840-6468 Fermilab ComputingDivision/OSS CSI Group __________________________________________________ From rees@umich.edu Fri Oct 18 21:38:30 2002 From: rees@umich.edu (Jim Rees) Date: Fri, 18 Oct 2002 16:38:30 -0400 Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: Andrei Maslennikov, Fri, 18 Oct 2002 17:21:06 -0000 Message-ID: <20021018203831.ED263207C1@citi.umich.edu> Hmm. Clearly one of the base things with AFS is that all clients must be working in sync between each other, and with the servers. Yes, clearly. That's why the usual case is that all servers and clients use some other mechanism, usually ntp, to keep proper time. In this case, afs has no business fooling with the clock. That's why the default should be -nosettime. It is true that other means may be used for syncronization, but then two services (afs and, say, ntpd) should necessarily be maintained together instead of one (afs) on every host involved. I strongly disagree. If you are running two different time sync mechanisms, and they agree, what's the point? If they disagree, both will get confused and nothing will work. If one starts to use ntpd on client and runs afsd with "-nosettime" (option normally used only on servers), then it is essential to make sure that servers run ntpd as well - which is not always the case. If your servers have the wrong time, you should fix them. Synchronizing your clients to incorrect server time is wrong. But if you insist on doing this, just run afsd with -settime. From csnyder@mvpsoft.com Fri Oct 18 22:14:27 2002 From: csnyder@mvpsoft.com (Chris Snyder) Date: Fri, 18 Oct 2002 17:14:27 -0400 Subject: [OpenAFS] AFS Authentication from Apache? Message-ID: <3DB079B3.7040504@mvpsoft.com> I've been banging my head about this for quite some time, but I can't seem to get it to work. Basically, all I want to do is have users authenticate to Apache using their AFS accounts. I've tried using mod_auth_pam, but it doesn't work, returning cryptic error messages about the account not existing, having expired, etc. (in random order), and also disrupting the rest of the web sites. I presume this is because I have the sites in AFS space, and when the pam module is used, it obtains a token for the user logging in, destroying my apache token for that server process. Has anyone been able to do this? I'm running Apache 1.3.27, running on Gentoo Linux, with OpenAFS version 1.2.6. Thanks in advance. From tipparam@yahoo.com Sat Oct 19 00:21:58 2002 From: tipparam@yahoo.com (Venkat Tipparam) Date: Fri, 18 Oct 2002 16:21:58 -0700 (PDT) Subject: [OpenAFS] On-demand replication? Message-ID: <20021018232158.10990.qmail@web40908.mail.yahoo.com> We have a home grown file server that optimizes file downloads across geographically distributed file servers. I am evaluating to see if we can replace this with OpenAFS replication feature. I am hoping to get the nice benefits like fail-over, client-side cache, security from OpenAFS. I have a question however. Our server implements a simple on-demand replication of files across the file servers. Most of the time files at a given site are not used at the other site. Occationally, it is possible for a local site to access files located at a remote site. In this case the server replicates the file on demand. Now if I were to use OpenAFS to provide similar functionality I am thinking of using replication feature of OpenAFS. However by reading the documentation my understanding is that the files are always replicated in a replicated volume whether they are used are not. Is it possible to setup replicated volumes in such a way that the files are replicated on-demand when they are accessed from a local server? Hope I made my question clear. Thanks in advance for your help. Venkat. __________________________________________________ Do you Yahoo!? Faith Hill - Exclusive Performances, Videos & More http://faith.yahoo.com From shadow@dementia.org Sat Oct 19 03:53:31 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 18 Oct 2002 22:53:31 -0400 (EDT) Subject: [OpenAFS] On-demand replication? In-Reply-To: <20021018232158.10990.qmail@web40908.mail.yahoo.com> Message-ID: On Fri, 18 Oct 2002, Venkat Tipparam wrote: > documentation my understanding is that the files are > always replicated in a replicated volume whether they > are used are not. Is it possible to setup replicated > volumes in such a way that the files are replicated > on-demand when they are accessed from a local server? your understanding based on the documentation is correct, e.g., can't be done From nneul@umr.edu Sat Oct 19 04:02:58 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 18 Oct 2002 22:02:58 -0500 Subject: [OpenAFS] On-demand replication? In-Reply-To: References: Message-ID: <1034996578.8829.16.camel@cessna.rollanet.org> On Fri, 2002-10-18 at 21:53, Derrick J Brashear wrote: > On Fri, 18 Oct 2002, Venkat Tipparam wrote: > > > documentation my understanding is that the files are > > always replicated in a replicated volume whether they > > are used are not. Is it possible to setup replicated > > volumes in such a way that the files are replicated > > on-demand when they are accessed from a local server? > > your understanding based on the documentation is correct, e.g., can't be > done However, with some minor logging changes to the file server - it would be trivial to have an external tool monitor accesses to the volumes, and "replicate on demand" as it sees accesses to volumes from clients outside the local region. i.e. start with no replicates, watch what IP's access what volumes, when you see enough accesses to a volume from an IP with a local fileserver, do an addsite+release to that server. For that matter, you could probably also have it move the volumes around if a significantly larger percentage of accesses are occurring in other regions. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From security@xauth.net Sat Oct 19 07:39:47 2002 From: security@xauth.net (Charles Clancy) Date: Sat, 19 Oct 2002 01:39:47 -0500 (CDT) Subject: [OpenAFS] AFS Authentication from Apache? In-Reply-To: <3DB079B3.7040504@mvpsoft.com> Message-ID: > I've been banging my head about this for quite some time, but I can't > seem to get it to work. Basically, all I want to do is have users > authenticate to Apache using their AFS accounts. > > I've tried using mod_auth_pam, but it doesn't work, returning cryptic > error messages about the account not existing, having expired, etc. (in > random order), and also disrupting the rest of the web sites. I presume > this is because I have the sites in AFS space, and when the pam module > is used, it obtains a token for the user logging in, destroying my > apache token for that server process. To use full-blown PAM, you'll need /etc/passwd-ish entries for your AFS users. I've used mod_auth_external in the past. Essentially, you give apache the name of a script and it pipes the username/password to it. Depending on the errorlevel when it script exists, it decides whether or not it was successful. I wrote a script that would grab a PAG, try to authenticate, then return success or failure. Since it directly called klog, it didn't need the users to have NSS info to log in, and since it grabbed a new PAG, there weren't any token overwriting issues. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From security@xauth.net Sat Oct 19 07:43:39 2002 From: security@xauth.net (Charles Clancy) Date: Sat, 19 Oct 2002 01:43:39 -0500 (CDT) Subject: [OpenAFS] Tokens that do not expire Message-ID: > >This of course *requires* either a hardcoded password in a > >reauthentication script or some other file-based method of obtaining > >the tokens (such as a kerberos srvtab/keytab). > > One additional thing to consider ... a ticket which never expires is > equivalant to a hardcoded password/Kerberos keytab, so it's not like a > never-expiring ticket gains you much in the way of security ... Or for that matter, why not just use an IP ACL. Similar level of security to a hardcoded password (assuming hacked machine == stolen IP), but no tokens to worry about. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From kolya@MIT.EDU Sat Oct 19 08:21:20 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Sat, 19 Oct 2002 03:21:20 -0400 Subject: [OpenAFS] Tokens that do not expire Message-ID: <200210190721.DAA13921@contents-vnder-pressvre.mit.edu> > Or for that matter, why not just use an IP ACL. Similar level of security > to a hardcoded password (assuming hacked machine == stolen IP), but no > tokens to worry about. The level of security provided by IP ACLs is far less than that provided by any sort of ticket, expiring or not. (Especially if you do 'fs setcrypt on', you're in much better shape with a token than with an IP ACL.) -- kolya From tino.schwarze@informatik.tu-chemnitz.de Sat Oct 19 10:29:49 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Sat, 19 Oct 2002 11:29:49 +0200 Subject: [OpenAFS] Tokens that do not expire In-Reply-To: ; from security@xauth.net on Sat, Oct 19, 2002 at 01:43:39AM -0500 References: Message-ID: <20021019112949.B10305@informatik.tu-chemnitz.de> On Sat, Oct 19, 2002 at 01:43:39AM -0500, Charles Clancy wrote: > > >This of course *requires* either a hardcoded password in a > > >reauthentication script or some other file-based method of obtaining > > >the tokens (such as a kerberos srvtab/keytab). > > > > One additional thing to consider ... a ticket which never expires is > > equivalant to a hardcoded password/Kerberos keytab, so it's not like a > > never-expiring ticket gains you much in the way of security ... > > Or for that matter, why not just use an IP ACL. Similar level of security > to a hardcoded password (assuming hacked machine == stolen IP), but no > tokens to worry about. A machine doesn't need to be hacked to steal it's IP. That is the main problem of IP-based authentication. Bye, Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From deniz@arayan.com Sat Oct 19 11:48:51 2002 From: deniz@arayan.com (Deniz Akkus Kanca) Date: Sat, 19 Oct 2002 13:48:51 +0300 Subject: [OpenAFS] Redhat 7.3/8.0 Kernel upgrade breaks OpenAFS -- sys_call_table not exported Message-ID: <200210191348.51600.deniz@arayan.com> Hi, I searched through the archives and found that the decision to stop expor= ting=20 sys_call_table and how this affects OpenAFS was discussed some time in Ap= ril.=20 I'd like to report that the recent kernel update for Redhat 7.3 and 8.0=20 (security advisory RHSA-2002:206-12) going from kernel-2.4.18-10 to=20 kernel-2.4.18-17.7.x (for RH 7.3) and kernel-2.4.18-14 to=20 kernel-2.4.18-17.8.0 (for RH 8.0) stops exporting sys_call_table -- with = the=20 result that OpenAFS will no longer work.=20 I was a little upset with Redhat as it took me a while to figure out what= was=20 happening and why. The security advisory does not mention this at all and= =20 methinks it does seem like a big deal to push through in such a seemingly= =20 minor bug fix.=20 I filed a bug report with Redhat -- more of a rant really, I guess, but a= =20 routine upgrade turned into a debugging task, so I was a little upset. Ho= pe=20 did not make too many mistakes -- I am not that familiar with the inner=20 workings of OpenAFS or the kernel, I just use them.=20 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=3D76289 I'd like to caution people who might be using Redhat 7.3 or 8.0 with Open= AFS=20 from upgrading to this kernel.=20 In the meantime, is there a solution planned for this on the OpenAFS fron= t?=20 (Other than not using the particular kernel patch I mean, since it does l= ook=20 as if this is going mainstream).=20 Best regards, and thanks for the great AFS software.=20 Deniz From Dr A V Le Blanc Sat Oct 19 12:13:57 2002 From: Dr A V Le Blanc (Dr A V Le Blanc) Date: Sat, 19 Oct 2002 12:13:57 +0100 Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: <20021019093102.0295C9D10@grand.central.org> References: <20021019093102.0295C9D10@grand.central.org> Message-ID: <20021019111357.GC7116@afs.mcc.ac.uk> On Fri, 18 Oct 2002 16:38:30 -0400, Jim Rees wrote: >> It is true that other means may be used for syncronization, >> but then two services (afs and, say, ntpd) should necessarily >> be maintained together instead of one (afs) on every host involved. > > I strongly disagree. If you are running two different time sync mechanisms, > and they agree, what's the point? If they disagree, both will get confused > and nothing will work. Actually, there's a problem running ntp when you run afsd without -nosettime: if afsd ever _does_ change the time, it messes up the ntp algorithm. I have AFS servers running ntpd, and rarely more than .003 second off from each other; all clients run ntpd as well. Occasionally someone starts afsd without -nosettime, and problems do occur. The present defaults _sound_ reasonable, but evidently cause problems in some cases. The question is, should they be changed? I think the answer is not so obvious. -- Owen LeBlanc@mcc.ac.uk From andrei@caspur.it Sat Oct 19 13:13:40 2002 From: andrei@caspur.it (Andrei Maslennikov) Date: Sat, 19 Oct 2002 12:13:40 +0000 ( ) Subject: [OpenAFS] Problems in stopping the afs-client In-Reply-To: <20021019111357.GC7116@afs.mcc.ac.uk> Message-ID: On Sat, 19 Oct 2002, Dr A V Le Blanc wrote: > Actually, there's a problem running ntp when you run afsd without > -nosettime: if afsd ever _does_ change the time, it messes up the > ntp algorithm. I have AFS servers running ntpd, and rarely more > than .003 second off from each other; all clients run ntpd as well. > Occasionally someone starts afsd without -nosettime, and problems > do occur. > > The present defaults _sound_ reasonable, but evidently cause problems > in some cases. The question is, should they be changed? I think > the answer is not so obvious. > I see that afsd *IS* adjusting the time to that of the servers. So at least clients are in sync and local authentication works. Now, whether the servers are set to point to an official time source or not (BTW, in our particular case they do), is in the end the decision of a local admin, right it is or wrong. If the time-control part of afsd would not work (or would be imprecise or/and hard to maintain), I would be the first to vote for defaults' change. As so far nobody has ever complained about this, I believe we should better leave them defaults in peace for the time being. Andrei. PS I do agree that it hardly makes any sense to run both ntpd and afsd with settime on the same machine. From warlord@MIT.EDU Sat Oct 19 15:40:20 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 19 Oct 2002 10:40:20 -0400 Subject: [OpenAFS] AFS Authentication from Apache? In-Reply-To: References: Message-ID: Charles Clancy writes: > I wrote a script that would grab a PAG, try to authenticate, then return > success or failure. Since it directly called klog, it didn't need the > users to have NSS info to log in, and since it grabbed a new PAG, there > weren't any token overwriting issues. Hopefully you grabbed rather short-lived tokens? Also, you do realize that PAG generation is limited to approx 1/sec? -derek > [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Sat Oct 19 15:43:03 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 19 Oct 2002 10:43:03 -0400 Subject: [OpenAFS] Redhat 7.3/8.0 Kernel upgrade breaks OpenAFS -- sys_call_table not exported In-Reply-To: <200210191348.51600.deniz@arayan.com> References: <200210191348.51600.deniz@arayan.com> Message-ID: Deniz Akkus Kanca writes: > I'd like to caution people who might be using Redhat 7.3 or 8.0 with OpenAFS > from upgrading to this kernel. I am actually surprised that the 8.0 upgrade fails... The _original_ 8.0 kernel had sys_call_table removed, so the 8.0 RPMs already had a workaround. Did you actually try recompiling for 8.0? Or are you just guessing that it actually fails? > In the meantime, is there a solution planned for this on the OpenAFS front? > (Other than not using the particular kernel patch I mean, since it does look > as if this is going mainstream). Well, we have a workaround (in the 8.0 RPMS), but we've had one report of that workaround not working properly.... > Best regards, and thanks for the great AFS software. > Deniz -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From security@xauth.net Sat Oct 19 15:54:27 2002 From: security@xauth.net (Charles Clancy) Date: Sat, 19 Oct 2002 09:54:27 -0500 (CDT) Subject: [OpenAFS] AFS Authentication from Apache? In-Reply-To: Message-ID: On 19 Oct 2002, Derek Atkins wrote: > Charles Clancy writes: > > > I wrote a script that would grab a PAG, try to authenticate, then return > > success or failure. Since it directly called klog, it didn't need the > > users to have NSS info to log in, and since it grabbed a new PAG, there > > weren't any token overwriting issues. > > Hopefully you grabbed rather short-lived tokens? It unlogged too. Wouldn't the token die with the PAG, so what difference would it make? > Also, you do realize that PAG generation is limited to approx 1/sec? Our site didn't have that much traffic. Perhaps a better model would be to use a v4 kinit: check password without ever getting a token. Of course, none of this works if you're trying to use the obtained token to access AFS space with apache. My method was only intended to authenticate, not authorize. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From security@xauth.net Sat Oct 19 16:12:42 2002 From: security@xauth.net (Charles Clancy) Date: Sat, 19 Oct 2002 10:12:42 -0500 (CDT) Subject: [OpenAFS] Tokens that do not expire In-Reply-To: <200210190721.DAA13921@contents-vnder-pressvre.mit.edu> Message-ID: > > Or for that matter, why not just use an IP ACL. Similar level of security > > to a hardcoded password (assuming hacked machine == stolen IP), but no > > tokens to worry about. > > The level of security provided by IP ACLs is far less than that provided > by any sort of ticket, expiring or not. (Especially if you do 'fs setcrypt > on', you're in much better shape with a token than with an IP ACL.) My assumptions included things such as subnet isolation, security of the other hosts on the subnet, reasonably well configured routers, etc. Provided the level of difficulty of hacking the machine and hijacking its IP are similar, and the link between the host and the AFS servers is "trusted", I think the danger is minimal. In a properly configured environment with well maintained systems, I'm not saying IP ACLs are better or even as good as token-based authorization -- just that both are signifcantly below my threshold of security concern, making IP ACLs more attractive as far as managability. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From warlord@MIT.EDU Sat Oct 19 18:25:42 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 19 Oct 2002 13:25:42 -0400 Subject: [OpenAFS] AFS Authentication from Apache? In-Reply-To: References: Message-ID: Charles Clancy writes: > > Hopefully you grabbed rather short-lived tokens? > > It unlogged too. Wouldn't the token die with the PAG, so what difference > would it make? PAGs never "die" (per se). Tokens do. PAGs are GCed periodically, but I don't know the GC algo offhand. > > Also, you do realize that PAG generation is limited to approx 1/sec? > > Our site didn't have that much traffic. > > Perhaps a better model would be to use a v4 kinit: check password without > ever getting a token. > > Of course, none of this works if you're trying to use the obtained token > to access AFS space with apache. My method was only intended to > authenticate, not authorize. A v4 tgt is probably "better" in terms of authenticating. Just make sure you get a TGT and then a service ticket for a "known" key (like http/) so you dont get hit with the KDC-spoofing attack. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Sat Oct 19 18:36:51 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Sat, 19 Oct 2002 13:36:51 -0400 (EDT) Subject: [OpenAFS] AFS Authentication from Apache? In-Reply-To: Message-ID: On 19 Oct 2002, Derek Atkins wrote: > Charles Clancy writes: > > > > Hopefully you grabbed rather short-lived tokens? > > > > It unlogged too. Wouldn't the token die with the PAG, so what difference > > would it make? > > PAGs never "die" (per se). Tokens do. PAGs are GCed periodically, > but I don't know the GC algo offhand. no processes left in the PAG. From kerberos@northsailor.de Mon Oct 21 15:11:47 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Mon, 21 Oct 2002 16:11:47 +0200 Subject: [OpenAFS] moving /changing IP-adress of system control server / database management server Message-ID: <00a101c2790b$cb4fc900$2b03a8c0@mummert.priv> Hi, what do i have to do when i want to move or change the ip-adress of a: a database managmenet server b: the system control maschine (on which the updateserver-prozesses are running) ? Do i have to change the configuration of every file-server then? Thanks Klaas From Venkat.Tipparam@agile.com Fri Oct 18 18:58:20 2002 From: Venkat.Tipparam@agile.com (Venkat Tipparam) Date: Fri, 18 Oct 2002 10:58:20 -0700 Subject: [OpenAFS] OpenAFS on Windows 2000 Message-ID: <6FF67BF1EABDA040A8D290376065BDF618FCD8@outlook3.agile.agilesoft.com> Has any one successfully installed OpenAFS on Windows 2000? I have installed OpenAFS 1.2.2b for Windows NT/2000 and it hangs while trying configure servers. My directory structure looks like this after installation: C:\Program Files\IBM\AFS |--Server | |--usr | | |--afs | | | |--bin | | | |--etc | | | |--local | | | |--logs I have built the latest version from the source and after some debugging it appears that bosserver is spawning processes with incorrect path. It is trying to spawn processes from Serverbin and Server\bin directories rather than Server\usr\afs\bin. I have created Serverbin under AFS and bin under AFS\Server and copied files from AFS\Server\usr\afs\bin and it worked fine. The installation worked with the following directory structure: C:\Program Files\IBM\AFS |--Server | |--usr | | |--afs | | | |--bin | | | |--etc | | | |--local | | | |--logs | |--bin |--Serverbin |--Serveretc |--Serverlocal |--Serverlogs Is this a known issue in OpenAFS for Windows? Thanks in advance for your help. Venkat. From heiko@mathematik.uni-stuttgart.de Fri Oct 18 23:10:04 2002 From: heiko@mathematik.uni-stuttgart.de (Heiko Schulz) Date: Sat, 19 Oct 2002 00:10:04 +0200 (CEST) Subject: [OpenAFS] kernel 2.4.19 problem In-Reply-To: from "Derek Atkins" at Okt 17, 2002 08:13:34 Message-ID: <200210182210.g9IMA4sr025084@vwin.mathematik.uni-stuttgart.de> > > Is this a 2.4.19 from kernel.org, or a 2.4.19 with a lot of patches > for some particular distribution? > The kernel is from kernel.org, without any patches, compiled by myself. Heiko Schulz From papitas@hotmail.com Mon Oct 21 05:10:47 2002 From: papitas@hotmail.com (Andres Cardenas) Date: Sun, 20 Oct 2002 21:10:47 -0700 Subject: [OpenAFS] Kerberos and AFS Message-ID: <000001c278b7$d8c3e3e0$30f43f04@morpheus> This is a multi-part message in MIME format. ------=_NextPart_000_0001_01C2787D.2C650BE0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I will be running 1 Solaris 9 AFS server with 2 SuSe 8.1 KDC's, how do I go about using the K5 authentication with AFS seamlessly? Thanks. ------=_NextPart_000_0001_01C2787D.2C650BE0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
I will = be running 1=20 Solaris 9 AFS server with 2 SuSe 8.1 KDC's, how do I go about using the = K5=20 authentication with AFS seamlessly?
Thanks.
------=_NextPart_000_0001_01C2787D.2C650BE0-- From shadow@dementia.org Mon Oct 21 16:03:15 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Mon, 21 Oct 2002 11:03:15 -0400 (EDT) Subject: [OpenAFS] OpenAFS on Windows 2000 In-Reply-To: <6FF67BF1EABDA040A8D290376065BDF618FCD8@outlook3.agile.agilesoft.com> Message-ID: On Fri, 18 Oct 2002, Venkat Tipparam wrote: > Has any one successfully installed OpenAFS on Windows 2000? Yes, but not the server, just like before. >I have installed OpenAFS 1.2.2b for Windows NT/2000 and it hangs while > trying configure > servers. My directory structure looks like this after installation: > > C:\Program Files\IBM\AFS > |--Server > | |--usr > | | |--afs > | | | |--bin > | | | |--etc > | | | |--local > | | | |--logs > > I have built the latest version from the source and after some debugging it appears that bosserver is spawning processes with incorrect path. It is > trying to spawn processes from Serverbin and Server\bin directories rather than Server\usr\afs\bin. I have created Serverbin under AFS and bin under > AFS\Server and copied files from AFS\Server\usr\afs\bin and it worked fine. Well, the right answer is to fix the problem instead of copying stuff around, but I don't know offhand where that is. > The installation worked with the following directory structure: > > C:\Program Files\IBM\AFS > |--Server > | |--usr > | | |--afs > | | | |--bin > | | | |--etc > | | | |--local > | | | |--logs > | |--bin > |--Serverbin > |--Serveretc > |--Serverlocal > |--Serverlogs > > > Is this a known issue in OpenAFS for Windows? A similar issue was known, where dirpath.h.nt (in src/util) didn't exist, which is why 1.2.2b servers didn't work. This implies some other problem. From warlord@MIT.EDU Mon Oct 21 16:50:17 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 21 Oct 2002 11:50:17 -0400 Subject: [OpenAFS] Kerberos and AFS In-Reply-To: <000001c278b7$d8c3e3e0$30f43f04@morpheus> References: <000001c278b7$d8c3e3e0$30f43f04@morpheus> Message-ID: "Andres Cardenas" writes: > I will be running 1 Solaris 9 AFS server with 2 SuSe 8.1 KDC's, how do I > go about using the K5 authentication with AFS seamlessly? You need the krb5 migration kit (which is included in the Red Hat RPMS) so you can build 'asetkey' and 'aklog. You generate an afs/@REALM key in your KDC, making sure you use '-e des-cbc-crc:v4' and extract that into an afs keytab. Then you use asetkey to add the keytab key into an AFS KeyFile. Set up AFS as usual, except you don't need the KAServer. Finally, you can use 'kinit' and 'aklog' to authenticate to AFS. > Thanks. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From amar deep kumar" HI i want to install Andrew file system on red hat running on alpha machines.from where i can get the RPMS. amardeep amardeep kumar barc,mumbai From warlord@MIT.EDU Tue Oct 22 14:17:26 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 22 Oct 2002 09:17:26 -0400 Subject: [OpenAFS] AFS for redhat linux on alpha machines In-Reply-To: <20021022072216.14318.qmail@webmail9.rediffmail.com> References: <20021022072216.14318.qmail@webmail9.rediffmail.com> Message-ID: "amar deep kumar" writes: > HI > > i want to install Andrew file system on red hat running on > alpha machines.from where i can get the RPMS. They are no pre-built RPMS for alpha. You should be able to use the SRPM and build it yourself. > amardeep -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From andreas.buhr@epost.de Mon Oct 21 19:42:28 2002 From: andreas.buhr@epost.de (Andreas Buhr) Date: Mon, 21 Oct 2002 20:42:28 +0200 Subject: [OpenAFS] Kerberos and AFS References: <000001c278b7$d8c3e3e0$30f43f04@morpheus> Message-ID: <3DB44A94.9060906@epost.de> >>I will be running 1 Solaris 9 AFS server with 2 SuSe 8.1 KDC's, how do I >>go about using the K5 authentication with AFS seamlessly? > > > You need the krb5 migration kit (which is included in the Red Hat > RPMS) so you can build 'asetkey' and 'aklog. You generate an > afs/@REALM key in your KDC, making sure you use '-e > des-cbc-crc:v4' and extract that into an afs keytab. Then you use > asetkey to add the keytab key into an AFS KeyFile. > Be aware that in the current release of Kerberos (1.2.6) krb524 (which converts the krb5-tickets to the kerberos 4 format, which is used by AFS) provides by default a keytype, which is IMHO not supportet by the current release of AFS. You can change this behavior in the config-files. Greetz Andreas btw: Hello to the list, I'm new here :-) From deengert@anl.gov Tue Oct 22 15:52:51 2002 From: deengert@anl.gov (Douglas E. Engert) Date: Tue, 22 Oct 2002 09:52:51 -0500 Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 Message-ID: <3DB56643.103CAF92@anl.gov> Is there any work being done on the client for OpenAFS for HP_UX? We have been using the Transarc clients for years, and would like to convert to OPenAFS. We have also recently obtained a new HP machine based on the Intel Itanium 2 processor. Even though these can run the PA-RISC programs in emulation mode, I am assuming the kernel modules will have to be native code. I might have some time to work on this, but would like to know what has already been done. Even a choice of a sysname for these would be a start, how about ia64_ux1122 Thanks. -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 From kerberos@northsailor.de Tue Oct 22 16:12:14 2002 From: kerberos@northsailor.de (Klaas Hagemann) Date: Tue, 22 Oct 2002 17:12:14 +0200 Subject: [OpenAFS] Kerberos and AFS References: <000001c278b7$d8c3e3e0$30f43f04@morpheus> <3DB44A94.9060906@epost.de> Message-ID: <004401c279dd$685f3b00$2b03a8c0@mummert.priv> Hi, concerning the problem with the krb5-1.2.6 i got very usefull hints from the kerberos mailing list: - you have to modify the krb5.conf on the kerberos server (look at /src/krb524d/README in the krb5-1.2.6 source code package). - there is a bug in the kerberos package in krb524d that does not set the kvno on the returned V4 ticket. Here is the patch for /src/krb524/krb524d.c (thanks to cesar garcia) : $ diff -c krb524d.c.orig krb524d.c *** krb524d.c.orig Thu Oct 17 13:37:30 2002 --- krb524d.c Thu Oct 17 13:39:55 2002 *************** *** 412,418 **** memset (key, 0, sizeof (*key)); return ret; } ! krb5_kt_free_entry(context, &entry); return 0; } else if (use_master) { --- 412,419 ---- memset (key, 0, sizeof (*key)); return ret; } ! if(kvnop) ! *kvnop = entry.vno; krb5_kt_free_entry(context, &entry); return 0; } else if (use_master) { Klaas PS: Hello Andreas... ----- Original Message ----- From: "Andreas Buhr" To: Cc: Sent: Monday, October 21, 2002 8:42 PM Subject: Re: [OpenAFS] Kerberos and AFS > >>I will be running 1 Solaris 9 AFS server with 2 SuSe 8.1 KDC's, how do I > >>go about using the K5 authentication with AFS seamlessly? > > > > > > You need the krb5 migration kit (which is included in the Red Hat > > RPMS) so you can build 'asetkey' and 'aklog. You generate an > > afs/@REALM key in your KDC, making sure you use '-e > > des-cbc-crc:v4' and extract that into an afs keytab. Then you use > > asetkey to add the keytab key into an AFS KeyFile. > > > > Be aware that in the current release of Kerberos (1.2.6) krb524 (which > converts the krb5-tickets to the kerberos 4 format, which is used by > AFS) provides by default a keytype, which is IMHO not supportet by the > current release of AFS. You can change this behavior in the config-files. > > Greetz > > Andreas > > btw: > Hello to the list, I'm new here :-) > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From shadow@dementia.org Tue Oct 22 16:13:11 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 22 Oct 2002 11:13:11 -0400 (EDT) Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 In-Reply-To: <3DB56643.103CAF92@anl.gov> Message-ID: On Tue, 22 Oct 2002, Douglas E. Engert wrote: > Is there any work being done on the client for OpenAFS for HP_UX? We have an HP-UX 11.0 port which requires being built into the kernel. PA-RISC, obviously. We have no 11.11 and on ports yet, nor ia64 HP-UX support. From somkar@in.ibm.com Tue Oct 22 16:11:05 2002 From: somkar@in.ibm.com (Omkar Sathe) Date: Tue, 22 Oct 2002 20:41:05 +0530 Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 Message-ID: how about ia64_hpux1122 for sysname ? regards -omkar wq! |---------+------------------------------> | | "Douglas E. Engert"| | | | | | Sent by: | | | openafs-info-admin@| | | openafs.org | | | | | | | | | 10/22/02 08:22 PM | | | | |---------+------------------------------> >--------------------------------------------------------------------------------------------------------------| | | | To: openafs-info@openafs.org | | cc: | | Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 | | | | | >--------------------------------------------------------------------------------------------------------------| Is there any work being done on the client for OpenAFS for HP_UX? We have been using the Transarc clients for years, and would like to convert to OPenAFS. We have also recently obtained a new HP machine based on the Intel Itanium 2 processor. Even though these can run the PA-RISC programs in emulation mode, I am assuming the kernel modules will have to be native code. I might have some time to work on this, but would like to know what has already been done. Even a choice of a sysname for these would be a start, how about ia64_ux1122 Thanks. -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info From deengert@anl.gov Tue Oct 22 16:27:58 2002 From: deengert@anl.gov (Douglas E. Engert) Date: Tue, 22 Oct 2002 10:27:58 -0500 Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 References: Message-ID: <3DB56E7E.F95EB8A6@anl.gov> Derrick J Brashear wrote: > > On Tue, 22 Oct 2002, Douglas E. Engert wrote: > > > Is there any work being done on the client for OpenAFS for HP_UX? > > We have an HP-UX 11.0 port which requires being built into the kernel. > PA-RISC, obviously. We have no 11.11 and on ports yet, nor ia64 HP-UX > support. OK, I did not see that, I saw comments about no client, and a comment about Missing RX code reconstructed, and a Kernal header needed from HP. which they have to release. Is there any aditional information on what is missing from HP? If I was to try and build the HP UX for 11.00, should I try the 1.3.2? > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Douglas E. Engert Argonne National Laboratory 9700 South Cass Avenue Argonne, Illinois 60439 (630) 252-5444 From shadow@dementia.org Tue Oct 22 16:36:03 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 22 Oct 2002 11:36:03 -0400 (EDT) Subject: [OpenAFS] AFS and HP_UX on PA-RISC and Itanium ia64 In-Reply-To: <3DB56E7E.F95EB8A6@anl.gov> Message-ID: On Tue, 22 Oct 2002, Douglas E. Engert wrote: > > We have an HP-UX 11.0 port which requires being built into the kernel. > > PA-RISC, obviously. We have no 11.11 and on ports yet, nor ia64 HP-UX > > support. > > OK, I did not see that, I saw comments about no client, and a comment > about Missing RX code reconstructed, and a Kernal header needed from HP. > which they have to release. Is there any aditional information on what is > missing from HP? Well, they released the header, so, nothing. OpenAFS 1.2.8 will include said support. > If I was to try and build the HP UX for 11.00, should I try the 1.3.2? 1.3.2 is older than 1.2.7. You can try the head... From nemesis-lists@icequake.net Wed Oct 23 06:38:35 2002 From: nemesis-lists@icequake.net (Ryan Underwood) Date: Wed, 23 Oct 2002 05:38:35 +0000 Subject: [OpenAFS] ReiserFS settings for /vicep Message-ID: Hi, Someone posted the optimal settings for using a reiser filesystem as an AFS partition, but I can't seem to find the message in the archives anymore. If this info could be re-posted, I would appreciate it. Thanks! -- Ryan Underwood, , icq=10317253 From amar deep kumar" Hi, can any body tell rpc exchange between fileserver and cachemanager during a file transfer when 1. file is not present in the cache. 2. file is present in the cache. amardeep From thomas.mueller@hrz.tu-chemnitz.de Thu Oct 24 06:57:30 2002 From: thomas.mueller@hrz.tu-chemnitz.de (Thomas Mueller) Date: Thu, 24 Oct 2002 07:57:30 +0200 (MEST) Subject: [OpenAFS] cache performance Message-ID: What do you think about using the mount options "noatime,data=3Dwriteback"= =20 when using an ext3 filesystem for the AFS cache on linux systems. I think this could increase the performance on a heavily used cache. Do you see any other impacts? Thomas. --=20 ------------------------------------------------- Thomas M=FCller, TU Chemnitz, URZ, D-09107 Chemnitz ------------------------------------------------- From kolya@MIT.EDU Thu Oct 24 07:38:24 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Thu, 24 Oct 2002 02:38:24 -0400 Subject: [OpenAFS] cache performance Message-ID: <200210240638.CAA10323@contents-vnder-pressvre.mit.edu> > What do you think about using the mount options "noatime,data=writeback" > when using an ext3 filesystem for the AFS cache on linux systems. > I think this could increase the performance on a heavily used cache. The "noatime" option will not make any difference -- the kernel module already sets the NOATIME bit on all the cache file inodes. I don't know for sure what the "data=writeback" option does, but guessing that it makes the buffer cache a write-back one, sure, it may increase your performance. Though I had the impression that Linux already did writeback caching.. Or maybe that was only for ext2, and ext3 enforces more traditional semantics? -- kolya From mpb@est.ibm.com Thu Oct 24 08:48:12 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Thu, 24 Oct 2002 08:48:12 +0100 Subject: [OpenAFS] OpenAFS and http://www.kernel.org Message-ID: <3DB7A5BC.5090203@est.ibm.com> One of the impediments for OpenAFS [1] is the proliferation of Linux distributions each with their own kernel ports. Example: Mandrake 9.0 [2] is not currently "supported" by OpenAFS. Would it be possible to take the kernel parts of OpenAFS and integrate them into the main Linux kernel [3] releases? If this were achieved, would it not make the task of making OpenAFS available in new distro releases a whole lot simpler? -- cheers paul http://acm.org/~mpb References: [1] OpenAFS http://www.openafs.org/ [2] Mandrake 9.0 Linux http://www.linux-mandrake.com/en/9.0/presentation/index.php3 [3] Linux kernel.org http://www.kernel.org/ From makowskm@chemia.uj.edu.pl Thu Oct 24 09:18:05 2002 From: makowskm@chemia.uj.edu.pl (makowskm@chemia.uj.edu.pl) Date: Thu, 24 Oct 2002 10:18:05 +0200 (CEST) Subject: [OpenAFS] Stability of AFS Message-ID: <3835.149.156.71.133.1035447485.squirrel@mail.ch.uj.edu.pl> We are using AFS for few months in our organization. For two weeks we have constant problems with stability of file system. Every 2(3) days it collapses producing system logs like those: Oct 23 15:18:31 porsacz kernel: Unable to handle kernel paging request at virtual address 0f3c8b21 Oct 23 15:18:31 porsacz kernel: printing eip: Oct 23 15:18:31 porsacz kernel: f883bde3 Oct 23 15:18:31 porsacz kernel: *pde = 00000000 Oct 23 15:18:31 porsacz kernel: Oops: 0002 Oct 23 15:18:31 porsacz kernel: libafs-2.4.18-10-athlon.mp soundcore eepro100 ext3 jbd 3w-xxxx sd_mod scsi_mod Oct 23 15:18:31 porsacz kernel: CPU: 1 Oct 23 15:18:31 porsacz kernel: EIP: 0010:[] Tainted: PF Oct 23 15:18:31 porsacz kernel: EFLAGS: 00010246 Oct 23 15:18:31 porsacz kernel: Oct 23 15:18:31 porsacz kernel: EIP is at journal_commit_transaction [jbd] 0x7c3 (2.4.18-10smp) Oct 23 15:18:31 porsacz kernel: eax: 0f3c8b11 ebx: f6488c90 ecx: 00000b5c edx: f6837840 Oct 23 15:18:31 porsacz kernel: esi: 00000000 edi: f6946600 ebp: e3787f90 esp: f69bde80 Oct 23 15:18:31 porsacz kernel: ds: 0018 es: 0018 ss: 0018 Oct 23 15:18:31 porsacz kernel: Process kjournald (pid: 149, stackpage=f69bd000) Oct 23 15:18:31 porsacz kernel: Stack: 00003016 00000000 00000f9c c5363064 0000000a cc065ac0 cd977bd0 00000d77 Oct 23 15:18:31 porsacz kernel: 00000001 ec274700 ec7e15c0 00000000 d7bbc3c0 cb1c1240 cb1c11c0 cb1c1140 Oct 23 15:18:31 porsacz kernel: cb1c10c0 cb5d3f40 cb5d3ec0 cb5d3e40 cb5d3dc0 cb5d3d40 cb1c1d40 cb1c1cc0 Oct 23 15:18:31 porsacz kernel: Call Trace: [] kjournald [jbd] 0x136 Oct 23 15:18:31 porsacz kernel: [] commit_timeout [jbd] 0x0 Oct 23 15:18:31 porsacz kernel: [] kernel_thread [kernel] 0x26 Oct 23 15:18:31 porsacz kernel: [] kjournald [jbd] 0x0 Oct 23 15:18:31 porsacz kernel: Oct 23 15:18:31 porsacz kernel: Oct 23 15:18:31 porsacz kernel: Code: f0 ff 40 10 8b 03 f0 0f ba 68 18 0a 8b 44 24 1c 50 8d 44 24 Checking the server status after such events don't show anything wrong, but in fact none of the AFS clients can get to file system. All what can be done is to obtain a token.The only way to bring back functionality is restarting the server machine. We are using OpenAFS ver.1.2.6 on RedHat 7.3 with OpenAFS modules compiled for our kernel (2.4.18-10smp). The server works as SMP with two Athlons1800+.The file system is located on the RAID5 with ext3 type partition. The machine has both AFS server and client functionality and the client cache is located on a separate partition of ext2 type. Could anyone help us to explain the instability of AFS in such configuration? Yours, Marcin Makowski Department of the Theoretical Chemistry Jagiellonian University makowskm@chemia.uj.edu.pl From mpb@est.ibm.com Thu Oct 24 09:35:46 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Thu, 24 Oct 2002 09:35:46 +0100 Subject: [OpenAFS] Stability of AFS References: <3835.149.156.71.133.1035447485.squirrel@mail.ch.uj.edu.pl> Message-ID: <3DB7B0E2.7070701@est.ibm.com> Hello Marcin, Just to let you know that we are using OpenAFS 1.2.7 installed as a set of RPMs on a RedHat 7.3 with kernel 2.4.18-10smp. The kernel module is: libafs-2.4.18-10-i686.mp. Our AFS fileserver partitions are ext3. This has been stable for us. -- cheers paul http://acm.org/~mpb makowskm@chemia.uj.edu.pl wrote: >We are using AFS for few months in our organization. For two weeks we have >constant problems with stability of file system. Every 2(3) days it >collapses producing system logs like those: > >Oct 23 15:18:31 porsacz kernel: Unable to handle kernel paging request at >virtual address 0f3c8b21 >Oct 23 15:18:31 porsacz kernel: printing eip: >Oct 23 15:18:31 porsacz kernel: f883bde3 >Oct 23 15:18:31 porsacz kernel: *pde = 00000000 >Oct 23 15:18:31 porsacz kernel: Oops: 0002 >Oct 23 15:18:31 porsacz kernel: libafs-2.4.18-10-athlon.mp soundcore >eepro100 ext3 jbd 3w-xxxx sd_mod scsi_mod >Oct 23 15:18:31 porsacz kernel: CPU: 1 >Oct 23 15:18:31 porsacz kernel: EIP: 0010:[] Tainted: PF >Oct 23 15:18:31 porsacz kernel: EFLAGS: 00010246 >Oct 23 15:18:31 porsacz kernel: >Oct 23 15:18:31 porsacz kernel: EIP is at journal_commit_transaction [jbd] >0x7c3 (2.4.18-10smp) >Oct 23 15:18:31 porsacz kernel: eax: 0f3c8b11 ebx: f6488c90 ecx: >00000b5c edx: f6837840 >Oct 23 15:18:31 porsacz kernel: esi: 00000000 edi: f6946600 ebp: >e3787f90 esp: f69bde80 >Oct 23 15:18:31 porsacz kernel: ds: 0018 es: 0018 ss: 0018 >Oct 23 15:18:31 porsacz kernel: Process kjournald (pid: 149, >stackpage=f69bd000) >Oct 23 15:18:31 porsacz kernel: Stack: 00003016 00000000 00000f9c c5363064 >0000000a cc065ac0 cd977bd0 00000d77 >Oct 23 15:18:31 porsacz kernel: 00000001 ec274700 ec7e15c0 00000000 >d7bbc3c0 cb1c1240 cb1c11c0 cb1c1140 >Oct 23 15:18:31 porsacz kernel: cb1c10c0 cb5d3f40 cb5d3ec0 cb5d3e40 >cb5d3dc0 cb5d3d40 cb1c1d40 cb1c1cc0 >Oct 23 15:18:31 porsacz kernel: Call Trace: [] kjournald [jbd] >0x136 >Oct 23 15:18:31 porsacz kernel: [] commit_timeout [jbd] 0x0 >Oct 23 15:18:31 porsacz kernel: [] kernel_thread [kernel] 0x26 >Oct 23 15:18:31 porsacz kernel: [] kjournald [jbd] 0x0 >Oct 23 15:18:31 porsacz kernel: >Oct 23 15:18:31 porsacz kernel: >Oct 23 15:18:31 porsacz kernel: Code: f0 ff 40 10 8b 03 f0 0f ba 68 18 0a >8b 44 24 1c 50 8d 44 24 > > Checking the server status after such events don't show anything wrong, >but in fact none of the AFS clients can get to file system. All what can >be done is to obtain a token.The only way to bring back functionality is >restarting the server machine. > > We are using OpenAFS ver.1.2.6 on RedHat 7.3 with OpenAFS modules >compiled for our kernel (2.4.18-10smp). The server works as SMP with two >Athlons1800+.The file system is located on the RAID5 with ext3 type >partition. The machine has both AFS server and client functionality and >the client cache is located on a separate partition of ext2 type. > >Could anyone help us to explain the instability of AFS in such configuration? > >Yours, > >Marcin Makowski >Department of the Theoretical Chemistry >Jagiellonian University >makowskm@chemia.uj.edu.pl > > >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > From reuter@rzg.mpg.de Thu Oct 24 10:01:14 2002 From: reuter@rzg.mpg.de (Hartmut Reuter) Date: Thu, 24 Oct 2002 11:01:14 +0200 Subject: [OpenAFS] Stability of AFS References: <3835.149.156.71.133.1035447485.squirrel@mail.ch.uj.edu.pl> Message-ID: <3DB7B6DA.3090403@rzg.mpg.de> To me this looks like a problem with your (RAID?) filesystem. The fileserver itself is a pure userland process. Also it doesn't look like the AFS-client on this machine would be involved. Your fileserver should be able to run without the AFS kernel extensions being loaded and without the client being running. The process name "kjournald" points to the filesystem layer. You have 3w-xxxx kernel extension loaded: this looks like you are using the 3ware RAID-controller. We had problems with the Escalade 6000 series and have them replaced by the 7850 controllers now. Does the web interface of the 3ware controller show any events? Hartmut makowskm@chemia.uj.edu.pl wrote: > We are using AFS for few months in our organization. For two weeks we have > constant problems with stability of file system. Every 2(3) days it > collapses producing system logs like those: > > Oct 23 15:18:31 porsacz kernel: Unable to handle kernel paging request at > virtual address 0f3c8b21 > Oct 23 15:18:31 porsacz kernel: printing eip: > Oct 23 15:18:31 porsacz kernel: f883bde3 > Oct 23 15:18:31 porsacz kernel: *pde = 00000000 > Oct 23 15:18:31 porsacz kernel: Oops: 0002 > Oct 23 15:18:31 porsacz kernel: libafs-2.4.18-10-athlon.mp soundcore > eepro100 ext3 jbd 3w-xxxx sd_mod scsi_mod > Oct 23 15:18:31 porsacz kernel: CPU: 1 > Oct 23 15:18:31 porsacz kernel: EIP: 0010:[] Tainted: PF > Oct 23 15:18:31 porsacz kernel: EFLAGS: 00010246 > Oct 23 15:18:31 porsacz kernel: > Oct 23 15:18:31 porsacz kernel: EIP is at journal_commit_transaction [jbd] > 0x7c3 (2.4.18-10smp) > Oct 23 15:18:31 porsacz kernel: eax: 0f3c8b11 ebx: f6488c90 ecx: > 00000b5c edx: f6837840 > Oct 23 15:18:31 porsacz kernel: esi: 00000000 edi: f6946600 ebp: > e3787f90 esp: f69bde80 > Oct 23 15:18:31 porsacz kernel: ds: 0018 es: 0018 ss: 0018 > Oct 23 15:18:31 porsacz kernel: Process kjournald (pid: 149, > stackpage=f69bd000) > Oct 23 15:18:31 porsacz kernel: Stack: 00003016 00000000 00000f9c c5363064 > 0000000a cc065ac0 cd977bd0 00000d77 > Oct 23 15:18:31 porsacz kernel: 00000001 ec274700 ec7e15c0 00000000 > d7bbc3c0 cb1c1240 cb1c11c0 cb1c1140 > Oct 23 15:18:31 porsacz kernel: cb1c10c0 cb5d3f40 cb5d3ec0 cb5d3e40 > cb5d3dc0 cb5d3d40 cb1c1d40 cb1c1cc0 > Oct 23 15:18:31 porsacz kernel: Call Trace: [] kjournald [jbd] > 0x136 > Oct 23 15:18:31 porsacz kernel: [] commit_timeout [jbd] 0x0 > Oct 23 15:18:31 porsacz kernel: [] kernel_thread [kernel] 0x26 > Oct 23 15:18:31 porsacz kernel: [] kjournald [jbd] 0x0 > Oct 23 15:18:31 porsacz kernel: > Oct 23 15:18:31 porsacz kernel: > Oct 23 15:18:31 porsacz kernel: Code: f0 ff 40 10 8b 03 f0 0f ba 68 18 0a > 8b 44 24 1c 50 8d 44 24 > > Checking the server status after such events don't show anything wrong, > but in fact none of the AFS clients can get to file system. All what can > be done is to obtain a token.The only way to bring back functionality is > restarting the server machine. > > We are using OpenAFS ver.1.2.6 on RedHat 7.3 with OpenAFS modules > compiled for our kernel (2.4.18-10smp). The server works as SMP with two > Athlons1800+.The file system is located on the RAID5 with ext3 type > partition. The machine has both AFS server and client functionality and > the client cache is located on a separate partition of ext2 type. > > Could anyone help us to explain the instability of AFS in such configuration? > > Yours, > > Marcin Makowski > Department of the Theoretical Chemistry > Jagiellonian University > makowskm@chemia.uj.edu.pl > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ----------------------------------------------------------------- Hartmut Reuter e-mail reuter@rzg.mpg.de phone +49-89-3299-1328 RZG (Rechenzentrum Garching) fax +49-89-3299-1301 Computing Center of the Max-Planck-Gesellschaft (MPG) and the Institut fuer Plasmaphysik (IPP) ----------------------------------------------------------------- From shadow@dementia.org Thu Oct 24 13:27:27 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 24 Oct 2002 08:27:27 -0400 (EDT) Subject: [OpenAFS] OpenAFS and http://www.kernel.org In-Reply-To: <3DB7A5BC.5090203@est.ibm.com> Message-ID: On Thu, 24 Oct 2002, Paul Blackburn wrote: > One of the impediments for OpenAFS [1] is the proliferation > of Linux distributions each with their own kernel ports. > > Example: Mandrake 9.0 [2] is not currently "supported" by OpenAFS. > > Would it be possible to take the kernel parts of OpenAFS > and integrate them into the main Linux kernel [3] releases? > > If this were achieved, would it not make the task of making > OpenAFS available in new distro releases a whole lot simpler? This really isn't the right week to go there. I'll just say "I don't think it's going to happen" From joseph@ctcgsc.org Thu Oct 24 13:56:27 2002 From: joseph@ctcgsc.org (Norman P. B. Joseph) Date: 24 Oct 2002 08:56:27 -0400 Subject: [OpenAFS] Spinnaker Networks Message-ID: <1035464187.20079.52.camel@linux27.ctcgsc.org> I was pulled into a meeting unexpectedly this week between upper management and representatives of a Pittsburgh startup called Spinnaker Networks. This company was formed with former Fore Systems and Transarc employees, and their recently announced product is a NAS server with operating characteristics very similar (no surprise) to AFS. Clients would be presented with a CIFS/NFS protocol interface and require no special client-side software. Immediately I see the lack of client-side caching as a drawback (not to mention the price), but it may also solve our issues with byte-range locking, especially with Windows (Outlook) clients. And not having to deal with client-side software (and all that that implies) would be a big win. I know this might be slightly off-topic, but I thought this would be a good arena to solicit opinions about (or possibly experience with) their product, especially as it compares to an AFS infrastructure. I would be happy to take off-list correspondence if you feel this is too far afield from openafs-info. Their website is http://spinnakernet.com/ -- Norman Joseph, Systems Engineer joseph@ctcgsc.org IC|XC Concurrent Technologies Corporation 814/269.2633 --+-- Global Systems Center NI|KA *** Be kind, for everyone you meet is fighting a great battle *** From schmitt@inf.ethz.ch Thu Oct 24 14:12:46 2002 From: schmitt@inf.ethz.ch (Marc Schmitt) Date: Thu, 24 Oct 2002 15:12:46 +0200 Subject: [OpenAFS] Volume management for non-AFS-admins Message-ID: <3DB7F1CE.4020703@inf.ethz.ch> Dear all, We`re using AFS for software distribution and would like to give some "regular users" the possibility to create/replicate/release volumes on certain servers/partitions, setting ACLs or quota without making them global AFS-admins. In addition, those "regular users" should be able to change the owner of files (sometimes required when installing software). I imagine that many AFS sites have such a facility in production. I`d very appreciate any pointers/comments to such tools. We`re also considering to create a separate cell for satisfying the needs described above. Afaik, there are no sub-cells in AFS, we`d have to set up and maintain a completely independent cell (additonal DB/File-servers etc...). I`m sure many AFS-admins are confronted with such needs. How did you solve it? TIA Regards, Marc From warlord@MIT.EDU Thu Oct 24 14:39:11 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 24 Oct 2002 09:39:11 -0400 Subject: [OpenAFS] OpenAFS and http://www.kernel.org In-Reply-To: <3DB7A5BC.5090203@est.ibm.com> References: <3DB7A5BC.5090203@est.ibm.com> Message-ID: I had broached the subject earlier. One of the issues if that the IPL and GPL (theoretically) do not interact properly. Then there is the problem of code divergence and stability. There are a few "well known" issues that, once fixed, should significantly reduce the portability problems across kernels. ISTR that Derrick enumerated these issues in a recent mail. The biggest impediment is the inode/vnode cache -- if AFS could use the Linux kernel inode cache instead of its own, it would go a LONG WAY to fixing the portability problemss (many of which are problems with inode initialization). If you want to work on that, I'm sure Derrick would be happy to incorporate patches. -derek Paul Blackburn writes: > One of the impediments for OpenAFS [1] is the proliferation > of Linux distributions each with their own kernel ports. > > Example: Mandrake 9.0 [2] is not currently "supported" by OpenAFS. > > Would it be possible to take the kernel parts of OpenAFS > and integrate them into the main Linux kernel [3] releases? > > If this were achieved, would it not make the task of making > OpenAFS available in new distro releases a whole lot simpler? > -- > cheers > paul http://acm.org/~mpb > > References: > > [1] OpenAFS > http://www.openafs.org/ > > [2] Mandrake 9.0 Linux > http://www.linux-mandrake.com/en/9.0/presentation/index.php3 > > [3] Linux kernel.org > http://www.kernel.org/ > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From nrawling@firedrake.net Thu Oct 24 15:06:28 2002 From: nrawling@firedrake.net (Nathan Rawling) Date: Thu, 24 Oct 2002 10:06:28 -0400 (EDT) Subject: [OpenAFS] Volume management for non-AFS-admins In-Reply-To: <3DB7F1CE.4020703@inf.ethz.ch> Message-ID: > I imagine that many AFS sites have such a facility in production. > I`d very appreciate any pointers/comments to such tools. The last time I had to solve this problem (a few years ago), I used ADM from Carnegie-Mellon. ADM is a client-server application scriptable in Scheme, a LISP derivative. I know a number of sites have used it to great success, although I found the Scheme authoring to be a somewhat distasteful part of the process. I did manage to implement a number of functions that you are describing though with this tool. I wrapped up the client utility "admclt" with a Perl script using the Expect module to provide a layer of userproofing. This reduced the amount of error-checking code I had to write in Scheme. Obviously, the permissions checking still needed to take place in Scheme, but most other checks and formatting happened in Perl. I always told myself, however, that if I had to do it over again, I would write a daemon in Perl using some of the client/server modules available there, and possibly the AFS module, although it was dreadfully out-of-date the last time I looked at it. Nathan From shadow@dementia.org Thu Oct 24 15:18:29 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 24 Oct 2002 10:18:29 -0400 (EDT) Subject: [OpenAFS] Volume management for non-AFS-admins In-Reply-To: Message-ID: On Thu, 24 Oct 2002, Nathan Rawling wrote: > > I imagine that many AFS sites have such a facility in production. > > I`d very appreciate any pointers/comments to such tools. > > The last time I had to solve this problem (a few years ago), I used ADM > from Carnegie-Mellon. ADM is a client-server application scriptable in > Scheme, a LISP derivative. > > I know a number of sites have used it to great success, although I found > the Scheme authoring to be a somewhat distasteful part of the process. I > did manage to implement a number of functions that you are describing > though with this tool. I sat down and learned enough scheme over about 3 days to start using ADM after a coworker who used to maintain it left. I've extended it since but it needs autoconf cleanup. I dislike writing scheme, but for a clever person it's probably easy; I mean, if I can do it imagine what someone smart can do;-) > I always told myself, however, that if I had to do it over again, I would > write a daemon in Perl using some of the client/server modules available > there, and possibly the AFS module, although it was dreadfully out-of-date > the last time I looked at it. We've had the same idea on and off, but no time. From thomas.mueller@hrz.tu-chemnitz.de Thu Oct 24 15:42:16 2002 From: thomas.mueller@hrz.tu-chemnitz.de (Thomas Mueller) Date: Thu, 24 Oct 2002 16:42:16 +0200 (MEST) Subject: [OpenAFS] cache performance In-Reply-To: <200210240638.CAA10323@contents-vnder-pressvre.mit.edu> Message-ID: On Thu, 24 Oct 2002, Nickolai Zeldovich wrote: > > What do you think about using the mount options "noatime,data=3Dwriteba= ck"=20 > > when using an ext3 filesystem for the AFS cache on linux systems. > > I think this could increase the performance on a heavily used cache. >=20 > The "noatime" option will not make any difference -- the kernel module > already sets the NOATIME bit on all the cache file inodes. I don't know > for sure what the "data=3Dwriteback" option does, but guessing that it ma= kes > the buffer cache a write-back one, sure, it may increase your performance= =2E > Though I had the impression that Linux already did writeback caching.. O= r > maybe that was only for ext2, and ext3 enforces more traditional semantic= s? The default for ext3 is "data=3Dordered", which means=20 that all data is forced directly to the filesystem before associated=20 metadata updates are committed to the journal. "data=3Dwriteback" means that filesystem data updates can be made lazily,= =20 even after related metadata changes have been committed to the journal. We will give it a trial ... Thanks, Thomas. =20 --=20 ------------------------------------------------- Thomas M=FCller, TU Chemnitz, URZ, D-09107 Chemnitz Tel: +49 (0)371 5311755 Fax: +49 (0)371 5311629 ------------------------------------------------- From Phil.Moore@morganstanley.com Thu Oct 24 22:29:04 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Thu, 24 Oct 2002 17:29:04 -0400 Subject: [OpenAFS] cache performance In-Reply-To: <200210240638.CAA10323@contents-vnder-pressvre.mit.edu> References: <200210240638.CAA10323@contents-vnder-pressvre.mit.edu> Message-ID: <15800.26144.533197.545205@zappa.ms.com> >>>>> "Nickolai" == Nickolai Zeldovich writes: >> What do you think about using the mount options "noatime,data=writeback" >> when using an ext3 filesystem for the AFS cache on linux systems. >> I think this could increase the performance on a heavily used cache. Nickolai> The "noatime" option will not make any difference -- the kernel module Nickolai> already sets the NOATIME bit on all the cache file inodes. I don't know Nickolai> for sure what the "data=writeback" option does, but guessing that it makes Nickolai> the buffer cache a write-back one, sure, it may increase your performance. Nickolai> Though I had the impression that Linux already did writeback caching.. Or Nickolai> maybe that was only for ext2, and ext3 enforces more traditional semantics? NOATIME!? Uh, forgive my ignorance, but I take it this means that access times are no longer maintained on the V files in the cache? I understand why this would be the case, as an obvious performance improvement, but I have code that analyzes the AFS cache and summarizes the usage by volume and cell, showing the size and *lastaccess* time of the volume in the cache. Experimentally, simply stating the V files and taking the most recent last access timestampt for all of the V files that comprise a specific volume did in fact produce results that were contistent with my expectations. The reason we have this code is that we analyze the contents of ALL of our clients caches (yes, I'm not joking, we really do), and procude enterprise wide reports on who is accessing what volumes. This has proven very useful. Now, what you are saying suggests that we can't contoinue to make this assumption about the access times, and thus, we'll have to rethink our cache analysis code. From shadow@dementia.org Thu Oct 24 22:38:11 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 24 Oct 2002 17:38:11 -0400 (EDT) Subject: [OpenAFS] cache performance In-Reply-To: <15800.26144.533197.545205@zappa.ms.com> Message-ID: On Thu, 24 Oct 2002 Phil.Moore@morganstanley.com wrote: > enterprise wide reports on who is accessing what volumes. This has > proven very useful. Who at a user level or machine level? > Now, what you are saying suggests that we can't contoinue to make this > assumption about the access times, and thus, we'll have to rethink our > cache analysis code. Snoop the wire and record the data you want (at the fileserver end)? From kolya@MIT.EDU Fri Oct 25 08:20:00 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Fri, 25 Oct 2002 03:20:00 -0400 Subject: [OpenAFS] cache performance In-Reply-To: Your message of "Thu, 24 Oct 2002 17:29:04 EDT." <15800.26144.533197.545205@zappa.ms.com> Message-ID: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> On Thu, 24 Oct 2002, Phil.Moore@morganstanley.com wrote: > NOATIME!? Uh, forgive my ignorance, but I take it this means that > access times are no longer maintained on the V files in the cache? Well, I thought this was the behavior for a long time now, but since you mention it, hm... It looks like in 3.5p2, Transarc added noatime code to the Solaris port (osi_DisableAtimes() in SOLARIS/osi_file.c), and to Linux (in osi_UFSOpen() in LINUX/osi_file.c). But something seems to be still updating the atimes, as I'm seeing recent atimes on most V files in my AFS client caches. So, although there's code that claims to disable atimes, empirical evidence suggests that it's broken, and atimes are being updated anyway (not a big surprise for Transarc/AFS code). Given that you are relying on atimes, I'm a bit hesitant to "fix" it, esp. lacking good performance reasons to do so. > The reason we have this code is that we analyze the contents of ALL of > our clients caches (yes, I'm not joking, we really do), and procude > enterprise wide reports on who is accessing what volumes. This has > proven very useful. Would a combination of cmdebug and server-side logging be a reasonable alternative? -- kolya From andreas.voss@id.ethz.ch Fri Oct 25 08:34:09 2002 From: andreas.voss@id.ethz.ch (Voss, Andreas) Date: Fri, 25 Oct 2002 09:34:09 +0200 Subject: [OpenAFS] Open AFS-Windows-Client does not update ntuser.dat Message-ID: Hello, =20 if i replace the ibm-afs-client by the open-afs-client on Windows 2000 = and log in with an useraccount with profile-path on afs, then everything = works - new profile is created, i can work etc. etc. - but after logoff = i got the message =20 "Windows cannot update your roaming profile. Contact your network = administrator.=20 DETAIL - The specified server cannot perform the requested operation" The Windows-Application-event-ID of this Error is 1000. Looking at the afsd.log, created with fs trace -dump, i detect, that i = can not find the string "ntuser.dat" inside. The same log created with = ibm-afs shows, that ntuser.dat is written. Looking further, i see, that in the log file the directory, where the = users (in this case: "carolm") ntuser.dat is stored = (\users\c\carolm\profiles\hg\win.pds) is not logged correctly and even = the path gets shorter and shorter in the log-File. In the IBM-Client the = full path is written (\users\c\carolm\profiles\hg\win.pds\NTUSER.DAT), = in the Log-File of the open-afs-client the path first is = "...carolm\profiles\hg\win.pds", then ...lm\profiles\hg\win.pds\*.*. Because open-afs does not support global drives in a way usable for = profile-creation (as reported earlier), the AFS-profile-path is mounted = via a startscript "mountsz.bat" and defined c:\winnt\afsdsbmt.ini. In = this way the drive "z" is mounted early enough (in opposite to the = global drives), so it is found with all problems. Doing the same with = ibm-afs, it is working well. The reason, why i try open afs is the problem posted before: the = redirected favorites are working fine with open afs even after = installation of Windows 2000 SP3. But now i have the other - more = important - problem: ntuser.dat cannot be updated. And this is = nessecary, even if all file-stores (My Documents, My Pictures, = Favorites, App Data) are redirected, because ntuser.dat stores the many = application-settings (where for example SPLUS stores his data). I hope, anybody uses open-afs als client with Profiles on afs and can = help me. The full-log files of the open afs (afsdopen.log) and ibm afs = (afsdibm.log) are found on my download-page http://n.ethz.ch/student/avo/download/profileproblem/ Thank you for help Andreas Voss, ETH Zuerich, andreas.voss@id.ethz.ch From mpb@est.ibm.com Fri Oct 25 09:47:36 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Fri, 25 Oct 2002 09:47:36 +0100 Subject: [OpenAFS] [Q] Some questions on AFS... References: <20021025052117.C721E38B95@mail.embian.com> Message-ID: <3DB90528.3090003@est.ibm.com> S.J.Chun wrote: >Hi, > >If the master AFS server does down(or crashes) what happens to users and the >other servers ? How can I set fail over mechanism on master AFS server? >And, how can I extend life time of a token ? > >Thanks in advance. >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > Hello, If you have only one AFS server and it crashes then you have problems (at least until it is rebooted). What we do is to have three dedicated AFS database servers and separate dedicated AFS fileservers. AFS database servers By having multiple AFS database servers you provide highly available services for your AFS cell. If one crashes then the others continue to provide service. Clients may or may not notice a slight delay if one out of three database servers is down. This is because when a client needs to communicate with a DB server, it chooses one at random from the CellServDB list. If the selected DB server does not respond, then after a timeout delay the client selects another. There needs to be synchronization of data between the DB servers. This is achieved using "Ubik". Multiple DB servers have a voting system to decide which one will be the "sync site" (or master DB server). If this "sync site" db server fails, the remaining DB servers vote between themselves to decide a new "sync site". So, when you recover a failed DB server, it automagically re-joins the "Ubik" synchronisation and "sync site" voting. The other good advantage of having dedicated DB servers is for performance: the processing load is now distributed over several machines. Also, by only running AFS DB processes (eg no general user login or other services: web etc) you provide optimum AFS service which won't be degraded by non-AFS processing. You can use relatively low-cost machines for DB servers. They don't need much disk space. Fileservers You can improve the robustness of access to /afs/@cell/ by having several dedicated AFS fileservers and creating replicated ReadOnly copies of your ReadWrite volumes. Typically, you use this for data that is "read-mostly". For example: the top level directories of your cell like root.afs, root.cell, and (if you have one) root.othercells. Once you have replicated the root.cell volume onto two or more fileservers then access to /afs/@cell/ will still work if one fileserver is down. It turns out that there is alot of "read-mostly" data which you can replicate: top level directories, executables and scripts, documentation, HTML pages and graphics. It just depends on your file content as to the best way to replicate. One point to remember, it is not effective to try to have replicated ReadOnly copies of dynamic data (for example: personal home directories). However, one you have multiple fileservers you have reduced your dependency on a single machine and therefore the impact of s single machine failing is much less. One of the really neat things about AFS is that you can move AFS volumes between fileservers without having an impact on your "live" users. One point about fileservers: they do not have a voting system like database servers. So, you could buy a high specification new fileserver, add it into your AFS cell, and move all AFS volumes off an old fileserver to the new one with no outage of your AFS services to your "live" users. AFS gives you a excellent ways to manage your fileservice. So, the "failover" you asked about to is _free_ if you build your AFS cell in a robust way. > And, how can I extend life time of a token ? There are a few ways, depending on what you want to do. AFS administrators can alter token lifetimes using the kas command. If you want to run some afs-authenticated task for a long time you could use an automatic re-authentication process (like reauth). There are also ways to have AFS authentication for long-running batch jobs. eg: http://www.lam-mpi.org/software/psr/ I hope this helps. -- cheers paul http://acm.org/~mpb From kb44@rz.uni-karlsruhe.de Fri Oct 25 10:31:57 2002 From: kb44@rz.uni-karlsruhe.de (=?iso-8859-1?Q?Rubino_Gei=DF?=) Date: Fri, 25 Oct 2002 11:31:57 +0200 Subject: [OpenAFS] Buffer Overflow in kerberos / are we affected? Message-ID: <001801c27c09$6eb41240$835516ac@info.unikarlsruhe.de> See: http://www.ciac.org/ciac/bulletins/n-009.shtml In brief: PROBLEM: A stack buffer overflow in the implementation of the Kerberos v4 compatibility administration daemon (kadmind4) in the MIT krb5 distribution could be exploited to gain unauthorized root access to a KDC host. SOTFWARE: All releases of MIT Kerberos 5, up to and including krb5-1.2.6. All Kerberos 4 implementations derived from MIT Kerberos 4, including Cygnus Network Security (CNS). DAMAGE: A remote attacker could execute arbitrary code on the KDC with the privileges of the user running kadmind4 (usually root). SOLUTION: Apply patch. Is the AFS kerberos impl. derived from MIT? Hope we do not have a problem! Bye, Rubino R. Geiss -- Rubino Geiss, Universitaet Karlsruhe, IPD Goos Postfach 6980, D-76128 Karlsruhe, GERMANY Adenauerring 20a, 50.41 (AVG), Zi. 235 rubino@ipd.info.uni-karlsruhe.de Tel: (+49) 721 / 608-8352 Fax: (+49) 721 / 30047 From ian@assv.net Fri Oct 25 11:51:26 2002 From: ian@assv.net (Ian Delahorne) Date: 25 Oct 2002 12:51:26 +0200 Subject: [OpenAFS] Buffer Overflow in kerberos / are we affected? In-Reply-To: <001801c27c09$6eb41240$835516ac@info.unikarlsruhe.de> References: <001801c27c09$6eb41240$835516ac@info.unikarlsruhe.de> Message-ID: Rubino Gei=DF writes: > See: http://www.ciac.org/ciac/bulletins/n-009.shtml >=20 > In brief: > PROBLEM: A stack buffer overflow in the implementation of the Kerberos > v4 compatibility administration daemon (kadmind4) in the MIT krb5 > distribution could be exploited to gain unauthorized root access to a > KDC host.=20=20 This also effects Heimdal with krb4-support and kth-krb4, for those that haven't noticed. --=20 /Ian D ian@assv.net - www.assv.net From andrej.filipcic@ijs.si Fri Oct 25 12:13:08 2002 From: andrej.filipcic@ijs.si (Andrej Filipcic) Date: Fri, 25 Oct 2002 13:13:08 +0200 (CEST) Subject: [OpenAFS] 1.2.7 dynroot & xfs Message-ID: This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to mime@docserver.cac.washington.edu for more info. ---104725860-1645359329-1035544388=:2071 Content-Type: TEXT/PLAIN; charset=US-ASCII Hi, I have a problem with openafs-1.2.7 on RH8.0 and "-dynroot". Root fs is on xfs filesystem, cache is on ext2. If I try to use "-dynroot", afsd oopses the kernel on afs start (log in attachment). Without "-dynroot", it works OK. I have noticed a call to "xfs_next_bit" xfs function in the log with dynroot. the kernel is "official" xfs patched redhat with sys_call_table exported (kernel-2.4.18-17SGI_XFS_1.2pre2 from oss.sgi.com) Is this xfs or openafs issue? Best regards, Andrej -- _____________________________________________________________ doc. dr. Andrej Filipcic, E-mail: Andrej.Filipcic@ijs.si Department of Experimental High Energy Physics - F9 Jozef Stefan Institute, Jamova 39, P.o.Box 3000 SI-1001 Ljubljana, Slovenia Tel.: +386-1-477-3674 Fax: +386-1-425-7074 ------------------------------------------------------------- ---104725860-1645359329-1035544388=:2071 Content-Type: TEXT/PLAIN; charset=US-ASCII; name=afslog Content-Transfer-Encoding: BASE64 Content-ID: Content-Description: Content-Disposition: attachment; filename=afslog U3RhcnRpbmcgQUZTIGNhY2hlIHNjYW4uLi5mb3VuZCAwIG5vbi1lbXB0eSBj YWNoZSBmaWxlcyAoMCUlKS4NClVuYWJsZSB0byBoYW5kbGUga2VybmVsIHBh Z2luZyByZXF1ZXN0IGF0IHZpcnR1YWwgYWRkcmVzcyBmOGRhZDAwMA0KIHBy aW50aW5nIGVpcDoNCmY4YjQ0MTBkDQoqcGRlID0gMzZhZjMwNjcNCipwdGUg PSAwMDAwMDAwMA0KT29wczogMDAwMg0KbGliYWZzLTIuNC4xOC0xN2FmMXNt cC5tcCBiaW5mbXRfbWlzYyBzbmQtZW11MTBrMS1zeW50aCBzbmQtZW11eC1z eW50aCBzbmQtc2VxDQpDUFU6ICAgIDENCkVJUDogICAgMDAxMDpbPGY4YjQ0 MTBkPl0gICAgVGFpbnRlZDogUEYNCkVGTEFHUzogMDAwMTAyMDINCg0KRUlQ IGlzIGF0IGFmc19Jc0R5bnJvb3QgW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAu bXBdIDB4OGQgKDIuNC4xOC0xN2FmMXNtcCkNCmVheDogMDAwMDIwMDAgICBl Yng6IGY4ZGFkMDAwICAgZWN4OiAwMDAwMDA0MSAgIGVkeDogMDAwMDAwM2YN CmVzaTogMDAwMDAwMDEgICBlZGk6IDAxMDAwMTlhICAgZWJwOiAwMDAwMDAw NCAgIGVzcDogZjZiMTdjYzQNCmRzOiAwMDE4ICAgZXM6IDAwMTggICBzczog MDAxOA0KUHJvY2VzcyBhZnNkIChwaWQ6IDExMTcsIHN0YWNrcGFnZT1mNmIx NzAwMCkNClN0YWNrOiBmOGE3MTAwMCAwMDAwMTViYiBmOGE3N2YwOCAwMDAw MDAwMyAwMDAwMDAwMSAwMDAwMDAwNCAwMDAwMDAwMiAwMTAwMDE5YSANCiAg ICAgICBmNmFiMTgxMiBmNjEzMmI5MyBmNjEzMmI4MCBmOGI0NDUzYyBmOGRh YjAwMCBmNmIxN2QzYyBmNmIxN2Q0MCBmNjEzMmI4MCANCiAgICAgICAwMTAw MDE5YSAwMDAwMDAwMSAwMDAwMDAwMCAwMTAwMDE5NiAwMDAzODAwMCBmNmI4 MDY4MCAwMDAwMDBjZSAwMDAwMDAwMCANCkNhbGwgVHJhY2U6IFs8ZjhiNDQ1 M2M+XSBhZnNfUmVmcmVzaER5bnJvb3QgW2xpYmFmcy0yLjQuMTgtMTdhZjFz bXAubXBdIDB4MzJjICgweGY2YjE3Y2YwKSkNCls8YzAxYzAxZWQ+XSB4ZnNf bmV4dF9iaXRfUnNtcF81MDFlZDU5NCBbXSAweDIyMThkICgweGY2YjE3ZDQ0 KSkNCls8ZjhiNDQ4ODg+XSBhZnNfR2V0RHlucm9vdCBbbGliYWZzLTIuNC4x OC0xN2FmMXNtcC5tcF0gMHg3OCAoMHhmNmIxN2Q3MCkpDQpbPGY4YmJkYjIw Pl0gYWZzX3Jvb3RGaWQgW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAubXBdIDB4 MCAoMHhmNmIxN2Q3YykpDQpbPGY4YjQ0ZDUxPl0gYWZzX0R5bnJvb3ROZXdW bm9kZSBbbGliYWZzLTIuNC4xOC0xN2FmMXNtcC5tcF0gMHgzNzEgKDB4ZjZi MTdkODApKQ0KWzxmOGJiZGIyMD5dIGFmc19yb290RmlkIFtsaWJhZnMtMi40 LjE4LTE3YWYxc21wLm1wXSAweDAgKDB4ZjZiMTdkOTQpKQ0KWzxmOGJiZGIy MD5dIGFmc19yb290RmlkIFtsaWJhZnMtMi40LjE4LTE3YWYxc21wLm1wXSAw eDAgKDB4ZjZiMTdkYjgpKQ0KWzxmOGI1MjRhNj5dIGFmc19HZXRWQ2FjaGUg W2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAubXBdIDB4MjY2ICgweGY2YjE3ZGMw KSkNCls8ZjhiYjNlMmM+XSBhZnNfZ2xvYmFsX2xvY2sgW2xpYmFmcy0yLjQu MTgtMTdhZjFzbXAubXBdIDB4MCAoMHhmNmIxN2RlYykpDQpbPGY4YjM2Njg5 Pl0gYWZzX2xoYXNoX2VudGVyIFtsaWJhZnMtMi40LjE4LTE3YWYxc21wLm1w XSAweDY5ICgweGY2YjE3ZGYwKSkNCls8ZjhiYjNmY2M+XSBhZnNfZmlsZV9z eXN0ZW0gW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAubXBdIDB4MCAoMHhmNmIx N2UwYykpDQpbPGY4Yjg3M2M0Pl0gb3NpX2xpbnV4X2FsbG9jIFtsaWJhZnMt Mi40LjE4LTE3YWYxc21wLm1wXSAweDg0ICgweGY2YjE3ZTEwKSkNCls8Zjhi NDk5Njg+XSBQYWdJbkNyZWQgW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAubXBd IDB4MjggKDB4ZjZiMTdlMzApKQ0KWzxmOGJiM2ZjYz5dIGFmc19maWxlX3N5 c3RlbSBbbGliYWZzLTIuNC4xOC0xN2FmMXNtcC5tcF0gMHgwICgweGY2YjE3 ZTRjKSkNCls8ZjhiYjNlMmM+XSBhZnNfZ2xvYmFsX2xvY2sgW2xpYmFmcy0y LjQuMTgtMTdhZjFzbXAubXBdIDB4MCAoMHhmNmIxN2U1YykpDQpbPGY4Yjg5 ZTJmPl0gYWZzX3JlYWRfc3VwZXIgW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAu bXBdIDB4MjFmICgweGY2YjE3ZTYwKSkNCls8ZjhiYmRiMjA+XSBhZnNfcm9v dEZpZCBbbGliYWZzLTIuNC4xOC0xN2FmMXNtcC5tcF0gMHgwICgweGY2YjE3 ZTY0KSkNCls8ZjhiODllMTU+XSBhZnNfcmVhZF9zdXBlciBbbGliYWZzLTIu NC4xOC0xN2FmMXNtcC5tcF0gMHgyMDUgKDB4ZjZiMTdlODApKQ0KWzxmOGJi M2ZjYz5dIGFmc19maWxlX3N5c3RlbSBbbGliYWZzLTIuNC4xOC0xN2FmMXNt cC5tcF0gMHgwICgweGY2YjE3ZWFjKSkNCls8ZjhiODljZjk+XSBhZnNfcmVh ZF9zdXBlciBbbGliYWZzLTIuNC4xOC0xN2FmMXNtcC5tcF0gMHhlOSAoMHhm NmIxN2ViMCkpDQpbPGY4YmIzZmNjPl0gYWZzX2ZpbGVfc3lzdGVtIFtsaWJh ZnMtMi40LjE4LTE3YWYxc21wLm1wXSAweDAgKDB4ZjZiMTdlYjgpKQ0KWzxj MDE1MGM0YT5dIGdldF9zdXBlcl9Sc21wX2ZkOWZiNTU1IFtdIDB4M2RhICgw eGY2YjE3ZWMwKSkNCls8ZjhiYjNmY2M+XSBhZnNfZmlsZV9zeXN0ZW0gW2xp YmFmcy0yLjQuMTgtMTdhZjFzbXAubXBdIDB4MCAoMHhmNmIxN2VjNCkpDQpb PGY4YmIzZmNjPl0gYWZzX2ZpbGVfc3lzdGVtIFtsaWJhZnMtMi40LjE4LTE3 YWYxc21wLm1wXSAweDAgKDB4ZjZiMTdlYzgpKQ0KWzxmOGJiM2ZjYz5dIGFm c19maWxlX3N5c3RlbSBbbGliYWZzLTIuNC4xOC0xN2FmMXNtcC5tcF0gMHgw ICgweGY2YjE3ZWQ4KSkNCls8YzAxNTBmYzM+XSBnZXRfc3VwZXJfUnNtcF9m ZDlmYjU1NSBbXSAweDc1MyAoMHhmNmIxN2VlMCkpDQpbPGY4YmIzZmNjPl0g YWZzX2ZpbGVfc3lzdGVtIFtsaWJhZnMtMi40LjE4LTE3YWYxc21wLm1wXSAw eDAgKDB4ZjZiMTdlZjgpKQ0KWzxjMDE1MTFmMD5dIGdldF9zdXBlcl9Sc21w X2ZkOWZiNTU1IFtdIDB4OTgwICgweGY2YjE3ZWZjKSkNCls8ZjhiYjNmY2M+ XSBhZnNfZmlsZV9zeXN0ZW0gW2xpYmFmcy0yLjQuMTgtMTdhZjFzbXAubXBd IDB4MCAoMHhmNmIxN2YwMCkpDQpbPGMwMTY2YWMzPl0gc3lzX29sZHVtb3Vu dF9Sc21wX2MwN2RiZmZiIFtdIDB4N2MzICgweGY2YjE3ZjIwKSkNCls8YzAx NjZkZjA+XSBzeXNfb2xkdW1vdW50X1JzbXBfYzA3ZGJmZmIgW10gMHhhZjAg KDB4ZjZiMTdmNDApKQ0KWzxjMDE2NmMzOT5dIHN5c19vbGR1bW91bnRfUnNt cF9jMDdkYmZmYiBbXSAweDkzOSAoMHhmNmIxN2Y3MCkpDQpbPGMwMTY3MmRm Pl0gc3lzX21vdW50X1JzbXBfNTU1NzBkOWUgW10gMHhkZiAoMHhmNmIxN2Y5 MCkpDQpbPGMwMTA5NDU3Pl0gc3lzX3NpZ2FsdHN0YWNrX1JzbXBfYWI2NTUz NmIgW10gMHgxMDI3ICgweGY2YjE3ZmMwKSkNCg0KDQpDb2RlOiA2NiBjNyAw MyAwMCAwMCBiZSAwMSAwMCAwMCAwMCA2NiBjNyA0MyAwMiAwNCBkMiBjNiA0 MyAwNCAwMCANCg== ---104725860-1645359329-1035544388=:2071-- From jcn@austin.ibm.com Fri Oct 25 13:19:57 2002 From: jcn@austin.ibm.com (Jean-Marc Chaton) Date: Fri, 25 Oct 2002 14:19:57 +0200 Subject: [OpenAFS] Pending bogus vos release transactions Message-ID: <20021025121957.GA29055@bullet.parislab.fr.ibm.com> Hi all, I have noticed that when you issue a 'vos release' and that the controling terminal from which you have issued the command is no longer available (for example you closed the xterm) then the initiated transaction continues forever: A 'vos status' on the target side shows an active 'procedure: Restore' with 'packetRead:' growing (space is eaten on the underlying FS as well) A 'vos status' on the source side shows an active 'procedure: ForwardMulti'. My questions are : 1- What is the proper/clean way to cancel this transaction ? 2- If it's not possible, wouldn't it be more cautious to forbid these pending transactions ? Thanks in advance -- Jean-Marc Chaton | La Terre n'est pas un héritage de nos IBM Paris AD Lab | ancêtres, nous l'empruntons à nos enfants. Intranet Services | =^..^= From turbo@bayour.com Fri Oct 25 13:54:45 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 25 Oct 2002 14:54:45 +0200 Subject: [OpenAFS] hung directory Message-ID: <874rbaoezu.fsf@papadoc.bayour.com> I'm running my web server (Roxen 2.1.265) in AFS space (v1.2.6 with v1.2.3final2 kernel module). Today I noticed that the web server didn't publish pages at all, so I restarted and thought that would do it (I'm doing kinit/aklog) from the init script). It didn't. When i did a 'ls' on the directory, the command hung! This have happened before a couple of months ago (see https://lists.openafs.org/pipermail/openafs-info/2002-August/005509.html). The machine have NOT been rebooted (it's now been up for 83 days) so I'm quite satisfied with AFS. BUT... What's happening here? ----- s n i p ----- [papadoc.pts/24]$ ps | egrep ' D | Z ' 27529 ? Z 0:00 [gzip ] 27530 ? Z 0:00 [find ] 31406 ? D 0:00 find . -name *.o -exec rm -f {} ; 31842 ? D 0:00 find . -name *.o -exec rm -f {} ; 31846 ? D 0:00 find 31889 ? D 0:00 /bin/ls -CF idn/ 1207 ? D 0:00 /bin/ls -CF 6331 ? D 0:00 /USR/SBIN/CRON 6332 ? D 0:00 /USR/SBIN/CRON 6333 ? D 0:00 /USR/SBIN/CRON 10569 ? D 0:00 rm -Rf build-tree stampdir stampdir/patch 10574 ? D 0:00 /bin/ls -CF build-tree stampdir 3647 ? Z 0:01 [pike ] 937 ? D 0:00 /bin/bash 14176 ? D 0:00 mv swenet swenet.old 14208 ? D 0:00 /bin/ls -CF 14255 ? D 0:00 /bin/ls -CF web/bayour/ ----- s n i p ----- To these there's also some processes in Sleep mode (proably waiting for the mother proces to finish). They can't be killed, and the directory can't be accessed. There's nothing in the logs about what could happened either.. The latest problem was pid 14255 and 14176... From turbo@bayour.com Fri Oct 25 14:49:58 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 25 Oct 2002 15:49:58 +0200 Subject: [OpenAFS] hung directory In-Reply-To: <874rbaoezu.fsf@papadoc.bayour.com> References: <874rbaoezu.fsf@papadoc.bayour.com> Message-ID: <87znt2mxvd.fsf@papadoc.bayour.com> COULD this have something to do with the replication? I'm replicating the public.web (on /vicepb) to same host (on /vicepc). IF something (?) accessed/locked/whatnot something on the volume when the replication started, could this trigger this behaviour? I noticed that the replication script I'm using started at 12:00:01, and I discovered the hang soon after that. Verifying the Roxen logs, I see that it was restarted at 12:21:44. Don't know if I have something closer to 12:00, it only keeps 5 logs intact... If this could be the case, how do I fix it (WITHOUT rebooting preferably) and how to avoid that it happens again? From shadow@dementia.org Fri Oct 25 15:16:00 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 25 Oct 2002 10:16:00 -0400 (EDT) Subject: [OpenAFS] hung directory In-Reply-To: <874rbaoezu.fsf@papadoc.bayour.com> Message-ID: On 25 Oct 2002, Turbo Fredriksson wrote: > I'm running my web server (Roxen 2.1.265) in AFS space (v1.2.6 with > v1.2.3final2 kernel module). > > Today I noticed that the web server didn't publish pages at all, > so I restarted and thought that would do it (I'm doing kinit/aklog) > from the init script). It didn't. When i did a 'ls' on the directory, > the command hung! There were bugs in the kernel module in Linux that could manifest themselves as hangs; Several in fact. Is that find running in AFS space? You should really upgrade to 1.2.7. From shadow@dementia.org Fri Oct 25 15:17:29 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 25 Oct 2002 10:17:29 -0400 (EDT) Subject: [OpenAFS] Buffer Overflow in kerberos / are we affected? In-Reply-To: <001801c27c09$6eb41240$835516ac@info.unikarlsruhe.de> Message-ID: On Fri, 25 Oct 2002, [iso-8859-1] Rubino Geiß wrote: > In brief: > PROBLEM: A stack buffer overflow in the implementation of the Kerberos > v4 compatibility administration daemon (kadmind4) in the MIT krb5 > distribution could be exploited to gain unauthorized root access to a > KDC host. Simple answer: we don't have a Kerberos v4 kadmind. From Phil.Moore@morganstanley.com Fri Oct 25 15:21:48 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 10:21:48 -0400 Subject: [OpenAFS] cache performance In-Reply-To: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> References: <15800.26144.533197.545205@zappa.ms.com> <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> Message-ID: <15801.21372.720933.119376@zappa.ms.com> >>>>> "Nickolai" == Nickolai Zeldovich writes: Nickolai> Well, I thought this was the behavior for a long time now, but since Nickolai> you mention it, hm... It looks like in 3.5p2, Transarc added noatime Nickolai> code to the Solaris port (osi_DisableAtimes() in SOLARIS/osi_file.c), Nickolai> and to Linux (in osi_UFSOpen() in LINUX/osi_file.c). But something Nickolai> seems to be still updating the atimes, as I'm seeing recent atimes Nickolai> on most V files in my AFS client caches. Nickolai> So, although there's code that claims to disable atimes, empirical Nickolai> evidence suggests that it's broken, and atimes are being updated Nickolai> anyway (not a big surprise for Transarc/AFS code). Given that you Nickolai> are relying on atimes, I'm a bit hesitant to "fix" it, esp. lacking Nickolai> good performance reasons to do so. It would not be the end of the world if we lost this functionality, and given the weak performance of the AFS client (generally, anecdotally speaking) anything that improves performance would most likely be the right trade off. >> The reason we have this code is that we analyze the contents of ALL of >> our clients caches (yes, I'm not joking, we really do), and procude >> enterprise wide reports on who is accessing what volumes. This has >> proven very useful. Nickolai> Would a combination of cmdebug and server-side logging be a Nickolai> reasonable alternative? Well, what I really want is a way to cleanly extract this inforamtion from the servers. Any audit that depends on automated tasks running on clients is guaranteed to NOT give you 100% coverage. The server's the right place to do this, of course, and eventually, we want to look into significantly enhancing the server side client statistics, and the mechanisms for extracting them. If I have to audit the client, I don't care *how*, provided I can get at the necessary information. If cmdebug can give me a comprehensive summary of what volumes are in the cache, I'll rewrite our code. From Phil.Moore@morganstanley.com Fri Oct 25 15:24:41 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 10:24:41 -0400 Subject: [OpenAFS] cache performance In-Reply-To: References: <15800.26144.533197.545205@zappa.ms.com> Message-ID: <15801.21545.799380.523751@zappa.ms.com> >>>>> "Derrick" == Derrick J Brashear writes: On Thu, 24 Oct 2002 Phil.Moore@morganstanley.com wrote: >> enterprise wide reports on who is accessing what volumes. This has >> proven very useful. Derrick> Who at a user level or machine level? Machine, of course, but that's a good place to start. I'd love to get the user's, too. Does the cache manager keep track of this at all? >> Now, what you are saying suggests that we can't contoinue to make this >> assumption about the access times, and thus, we'll have to rethink our >> cache analysis code. Derrick> Snoop the wire and record the data you want (at the fileserver end)? Snooping the wire, enterprise-wide, would be prohibitively expensive, especially in a very large environment under very heavy load. We don't care about realtime analysis, we want batch audits that give us last 24 hour statistics. As I mentioned in a seperate note, the "right place" to get all of this information is from the fileservers, and one of the things on my virtual list (virtual because its in my head, and not written down yet), is to fund work to enhance the performance and usage statistics mechanisms in the AFS server code. From nneul@umr.edu Fri Oct 25 15:25:41 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Fri, 25 Oct 2002 09:25:41 -0500 Subject: [OpenAFS] cache performance Message-ID: At one point, I was considering trying to merge the cache debugging tools with fs, to add a root-only "fs dumpcache" command.=20 Not sure if this would be an ideal way to go about it.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Phil.Moore@morganstanley.com=20 > [mailto:Phil.Moore@morganstanley.com]=20 > Sent: Friday, October 25, 2002 9:22 AM > To: openafs-info@openafs.org > Subject: Re: [OpenAFS] cache performance >=20 >=20 > >>>>> "Nickolai" =3D=3D Nickolai Zeldovich writes: >=20 > Nickolai> Well, I thought this was the behavior for a long=20 > time now, but since > Nickolai> you mention it, hm... It looks like in 3.5p2,=20 > Transarc added noatime > Nickolai> code to the Solaris port (osi_DisableAtimes() in=20 > SOLARIS/osi_file.c), > Nickolai> and to Linux (in osi_UFSOpen() in=20 > LINUX/osi_file.c). But something > Nickolai> seems to be still updating the atimes, as I'm=20 > seeing recent atimes > Nickolai> on most V files in my AFS client caches. >=20 > Nickolai> So, although there's code that claims to disable=20 > atimes, empirical > Nickolai> evidence suggests that it's broken, and atimes are=20 > being updated > Nickolai> anyway (not a big surprise for Transarc/AFS code). =20 > Given that you > Nickolai> are relying on atimes, I'm a bit hesitant to "fix"=20 > it, esp. lacking > Nickolai> good performance reasons to do so. >=20 > It would not be the end of the world if we lost this functionality, > and given the weak performance of the AFS client (generally, > anecdotally speaking) anything that improves performance would most > likely be the right trade off. >=20 > >> The reason we have this code is that we analyze the=20 > contents of ALL of > >> our clients caches (yes, I'm not joking, we really do), and procude > >> enterprise wide reports on who is accessing what volumes. This has > >> proven very useful. >=20 > Nickolai> Would a combination of cmdebug and server-side logging be a > Nickolai> reasonable alternative? >=20 > Well, what I really want is a way to cleanly extract this inforamtion > from the servers. Any audit that depends on automated tasks running > on clients is guaranteed to NOT give you 100% coverage. =20 >=20 > The server's the right place to do this, of course, and eventually, we > want to look into significantly enhancing the server side client > statistics, and the mechanisms for extracting them. >=20 > If I have to audit the client, I don't care *how*, provided I can get > at the necessary information. If cmdebug can give me a comprehensive > summary of what volumes are in the cache, I'll rewrite our code. >=20 >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From zwlu@ucdavis.edu Fri Oct 25 02:01:45 2002 From: zwlu@ucdavis.edu (zwlu@ucdavis.edu) Date: Thu, 24 Oct 2002 18:01:45 -0700 Subject: [OpenAFS] Redhat 8.0 kernel update breaks openafs, any solution yet? Message-ID: <200210250101.g9P11jc04856@alegre.cipic.ucdavis.edu> Dear OpenAFS gurus, I have updated my redhat 8.0 kernel from 2.4.18-14 to 2.4.18-17.8.0 today. I have recompiled openafs-kernel-1.2.7 kernel modules. The kernel modules fails to load: /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: unresolved symbol kallsyms_symbol_to_address /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. I have seen the discussions about this problem on this list, but I didn't seem to find any solution to this problem on the archive site. Does anyone have a fix for this problem? Thanks. -- Zhi-Wei Lu CIPIC (Center for Image Processing and Integrated Computing) UC Davis Phone: (530)-752-0494 Davis, CA 95616 Fax: (530)-752-8894 From Luigi.Benussi@lnf.infn.it Fri Oct 25 13:13:54 2002 From: Luigi.Benussi@lnf.infn.it (Luigi Benussi) Date: Fri, 25 Oct 2002 14:13:54 +0200 (MET DST) Subject: [OpenAFS] AFS problem on RH 8.0... Message-ID: Hi, I have tried to install afs 1.2.7 on my redhat box (RH 8.0 kernel 2.4.18-17.8.0) but after building the module when I start afs i get the following error: Found libafs-2.4.18-17.8.0.o from SymTable... Loading... Failed to load AFS client, not starting AFS services. Of course client is installed as well.... Any hints? \\\ <==< ( _________oOOo__\/__________________________________________ | Member //~~~* Luigi Benussi | | //__ / /\/ / / /\ + Phone: +39-06-94032761 | | // / / / /_/ /_//_\ Group FAx: +39-06-94032209 | |______//________________oOOo_______________________________| .ooO Ooo. From turbo@bayour.com Fri Oct 25 15:34:43 2002 From: turbo@bayour.com (Turbo Fredriksson) Date: 25 Oct 2002 16:34:43 +0200 Subject: [OpenAFS] hung directory In-Reply-To: References: Message-ID: <87vg3qmvss.fsf@papadoc.bayour.com> >>>>> "Derrick" == Derrick J Brashear writes: Derrick> On 25 Oct 2002, Turbo Fredriksson wrote: >> I'm running my web server (Roxen 2.1.265) in AFS space (v1.2.6 >> with v1.2.3final2 kernel module). >> >> Today I noticed that the web server didn't publish pages at >> all, so I restarted and thought that would do it (I'm doing >> kinit/aklog) from the init script). It didn't. When i did a >> 'ls' on the directory, the command hung! Derrick> There were bugs in the kernel module in Linux that could Derrick> manifest themselves as hangs; Several in fact. Is that Derrick> find running in AFS space? Yes it does (did :). Derrick> You should really upgrade to 1.2.7. Ok, I almost suspected that. I have everything ready, I just need to reboot :) BUT I DON'T WANT TO !!! :) Ah, well. I got to get the webserver up and running, so I guess I have no choice. To bad a restart of the afsd result in kernel panic's. From shadow@dementia.org Fri Oct 25 15:33:24 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 25 Oct 2002 10:33:24 -0400 (EDT) Subject: [OpenAFS] OpenAFS patch for sys_call_table-crippled RedHat kernels. Message-ID: This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to mime@docserver.cac.washington.edu for more info. --42002020-1582993119-1035556404=:7040 Content-Type: TEXT/PLAIN; CHARSET=us-ascii; FORMAT=flowed Content-ID: Now it's in the archives on this list as well as openafs-devel, so hopefully people will find it. ---------- Forwarded message ---------- Date: Fri, 18 Oct 2002 19:08:50 -0400 From: Chaskiel M Grundman To: openafs-devel@openafs.org Subject: [OpenAFS-devel] Updated redhat workaround patch The attached patch should be able to deal with the current redhat kernels that export neither sys_call_table nor kallsyms_symbol_to_address (This one's configure script should even be able to tell when redhat breaks it again) This patch completely replaces the earlier patch I wrote, which is in the redhat 8.0 openafs 1.2.7 SRPM. P.S. to whoever redhat's informant on this list is: In the absolute worst case, I can nm vmlinux and/or read System.map and write the address into a /proc file to get at it. In the long run openafs can and probably will transition to a proc based interface for most of it's needs. But that's the long run and there are still some unresolved issues, so this isn't helping. --42002020-1582993119-1035556404=:7040 Content-Type: TEXT/PLAIN; CHARSET=iso-8859-1; NAME="rh8-stable.diff" Content-Transfer-Encoding: QUOTED-PRINTABLE Content-ID: Content-Description: diff -ru openafs-1.2.7-orig/acconfig.h openafs-1.2.7/acconfig.h --- openafs-1.2.7-orig/acconfig.h 2002-09-11 03:02:15.000000000 -0400 +++ openafs-1.2.7/acconfig.h 2002-10-18 18:37:09.000000000 -0400 @@ -36,6 +36,9 @@ #undef STRUCT_INODE_HAS_I_DIRTY_DATA_BUFFERS #undef STRUCT_INODE_HAS_I_DEVICES #undef EXPORTED_TASKLIST_LOCK +#undef EXPORTED_SYS_CALL_TABLE +#undef EXPORTED_KALLSYMS_SYMBOL +#undef EXPORTED_KALLSYMS_ADDRESS #undef COMPLETION_H_EXISTS #undef ssize_t =20 diff -ru openafs-1.2.7-orig/acinclude.m4 openafs-1.2.7/acinclude.m4 --- openafs-1.2.7-orig/acinclude.m4 2002-09-25 23:48:52.000000000 -0400 +++ openafs-1.2.7/acinclude.m4 2002-10-18 18:42:00.000000000 -0400 @@ -130,6 +130,12 @@ OMIT_FRAME_POINTER=3D-fomit-frame-pointer fi AC_SUBST(OMIT_FRAME_POINTER) + OPENAFS_GCC_SUPPORTS_MARCH + AC_SUBST(P5PLUS_KOPTS) + OPENAFS_GCC_NEEDS_NO_STRENGTH_REDUCE + OPENAFS_GCC_NEEDS_NO_STRICT_ALIASING + OPENAFS_GCC_SUPPORTS_NO_COMMON + AC_SUBST(LINUX_GCC_KOPTS) ifdef([OPENAFS_CONFIGURE_LIBAFS], [LINUX_BUILD_VNODE_FROM_INODE(config,afs)], [LINUX_BUILD_VNODE_FROM_INODE(src/config,src/afs/LINUX)] @@ -144,9 +150,42 @@ LINUX_EXPORTS_TASKLIST_LOCK LINUX_NEED_RHCONFIG LINUX_WHICH_MODULES + if test "$ac_cv_linux_config_modversions" =3D "xno"; then + AC_MSG_WARN([Cannot determine sys_call_table status. assuming it's = exported]) + ac_cv_linux_exports_sys_call_table=3Dyes + else + LINUX_EXPORTS_SYS_CALL_TABLE + LINUX_EXPORTS_KALLSYMS_SYMBOL + LINUX_EXPORTS_KALLSYMS_ADDRESS + LINUX_EXPORTS_INIT_MM + if test "x$ac_cv_linux_exports_sys_call_table" =3D "xno"; then + linux_syscall_method=3Dnone + if test "x$ac_cv_linux_exports_init_mm" =3D "xyes"; = then + linux_syscall_method=3Dscan + if test "x$ac_cv_linux_exports_kallsyms_address" = =3D "xyes"; then + = linux_syscall_method=3Dscan_with_kallsyms_address + fi + fi + if test "x$ac_cv_linux_exports_kallsyms_symbol" =3D = "xyes"; then + linux_syscall_method=3Dkallsyms_symbol + fi + if test "x$linux_syscall_method" =3D "xnone"; then + AC_MSG_ERROR([no available sys_call_table access method]) + fi + fi + fi if test "x$ac_cv_linux_exports_tasklist_lock" =3D "xyes" ; then AC_DEFINE(EXPORTED_TASKLIST_LOCK) fi + if test "x$ac_cv_linux_exports_sys_call_table" =3D "xyes"; then + AC_DEFINE(EXPORTED_SYS_CALL_TABLE) + fi + if test "x$ac_cv_linux_exports_kallsyms_symbol" =3D "xyes"; then + AC_DEFINE(EXPORTED_KALLSYMS_SYMBOL) + fi + if test "x$ac_cv_linux_exports_kallsyms_address" =3D "xyes"; then + AC_DEFINE(EXPORTED_KALLSYMS_ADDRESS) + fi if test "x$ac_cv_linux_completion_h_exists" =3D "xyes" ; then AC_DEFINE(COMPLETION_H_EXISTS) fi diff -ru openafs-1.2.7-orig/src/afs/LINUX/osi_module.c = openafs-1.2.7/src/afs/LINUX/osi_module.c --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c 2002-05-02 = 11:38:45.000000000 -0400 +++ openafs-1.2.7/src/afs/LINUX/osi_module.c 2002-10-18 18:52:13.000000000 = -0400 @@ -26,6 +26,10 @@ #if LINUX_VERSION_CODE >=3D KERNEL_VERSION(2,4,0) #include #endif +#ifndef EXPORTED_SYS_CALL_TABLE +#include +#include +#endif =20 =20 =20 @@ -40,11 +44,19 @@ asmlinkage int (*sys_killp)(int pid, int signal); asmlinkage long (*sys_setgroupsp)(int gidsetsize, gid_t *grouplist); =20 +#ifdef EXPORTED_SYS_CALL_TABLE #ifdef AFS_SPARC64_LINUX20_ENV extern unsigned int sys_call_table[]; /* changed to uint because SPARC64 = has syscaltable of 32bit items */ #else extern void * sys_call_table[]; /* safer for other linuces */ #endif +#else /* EXPORTED_SYS_CALL_TABLE */ +#ifdef AFS_SPARC64_LINUX20_ENV +static unsigned int *sys_call_table; /* changed to uint because SPARC64 = has syscaltable of 32bit items */ +#else +static void ** sys_call_table; /* safer for other linuces */ +#endif +#endif extern struct file_system_type afs_file_system; =20 static long get_page_offset(void); @@ -72,7 +84,11 @@ #if defined(__NR_setgroups32) asmlinkage int (*sys32_setgroups32p)(int gidsetsize, __kernel_gid_t32 = *grouplist); #endif +#ifdef EXPORTED_SYS_CALL_TABLE extern unsigned int sys_call_table32[]; +#else +static unsigned int *sys_call_table32; +#endif =20 asmlinkage int afs_syscall32(long syscall, long parm1, long parm2, long = parm3, long parm4, long parm5) @@ -200,6 +216,24 @@ #endif #endif =20 +#ifndef EXPORTED_SYS_CALL_TABLE + unsigned long *ptr; + unsigned long offset; + unsigned long datalen; + int ret; + unsigned long token; + char *mod_name; + unsigned long mod_start; + unsigned long mod_end; + char *sec_name; + unsigned long sec_start; + unsigned long sec_end; + char *sym_name; + unsigned long sym_start; + unsigned long sym_end; +#endif + + =20 =20 /* obtain PAGE_OFFSET value */ @@ -213,6 +247,58 @@ } #endif =20 +#ifndef EXPORTED_SYS_CALL_TABLE + sys_call_table=3D0; + +#ifdef EXPORTED_KALLSYMS_SYMBOL + ret=3D1; + token=3D0; + while (ret) { + sym_start=3D0; + ret=3Dkallsyms_symbol_to_address("sys_call_table", &token, = &mod_name, + &mod_start, &mod_end, &sec_name, &sec_start, &sec_end, + &sym_name, &sym_start, &sym_end); + if (ret && !strcmp(mod_name, "kernel")) + break; + } + if (ret && sym_start) { + sys_call_table=3Dsym_start; + } +#else +#ifdef EXPORTED_KALLSYMS_ADDRESS + ret=3Dkallsyms_address_to_symbol((unsigned long)&init_mm, &mod_name, + &mod_start, &mod_end, &sec_name, &sec_start, &sec_end, + &sym_name, &sym_start, &sym_end); + ptr=3D(unsigned long *)sec_start; + datalen=3D(sec_end-sec_start)/sizeof(unsigned long); +#else + ptr=3D(unsigned long *)&init_mm; + datalen=3D16384; +#endif + for (offset=3D0;offset gp; Only in openafs-1.2.7/src/afs/LINUX: osi_vfs.h diff -ru openafs-1.2.7-orig/src/cf/linux-test4.m4 = openafs-1.2.7/src/cf/linux-test4.m4 --- openafs-1.2.7-orig/src/cf/linux-test4.m4 2002-09-11 03:02:51.000000000 = -0400 +++ openafs-1.2.7/src/cf/linux-test4.m4 2002-10-18 18:44:47.000000000 -0400 @@ -14,6 +14,70 @@ AC_MSG_RESULT($ac_cv_linux_exports_tasklist_lock) CPPFLAGS=3D"$save_CPPFLAGS"]) =20 +AC_DEFUN(LINUX_EXPORTS_SYS_CALL_TABLE, [ +AC_MSG_CHECKING(for exported sys_call_table) +save_CPPFLAGS=3D"$CPPFLAGS" +CPPFLAGS=3D"-I${LINUX_KERNEL_PATH}/include -D__KERNEL__ $CPPFLAGS" +AC_CACHE_VAL(ac_cv_linux_exports_sys_call_table, +[ +AC_TRY_COMPILE( +[#include ], +[#ifndef __ver_sys_call_table +#error sys_call_table not exported +#endif], +ac_cv_linux_exports_sys_call_table=3Dyes, +ac_cv_linux_exports_sys_call_table=3Dno)]) +AC_MSG_RESULT($ac_cv_linux_exports_sys_call_table) +CPPFLAGS=3D"$save_CPPFLAGS"]) + +AC_DEFUN(LINUX_EXPORTS_INIT_MM, [ +AC_MSG_CHECKING(for exported init_mm) +save_CPPFLAGS=3D"$CPPFLAGS" +CPPFLAGS=3D"-I${LINUX_KERNEL_PATH}/include -D__KERNEL__ $CPPFLAGS" +AC_CACHE_VAL(ac_cv_linux_exports_init_mm, +[ +AC_TRY_COMPILE( +[#include ], +[#ifndef __ver_init_mm +#error init_mm not exported +#endif], +ac_cv_linux_exports_init_mm=3Dyes, +ac_cv_linux_exports_init_mm=3Dno)]) +AC_MSG_RESULT($ac_cv_linux_exports_init_mm) +CPPFLAGS=3D"$save_CPPFLAGS"]) + +AC_DEFUN(LINUX_EXPORTS_KALLSYMS_SYMBOL, [ +AC_MSG_CHECKING(for exported kallsyms_symbol_to_address) +save_CPPFLAGS=3D"$CPPFLAGS" +CPPFLAGS=3D"-I${LINUX_KERNEL_PATH}/include -D__KERNEL__ $CPPFLAGS" +AC_CACHE_VAL(ac_cv_linux_exports_kallsyms_symbol, +[ +AC_TRY_COMPILE( +[#include ], +[#ifndef __ver_kallsyms_symbol_to_address +#error kallsyms_symbol_to_address not exported +#endif], +ac_cv_linux_exports_kallsyms_symbol=3Dyes, +ac_cv_linux_exports_kallsyms_symbol=3Dno)]) +AC_MSG_RESULT($ac_cv_linux_exports_kallsyms_symbol) +CPPFLAGS=3D"$save_CPPFLAGS"]) + +AC_DEFUN(LINUX_EXPORTS_KALLSYMS_ADDRESS, [ +AC_MSG_CHECKING(for exported kallsyms_address_to_symbol) +save_CPPFLAGS=3D"$CPPFLAGS" +CPPFLAGS=3D"-I${LINUX_KERNEL_PATH}/include -D__KERNEL__ $CPPFLAGS" +AC_CACHE_VAL(ac_cv_linux_exports_kallsyms_address, +[ +AC_TRY_COMPILE( +[#include ], +[#ifndef __ver_kallsyms_address_to_symbol +#error kallsyms_address_to_symbol not exported +#endif], +ac_cv_linux_exports_kallsyms_address=3Dyes, +ac_cv_linux_exports_kallsyms_address=3Dno)]) +AC_MSG_RESULT($ac_cv_linux_exports_kallsyms_address) +CPPFLAGS=3D"$save_CPPFLAGS"]) + AC_DEFUN(LINUX_COMPLETION_H_EXISTS, [ AC_MSG_CHECKING(for linux/completion.h existance) save_CPPFLAGS=3D"$CPPFLAGS" Only in openafs-1.2.7/src/cf: linux-test5.m4 Only in openafs-1.2.7/src/config: afsconfig.h.in Only in openafs-1.2.7/src/config: afsconfig.h.in~ diff -ru openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in = openafs-1.2.7/src/libafs/MakefileProto.LINUX.in --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in 2002-06-08 = 00:47:42.000000000 -0400 +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in 2002-10-03 = 12:19:46.000000000 -0400 @@ -52,44 +52,41 @@ # System specific build commands and flags CC =3D gcc LD =3D ld +GCC_KOPTS=3D@LINUX_GCC_KOPTS@ # -Wall -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) \ - -fno-strength-reduce -pipe -march=3Di486 -malign-loops=3D2 = -malign-jumps=3D2 \ - -malign-functions=3D2 +P5PLUS=3D@P5PLUS_KOPTS@ +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) -pipe $(P5PLUS) DEFINES =3D -D__KERNEL__ -DCPU=3D586 -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} ${KDEFINES} -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) -fno-strength-reduce -pipe -mno-fp-regs = -ffixed-8 +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) -pipe -mno-fp-regs = -ffixed-8 DEFINES =3D -D__KERNEL__ -DKERNEL -D_KERNEL -DMODULE ${SMP_DEF} -CCFLAGS =3D -O $(FOMIT) -fno-strength-reduce \ - -fno-strict-aliasing -fsigned-char=20 +CCFLAGS =3D -O $(FOMIT) $(GCC_KOPTS) -fsigned-char=20 DEFINES =3D -D__KERNEL__ -D__s390__ -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} LD =3D ld -m elf32_sparc -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) \ - -fno-strength-reduce -pipe -mcpu=3Dv8 -mno-fpu -fcall-used-g5 = -fcall-used-g7 +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) \ + -pipe -mcpu=3Dv8 -mno-fpu -fcall-used-g5 -fcall-used-g7 DEFINES =3D -D__KERNEL__ -DCPU=3Dsparc -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} CC =3D sparc64-linux-gcc LD =3D ld -m elf64_sparc -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) \ - -fno-strength-reduce -pipe -mcpu=3Dultrasparc -m64 -mno-fpu = -mcmodel=3Dmedlow -ffixed-g4 -fcall-used-g5 -fcall-used-g7 = -Wno-sign-compare +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) \ + -pipe -mcpu=3Dultrasparc -m64 -mno-fpu -mcmodel=3Dmedlow -ffixed-g4 = -fcall-used-g5 -fcall-used-g7 -Wno-sign-compare DEFINES =3D -D__KERNEL__ -DCPU=3Dsparc64 -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) -fno-strength-reduce \ - -fno-strict-aliasing -fsigned-char -msoft-float -pipe \ +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) -fsigned-char = -msoft-float -pipe \ -fno-builtin -ffixed-r2 DEFINES =3D -D__KERNEL__ -D__powerpc__ -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) \ - -fno-strict-aliasing -fno-common -fno-strength-reduce \ - -fno-strict-aliasing -fsigned-char -mno-space-regs = -mfast-indirect-calls \ - -mdisable-fpregs -ffunction-sections -march=3D1.1 = -mschedule=3D7100 +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) -fsigned-char = -mno-space-regs \ + -mfast-indirect-calls -mdisable-fpregs -ffunction-sections \ + -march=3D1.1 -mschedule=3D7100 DEFINES =3D -D__KERNEL__ -D__linux__ -DKERNEL -D_KERNEL -DMODULE = ${SMP_DEF} -CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) -fno-strict-aliasing -fno-common = -pipe \ - -ffixed-r13 -mfixed-range=3Df10-f15,f32-f127 -falign-functions=3D32 = -mb-step +CCFLAGS =3D $(KDEBUG) -O2 $(FOMIT) $(GCC_KOPTS) -pipe -ffixed-r13 \ + -mfixed-range=3Df10-f15,f32-f127 -falign-functions=3D32 -mb-step DEFINES =3D -D__KERNEL__ -DKERNEL -D_KERNEL ${SMP_DEF} -DMODULE INCLUDES =3D -I. -I../ -I${TOP_SRCDIR}/config --42002020-1582993119-1035556404=:7040-- From jlrobins@uncc.edu Fri Oct 25 15:51:29 2002 From: jlrobins@uncc.edu (James L Robinson) Date: Fri, 25 Oct 2002 10:51:29 -0400 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #874 - 10 msgs In-Reply-To: <20021025143801.5900C9D1D@grand.central.org> References: <20021025143801.5900C9D1D@grand.central.org> Message-ID: <200210251051.29113.jlrobins@uncc.edu> On Friday 25 October 2002 10:38 am, openafs-info-request@openafs.org wrot= e: > Ah, well. I got to get the webserver up and running, so I guess I have > no choice. To bad a restart of the afsd result in kernel panic's. I can say that I was also seeing find in /afs cause kernel thread deaths on SMP boxes running the 1.2.6 client, and am very happy to report that 1.2.7 + RedHat kernel-smp-2.4.18-10 have been rock-solid together (relative to 1.2.6 + the previous kernel release). James --=20 James Robinson Phone: (704) 687-4876 College of Information Technology FAX: (704) 687-3516 UNC Charlotte Email: jlrobins@uncc.edu Charlotte, NC 28223-0001 Director of Technology Services From Phil.Moore@morganstanley.com Fri Oct 25 15:55:11 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 10:55:11 -0400 Subject: [OpenAFS] cache performance In-Reply-To: References: Message-ID: <15801.23375.840694.979292@zappa.ms.com> >>>>> "Nathan" == Neulinger, Nathan writes: Nathan> At one point, I was considering trying to merge the cache Nathan> debugging tools with fs, to add a root-only "fs dumpcache" Nathan> command. Nathan> Not sure if this would be an ideal way to go about it. Ideal? Neah, but I've long ago given up on the ideal solution. I just want a working one ;-) Seriously though, dump_afscache was *never* a fully integrated and respected debugging utility in the product. You had to beg Transarc to give it to you (wasn't part of the product distribution), even though it was essential for debugging cache problems. I beleive the same was true for kdump. A quick scan of the openafs source tree suggests that we at least install this thing by default now. Personally, I'd like to see the debugging tools improved, since we use them for more than just problem diagnosis. We also use them for statistical analysis of system usage and performance. I already alluded to our cache audits (which, although expensive in terms of disk space, CPU, and data management, have proven to be a very powerful tool), but I beleive that capacity planning is one of the hardest problems we have to solve, and you can only get a handle on that problem with good performance and usage statistics, maintained historically, and analyzed agressively. You can only do good capacity planning when you have good performance and usage stats, and code that uses kdump, dump_afscache, and their ilk to accomplish this is hackery at best. The good news is that we (Morgan Stanley) need this stuff so bad, we're willing to fund some of the development (when all of you fine people don't do it for us for free ;-), and in case you're paranoid, *OF COURSE* the result of what we fund go back into the OpenAFS code base. From utoddl@email.unc.edu Fri Oct 25 16:17:54 2002 From: utoddl@email.unc.edu (Todd M. Lewis) Date: Fri, 25 Oct 2002 11:17:54 -0400 Subject: [OpenAFS] cache performance References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> Message-ID: <3DB960A2.4030701@email.unc.edu> Nickolai Zeldovich wrote: > On Thu, 24 Oct 2002, Phil.Moore@morganstanley.com wrote: >>The reason we have this code is that we analyze the contents of ALL of >>our clients caches (yes, I'm not joking, we really do), and procude >>enterprise wide reports on who is accessing what volumes. This has >>proven very useful. > > > Would a combination of cmdebug and server-side logging be a reasonable > alternative? Seems like capturing the data at the server would be a lot more efficient. (And let's not even mention the glaring assumption that you actually know about all your clients...) Just curious: could you point out in what ways specifically this has been useful? Perhaps adding appropriate logging on the server would be worth it for some of the rest of us. -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ From Phil.Moore@morganstanley.com Fri Oct 25 16:30:33 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 11:30:33 -0400 Subject: [OpenAFS] cache performance In-Reply-To: References: Message-ID: <15801.25497.333235.195332@zappa.ms.com> >>>>> "Nathan" == Neulinger, Nathan writes: Nathan> At one point, I was considering trying to merge the cache Nathan> debugging tools with fs, to add a root-only "fs dumpcache" Nathan> command. Nathan> Not sure if this would be an ideal way to go about it. OK, some more research and thoughts on this topic... Looking at the cmdebug code, and in particular, the AFSDBCacheEntry structure that is basically just pretty-prints (although, personally, I would not call that output "pretty"), I don't see that the cache manager maintains the last access data, or anything like it. However, I wonder if the cbExpires (obviously the callback expiration) couldn't be used to similar effect? If I have data in my cache that hasn't been accessed in a while, one would assume that the callback expiration should be pretty old, right? Tactically, I should be able to use this to determine roughly when a volume was most recently accessed, based on the assumption that accessing the volume will refresh the callback. Fair enough? The only issue I see is that cmdebug currently only prints the first 10000 cache entries, and I want them all: for(i=0;i<10000;i++) { code = RXAFSCB_GetCE(aconn, i, ¢ry); if (code) { if (code == 1) break; printf("cmdebug: failed to get cache entry %d (%s)\n", i, error_message(code)); return code; } Damn, I hate hardcoded limits like that... Isn't there a more elegant way to determine when we've hit the end of the list of cache entries? Loking at the RXAFSCB_GetCE, it seems to me that this will return 1 when there's nothing to get, so is there any good reason not to have the cmdebug code loop until that condition is reached? That is: while (1) { code = RXAFSCB_GetCE(aconn, i, ¢ry); if (code) { if (code == 1) break; Seems to me a reasonable replacement for the missing access times may be readily available, if not entirely equiavalent. From Phil.Moore@morganstanley.com Fri Oct 25 16:42:41 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 11:42:41 -0400 Subject: [OpenAFS] cache performance In-Reply-To: <3DB960A2.4030701@email.unc.edu> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> Message-ID: <15801.26225.555407.357918@zappa.ms.com> >>>>> "Todd" == Todd M Lewis writes: Todd> Seems like capturing the data at the server would be a lot more Todd> efficient. (And let's not even mention the glaring assumption Todd> that you actually know about all your clients...) Oh, I'm not arguing that point at all. Server-side data collection will *ALWAYS* be more efficient that client side, and we know we don't get complete client coverage, even in a draconian, fascist control-phreaque environment like ours. Todd> Just curious: could you point out in what ways specifically this Todd> has been useful? Perhaps adding appropriate logging on the Todd> server would be worth it for some of the rest of us. We have a HUGE environment here, and almost (>95%) all of our production software is run from readonly AFS volumes. When we want to decommission old releases of software, and reclaim the space, we have a huge headache on our hands. We need to know *who* is using something, so we can get them to upgrade to newer releases of the given product. We provide the following information to our developers to help them manage this problem. First of all, we perform server-side analysis of AFS volume access to determine the most recent last access timestamp on each AFS volume, in each AFS cell (any given software product is distributed across numerous AFS cells). We can roll this up and provide a single last access time for each release (since we know which AFS volumes comprise any given software release). But that only tells me *when* software was accessed, not by *who*. This is where the cache audits have proven emmensely useful. Now, I can at least provide a list of machines that have accessed the release, so they know where to start looking for the dependencies. Its not easy, of course -- you have to grope the process table, look at what software packages are configured to run on these hosts, etc. Its not a perfect solution, but in practice, we've frequently been able to track down production dependencies on software we wanted to wipe out, and work proactively with the owners of the dependent software to get them upgraded, and avoid the inevitable outages that happen when we remove something that is still in use. So... I absolutely want this data to be available on the server side, and strategically, this is an area we (Morgan Stanley) will eventually focus on. However, tactically, I am looking for a way to get better data out of the clients, since I have the infrastructure in place to (at least attempt to) audit them. Long term, server-side is clearly the way to go, of course. From nneul@umr.edu Fri Oct 25 16:43:55 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Fri, 25 Oct 2002 10:43:55 -0500 Subject: [OpenAFS] cache performance Message-ID: One assumption I see you making is that your cache isn't flushing. Unless your cache is larger than your working set, you'll need to run your scans repeatedly to insure that you have a good chance of catching all the accesses.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Phil.Moore@morganstanley.com=20 > [mailto:Phil.Moore@morganstanley.com]=20 > Sent: Friday, October 25, 2002 10:31 AM > To: openafs-info@openafs.org > Subject: RE: [OpenAFS] cache performance >=20 >=20 > >>>>> "Nathan" =3D=3D Neulinger, Nathan writes: >=20 > Nathan> At one point, I was considering trying to merge the cache > Nathan> debugging tools with fs, to add a root-only "fs dumpcache" > Nathan> command. >=20 > Nathan> Not sure if this would be an ideal way to go about it.=20 >=20 > OK, some more research and thoughts on this topic... >=20 > Looking at the cmdebug code, and in particular, the AFSDBCacheEntry > structure that is basically just pretty-prints (although, personally, > I would not call that output "pretty"), I don't see that the cache > manager maintains the last access data, or anything like it. >=20 > However, I wonder if the cbExpires (obviously the callback expiration) > couldn't be used to similar effect? If I have data in my cache that > hasn't been accessed in a while, one would assume that the callback > expiration should be pretty old, right? >=20 > Tactically, I should be able to use this to determine roughly when a > volume was most recently accessed, based on the assumption that > accessing the volume will refresh the callback. Fair enough? >=20 > The only issue I see is that cmdebug currently only prints the first > 10000 cache entries, and I want them all: >=20 > for(i=3D0;i<10000;i++) { > code =3D RXAFSCB_GetCE(aconn, i, ¢ry); > if (code) { > if (code =3D=3D 1) break; > printf("cmdebug: failed to get cache entry %d (%s)\n", i, > error_message(code)); > return code; > } >=20 > Damn, I hate hardcoded limits like that... Isn't there a more elegant > way to determine when we've hit the end of the list of cache entries? > Loking at the RXAFSCB_GetCE, it seems to me that this will return 1 > when there's nothing to get, so is there any good reason not to have > the cmdebug code loop until that condition is reached? That is: >=20 > while (1) { > code =3D RXAFSCB_GetCE(aconn, i, ¢ry); > if (code) { > if (code =3D=3D 1) break; >=20 > Seems to me a reasonable replacement for the missing access times may > be readily available, if not entirely equiavalent. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From Phil.Moore@morganstanley.com Fri Oct 25 16:50:45 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 11:50:45 -0400 Subject: [OpenAFS] cache performance In-Reply-To: References: Message-ID: <15801.26709.559963.522065@zappa.ms.com> >>>>> "Nathan" == Neulinger, Nathan writes: Nathan> One assumption I see you making is that your cache isn't Nathan> flushing. Unless your cache is larger than your working set, Nathan> you'll need to run your scans repeatedly to insure that you Nathan> have a good chance of catching all the accesses. Good point -- this is another reason we know the cache audits only provide part of the picture. I can trivially wipe my cache out just by running a find | xargs grep against, say, oh how about the openafs source tree? ;-) Its also a another reason why the cache audit approach is really the wrong design, long term. Again, I'll point out that we did this because, well, we could. Had there been a mechanism for getting this data from the servers, that would be my preference. Tactically, I'm looking to get better cache audit data, but strategically, I want to get rid of this mechanism entirely, and do server-only audits. In fact, one of the reasons we're looking to abandon the cache audits long term is that the Windows client is likely going to be installed here on a frighteningly large scale, and I have no desire to depend on anything running reliably on Windows... (but I'm a proud anti-Microsoft bigot :-). From Dr A V Le Blanc Fri Oct 25 17:12:49 2002 From: Dr A V Le Blanc (Dr A V Le Blanc) Date: Fri, 25 Oct 2002 17:12:49 +0100 Subject: [OpenAFS] hung directory In-Reply-To: <20021025143802.433309D20@grand.central.org> References: <20021025143802.433309D20@grand.central.org> Message-ID: <20021025161249.GA17137@afs.mcc.ac.uk> With respect to the problems of hangs, we've had a couple of nasty problems here. We have two fileservers running OpenAFS 1.2.7 on IRIX 6.5, and one running OpenAFS 1.2.7 on a linux 2.4.19 machine (Debian woody). One volume on one of the SGI fileservers somehow got itself duplicated: that is, there were two volumes with the same name on the same vice partition. For some reason, one of these volumes was always visible to users, got written to, and contained all the valuable data; the other volume was always backed up, and contained nothing. Recently I noticed that a volume of this name was listed as off line. I tried to salvage it, but it was still listed as off line. So I moved it to a partition on another server. This changed everything: only the empty volume was visible as well as backed up. We solved the problem by deleting the empty volume from the new partition, and then doing 'vos syncv' for the specific server, partition, and volume on the old disk. This make the volume visible again, and I moved it to the new server. Question: How can there be two volumes with the same name on the same partition? The server where this volume appeared has been having problems recently. Its load average goes up, sometimes to 5, sometimes to 10, and it becomes very unresponsive. Attempts to move or backup volumes on the server may cause it to lose contact with clients. Some vos commands may hang, and be unkillable, in the sense that even after receiving the signal -9, they are still there 12 hours later; only reboot can get rid of them. Moreover, attempts to move volumes often end up timing out. Rebooting this system is perilous as well, since the salvage operation usually takes at least 30 or 40 minutes, even when the machine was shut down cleanly. Once recently it took 4 hours. Some problematic volumes on this machine have poor access times; transfer rates of between 5 and 15 _megabytes_ per minute are not uncommon. This is an Origin machine, with a 180mhz IP27 processor. The other SGI server is identical hardware and identical software, but never shows this problem. Questions: I'm afraid of running 'vos syncv' and 'vos syncs' generally; I might lose more un-backed-up volumes with data and keep the empty backup volumes, if there are more like this. How can we identify potential problem volumes? Also what is wrong with the machine that it is having these performance problems? There are no reports of hardware errors, which usually do show up on SGI machines. Finally, how can I fix it? There are almost 1300 volumes on this server, 3705 on the twin machine, and 1276 on the new Linux server. -- Owen LeBlanc@mcc.ac.uk From warlord@MIT.EDU Fri Oct 25 17:54:48 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 25 Oct 2002 12:54:48 -0400 Subject: [OpenAFS] Redhat 8.0 kernel update breaks openafs, any solution yet? In-Reply-To: <200210250101.g9P11jc04856@alegre.cipic.ucdavis.edu> References: <200210250101.g9P11jc04856@alegre.cipic.ucdavis.edu> Message-ID: There was a patch sent to -devel.. I have not had the chance to rebuild RPMS. I will endeavor to do so this weekend. -derek zwlu@ucdavis.edu writes: > Dear OpenAFS gurus, > > I have updated my redhat 8.0 kernel from 2.4.18-14 to 2.4.18-17.8.0 today. > I have recompiled openafs-kernel-1.2.7 kernel modules. > The kernel modules fails to load: > > /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: unresolved symbol kallsyms_symbol_to_address > /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: > Hint: You are trying to load a module without a GPL compatible license > and it has unresolved symbols. Contact the module supplier for > assistance, only they can help you. > > I have seen the discussions about this problem on this list, but I didn't seem > to find any solution to this problem on the archive site. Does anyone have > a fix for this problem? > > Thanks. > > -- > Zhi-Wei Lu > CIPIC (Center for Image Processing and Integrated Computing) > UC Davis Phone: (530)-752-0494 > Davis, CA 95616 Fax: (530)-752-8894 > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Fri Oct 25 17:55:23 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 25 Oct 2002 12:55:23 -0400 Subject: [OpenAFS] AFS problem on RH 8.0... In-Reply-To: References: Message-ID: This is a known problem. A proposed patch was sent to the -devel list. I shall endeavor to build new RPMs this weekend. -derek Luigi Benussi writes: > Hi, > I have tried to install afs 1.2.7 on my redhat box (RH 8.0 kernel > 2.4.18-17.8.0) but after building the module when I start afs i get the > following error: > > Found libafs-2.4.18-17.8.0.o from SymTable... Loading... > Failed to load AFS client, not starting AFS services. > > Of course client is installed as well.... > > Any hints? > > \\\ > <==< > ( > _________oOOo__\/__________________________________________ > | Member //~~~* Luigi Benussi | > | //__ / /\/ / / /\ + Phone: +39-06-94032761 | > | // / / / /_/ /_//_\ Group FAx: +39-06-94032209 | > |______//________________oOOo_______________________________| > .ooO Ooo. > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From utoddl@email.unc.edu Fri Oct 25 19:20:16 2002 From: utoddl@email.unc.edu (Todd M. Lewis) Date: Fri, 25 Oct 2002 14:20:16 -0400 Subject: [OpenAFS] cache performance References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> Message-ID: <3DB98B60.2080407@email.unc.edu> Phil.Moore@morganstanley.com wrote: >>>>>>"Todd" == Todd M Lewis writes: > Todd> Just curious: could you point out in what ways specifically this > Todd> has been useful? Perhaps adding appropriate logging on the > Todd> server would be worth it for some of the rest of us. > > We have a HUGE environment here, and almost (>95%) all of our > production software is run from readonly AFS volumes. When we want to > decommission old releases of software, and reclaim the space, we have > a huge headache on our hands. > > We need to know *who* is using something, so we can get them to > upgrade to newer releases of the given product. [...] > First of all, we perform server-side analysis of AFS volume access [...] > But that only tells me *when* software was accessed, not by *who*. > This is where the cache audits have proven emmensely useful. [...] > > However, tactically, I am looking for a way to get better data out of > the clients,[...] You might be interested in what we've done in this area. We're an academic shop (U. of North Carolina - Chapel Hill), so our needs are admittedly different from yours, but we build a bunch of packages from source, usually for as many of our supported architectures as we can get 'em to build on. We wanted to know who's using what, so we would know how to spend our limited people resources when deciding what to upgrade, what versions to abandon, etc. We came up with a mechanism called runlogger. Basically, we stick a call to the runlogger client function somewhere near the beginning of a program when we build it. If that's not practical (if it's a script based thing for example) we have it call the stand-alone runlogger client program, and if it comes to it and we really want it logged badly enough, we'll wrap the application in a script that runs the runlogger client before running the program in question. The runlogger client takes one parameter -- the name of the package we want to log. If we need finer grained logging (a pkg might contain several different programs for example), then it could pass the pkg name, a colon, and the program name as one parameter. Runlogger takes this parameter and concatenates the uid of the user (which is usually who he/she's klogged as) and the AFS @sys name for this architecture (which was hard coded into the runlogger routine at build time) into a colon delimited string and passes it off via UDP to the runloggerd daemon indicated in the runlogger pkg's config file. runloggerd takes this steady stream of UDP packets from all these different clients, adds to them a time stamp and the IP address of client, and appends them onto its log file. You get things that look like this (w/ numbers changed to protect the innocent): > 2002.05.29.13.32.00 [152.2.1.103]:[rs_aix43]:[5678]:pine-421 > 2002.05.29.13.32.00 [152.2.1.149]:[sun4x_57]:[0]:lynx-284 > 2002.05.29.13.32.19 [152.2.1.104]:[rs_aix43]:[5847]:pine-421 > 2002.05.29.13.32.20 [152.2.68.144]:[sun4x_58]:[26678]:pine-421 > 2002.05.29.13.32.32 [152.2.1.106]:[rs_aix43]:[9491]:pine-421 > 2002.05.29.13.32.32 [152.2.1.99]:[rs_aix43]:[3190]:openssh-252p2 > 2002.05.29.13.32.33 [152.2.48.55]:[sgi_65]:[6309]:tcsh-611 That's a time stamp, the client IP, the @sys name, uid, and pkg name. We routinely analyze the log file to see what's being run, when, by whom, and on what architecture(s). You can try to log everything, or limit it to only logging those things you're interested it at the moment. We've made a variation of it called pmlogger which lets us see which Perl modules are actually being used. (Perl module life cycling can be a real pain, and it's a lot easier to drop support for an old module when you know it isn't being used by anybody.) I'm sure the file servers could give us other interesting information, but the runlogger/runloggerd approach has given us good results without having to change the production servers. It adds a little overhead to each logged program's startup, but not much. If you interested, I could package it up and make it presentable... -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ From Phil.Moore@morganstanley.com Fri Oct 25 19:33:01 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Fri, 25 Oct 2002 14:33:01 -0400 Subject: [OpenAFS] cache performance In-Reply-To: <3DB98B60.2080407@email.unc.edu> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> Message-ID: <15801.36445.753666.219539@zappa.ms.com> This is very interesting indeed, but we're way too diverse to impose a execution mechanism on our environment, especially with the specter of 30,000 Windows boxes all just waiting to finally have a stable distributed filesystem out of which to run applications. We've tried similar approaches to yours in the past, with varying degrees of success, but I think our scale makes such an approach impractical. The strategic focus *MUST* be on getting richer statistics out of the fileservers, so we can perform this analysis centrally. Then again, if you have a mature logging mechanism like this, it certainly would complement anything we can gather on the servers, too. >>>>> "Todd" == Todd M Lewis writes: Todd> You might be interested in what we've done in this area. We're an Todd> academic shop (U. of North Carolina - Chapel Hill), so our needs are Todd> admittedly different from yours, but we build a bunch of packages from Todd> source, usually for as many of our supported architectures as we can get Todd> 'em to build on. We wanted to know who's using what, so we would know Todd> how to spend our limited people resources when deciding what to upgrade, Todd> what versions to abandon, etc. Todd> We came up with a mechanism called runlogger. Basically, we stick a Todd> call to the runlogger client function somewhere near the beginning of a Todd> program when we build it. If that's not practical (if it's a script Todd> based thing for example) we have it call the stand-alone runlogger Todd> client program, and if it comes to it and we really want it logged badly Todd> enough, we'll wrap the application in a script that runs the runlogger Todd> client before running the program in question. Todd> The runlogger client takes one parameter -- the name of the package we Todd> want to log. If we need finer grained logging (a pkg might contain Todd> several different programs for example), then it could pass the pkg Todd> name, a colon, and the program name as one parameter. Runlogger takes Todd> this parameter and concatenates the uid of the user (which is usually Todd> who he/she's klogged as) and the AFS @sys name for this architecture Todd> (which was hard coded into the runlogger routine at build time) into a Todd> colon delimited string and passes it off via UDP to the runloggerd Todd> daemon indicated in the runlogger pkg's config file. Todd> runloggerd takes this steady stream of UDP packets from all these Todd> different clients, adds to them a time stamp and the IP address of Todd> client, and appends them onto its log file. You get things that look Todd> like this (w/ numbers changed to protect the innocent): >> 2002.05.29.13.32.00 [152.2.1.103]:[rs_aix43]:[5678]:pine-421 >> 2002.05.29.13.32.00 [152.2.1.149]:[sun4x_57]:[0]:lynx-284 >> 2002.05.29.13.32.19 [152.2.1.104]:[rs_aix43]:[5847]:pine-421 >> 2002.05.29.13.32.20 [152.2.68.144]:[sun4x_58]:[26678]:pine-421 >> 2002.05.29.13.32.32 [152.2.1.106]:[rs_aix43]:[9491]:pine-421 >> 2002.05.29.13.32.32 [152.2.1.99]:[rs_aix43]:[3190]:openssh-252p2 >> 2002.05.29.13.32.33 [152.2.48.55]:[sgi_65]:[6309]:tcsh-611 Todd> That's a time stamp, the client IP, the @sys name, uid, and pkg name. Todd> We routinely analyze the log file to see what's being run, when, by Todd> whom, and on what architecture(s). You can try to log everything, or Todd> limit it to only logging those things you're interested it at the moment. Todd> We've made a variation of it called pmlogger which lets us see which Todd> Perl modules are actually being used. (Perl module life cycling can be Todd> a real pain, and it's a lot easier to drop support for an old module Todd> when you know it isn't being used by anybody.) Todd> I'm sure the file servers could give us other interesting information, Todd> but the runlogger/runloggerd approach has given us good results without Todd> having to change the production servers. It adds a little overhead to Todd> each logged program's startup, but not much. If you interested, I could Todd> package it up and make it presentable... From shadow@dementia.org Fri Oct 25 22:37:24 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Fri, 25 Oct 2002 17:37:24 -0400 (EDT) Subject: [OpenAFS] hung directory In-Reply-To: <87vg3qmvss.fsf@papadoc.bayour.com> Message-ID: On 25 Oct 2002, Turbo Fredriksson wrote: > Derrick> You should really upgrade to 1.2.7. > > Ok, I almost suspected that. I have everything ready, I just need to > reboot :) BUT I DON'T WANT TO !!! :) Well, you could have not rebooted, if you had restarted AFS before it got unhappy. From aangel@myrealbox.com Sat Oct 26 19:41:45 2002 From: aangel@myrealbox.com (Aaron J. Angel) Date: Sat, 26 Oct 2002 13:41:45 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV Message-ID: <3DBAE1E9.5020508@myrealbox.com> What is required to switch from kaserver to a ``real'' MIT Kerberos 4 server? From warlord@MIT.EDU Sat Oct 26 20:53:36 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 26 Oct 2002 15:53:36 -0400 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBAE1E9.5020508@myrealbox.com> References: <3DBAE1E9.5020508@myrealbox.com> Message-ID: Well, at this point I would suggest a "real Kerberos 5" server as opposed to a v4 server. Having said that, the real question is the database migration from kaserver to a real KDC, and that will depend on which KDC implementation you use and whether you want to "start over" or perform a "live" cutover.. -derek "Aaron J. Angel" writes: > What is required to switch from kaserver to a ``real'' MIT Kerberos 4 > server? > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From aangel@myrealbox.com Sat Oct 26 21:06:00 2002 From: aangel@myrealbox.com (Aaron J. Angel) Date: Sat, 26 Oct 2002 15:06:00 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV References: <3DBAE1E9.5020508@myrealbox.com> Message-ID: <3DBAF5A8.7060706@myrealbox.com> Derek Atkins wrote: | Well, at this point I would suggest a "real Kerberos 5" server as | opposed to a v4 server. Having said that, the real question is | the database migration from kaserver to a real KDC, and that | will depend on which KDC implementation you use and whether you want | to "start over" or perform a "live" cutover.. I was considering that, but I'm not as familiar with KRB5 as I am with KRB4, and last time I tried to set that up I failed miserably, heh. What is involed with migrating the database? I don't really have that much to migrate, so I could start over fairly easily. I suppose I'll be using Heimdal, if I opt for KRB5. Is there anything required as far as OpenAFS goes to make it use the KDC short of stopping kaserver? And do I need any additional principals? From warlord@MIT.EDU Sat Oct 26 21:38:47 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 26 Oct 2002 16:38:47 -0400 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBAF5A8.7060706@myrealbox.com> References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> Message-ID: "Aaron J. Angel" writes: > Derek Atkins wrote: > | Well, at this point I would suggest a "real Kerberos 5" server as > | opposed to a v4 server. Having said that, the real question is > | the database migration from kaserver to a real KDC, and that > | will depend on which KDC implementation you use and whether you want > | to "start over" or perform a "live" cutover.. > > I was considering that, but I'm not as familiar with KRB5 as I am with > KRB4, and last time I tried to set that up I failed miserably, heh. It's really Not That Hard. The key is to make sure you only have a des-cbc-crc key in the KDC, and that the key/kvno in the KDC matches the key/kvno in the AFS KeyFile. > What is involed with migrating the database? I don't really have that > much to migrate, so I could start over fairly easily. I suppose I'll be > using Heimdal, if I opt for KRB5. If you opt for Heimdal then you should be able to just migrate the database wholesale (ISTR Heimdal as a KADB importer). > Is there anything required as far as OpenAFS goes to make it use the KDC > short of stopping kaserver? And do I need any additional principals? Just make sure your keys match, then you can use kinit/aklog (or afslog). -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Sat Oct 26 23:40:59 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 26 Oct 2002 18:40:59 -0400 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBB143E.8090805@myrealbox.com> References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> Message-ID: please cc: openafs-info on your resonses... "Aaron J. Angel" writes: > >>What is involed with migrating the database? I don't really have that > >>much to migrate, so I could start over fairly easily. I suppose I'll be > >>using Heimdal, if I opt for KRB5. > > If you opt for Heimdal then you should be able to just migrate the > > database wholesale (ISTR Heimdal as a KADB importer). > > Say who? ISTR == I Seem To Recall KADB == KA DataBase > >>Is there anything required as far as OpenAFS goes to make it use the KDC > >>short of stopping kaserver? And do I need any additional principals? > > Just make sure your keys match, then you can use kinit/aklog (or > > afslog). > > Is krb5 backwards compatable? I suppose I could just modify pam_krb5 > with some afs changes...I use pam_kerberosIV+afs now, which is why I > was originally planning on KRB4. v4 and v5 are different protocols. But you don't want to use v4. What other v4 apps do you use? If AFS is your only kerberized app, then you are MUCH better off using v5 (which is 2002 technology) than v4 (which in 1988 technology). > Another question; how would one create a principal with a specific > instance using kaserver? I dont know. It's easy in v5 ;) -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From aangel@myrealbox.com Sun Oct 27 00:58:56 2002 From: aangel@myrealbox.com (Aaron J. Angel) Date: Sat, 26 Oct 2002 18:58:56 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> Message-ID: <3DBB2C40.1020908@myrealbox.com> Derek Atkins wrote: > please cc: openafs-info on your resonses... Didn't I? Sorry, forgot the second time. > > v4 and v5 are different protocols. But you don't want to use v4. > What other v4 apps do you use? If AFS is your only kerberized app, > then you are MUCH better off using v5 (which is 2002 technology) > than v4 (which in 1988 technology). Ah; I see. Well, I haven't gotten any Kerberos software except that pam module...unfortunately, it has proven a bit difficult to find, let alone actually compile, *any* kerberized applications. So I guess KRB5 would be the best way to go, if I can get any KRB5 applications working. I'd like to get SSH and Telnet, at the very least, as well as OpenLDAP2. >>Another question; how would one create a principal with a specific >>instance using kaserver? > > > I dont know. It's easy in v5 ;) It's easy in V4 too, just not documented (if even available) in KA. From ian@assv.net Sun Oct 27 01:09:48 2002 From: ian@assv.net (Ian Delahorne) Date: 27 Oct 2002 02:09:48 +0200 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> Message-ID: Derek Atkins writes: > If you opt for Heimdal then you should be able to just migrate the > database wholesale (ISTR Heimdal as a KADB importer). Yep. Build Heimdal with kaserver support (may require krb4 support). Run hprop with the right incantation to extract kaserver information and import into your KDC database. Stop kaserver and start the KDC. Worked for me at least. -- /Ian D ian@assv.net - www.assv.net From ian@assv.net Sun Oct 27 01:12:33 2002 From: ian@assv.net (Ian Delahorne) Date: 27 Oct 2002 02:12:33 +0200 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBB2C40.1020908@myrealbox.com> References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> <3DBB2C40.1020908@myrealbox.com> Message-ID: "Aaron J. Angel" writes: > Derek Atkins wrote: > > please cc: openafs-info on your resonses... >=20 > Didn't I? Sorry, forgot the second time. >=20 > > v4 and v5 are different protocols. But you don't want to use v4. > > What other v4 apps do you use? If AFS is your only kerberized app, > > then you are MUCH better off using v5 (which is 2002 technology) > > than v4 (which in 1988 technology). >=20 > Ah; I see. Well, I haven't gotten any Kerberos software except that > pam module...unfortunately, it has proven a bit difficult to find, let > alone actually compile, *any* kerberized applications. So I guess > KRB5 would be the best way to go, if I can get any KRB5 applications > working. I'd like to get SSH and Telnet, at the very least, as well > as OpenLDAP2. Telnet is included in the release, at least in Heimdal. SSH can=B4t do kerberos. --=20 /Ian D ian@assv.net - www.assv.net From warlord@MIT.EDU Sun Oct 27 03:55:55 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 26 Oct 2002 23:55:55 -0400 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> <3DBB2C40.1020908@myrealbox.com> Message-ID: Ian Delahorne writes: > Telnet is included in the release, at least in Heimdal. SSH can=B4t do > kerberos. Actually, there ARE patches for kerberized SSH (I used them every day ;) -derek --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Sun Oct 27 07:16:25 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Sun, 27 Oct 2002 02:16:25 -0500 (EST) Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: Message-ID: On 27 Oct 2002, Ian Delahorne wrote: > > > please cc: openafs-info on your resonses... better yet, just send it to openafs-info > > Ah; I see. Well, I haven't gotten any Kerberos software except that > > pam module...unfortunately, it has proven a bit difficult to find, let > > alone actually compile, *any* kerberized applications. So I guess > > KRB5 would be the best way to go, if I can get any KRB5 applications > > working. I'd like to get SSH and Telnet, at the very least, as well > > as OpenLDAP2. > > Telnet is included in the release, at least in Heimdal. SSH can´t do > kerberos. the gss patches to ssh make it do kerberos v5. From ian@assv.net Sun Oct 27 09:55:36 2002 From: ian@assv.net (Ian Delahorne) Date: 27 Oct 2002 10:55:36 +0100 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> <3DBB2C40.1020908@myrealbox.com> Message-ID: Derek Atkins writes: > Ian Delahorne writes: >=20 > > Telnet is included in the release, at least in Heimdal. SSH can=B4t do > > kerberos. >=20 > Actually, there ARE patches for kerberized SSH (I used them every day ;) And it isn't on in v2 IIRC, for a reason (huge security holes is what I heard from the local OpenBSD/OpenSSH developers). Or maybe that was the token passing. --=20 /Ian D ian@assv.net - www.assv.net From warlord@MIT.EDU Sun Oct 27 13:51:42 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 27 Oct 2002 08:51:42 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: <3DBAE1E9.5020508@myrealbox.com> <3DBAF5A8.7060706@myrealbox.com> <3DBB143E.8090805@myrealbox.com> <3DBB2C40.1020908@myrealbox.com> Message-ID: Ian Delahorne writes: > And it isn't on in v2 IIRC, for a reason (huge security holes is what > I heard from the local OpenBSD/OpenSSH developers). Or maybe that was > the token passing. That was the token passing. > /Ian D > ian@assv.net - www.assv.net -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From shadow@dementia.org Sun Oct 27 16:36:45 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Sun, 27 Oct 2002 11:36:45 -0500 (EST) Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: Message-ID: On 27 Oct 2002, Ian Delahorne wrote: > > > > Actually, there ARE patches for kerberized SSH (I used them every day ;) > > And it isn't on in v2 IIRC, for a reason (huge security holes is what > I heard from the local OpenBSD/OpenSSH developers). Or maybe that was > the token passing. Give up (on the v4/AFS) stuff, use the GSS ssh patches, move along. Yes, the token passing had bugs, but they were fixed. Sounds like FUD, but I still don't recommend it, just the same. From jlrobins@uncc.edu Sun Oct 27 17:55:57 2002 From: jlrobins@uncc.edu (James Robinson) Date: Sun, 27 Oct 2002 12:55:57 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV Message-ID: <3DBC28AD.80607@uncc.edu> (dead horse beating time) Would Heimdal built with kaserver support smell just like kaserver from the Win32 AFS client's perspective (i.e. klog from win32 would 'just work') ? Assuming a ka-forwarder workalike was put in place on the afsdb machines? James From shadow@dementia.org Sun Oct 27 17:56:47 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Sun, 27 Oct 2002 12:56:47 -0500 (EST) Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBC28AD.80607@uncc.edu> Message-ID: On Sun, 27 Oct 2002, James Robinson wrote: > > (dead horse beating time) > > Would Heimdal built with kaserver support smell just > like kaserver from the Win32 AFS client's perspective > (i.e. klog from win32 would 'just work') ? Assuming > a ka-forwarder workalike was put in place on the > afsdb machines? If the klog speaks the ka protocol, it would work. If it speaks the krb4 protocol, ka-forwarder won't forward it. From ian@assv.net Sun Oct 27 19:07:12 2002 From: ian@assv.net (Ian Delahorne) Date: 27 Oct 2002 20:07:12 +0100 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <3DBC28AD.80607@uncc.edu> References: <3DBC28AD.80607@uncc.edu> Message-ID: James Robinson writes: > (dead horse beating time) > > Would Heimdal built with kaserver support smell just > like kaserver from the Win32 AFS client's perspective > (i.e. klog from win32 would 'just work') ? Assuming > a ka-forwarder workalike was put in place on the > afsdb machines? Works for me, but I run the KDC on the same machine as the VLDB. -- /Ian D ian@assv.net - www.assv.net From amar deep kumar" HI when a client host is shutdown not properly.then the file that was created and was being written by it shows of zero size. is not there any method to recollect the data or is it completely lost amardeep From flash@itp.tu-graz.ac.at Mon Oct 28 12:55:59 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 28 Oct 2002 13:55:59 +0100 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: Message-ID: <7gelaa3eow.fsf@faeppc20.tu-graz.ac.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Derrick J Brashear writes: > On 27 Oct 2002, Ian Delahorne wrote: > > > > > > > Actually, there ARE patches for kerberized SSH (I used them every day ;) > > > > And it isn't on in v2 IIRC, for a reason (huge security holes is what > > I heard from the local OpenBSD/OpenSSH developers). Or maybe that was > > the token passing. > > Give up (on the v4/AFS) stuff, use the GSS ssh patches, move along. > > Yes, the token passing had bugs, but they were fixed. Sounds like FUD, but > I still don't recommend it, just the same. > Just one question: I applied Simon Wilkinson GSS ssh patches to openssh. Authentication to the remote host works fine, I don't need to retype my password. Problem is, I don't get afs tokens. I have put a line for aklog into /etc/ssh/sshrc, but sshrc gets only executed after sshd has tried to chdir into $HOME. What are possible/available solutions for this problem. Thanks for your advice, Christian Pfaffel - -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Processed by Mailcrypt 3.5.7 iD8DBQE9vTPMzNp7/ndBhMQRArpOAJ9GyW4caxL7H92s0vsW/QPTgV0i3ACdECf0 poXyFvugB8OxqnHEos04pak= =TUgN -----END PGP SIGNATURE----- From warlord@MIT.EDU Mon Oct 28 13:38:17 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 28 Oct 2002 08:38:17 -0500 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <7gelaa3eow.fsf@faeppc20.tu-graz.ac.at> References: <7gelaa3eow.fsf@faeppc20.tu-graz.ac.at> Message-ID: Christian Pfaffel writes: > What are possible/available solutions for this problem. Build ssh with PAM support and acquire/build pam-openafs-sesssion? > Thanks for your advice, > > Christian Pfaffel -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From flash@itp.tu-graz.ac.at Mon Oct 28 13:43:26 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 28 Oct 2002 14:43:26 +0100 Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: References: <7gelaa3eow.fsf@faeppc20.tu-graz.ac.at> Message-ID: <7g65vm3cht.fsf@faeppc20.tu-graz.ac.at> Derek Atkins writes: > Christian Pfaffel writes: > > > What are possible/available solutions for this problem. > > Build ssh with PAM support and acquire/build pam-openafs-sesssion? > > > Thanks for your advice, > > > > Christian Pfaffel > > -derek Thanks, this worked. I built a redhat rpm for the module, so if someone is interested i can put it on the web. Another question that is somehow related to the previous one: I have gdm & redhat 7.[23] running on all of our workstations. Is there a way to configure a standard xscreensaver/xlock to renew/replace the kerberos V ticket and obtain a newer AFS token, so that I will always have a valid token to access my AFS homespace. Thanks for your advice on this topic as well, Christian Pfaffel -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg From Dr A V Le Blanc Mon Oct 28 16:12:15 2002 From: Dr A V Le Blanc (Dr A V Le Blanc) Date: Mon, 28 Oct 2002 16:12:15 +0000 Subject: [OpenAFS] ptserver processes hanging Message-ID: <20021028161215.GA21597@afs.mcc.ac.uk> I've now got the problem that the ptserver process is hanging at times on two of my DB servers; the process won't die even after kill -9, but remains in the process table for several hours, and the other machines are unable to form a quorum, so no changes can be made to the pt database. The two problem servers are SGI Origens with 180 MHZ IP27 processors, running IRIX 6.5 and openafs 1.2.7. The third server, which is not showing this problem, is an i386 Linux box with a 1.8 GHZ processor, running Debian woody and with openafs 1.2.7 as well. The only way I know to solve the problem is to reboot the server with the hanging ptserver, which I'm usually reluctant to do, since the salvaging at boot time usually takes about 40 minutes on these machines, even after a clean shutdowm. (After a power failure, salvaging sometimes takes about 4 hours.) The SGI machines are rock and ice, and the Linux one is snow. Currently ice's ptserver is hung. Below wre the results of udebug to the two runing ptservers. Note that each server is voting for itself as lowest host, which is why no quorum results. The funny times for last vote and last beacon also seem to be parts of the problem. -- Owen LeBlanc@mcc.ac.uk 'Udebug rock 7002 -long' returns: Host's addresses are: 130.88.203.11 Host's 130.88.203.11 time is Mon Oct 28 16:08:31 2002 Local time is Mon Oct 28 16:08:31 2002 (time differential 0 secs) Last yes vote for 130.88.203.11 was 9 secs ago (not sync site); Last vote started 9 secs ago (at Mon Oct 28 16:08:22 2002) Local db version is 1035451571.4 I am not sync site Lowest host 130.88.203.11 was set 5 secs ago Sync host 0.0.0.0 was set 32323 secs ago Sync site's db version is 1035451571.4 0 locked pages, 0 of them for write Last time a new db version was labelled was: 369740 secs ago (at Thu Oct 24 10:26:11 2002) Server (130.88.203.12): (db 1035451571.4) last vote rcvd 32369 secs ago (at Mon Oct 28 07:09:02 2002), last beacon sent 32338 secs ago (at Mon Oct 28 07:09:33 2002), last vote was yes dbcurrent=1, up=0 beaconSince=0 Server (130.88.203.13): (db 1035451571.4) last vote rcvd 32353 secs ago (at Mon Oct 28 07:09:18 2002), last beacon sent 10 secs ago (at Mon Oct 28 16:08:21 2002), last vote was yes dbcurrent=1, up=0 beaconSince=0 and 'udebug scree 7002 -long' returns: Host's addresses are: 130.88.203.13 Host's 130.88.203.13 time is Mon Oct 28 16:08:42 2002 Local time is Mon Oct 28 16:08:42 2002 (time differential 0 secs) Last yes vote for 130.88.203.13 was 1 secs ago (not sync site); Last vote started 1 secs ago (at Mon Oct 28 16:08:41 2002) Local db version is 1035451571.4 I am not sync site Lowest host 130.88.203.13 was set 1 secs ago Sync host 0.0.0.0 was set 32364 secs ago Sync site's db version is 1035451571.4 0 locked pages, 0 of them for write Server (130.88.203.12): (db 0.0) last vote rcvd 441604 secs ago (at Wed Oct 23 14:28:38 2002), last beacon sent 32268 secs ago (at Mon Oct 28 07:10:54 2002), last vote was no dbcurrent=0, up=0 beaconSince=0 Server (130.88.203.11): (db 0.0) last vote rcvd 1 secs ago (at Mon Oct 28 16:08:41 2002), last beacon sent 1 secs ago (at Mon Oct 28 16:08:41 2002), last vote was no dbcurrent=0, up=1 beaconSince=1 From reuter@rzg.mpg.de Mon Oct 28 17:00:09 2002 From: reuter@rzg.mpg.de (Hartmut Reuter) Date: Mon, 28 Oct 2002 18:00:09 +0100 Subject: [OpenAFS] ptserver processes hanging References: <20021028161215.GA21597@afs.mcc.ac.uk> Message-ID: <3DBD6D19.6000200@rzg.mpg.de> Dr A V Le Blanc wrote: > I've now got the problem that the ptserver process is hanging at times > on two of my DB servers; the process won't die even after kill -9, > but remains in the process table for several hours, and the other > machines are unable to form a quorum, so no changes can be made > to the pt database. For me this looks like a problem with the file-system where /usr/afs/db is in. The ptserver is pure userland code. I would separate the database servers from fileservers, anyway (keeping the ip-addresses for the database servervs, of course). > > The two problem servers are SGI Origens with 180 MHZ IP27 processors, > running IRIX 6.5 and openafs 1.2.7. The third server, which is not > showing this problem, is an i386 Linux box with a 1.8 GHZ processor, > running Debian woody and with openafs 1.2.7 as well. The only way > I know to solve the problem is to reboot the server with the > hanging ptserver, which I'm usually reluctant to do, since > the salvaging at boot time usually takes about 40 minutes on > these machines, even after a clean shutdowm. (After a power failure, > salvaging sometimes takes about 4 hours.) You should configure the build of your fileservers with "--enable-fast-restart". This skips the salvage and lets your fileservers come back immediately. If you really have a damaged volume it will probably go off-line by itself and you can salvage it later without shuting down the fileserver. We do this since years without any bad experience. Hartmut > > The SGI machines are rock and ice, and the Linux one is snow. > Currently ice's ptserver is hung. Below wre the results of udebug > to the two runing ptservers. Note that each server is voting for > itself as lowest host, which is why no quorum results. The funny > times for last vote and last beacon also seem to be parts of the > problem. > > -- Owen > LeBlanc@mcc.ac.uk > > 'Udebug rock 7002 -long' returns: > > Host's addresses are: 130.88.203.11 > Host's 130.88.203.11 time is Mon Oct 28 16:08:31 2002 > Local time is Mon Oct 28 16:08:31 2002 (time differential 0 secs) > Last yes vote for 130.88.203.11 was 9 secs ago (not sync site); > Last vote started 9 secs ago (at Mon Oct 28 16:08:22 2002) > Local db version is 1035451571.4 > I am not sync site > Lowest host 130.88.203.11 was set 5 secs ago > Sync host 0.0.0.0 was set 32323 secs ago > Sync site's db version is 1035451571.4 > 0 locked pages, 0 of them for write > Last time a new db version was labelled was: > 369740 secs ago (at Thu Oct 24 10:26:11 2002) > > Server (130.88.203.12): (db 1035451571.4) > last vote rcvd 32369 secs ago (at Mon Oct 28 07:09:02 2002), > last beacon sent 32338 secs ago (at Mon Oct 28 07:09:33 2002), last vote was yes > dbcurrent=1, up=0 beaconSince=0 > > Server (130.88.203.13): (db 1035451571.4) > last vote rcvd 32353 secs ago (at Mon Oct 28 07:09:18 2002), > last beacon sent 10 secs ago (at Mon Oct 28 16:08:21 2002), last vote was yes > dbcurrent=1, up=0 beaconSince=0 > > and 'udebug scree 7002 -long' returns: > > Host's addresses are: 130.88.203.13 > Host's 130.88.203.13 time is Mon Oct 28 16:08:42 2002 > Local time is Mon Oct 28 16:08:42 2002 (time differential 0 secs) > Last yes vote for 130.88.203.13 was 1 secs ago (not sync site); > Last vote started 1 secs ago (at Mon Oct 28 16:08:41 2002) > Local db version is 1035451571.4 > I am not sync site > Lowest host 130.88.203.13 was set 1 secs ago > Sync host 0.0.0.0 was set 32364 secs ago > Sync site's db version is 1035451571.4 > 0 locked pages, 0 of them for write > > Server (130.88.203.12): (db 0.0) > last vote rcvd 441604 secs ago (at Wed Oct 23 14:28:38 2002), > last beacon sent 32268 secs ago (at Mon Oct 28 07:10:54 2002), last vote was no > dbcurrent=0, up=0 beaconSince=0 > > Server (130.88.203.11): (db 0.0) > last vote rcvd 1 secs ago (at Mon Oct 28 16:08:41 2002), > last beacon sent 1 secs ago (at Mon Oct 28 16:08:41 2002), last vote was no > dbcurrent=0, up=1 beaconSince=1 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ----------------------------------------------------------------- Hartmut Reuter e-mail reuter@rzg.mpg.de phone +49-89-3299-1328 RZG (Rechenzentrum Garching) fax +49-89-3299-1301 Computing Center of the Max-Planck-Gesellschaft (MPG) and the Institut fuer Plasmaphysik (IPP) ----------------------------------------------------------------- From security@xauth.net Mon Oct 28 18:02:04 2002 From: security@xauth.net (Charles Clancy) Date: Mon, 28 Oct 2002 12:02:04 -0600 (CST) Subject: [OpenAFS] kaserver vs. Kerberos IV In-Reply-To: <7g65vm3cht.fsf@faeppc20.tu-graz.ac.at> Message-ID: On 28 Oct 2002, Christian Pfaffel wrote: > > Is there a way to configure a standard xscreensaver/xlock to > renew/replace the kerberos V ticket and obtain a newer AFS token, so > that I will always have a valid token to access my AFS homespace. Just use pam_krb5 for authentication; that should get you a new TGT. Then, pam_openafs-session should be able to get you a new token. You need to have pam_openafs-session NOT get a new PAG for you, otherwise that new token will die with xscreensaver. I'm not sure if there's an option to do that or not. If not, it should be added. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From pittmed@pittmed.pitt.edu Mon Oct 28 18:47:39 2002 From: pittmed@pittmed.pitt.edu (Computers in Medicine) Date: Mon, 28 Oct 2002 13:47:39 -0500 Subject: [OpenAFS] Compatibility Patch for OpenAFS 1.2.7 Message-ID: <002801c27eb2$7df0b280$0280000a@pelican> This is a multi-part message in MIME format. ------=_NextPart_000_0025_01C27E88.94A99930 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Would it be possible to have posted on the OpenAFS site either a set of = 1.2.7 source files with that compatibility patch already applied = (1.2.7.1 or 1.2.7-patched or something like that) or at least to have = the patch itself downloadable from the web site in the same place as the = source files? I subscribe to the list in digest mode, so the attachment = did not come through as an attachment and I think Pine introduced line = breaks when I saved the text that did come through. Also, people not = even reading the list will not know about the patch and will try to = build the unpatched source before figuring out it doesn't work and then = hopefully funding the patch. Can we make life easy and have everything = in one obvious place? Thanks! ------=_NextPart_000_0025_01C27E88.94A99930 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Would it be possible to have = posted on the=20 OpenAFS site either a set of 1.2.7 source files with that compatibility = patch=20 already applied (1.2.7.1 or 1.2.7-patched or something like that) or at = least to=20 have the patch itself downloadable from the web site in the same place = as the=20 source files?  I subscribe to the list in digest mode, so the = attachment=20 did not come through as an attachment and I think Pine introduced line = breaks=20 when I saved the text that did come through.  Also, people not even = reading=20 the list will not know about the patch and will try to build the = unpatched=20 source before figuring out it doesn't work and then hopefully funding = the=20 patch.  Can we make life easy and have everything in one obvious=20 place?  Thanks!
 
------=_NextPart_000_0025_01C27E88.94A99930-- From flash@itp.tu-graz.ac.at Tue Oct 29 11:07:38 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 29 Oct 2002 12:07:38 +0100 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: References: Message-ID: <7g4rb54i6d.fsf@faeppc20.tu-graz.ac.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Charles Clancy writes: > On 28 Oct 2002, Christian Pfaffel wrote: > > > > Is there a way to configure a standard xscreensaver/xlock to > > renew/replace the kerberos V ticket and obtain a newer AFS token, so > > that I will always have a valid token to access my AFS homespace. > > Just use pam_krb5 for authentication; that should get you a new TGT. > > Then, pam_openafs-session should be able to get you a new token. You need > to have pam_openafs-session NOT get a new PAG for you, otherwise that new > token will die with xscreensaver. I'm not sure if there's an option to do > that or not. If not, it should be added. > I do not even get the TGT if I authenticate to xlock | xscreensaver. I have the following lines in my /etc/pam.d/system-auth: ... auth sufficient /lib/security/pam_krb5afs.so debug tokens forwardable use_first_pass ... session optional /lib/security/pam_openafs_session.so ... I tried it with pam_krb5.so as well: auth sufficient /lib/security/pam_krb5.so debug forwardable use_first_pass It never does renew my TGT. klist befor and after xlock show the same expiration times for it. :-( Christian - -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Processed by Mailcrypt 3.5.7 iD8DBQE9vmvtzNp7/ndBhMQRAkT2AJ4jdhJJpFbKcSeiSo0rlmXJKOV/PgCbB/os BG4g67cPe+Abk0GOyjbyBZY= =W2pN -----END PGP SIGNATURE----- From 6delgado@informatik.uni-hamburg.de Tue Oct 29 13:12:07 2002 From: 6delgado@informatik.uni-hamburg.de (Friedrich Delgado Friedrichs) Date: Tue, 29 Oct 2002 14:12:07 +0100 Subject: [OpenAFS] Documentation Issue: Complex Mutual Authentication? Message-ID: <20021029131207.GA28262@taupan.ath.cx> --XsQoSWH+UP9D9v3l Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! I'm writing an introductory paper on OpenAFS (in german) in which i'd like = to say a few words about the concepts. In http://www.openafs.org/pages/doc/AdminGuide/auagd007.htm#HDRWQ75 i read about complex mutual authentication and simple mutual authentication. It says: "AFS uses simple mutual authentication to verify user identities during the first part of the login procedure. In that case, the key is based on the user's password." and "Complex mutual authentication involves three encryption keys and three parties. All secure AFS transactions (except the first part of the login process) employ complex mutual authentication." Inhowfar do these statements still apply to current versions of (Open)AFS? How is the authentication process modified if one uses - kaserver - the kerberos versions of kalog etc., supplied with afs - kerberos 5 with the the Kerberos Migration Kit - kaforwarder - (insert other means of authentication here, e.g. the prospected "new" afs tokens with Kerberos 5 Tickets) Kerberos 5 and the Kerberos Migration Kit is of special interest to my paper. As i understand it, the process of granting the initial Kerberos Ticket is already a form of Complex Mutual Authentication, as defined in the AFS System Administrators Manual. Is that assumption correct? Is there some documentation that is a little more thorough, technical, recent and specific to OpenAFS than the AFS documentation (which afaik still is the unaltered AFS 3.6 documentation)? Thanks and kind regards Friedel --=20 Friedrich Delgado Friedrichs Laziness led to the invention of the most useful tools. --XsQoSWH+UP9D9v3l Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (GNU/Linux) iEYEARECAAYFAj2+iScACgkQCTmCEtF2zEA7DwCffqFnr9qcgFEtPpUVHg0FEVJb h4YAoIHtdjA/Pi7PfobsY0wbsjOzq/c5 =NGVD -----END PGP SIGNATURE----- --XsQoSWH+UP9D9v3l-- From rees@umich.edu Tue Oct 29 15:21:59 2002 From: rees@umich.edu (Jim Rees) Date: Tue, 29 Oct 2002 10:21:59 -0500 Subject: [OpenAFS] cache performance In-Reply-To: Nickolai Zeldovich, Fri, 25 Oct 2002 03:20:00 EDT Message-ID: <20021029152159.38EDE207DC@citi.umich.edu> So, although there's code that claims to disable atimes, empirical evidence suggests that it's broken, and atimes are being updated anyway (not a big surprise for Transarc/AFS code). The cache manager depends on atimes to initialize the cache file lru list. This is in afs_dcache.c:afs_InitCacheFile(), "We must put this entry in the appropriate hash tables." So if you run your cache partition with noatime, when you reboot you will bash your hash with trash, and thrash your cache. From david.bear@asu.edu Mon Oct 28 23:10:08 2002 From: david.bear@asu.edu (David Bear) Date: Mon, 28 Oct 2002 16:10:08 -0700 Subject: [OpenAFS] afsd dying on win2k Message-ID: <200210281610.08238.iddwb@moroni.pp.asu.edu> Here's the strange happening We're using openafs and transarc AFS on windows 2000 machines. On some systems we see the AFS client dying. The sympton is that klog wi= ll=20 not get any tokens, returning a message that the afs client services was = not=20 started or stopped. So, we open a command window, issue=20 'net stop "IBM AFS Client"' and then as soon as that completes, issue 'net start "IBM AFS Client"' This has to be done with admin priveledge. After completing these comman= d,=20 afs works fine. klog gets tokens. the gui gets tokens. Drive maps work= =2E =20 The problem here is twofold 1) we shouldn't have to do this 2) you have to have admin priveledge to restart the service. Rebooting the system will not help. Attached is an exceprt from the sys= tem=20 logs 1527!System!Service Control Manager!ERROR!PP120144!Tue Oct 22 05:55:04=20 2002!7031!None!The IBM AFS Client service terminated unexpectedly. It ha= s=20 done this 1 time(s). The following corrective action will be taken in 0=20 milliseconds: No action. =20 3878!Application!AFS Client!ERROR!PP120144!Mon Oct 28 15:15:12=20 2002!1002!None!Invalid SMB message, length 64=20 3877!Application!AFS Client!ERROR!PP120144!Mon Oct 28 15:12:21=20 2002!1002!None!Invalid SMB message, length 64=20 3876!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:51:11=20 2002!1002!None!Invalid SMB message, length 64=20 3875!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:45:07=20 2002!1002!None!Invalid SMB message, length 64=20 3874!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:42:08=20 2002!1002!None!Invalid SMB message, length 64=20 3873!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:38:59=20 2002!1002!None!Invalid SMB message, length 64=20 3872!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:34:54=20 2002!1002!None!Invalid SMB message, length 64=20 3871!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:31:52=20 2002!1002!None!Invalid SMB message, length 64=20 3870!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:20:38=20 2002!1002!None!Invalid SMB message, length 64=20 --=20 David Bear College of Public Programs/ASU From mmcevoy@thanesoft.com Tue Oct 29 16:09:11 2002 From: mmcevoy@thanesoft.com (Micheal Mc Evoy) Date: Tue, 29 Oct 2002 10:09:11 -0600 (CST) Subject: [OpenAFS] Multiple kloging Message-ID: <30580.192.35.232.241.1035907751.squirrel@www.thanesoft.com> Quick question, I have an issue with one of the regular employees where I contract. He has a script that klog's every minute. I am concerned that this is causing problems with the cache as well as AFS performance, but I'm just a contractor. Other than there is no real requirement to klog once a minute, what are the implications of this ? Thanks, Micheal -- Micheal Mc Evoy mmcevoy@thanesoft.com Systems Programmer/Database Architect From Rich Sudlow Tue Oct 29 16:19:37 2002 From: Rich Sudlow (Rich Sudlow) Date: Tue, 29 Oct 2002 11:19:37 -0500 (EST) Subject: [OpenAFS] rsh with AFS token passing supported in openafs versions for Linux Message-ID: <200210291619.g9TGJbwb000988@dagger.nd.edu> Is AFS token passing supported for rsh in OpenAFS for Linux or just in the Transarc version?? I didn't see the rsh / inetd binaries. This is a (hopefully) a short term fix for a problem which right now can't be fixed with K5 and ticket passing ;-) Thanks Rich Rich Sudlow University of Notre Dame Office of Information Technologies 321 Information Technologies Center Notre Dame, IN 46556-0539 rich@nd.edu, rich@ieee.org (574) 631-7258 office phone (574) 631-9283 office fax From nneul@umr.edu Tue Oct 29 16:23:36 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Tue, 29 Oct 2002 10:23:36 -0600 Subject: [OpenAFS] rsh with AFS token passing supported in openafs versions for Linux Message-ID: They are there if you build with the --with-insecure option, but strongly recommended against. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Rich Sudlow [mailto:rich@nd.edu]=20 > Sent: Tuesday, October 29, 2002 10:20 AM > To: openafs-info@openafs.org > Subject: [OpenAFS] rsh with AFS token passing supported in=20 > openafs versions for Linux >=20 >=20 > Is AFS token passing supported for rsh in OpenAFS for Linux=20 > or just in the > Transarc version?? I didn't see the rsh / inetd binaries. >=20 > This is a (hopefully) a short term fix for a problem which right now > can't be fixed with K5 and ticket passing ;-) >=20 > Thanks >=20 > Rich >=20 >=20 > Rich Sudlow > University of Notre Dame > Office of Information Technologies > 321 Information Technologies Center > Notre Dame, IN 46556-0539 >=20 > rich@nd.edu, rich@ieee.org > (574) 631-7258 office phone > (574) 631-9283 office fax >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From nneul@umr.edu Tue Oct 29 16:24:31 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Tue, 29 Oct 2002 10:24:31 -0600 Subject: [OpenAFS] Multiple kloging Message-ID: On some platforms, you will see bad hangs if you don't clean up the tickets in the kernel. If it's a single PAG, it shouldn't impact anything, but multiple pags will cause problems after not too long. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Micheal Mc Evoy [mailto:mmcevoy@thanesoft.com]=20 > Sent: Tuesday, October 29, 2002 10:09 AM > To: openafs-info@openafs.org > Subject: [OpenAFS] Multiple kloging >=20 >=20 > Quick question, >=20 > I have an issue with one of the regular employees where I contract. > He has a script that klog's every minute. > I am concerned that this is causing problems with the cache=20 > as well as AFS > performance, but I'm just a contractor. >=20 > Other than there is no real requirement to klog once a=20 > minute, what are the > implications of this ? >=20 > Thanks, > Micheal > --=20 > Micheal Mc Evoy mmcevoy@thanesoft.com > Systems Programmer/Database Architect >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From rmdyer@uncc.edu Tue Oct 29 16:29:45 2002 From: rmdyer@uncc.edu (Rodney M Dyer) Date: Tue, 29 Oct 2002 11:29:45 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <200210281610.08238.iddwb@moroni.pp.asu.edu> Message-ID: <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> Mr. Bear, We've had the same issue here at UNC Charlotte. We are running Transarc's AFS 3.6 v2.32 (Patch 4). We are seeing random afsd_service.exe crashes on our Windows XP machines. A few of weeks ago we found extensive probing of NetBIOS ports from outside our campus gateway. We disabled the NetBIOS at the gateway and the level of AFS crashes went way down. We still have crashes however because we found other probing coming from compromised machines within our own network. This is a bad thing. We don't want to keep NetBIOS disabled at the router because we actually use Microsoft networking in some cases from the internet. In other cases we run Samba servers for access to AFS filespace for people who don't use the AFS client. I posted this same message weeks ago on the list. A Mr. Scott Williams at NC State was also seeing the problem. From the looks of it, I don't think anything is going to be done about the problem since no one on the OpenAFS group cares anything about Windoz... Since this seems to be the case, we are searching for other alternatives to AFS. I guess I shouldn't be surprised that AFS is so unstable on Windoz machines, I mean, it is open source, so you get what you get when you get it. (Yes, I am being sarcastic here about *nix, and open source in general.) Rodney Rodney M. Dyer x86 Systems Programmer College of Engineering Computing Services University of North Carolina at Charlotte Email rmdyer@uncc.edu Phone (704)687-3518 Help Desk Line (704)687-3150 FAX (704)687-2352 Office 267 Smith Building At 04:10 PM 10/28/2002 -0700, you wrote: >Here's the strange happening > >We're using openafs and transarc AFS on windows 2000 machines. > >On some systems we see the AFS client dying. The sympton is that klog will >not get any tokens, returning a message that the afs client services was not >started or stopped. So, we open a command window, issue >'net stop "IBM AFS Client"' > >and then as soon as that completes, issue >'net start "IBM AFS Client"' > >This has to be done with admin priveledge. After completing these command, >afs works fine. klog gets tokens. the gui gets tokens. Drive maps work. > >The problem here is twofold >1) we shouldn't have to do this >2) you have to have admin priveledge to restart the service. > >Rebooting the system will not help. Attached is an exceprt from the system >logs > >1527!System!Service Control Manager!ERROR!PP120144!Tue Oct 22 05:55:04 >2002!7031!None!The IBM AFS Client service terminated unexpectedly. It has >done this 1 time(s). The following corrective action will be taken in 0 >milliseconds: No action. > >3878!Application!AFS Client!ERROR!PP120144!Mon Oct 28 15:15:12 >2002!1002!None!Invalid SMB message, length 64 >3877!Application!AFS Client!ERROR!PP120144!Mon Oct 28 15:12:21 >2002!1002!None!Invalid SMB message, length 64 >3876!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:51:11 >2002!1002!None!Invalid SMB message, length 64 >3875!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:45:07 >2002!1002!None!Invalid SMB message, length 64 >3874!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:42:08 >2002!1002!None!Invalid SMB message, length 64 >3873!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:38:59 >2002!1002!None!Invalid SMB message, length 64 >3872!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:34:54 >2002!1002!None!Invalid SMB message, length 64 >3871!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:31:52 >2002!1002!None!Invalid SMB message, length 64 >3870!Application!AFS Client!ERROR!PP120144!Mon Oct 28 14:20:38 >2002!1002!None!Invalid SMB message, length 64 > > > >-- >David Bear >College of Public Programs/ASU >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info From kenh@cmf.nrl.navy.mil Tue Oct 29 16:33:21 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Tue, 29 Oct 2002 11:33:21 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: Your message of "Tue, 29 Oct 2002 11:29:45 EST." <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> Message-ID: <200210291633.g9TGXM6x015431@ginger.cmf.nrl.navy.mil> > From the looks of it, I don't think anything is going to be done about the >problem since no one on the OpenAFS group cares anything about >Windoz... In defense of the OpenAFS people, I don't think they don't care ... it's just that no one has stepped up to work on it. It _is_ a volunteer project, you know. --Ken From csnyder@mvpsoft.com Tue Oct 29 16:37:45 2002 From: csnyder@mvpsoft.com (Chris Snyder) Date: Tue, 29 Oct 2002 11:37:45 -0500 Subject: [OpenAFS] Authentication weirdness Message-ID: <3DBEB959.5050108@mvpsoft.com> As I said in a previous email to this list, I'm trying to get Apache to do authentication using AFS. I installed the mod_auth_external module, along with the pwauth program, which is PAM-aware. It works fine when I try pwauth from the command line as root, returning 0 when the username and password are correct. However, when I try to run it as any other user, with pwauth suid, it fails, returning an error code of 1. Also, I tried creating a little program that would be run from xinetd that would take a username and password, then return a status code if it works. I tried to use klog to authenticate. The program works fine when run from the command line, returning 0 when correct, but always returns -1 when run from xinetd. Again, it is running as root in both cases. Any ideas why both of these aren't working? I'd prefer to get the first option working if possible, but either would suffice. Thanks in advance! From shadow@dementia.org Tue Oct 29 16:57:05 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 11:57:05 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> Message-ID: On Tue, 29 Oct 2002, Rodney M Dyer wrote: > From the looks of it, I don't think anything is going to be done about the > problem since no one on the OpenAFS group cares anything about > Windoz... I don't think that's clear, but I can tell you I certainly don't have the time to care. I know a couple of people who probably care, but I'm not going to out them; They're welcome to comment themselves or not, and I have no idea if they can, or have the time, to look into this. I don't suppose anyone has an actual recipe for reproducing this, or is this one of those deals where someone should pray that their network is the same as yours? (Yes, now I'm being sarcastic. How about attaching a hub and a machine with tcpdump next to a dying client and seeing what's going on as close to when it dies as possible?) From Mitchell.D.Baker@rose-hulman.edu Tue Oct 29 17:07:32 2002 From: Mitchell.D.Baker@rose-hulman.edu (Mitchell D. Baker) Date: 29 Oct 2002 12:07:32 -0500 Subject: [OpenAFS] afsd dying on win2k Message-ID: <1035911242.2730.21.camel@babylon5.rose-hulman.edu> We are seeing this as well.. I might be able to get a tcpdump and send it to someone if they would like to look... I run it in a VMWare session and it to dies. I have not tried turning off the samba server to connect my VMWare session to my host system.. Might try this to see if it makes a difference. See-ya Mitch On Tue, 2002-10-29 at 11:57, Derrick J Brashear wrote: > On Tue, 29 Oct 2002, Rodney M Dyer wrote: > > > From the looks of it, I don't think anything is going to be done about the > > problem since no one on the OpenAFS group cares anything about > > Windoz... > > I don't think that's clear, but I can tell you I certainly don't have the > time to care. I know a couple of people who probably care, but I'm not > going to out them; They're welcome to comment themselves or not, and I > have no idea if they can, or have the time, to look into this. > > I don't suppose anyone has an actual recipe for reproducing this, or is > this one of those deals where someone should pray that their network is > the same as yours? > > (Yes, now I'm being sarcastic. How about attaching a hub and a machine > with tcpdump next to a dying client and seeing what's going on as close to > when it dies as possible?) > > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- /####################################################################/ /# Mitchell "Buzz" Baker "To Infinity And Beyond..." #/ /# Sr. Systems/Security Admin Rose-Hulman Institute of Technology #/ /# Mitchell.D.Baker@rose-hulman.edu www.rose-hulman.edu #/ /# For PGP Public key, check out www.keyserver.net #/ /####################################################################/ From shadow@dementia.org Tue Oct 29 18:38:25 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 13:38:25 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <1035911242.2730.21.camel@babylon5.rose-hulman.edu> Message-ID: On 29 Oct 2002, Mitchell D. Baker wrote: > We are seeing this as well.. I might be able to get a tcpdump and send > it to someone if they would like to look... Put it somewhere and send a pointer to openafs-devel? From shadow@dementia.org Tue Oct 29 20:46:12 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 15:46:12 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <200210291344.39361.iddwb@moroni.pp.asu.edu> Message-ID: On Tue, 29 Oct 2002, David Bear wrote: > afs service seems to die whenever a windows logon occurs. I can set tcpdump > to capture everything on a separate machine if this is what is wanted. Since > I can reproduce this at will, it shouldn't be too hard to limit the size of > the dump file. > > To whom should I send it? openafs-bugs@openafs.org, if the earlier suggestion about sticking it on a web server and sharing a pointer on openafs-devel isn't workable. From maldrich@reserveamerica.com Tue Oct 29 20:31:51 2002 From: maldrich@reserveamerica.com (Michael Aldrich) Date: Tue, 29 Oct 2002 15:31:51 -0500 Subject: [OpenAFS] Multiple Cells Message-ID: <200210291531.51060.maldrich@reserveamerica.com> Hi, It is completely impossible to have more than one cell housed on a single= AFS=20 server?=20 From shadow@dementia.org Tue Oct 29 20:55:12 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 15:55:12 -0500 (EST) Subject: [OpenAFS] Multiple Cells In-Reply-To: <200210291531.51060.maldrich@reserveamerica.com> Message-ID: On Tue, 29 Oct 2002, Michael Aldrich wrote: > Hi, > It is completely impossible to have more than one cell housed on a single AFS > server? Unless you have an OS which allows you to basically have virtual machines, (true, like, different root filesystems and network interfaces per host) yes From kolya@MIT.EDU Tue Oct 29 21:06:56 2002 From: kolya@MIT.EDU (Nickolai Zeldovich) Date: Tue, 29 Oct 2002 16:06:56 -0500 Subject: [OpenAFS] Multiple Cells Message-ID: <200210292106.QAA27663@contents-vnder-pressvre.mit.edu> > On Tue, 29 Oct 2002, Michael Aldrich wrote: > > Hi, > > It is completely impossible to have more than one cell housed on a single > > AFS server? > > Unless you have an OS which allows you to basically have virtual machines, > (true, like, different root filesystems and network interfaces per host) > yes FWIW, FreeBSD's jail system is probably enough of a virtual machine to let you do it (i.e., you don't need full-blown vmware in that case). The only thing I'm not sure about is the fssync interface between the fileserver and volserver; you might need to tweak it a little bit to make it work in this situation. -- kolya From Todd_Lewis@unc.edu Tue Oct 29 21:18:59 2002 From: Todd_Lewis@unc.edu (Todd M. Lewis) Date: Tue, 29 Oct 2002 16:18:59 -0500 Subject: [OpenAFS] cache performance References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> Message-ID: <3DBEFB43.1070909@email.unc.edu> give it a trygive it a trygive it a try Phil.Moore@morganstanley.com wrote: > This is very interesting indeed, but we're way too diverse to impose a > execution mechanism on our environment, especially with the specter of > 30,000 Windows boxes all just waiting to finally have a stable > distributed filesystem out of which to run applications. I don't quite follow you. The overhead of having an application send a UDP datagram on startup is not a particularly onerous imposition. And it doesn't require any reconfiguration of the client. > We've tried similar approaches to yours in the past, with varying > degrees of success, but I think our scale makes such an approach > impractical. The scale penalty would be that you might drop some of the datagrams, which means at worst your logs may not reflect every single invocation. I doubt it would happen very often though, even at the scale you're talking about. It's a pretty low overhead mechanism. > The strategic focus *MUST* be on getting richer statistics out of the > fileservers, so we can perform this analysis centrally. Maybe I wasn't clear, but the logging happens centrally, wherever you choose to run the runloggerd daemon, so analysis is central as well. I agree some interesting info could be gleaned from the fileservers, but you can put runlogger into just the apps/pkgs you are interested in and get very focused logs to analyze. (Or do what we do and log everything you can get your fingers into.) > Then again, if you have a mature logging mechanism like this, it > certainly would complement anything we can gather on the servers, too. You're welcome to give it a try. I've cleaned up the code a bit and packaged it up for public consumption. Point a browser at http://www.unc.edu/~utoddl/runlogger.2.tgz and give it a smoke test. As always, I'd welcome any comments or suggestions for improvements you or anyone else might have. -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ >>>>>>"Todd" == Todd M Lewis writes: >>>>> > > Todd> You might be interested in what we've done in this area. We're an > Todd> academic shop (U. of North Carolina - Chapel Hill), so our needs are > Todd> admittedly different from yours, but we build a bunch of packages from > Todd> source, usually for as many of our supported architectures as we can get > Todd> 'em to build on. We wanted to know who's using what, so we would know > Todd> how to spend our limited people resources when deciding what to upgrade, > Todd> what versions to abandon, etc. > > Todd> We came up with a mechanism called runlogger. Basically, we stick a > Todd> call to the runlogger client function somewhere near the beginning of a > Todd> program when we build it. If that's not practical (if it's a script > Todd> based thing for example) we have it call the stand-alone runlogger > Todd> client program, and if it comes to it and we really want it logged badly > Todd> enough, we'll wrap the application in a script that runs the runlogger > Todd> client before running the program in question. > > Todd> The runlogger client takes one parameter -- the name of the package we > Todd> want to log. If we need finer grained logging (a pkg might contain > Todd> several different programs for example), then it could pass the pkg > Todd> name, a colon, and the program name as one parameter. Runlogger takes > Todd> this parameter and concatenates the uid of the user (which is usually > Todd> who he/she's klogged as) and the AFS @sys name for this architecture > Todd> (which was hard coded into the runlogger routine at build time) into a > Todd> colon delimited string and passes it off via UDP to the runloggerd > Todd> daemon indicated in the runlogger pkg's config file. > > Todd> runloggerd takes this steady stream of UDP packets from all these > Todd> different clients, adds to them a time stamp and the IP address of > Todd> client, and appends them onto its log file. You get things that look > Todd> like this (w/ numbers changed to protect the innocent): > > >>>2002.05.29.13.32.00 [152.2.1.103]:[rs_aix43]:[5678]:pine-421 >>>2002.05.29.13.32.00 [152.2.1.149]:[sun4x_57]:[0]:lynx-284 >>>2002.05.29.13.32.19 [152.2.1.104]:[rs_aix43]:[5847]:pine-421 >>>2002.05.29.13.32.20 [152.2.68.144]:[sun4x_58]:[26678]:pine-421 >>>2002.05.29.13.32.32 [152.2.1.106]:[rs_aix43]:[9491]:pine-421 >>>2002.05.29.13.32.32 [152.2.1.99]:[rs_aix43]:[3190]:openssh-252p2 >>>2002.05.29.13.32.33 [152.2.48.55]:[sgi_65]:[6309]:tcsh-611 >> > > Todd> That's a time stamp, the client IP, the @sys name, uid, and pkg name. > > Todd> We routinely analyze the log file to see what's being run, when, by > Todd> whom, and on what architecture(s). You can try to log everything, or > Todd> limit it to only logging those things you're interested it at the moment. > > Todd> We've made a variation of it called pmlogger which lets us see which > Todd> Perl modules are actually being used. (Perl module life cycling can be > Todd> a real pain, and it's a lot easier to drop support for an old module > Todd> when you know it isn't being used by anybody.) > > Todd> I'm sure the file servers could give us other interesting information, > Todd> but the runlogger/runloggerd approach has given us good results without > Todd> having to change the production servers. It adds a little overhead to > Todd> each logged program's startup, but not much. If you interested, I could > Todd> package it up and make it presentable... From maldrich@reserveamerica.com Tue Oct 29 21:55:28 2002 From: maldrich@reserveamerica.com (Michael Aldrich) Date: Tue, 29 Oct 2002 16:55:28 -0500 Subject: [OpenAFS] Multiple Cells In-Reply-To: <200210292106.QAA27663@contents-vnder-pressvre.mit.edu> References: <200210292106.QAA27663@contents-vnder-pressvre.mit.edu> Message-ID: <200210291655.28299.maldrich@reserveamerica.com> Thanks for the info. Is it possible to share a single AFS cell between th= ree=20 subnets? > > On Tue, 29 Oct 2002, Michael Aldrich wrote: > > > Hi, > > > It is completely impossible to have more than one cell housed on a > > > single AFS server? > > > > Unless you have an OS which allows you to basically have virtual > > machines, (true, like, different root filesystems and network interfa= ces > > per host) yes > > FWIW, FreeBSD's jail system is probably enough of a virtual machine to > let you do it (i.e., you don't need full-blown vmware in that case). > The only thing I'm not sure about is the fssync interface between the > fileserver and volserver; you might need to tweak it a little bit to > make it work in this situation. > > -- kolya > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From shadow@dementia.org Tue Oct 29 22:55:59 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 17:55:59 -0500 (EST) Subject: [OpenAFS] Multiple Cells In-Reply-To: <200210291655.28299.maldrich@reserveamerica.com> Message-ID: On Tue, 29 Oct 2002, Michael Aldrich wrote: > Thanks for the info. Is it possible to share a single AFS cell between three > subnets? Explain what you mean. We share our AFS cell with the entire world (all the subnets;-) leading me to believe I'm misreading your question. From Phil.Moore@morganstanley.com Tue Oct 29 23:03:44 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Tue, 29 Oct 2002 18:03:44 -0500 Subject: [OpenAFS] cache performance In-Reply-To: <3DBEFB43.1070909@email.unc.edu> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> Message-ID: <15807.5072.52967.812237@zappa.ms.com> >>>>> "Todd" == Todd M Lewis writes: Phil> This is very interesting indeed, but we're way too diverse to Phil> impose a execution mechanism on our environment, especially with Phil> the specter of 30,000 Windows boxes all just waiting to finally Phil> have a stable distributed filesystem out of which to run Phil> applications. Todd> I don't quite follow you. The overhead of having an application send a Todd> UDP datagram on startup is not a particularly onerous imposition. And it Todd> doesn't require any reconfiguration of the client. I'm not concerned about the performance overhead, I'm concerned about the management overhead.... What I'm after is a near-complete (I'll take 90-95%) audit of the usage of my AFS volumes. Your approach would not scale in an environment as large as ours, simply because of the diversity of apps we have, and the global nature of our client base. The AFS infrastructure is *THE* place to deploy production apps, and we have 1000's of distinct applications (managed by lots of distinct groups), running on lots of different platforms, all of which would have to be wrapped in some fashion. That's a gargantuan task to begin with. Then we have to worry about managing the collection of data. We can't have the entire planet logging to one place. We have to distribute that (London logging somewhere in Lond, NY in NY, etc.) and then collect the data and analyze it centrally. Phil> The strategic focus *MUST* be on getting richer statistics out Phil> of the fileservers, so we can perform this analysis centrally. Todd> Maybe I wasn't clear, but the logging happens centrally, Todd> wherever you choose to run the runloggerd daemon, so analysis is Todd> central as well. I agree some interesting info could be gleaned Todd> from the fileservers, but you can put runlogger into just the Todd> apps/pkgs you are interested in and get very focused logs to Todd> analyze. (Or do what we do and log everything you can get your Todd> fingers into.) The log information may be collected centrally, but it is generated on each and every client, by each and every app. That's my point. But again, I'm not knocking your solution as a viable alternative, merely saying it won't scale to *our* scale, which is far larger than most other AFS shops. Therefore, I still encourage small to medium sized shops to look at this approach; it has value. If you're a huge enterprise like us, a client-based solution is simply too expensive (I mean *everything* scales, if you've got enough time and money). Therefore, we're going to focus our energy on server-based auditing that will meet these needs. Hopefully, if we do it right, you'll just have to upgrade to the latest OpenAFS server code, and get this new feature for free. Everything we fund for OpenAFS is contributed back to the code base; we don't do Morgan Stanley specials (been there, done that, paid millions to undo it). From nneul@umr.edu Tue Oct 29 23:08:55 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 29 Oct 2002 17:08:55 -0600 Subject: [OpenAFS] cache performance In-Reply-To: <15807.5072.52967.812237@zappa.ms.com> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> <15807.5072.52967.812237@zappa.ms.com> Message-ID: <1035932935.1333.9.camel@cessna.rollanet.org> What sort of additional logging are you looking for in the file server? Also, how do you plan on handling the "if it's already in the cache, the file server probably won't see a request" issue? Adding more logging is relatively easy to do, just come up with a list. -- Nathan On Tue, 2002-10-29 at 17:03, Phil.Moore@morganstanley.com wrote: > >>>>> "Todd" == Todd M Lewis writes: > > Phil> This is very interesting indeed, but we're way too diverse to > Phil> impose a execution mechanism on our environment, especially with > Phil> the specter of 30,000 Windows boxes all just waiting to finally > Phil> have a stable distributed filesystem out of which to run > Phil> applications. > > Todd> I don't quite follow you. The overhead of having an application send a > Todd> UDP datagram on startup is not a particularly onerous imposition. And it > Todd> doesn't require any reconfiguration of the client. > > I'm not concerned about the performance overhead, I'm concerned about > the management overhead.... > > What I'm after is a near-complete (I'll take 90-95%) audit of the > usage of my AFS volumes. Your approach would not scale in an > environment as large as ours, simply because of the diversity of apps > we have, and the global nature of our client base. > > The AFS infrastructure is *THE* place to deploy production apps, and > we have 1000's of distinct applications (managed by lots of distinct > groups), running on lots of different platforms, all of which would > have to be wrapped in some fashion. That's a gargantuan task to begin > with. > > Then we have to worry about managing the collection of data. We can't > have the entire planet logging to one place. We have to distribute > that (London logging somewhere in Lond, NY in NY, etc.) and then > collect the data and analyze it centrally. > > Phil> The strategic focus *MUST* be on getting richer statistics out > Phil> of the fileservers, so we can perform this analysis centrally. > > Todd> Maybe I wasn't clear, but the logging happens centrally, > Todd> wherever you choose to run the runloggerd daemon, so analysis is > Todd> central as well. I agree some interesting info could be gleaned > Todd> from the fileservers, but you can put runlogger into just the > Todd> apps/pkgs you are interested in and get very focused logs to > Todd> analyze. (Or do what we do and log everything you can get your > Todd> fingers into.) > > The log information may be collected centrally, but it is generated on > each and every client, by each and every app. That's my point. > > But again, I'm not knocking your solution as a viable alternative, > merely saying it won't scale to *our* scale, which is far larger than > most other AFS shops. Therefore, I still encourage small to medium > sized shops to look at this approach; it has value. > > If you're a huge enterprise like us, a client-based solution is > simply too expensive (I mean *everything* scales, if you've got enough > time and money). > > Therefore, we're going to focus our energy on server-based auditing > that will meet these needs. Hopefully, if we do it right, you'll just > have to upgrade to the latest OpenAFS server code, and get this new > feature for free. > > Everything we fund for OpenAFS is contributed back to the code base; > we don't do Morgan Stanley specials (been there, done that, paid > millions to undo it). > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From Phil.Moore@morganstanley.com Tue Oct 29 23:11:56 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Tue, 29 Oct 2002 18:11:56 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> References: <200210281610.08238.iddwb@moroni.pp.asu.edu> <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> Message-ID: <15807.5564.781359.773412@zappa.ms.com> >>>>> "Rodney" == Rodney M Dyer writes: Rodney> From the looks of it, I don't think anything is going to be Rodney> done about the problem since no one on the OpenAFS group cares Rodney> anything about Windoz... Since this seems to be the case, we Rodney> are searching for other alternatives to AFS. I guess I Rodney> shouldn't be surprised that AFS is so unstable on Windoz Rodney> machines, I mean, it is open source, so you get what you get Rodney> when you get it. (Yes, I am being sarcastic here about *nix, Rodney> and open source in general.) Well, that's simply not true. We (Morgan Stanley) care enough about the Windows client that we have funded development (through Sine Nomine) to stabilize it, and make it useful for us in a mission critical production environment. The lack of attention the Windows client gets on this mailing list is simply because there aren't many experts with Windows knowledge volunteering to work on the client. Its not that we don't care, its that we, as a group, are primarily UNIX experts, and UNIX is the platform on which AFS is most widely used. As for getting what you pay for, that's certainly true. We take that quite literally as a Firm, and that's why we are willing to fund development of Open Source products that are critically important to us. We've also funded, for example, the Perl Foundation, since perl is one of the more important development languages here. OK, you're in academia, and not rolling in cash, so I'm not going to ask you to pony up money for OpenAFS (although anyone reading this who works for a commercial enterprise that uses OpenAFS should do so), but perhaps you have NT expertise in your oen IT shop, and they could get involved in working with us to make the NT client better? Free labor is just as welcome (if not more so), than cash. From rmdyer@uncc.edu Wed Oct 30 00:32:28 2002 From: rmdyer@uncc.edu (Rodney M Dyer) Date: Tue, 29 Oct 2002 19:32:28 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: References: <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> Message-ID: <5.1.0.14.0.20021029184304.02668850@coeimap2.uncc.edu> At 11:57 AM 10/29/2002 -0500, you wrote: >On Tue, 29 Oct 2002, Rodney M Dyer wrote: > > > From the looks of it, I don't think anything is going to be done about > the > > problem since no one on the OpenAFS group cares anything about > > Windoz... > >I don't think that's clear, but I can tell you I certainly don't have the >time to care. Just on the side, my colleagues and I think it's funny that you say this. Are you paid as an OpenAFS help desk person? You seem to have enough time to respond to just about everything that hits this list. Do you ever have time for anything else? ;) I can only hope my sting was "mostly harmless", but it was intended to draw out comments on just what is going on in the group relative to Windows support. Yes, I am VERY appreciative of the support I'm getting out of this list. On at least a couple of occasions I've gotten good help. I'm sorry if I offended anyone. Believe me, the last time we had to get a very small problem debugged in the Transarc client, it ended up costing us a few thousand dollars to get fixed. I'm glad to hear from Mr. Phil Moore at Morgan Stanley. I'm glad to hear that someone is pony'ing up for support. But, is the version that Morgan Stanley using available as open source? Can anyone get a copy of it? Is it a forked version of OpenAFS? What is different about it? How much would it cost us? We've been in a real push now for over a year to get a single-sign-on system developed between our Windows/UNIX/Mac machines. Using Kerberos V as the authentication mechanism and AFS as the filesystem, we've managed to glue everything together as a working unit. It all works great except now we are having trouble weaning ourselves away from the kaserver. Seems the Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" daemon. This wouldn't be a problem except that it is a real annoyance for our users to "kinit" then "aklog" at the command line by hand. And, we're having problems with "aklog" behind a NAT router for some reason I can't fathom (yes, we've tried addressless tickets). BTW, for anyone who cares, if you setup cross-realm authentication for an AD domain to a Kerberos V realm, you may have trouble with AD domain file share access. This seems to be caused by a bug/feature/design flaw in the Kerberos V replay packet detection. Microsoft and MIT are currently working the issue out. We still need AD domain shares because we store files and databases there that AFS cannot support because it doesn't have complete record locking capability. Rodney > I know a couple of people who probably care, but I'm not >going to out them; They're welcome to comment themselves or not, and I >have no idea if they can, or have the time, to look into this. > >I don't suppose anyone has an actual recipe for reproducing this, or is >this one of those deals where someone should pray that their network is >the same as yours? > >(Yes, now I'm being sarcastic. How about attaching a hub and a machine >with tcpdump next to a dying client and seeing what's going on as close to >when it dies as possible?) > > > > >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info From kenh@cmf.nrl.navy.mil Wed Oct 30 01:35:49 2002 From: kenh@cmf.nrl.navy.mil (Ken Hornstein) Date: Tue, 29 Oct 2002 20:35:49 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: Your message of "Tue, 29 Oct 2002 19:32:28 EST." <5.1.0.14.0.20021029184304.02668850@coeimap2.uncc.edu> Message-ID: <200210300135.g9U1Zm6x004896@ginger.cmf.nrl.navy.mil> >We've been in a real push now for over a year to get a single-sign-on >system developed between our Windows/UNIX/Mac machines. Using Kerberos V >as the authentication mechanism and AFS as the filesystem, we've managed to >glue everything together as a working unit. It all works great except now >we are having trouble weaning ourselves away from the kaserver. Seems the >Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" >daemon. This wouldn't be a problem except that it is a real annoyance for >our users to "kinit" then "aklog" at the command line by hand. Rodney, it seems to me like it would be trivial to have kinit call aklog after it's gotten you a TGT. Didn't you even consider trying that? And have you heard the phrase, "If you're not part of the solution, you're part of the problem?" >And, we're >having problems with "aklog" behind a NAT router for some reason I can't >fathom (yes, we've tried addressless tickets). I suspect the problem is related to the fact that some versions of the 524 library wouldn't accept an addressless v5 TGT. --Ken From barrows@email.arc.nasa.gov Wed Oct 30 03:06:33 2002 From: barrows@email.arc.nasa.gov (Lester Barrows) Date: Tue, 29 Oct 2002 20:06:33 -0700 Subject: [OpenAFS] cache performance In-Reply-To: <1035932935.1333.9.camel@cessna.rollanet.org> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <15807.5072.52967.812237@zappa.ms.com> <1035932935.1333.9.camel@cessna.rollanet.org> Message-ID: <200210291906.33440.barrows@email.arc.nasa.gov> Whenever a file is accessed on the client, I believe it contacts the cach= e=20 manager to ensure that it hasn't changed. Perhaps the cache manager, rath= er=20 than the file server, would be the most authoritative place to collect th= is=20 information. Regards, Lester Barrows On Tuesday 29 October 2002 03:08 pm, Nathan Neulinger wrote: > What sort of additional logging are you looking for in the file server? > > Also, how do you plan on handling the "if it's already in the cache, th= e > file server probably won't see a request" issue? > > Adding more logging is relatively easy to do, just come up with a list. > > -- Nathan From shadow@dementia.org Wed Oct 30 03:19:53 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 22:19:53 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <5.1.0.14.0.20021029184304.02668850@coeimap2.uncc.edu> Message-ID: On Tue, 29 Oct 2002, Rodney M Dyer wrote: > >I don't think that's clear, but I can tell you I certainly don't have the > >time to care. > > Just on the side, my colleagues and I think it's funny that you say > this. Are you paid as an OpenAFS help desk person? I have 2 jobs, some percent of one of them is devoted to OpenAFS issues and the other is also OpenAFS related. > You seem to have > enough time to respond to just about everything that hits this list. Do > you ever have time for anything else? ;) Some. > I can only hope my sting was "mostly harmless", but it was intended to draw > out comments on just what is going on in the group relative to Windows > support. A lot, but not coherently organized. Perhaps that is part of the problem. > that someone is pony'ing up for support. But, is the version that Morgan > Stanley using available as open source? Can anyone get a copy of it? Is > it a forked version of OpenAFS? What is different about it? How much > would it cost us? It's not (apparently) forked OpenAFS, we got patches from Morgan Stanley for the real OpenAFS windows client (the incident is still open in the openafs-bugs queue) > glue everything together as a working unit. It all works great except now > we are having trouble weaning ourselves away from the kaserver. Seems the > Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" > daemon. This wouldn't be a problem except that it is a real annoyance for > our users to "kinit" then "aklog" at the command line by hand. And, we're > having problems with "aklog" behind a NAT router for some reason I can't > fathom (yes, we've tried addressless tickets). I suppose replacing kinit with one that does aklog is right out? We (OpenAFS) are going to have to deal with this in the near future to support the Kerberos 5 bridge proposal support which is actually expected to be useful (though not mandatory) in 1.2.8. From nneul@umr.edu Wed Oct 30 03:23:15 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 29 Oct 2002 21:23:15 -0600 Subject: [OpenAFS] cache performance In-Reply-To: <200210291906.33440.barrows@email.arc.nasa.gov> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <15807.5072.52967.812237@zappa.ms.com> <1035932935.1333.9.camel@cessna.rollanet.org> <200210291906.33440.barrows@email.arc.nasa.gov> Message-ID: <1035948195.2105.8.camel@cessna.rollanet.org> The cache manager is part of the client. So, yes, it is contacted. As long as a callback is still present with the server, there shouldn't be any communication with the file server. So, one possible solution would be a cache manager debug set (fs setset) that had a very minimal amount of logging generated - to where you could reasonably run fstrace regularly on clients. i.e. not a full bore - every access, just file opens. -- Nathan On Tue, 2002-10-29 at 21:06, Lester Barrows wrote: > Whenever a file is accessed on the client, I believe it contacts the cache > manager to ensure that it hasn't changed. Perhaps the cache manager, rather > than the file server, would be the most authoritative place to collect this > information. > > Regards, > Lester Barrows > > On Tuesday 29 October 2002 03:08 pm, Nathan Neulinger wrote: > > What sort of additional logging are you looking for in the file server? > > > > Also, how do you plan on handling the "if it's already in the cache, the > > file server probably won't see a request" issue? > > > > Adding more logging is relatively easy to do, just come up with a list. > > > > -- Nathan > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From Warren.Yenson@morganstanley.com Wed Oct 30 03:44:03 2002 From: Warren.Yenson@morganstanley.com (Warren.Yenson@morganstanley.com) Date: Tue, 29 Oct 2002 22:44:03 -0500 (EST) Subject: [OpenAFS] cache performance In-Reply-To: <1035948195.2105.8.camel@cessna.rollanet.org> Message-ID: > On Tue, 2002-10-29 at 21:06, Lester Barrows wrote: > > Whenever a file is accessed on the client, I believe it contacts the cache > > manager to ensure that it hasn't changed. Perhaps the cache manager, rather > > than the file server, would be the most authoritative place to collect this > > information. On 29 Oct 2002, Nathan Neulinger wrote: > The cache manager is part of the client. So, yes, it is contacted. > > As long as a callback is still present with the server, there shouldn't > be any communication with the file server. > > So, one possible solution would be a cache manager debug set (fs setset) > that had a very minimal amount of logging generated - to where you could > reasonably run fstrace regularly on clients. i.e. not a full bore - > every access, just file opens. The problem that Phil alludes to is not to get the most short term, up-to-date information, but over the course of a day, to get the access times of all volumes accessed by the client. Since callbacks are 30 minutes for read-write files, and 2 hours (or thereabouts) for read-only volumes, surely the client will contact the server sometime during the 24 hour period we are interested in. As the callback expires, the client has to send a FetchStatus to renew / extend the callback, which the server can record. This is why Phil would like that fact recorded in the server. This is still more authoratative for our purposes as there number of clients is in the order of thousands (to tens of thousands) but the number of servers is in the low hundreds. We also control the builds on the servers much, much more tightly, and can ensure that the audits run and complete successfully. From nneul@umr.edu Wed Oct 30 04:06:01 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 29 Oct 2002 22:06:01 -0600 Subject: [OpenAFS] cache performance In-Reply-To: References: Message-ID: <1035950760.2105.52.camel@cessna.rollanet.org> On Tue, 2002-10-29 at 21:44, Warren.Yenson@morganstanley.com wrote: > > On Tue, 2002-10-29 at 21:06, Lester Barrows wrote: > > > Whenever a file is accessed on the client, I believe it contacts the cache > > > manager to ensure that it hasn't changed. Perhaps the cache manager, rather > > > than the file server, would be the most authoritative place to collect this > > > information. > > On 29 Oct 2002, Nathan Neulinger wrote: > > The cache manager is part of the client. So, yes, it is contacted. > > > > As long as a callback is still present with the server, there shouldn't > > be any communication with the file server. > > > > So, one possible solution would be a cache manager debug set (fs setset) > > that had a very minimal amount of logging generated - to where you could > > reasonably run fstrace regularly on clients. i.e. not a full bore - > > every access, just file opens. > > The problem that Phil alludes to is not to get the most short term, > up-to-date information, but over the course of a day, to get the access > times of all volumes accessed by the client. > > Since callbacks are 30 minutes for read-write files, and 2 hours (or > thereabouts) for read-only volumes, surely the client will contact the > server sometime during the 24 hour period we are interested in. As the > callback expires, the client has to send a FetchStatus to renew / extend > the callback, which the server can record. This is why Phil would like > that fact recorded in the server. Ah, well that seems simple enough. I think it would be relatively trivial to add additional standard logging to the file server, although I wonder if a Rx based logging mechanism similar to fstrace might be more useful. Thoughts? > This is still more authoratative for our purposes as there number of > clients is in the order of thousands (to tens of thousands) but the number > of servers is in the low hundreds. We also control the builds on the > servers much, much more tightly, and can ensure that the audits run and > complete successfully. Out of curiosity, would y'all be willing to share some details of your architecture? -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From shadow@dementia.org Wed Oct 30 04:05:54 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Tue, 29 Oct 2002 23:05:54 -0500 (EST) Subject: [OpenAFS] cache performance In-Reply-To: <1035950760.2105.52.camel@cessna.rollanet.org> Message-ID: On 29 Oct 2002, Nathan Neulinger wrote: > Ah, well that seems simple enough. I think it would be relatively > trivial to add additional standard logging to the file server, although > I wonder if a Rx based logging mechanism similar to fstrace might be > more useful. I've been pondering this for a while, for other reasons. From security@xauth.net Wed Oct 30 04:10:09 2002 From: security@xauth.net (Charles Clancy) Date: Tue, 29 Oct 2002 22:10:09 -0600 (CST) Subject: [OpenAFS] Authentication weirdness In-Reply-To: <3DBEB959.5050108@mvpsoft.com> Message-ID: On Tue, 29 Oct 2002, Chris Snyder wrote: > As I said in a previous email to this list, I'm trying to get Apache to > do authentication using AFS. I installed the mod_auth_external module, > along with the pwauth program, which is PAM-aware. It works fine when I > try pwauth from the command line as root, returning 0 when the username > and password are correct. However, when I try to run it as any other > user, with pwauth suid, it fails, returning an error code of 1. I've found pwauth to be extremely flaky. When you have apache call a script call a program call PAM call a module call Kerberos to do the authentication, things are bound to go wrong. Try calling the attached program directly from Apache. (Make sure /usr/kerberos/lib is in Apache's LD_LIBRARY_PATH). [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] ------------------ begin krb5check.c ----------------------- /********************************************************** krb5check -- Accepts two lines of STDIN representing a username and a password. Authenticates them against a Kerberos 5 server, and returns 0 if successful. NOTE: can specify username@REALM for username if you want To compile: gcc -I/usr/kerberos/include -c -o krb5check.o krb5check.c gcc -L/usr/kerberos/lib -o krb5check krb5check.o -lkrb5 -lcrypto (of course, add -lxnet on Solaris) Tested: RedHat 7.3, Solaris 8 Author: Charles Clancy, tclancy@uiuc.edu **********************************************************/ #include "krb5.h" #include krb5_data tgtname = { 0, KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME }; int krb5_check_password(char *username, char *password) { krb5_context kcontext; krb5_creds my_creds; memset((char*)&my_creds, 0, sizeof(my_creds)); if (krb5_init_context(&kcontext)) return 1; if (krb5_parse_name (kcontext, username, &(my_creds.client))) return 1; if (krb5_build_principal_ext(kcontext, &my_creds.server, krb5_princ_realm(kcontext, my_creds.client)->length, krb5_princ_realm(kcontext, my_creds.client)->data, tgtname.length, tgtname.data, krb5_princ_realm(kcontext, my_creds.client)->length, krb5_princ_realm(kcontext, my_creds.client)->data, 0)) return 1; if (krb5_get_in_tkt_with_password(kcontext, 0, (krb5_address **)0, NULL, NULL, password, NULL, &my_creds, 0)) return 1; return 0; } int main(void) { int r; char username[256], password[256]; memset(username, 0, 256); memset(password, 0, 256); fgets(username, 255, stdin); username[strlen(username)-1]=0; /* chomp! */ fgets(password, 255, stdin); password[strlen(password)-1]=0; /* chomp! */ r=krb5_check_password(username, password); memset(password, 0, 256); if (r) fprintf(stderr, "auth failure for %s.\n",username); else fprintf(stderr, "auth successful for %s.\n",username); return r; } From security@xauth.net Wed Oct 30 04:28:15 2002 From: security@xauth.net (Charles Clancy) Date: Tue, 29 Oct 2002 22:28:15 -0600 (CST) Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: <7g4rb54i6d.fsf@faeppc20.tu-graz.ac.at> Message-ID: > I do not even get the TGT if I authenticate to xlock | xscreensaver. I > have the following lines in my /etc/pam.d/system-auth: > > ... > auth sufficient /lib/security/pam_krb5afs.so debug tokens forwardable use_first_pass > ... > session optional /lib/security/pam_openafs_session.so > ... > > I tried it with pam_krb5.so as well: > auth sufficient /lib/security/pam_krb5.so debug forwardable use_first_pass > > It never does renew my TGT. klist befor and after xlock show the same > expiration times for it. Maybe try adding "reuse_ccache" as an option to pam_krb5. I'm not entirely sure -- I've not played with pam_krb5 nearly as much as pam_afs. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] From tino.schwarze@informatik.tu-chemnitz.de Wed Oct 30 08:04:47 2002 From: tino.schwarze@informatik.tu-chemnitz.de (Tino Schwarze) Date: Wed, 30 Oct 2002 09:04:47 +0100 Subject: [OpenAFS] Authentication weirdness In-Reply-To: <3DBEB959.5050108@mvpsoft.com>; from csnyder@mvpsoft.com on Tue, Oct 29, 2002 at 11:37:45AM -0500 References: <3DBEB959.5050108@mvpsoft.com> Message-ID: <20021030090447.A25242@informatik.tu-chemnitz.de> On Tue, Oct 29, 2002 at 11:37:45AM -0500, Chris Snyder wrote: > As I said in a previous email to this list, I'm trying to get Apache to > do authentication using AFS. Is there any reason that the modified mod_auth_pam available at /afs/tu-chemnitz.de/openafs/AddOn/mod_auth_pam/ does not work for you? Bye, Tino. -- * LINUX - Where do you want to be tomorrow? * http://www.tu-chemnitz.de/linux/tag/ From flash@itp.tu-graz.ac.at Wed Oct 30 11:38:58 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 30 Oct 2002 12:38:58 +0100 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: References: Message-ID: <7g3cqokvfx.fsf@faeppc20.tu-graz.ac.at> Charles Clancy writes: > > I do not even get the TGT if I authenticate to xlock | xscreensaver. I > > have the following lines in my /etc/pam.d/system-auth: > > > > ... > > auth sufficient /lib/security/pam_krb5afs.so debug tokens forwardable use_first_pass > > ... > > session optional /lib/security/pam_openafs_session.so > > ... > > > > I tried it with pam_krb5.so as well: > > auth sufficient /lib/security/pam_krb5.so debug forwardable use_first_pass > > > > It never does renew my TGT. klist befor and after xlock show the same > > expiration times for it. > > Maybe try adding "reuse_ccache" as an option to pam_krb5. I'm not > entirely sure -- I've not played with pam_krb5 nearly as much as pam_afs. > There does not exist a "reuse_ccache" option for pam_krb5. Yesterday I did take some time and hacked a "refresh_token" option into pam_krb5afs. Once it is tested i will forward my changes to the pam_krb5 maintainer. Thanks for your help. Christian -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg From maldrich@reserveamerica.com Wed Oct 30 12:06:33 2002 From: maldrich@reserveamerica.com (Michael Aldrich) Date: Wed, 30 Oct 2002 07:06:33 -0500 Subject: [OpenAFS] Multiple Cells In-Reply-To: References: Message-ID: <200210300706.33457.maldrich@reserveamerica.com> Three different DMZ networks, each seperated by their own firewalls. Thanks again Mike > On Tue, 29 Oct 2002, Michael Aldrich wrote: > > Thanks for the info. Is it possible to share a single AFS cell betwee= n > > three subnets? > > Explain what you mean. We share our AFS cell with the entire world > (all the subnets;-) leading me to believe I'm misreading your question. > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info From excds@kth.se Wed Oct 30 12:42:32 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 30 Oct 2002 13:42:32 +0100 Subject: [OpenAFS] Mounting other filesystems within afs Message-ID: <1035981752.603.5.camel@hybris> Is it possible to "export" another network filesystem via afs? i.e. Would it be possible to use ncpmount on the fileserver and exporting Novell directories with afs? Is it also possible to mount a CD on the fileserver and export its contents? /Daniel From warlord@MIT.EDU Wed Oct 30 13:29:01 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 30 Oct 2002 08:29:01 -0500 Subject: [OpenAFS] Mounting other filesystems within afs In-Reply-To: <1035981752.603.5.camel@hybris> References: <1035981752.603.5.camel@hybris> Message-ID: No. -derek Daniel Sw=E4rd writes: > Is it possible to "export" another network filesystem via afs? >=20 > i.e. Would it be possible to use ncpmount on the fileserver and > exporting Novell directories with afs? >=20 > Is it also possible to mount a CD on the fileserver and export its > contents? >=20 > /Daniel >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From tomed@barq.itsco.com Wed Oct 30 13:58:05 2002 From: tomed@barq.itsco.com (Tom Ed White) Date: Wed, 30 Oct 2002 08:58:05 -0500 (EST) Subject: [OpenAFS] Two windows client questions Message-ID: <59779.198.89.32.79.1035986285.squirrel@barq.itsco.com> Question number one: Windows client AFS versions are running behind Unix fileserver AFS versions. Is it okay to have a mismatch, ie UNC's 1.2.6 windows client accessing a 1.2.7 Linux fileserver? Question number two: I've been playing around with Rose-Hulman's WAKE frontend for managing logins and AFS/Kerberos 5 compatibility on Windows clients. To me, it seems pretty slick, especially if you're forced to use a W2K DC as a KDC. Any caveats with this app? Any recommended alternatives? Thanks, Tom Ed White From warlord@MIT.EDU Wed Oct 30 14:07:57 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 30 Oct 2002 09:07:57 -0500 Subject: [OpenAFS] Two windows client questions In-Reply-To: <59779.198.89.32.79.1035986285.squirrel@barq.itsco.com> References: <59779.198.89.32.79.1035986285.squirrel@barq.itsco.com> Message-ID: "Tom Ed White" writes: > Question number one: > > Windows client AFS versions are running behind Unix fileserver AFS > versions. Is it okay to have a mismatch, ie UNC's 1.2.6 windows client > accessing a 1.2.7 Linux fileserver? This level of "mismatch" should be fine. The only time you really want to be running "the same version" is across servers. > Question number two: > > I've been playing around with Rose-Hulman's WAKE frontend for managing > logins and AFS/Kerberos 5 compatibility on Windows clients. To me, it > seems pretty slick, especially if you're forced to use a W2K DC as a KDC. > Any caveats with this app? Any recommended alternatives? I've never used this software, so I have no opinion. > Thanks, > Tom Ed White -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From nneul@umr.edu Wed Oct 30 14:13:34 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 30 Oct 2002 08:13:34 -0600 Subject: [OpenAFS] Mounting other filesystems within afs Message-ID: Ordinarily, no. But if you're brave there is a very-alpha file server = (not included with openafs) that does this.=20 I don't remember where it is though.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Daniel Sw=E4rd [mailto:excds@kth.se]=20 > Sent: Wednesday, October 30, 2002 6:43 AM > To: openafs > Subject: [OpenAFS] Mounting other filesystems within afs >=20 >=20 > Is it possible to "export" another network filesystem via afs? >=20 > i.e. Would it be possible to use ncpmount on the fileserver and > exporting Novell directories with afs? >=20 > Is it also possible to mount a CD on the fileserver and export its > contents? >=20 > /Daniel >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From Phil.Moore@morganstanley.com Wed Oct 30 14:13:47 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Wed, 30 Oct 2002 09:13:47 -0500 Subject: [OpenAFS] cache performance In-Reply-To: <1035950760.2105.52.camel@cessna.rollanet.org> References: <1035950760.2105.52.camel@cessna.rollanet.org> Message-ID: <15807.59675.786996.757737@zappa.ms.com> >>>>> "Nathan" == Nathan Neulinger writes: Warren> This is still more authoratative for our purposes as there number of Warren> clients is in the order of thousands (to tens of thousands) but the number Warren> of servers is in the low hundreds. We also control the builds on the Warren> servers much, much more tightly, and can ensure that the audits run and Warren> complete successfully. Nathan> Out of curiosity, would y'all be willing to share some details Nathan> of your architecture? Actually, I have, several times. At LISA 95, Decorum 97, and several other conference keynote presentations I've given. Let me see if I can't dredge up something and post it for external consumption this week. We're huge. By many metrics, the largest AFS shop on the planet, but not the traditional metrics that are associated with scale. We probably have less data, fewer clients, and fewer servers than many big engineering sites, but we have realtime mission critical dependencies on AFS for nearly *ALL* production applications on UNIX (and against my better judgement, soon Windoze as well), and when AFS stops working, our business grinds to a halt. I'll have more to say on this when I finish my coffee.... From excds@kth.se Wed Oct 30 14:17:12 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 30 Oct 2002 15:17:12 +0100 Subject: [OpenAFS] Mounting other filesystems within afs In-Reply-To: References: <1035981752.603.5.camel@hybris> Message-ID: <1035987432.599.11.camel@hybris> That's a bit of a shortcoming isn't it? Oh well, I guess I'll just have to set up the clients to do that instead. :-(( /Daniel On Wed, 2002-10-30 at 14:29, Derek Atkins wrote: > No. >=20 > -derek >=20 > Daniel Sw=E4rd writes: >=20 > > Is it possible to "export" another network filesystem via afs? > >=20 > > i.e. Would it be possible to use ncpmount on the fileserver and > > exporting Novell directories with afs? > >=20 > > Is it also possible to mount a CD on the fileserver and export its > > contents? > >=20 > > /Daniel From excds@kth.se Wed Oct 30 14:19:58 2002 From: excds@kth.se (Daniel =?ISO-8859-1?Q?Sw=E4rd?=) Date: 30 Oct 2002 15:19:58 +0100 Subject: [OpenAFS] Mounting other filesystems within afs In-Reply-To: References: Message-ID: <1035987598.603.15.camel@hybris> On Wed, 2002-10-30 at 15:13, Neulinger, Nathan wrote: > Ordinarily, no. But if you're brave there is a very-alpha file server (not included with openafs) that does this. Since I'm not entirely sure of how afs works I'll probably continue being a coward a while longer... ;-) /Daniel From security@xauth.net Wed Oct 30 14:22:25 2002 From: security@xauth.net (Charles Clancy) Date: Wed, 30 Oct 2002 08:22:25 -0600 (CST) Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: <7g3cqokvfx.fsf@faeppc20.tu-graz.ac.at> Message-ID: > There does not exist a "reuse_ccache" option for pam_krb5. The official version 1.0 from Frank Cusack's website (http://fcusack.com/) has that option. > Yesterday I did take some time and hacked a "refresh_token" option > into pam_krb5afs. Once it is tested i will forward my changes to the > pam_krb5 maintainer. Sounds good. [ t charles clancy ]--[ tclancy@uiuc.edu ]--[ www.uiuc.edu/~tclancy ] [ crypto ]---[ coordinated science lab ]---[ university of illinois ] From Phil.Moore@morganstanley.com Wed Oct 30 14:23:21 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Wed, 30 Oct 2002 09:23:21 -0500 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <5.1.0.14.0.20021029184304.02668850@coeimap2.uncc.edu> References: <5.1.0.14.0.20021029111920.02693eb0@coeimap2.uncc.edu> <5.1.0.14.0.20021029184304.02668850@coeimap2.uncc.edu> Message-ID: <15807.60249.790795.678833@zappa.ms.com> >>>>> "Rodney" == Rodney M Dyer writes: Rodney> I'm glad to hear from Mr. Phil Moore at Morgan Stanley. Please... Just "Phil". That sounds so.... official. Rodney> I'm glad to hear that someone is pony'ing up for support. Rodney> But, is the version that Morgan Stanley using available as Rodney> open source? Can anyone get a copy of it? Is it a forked Rodney> version of OpenAFS? What is different about it? How much Rodney> would it cost us? We use the same source code from openafs.org as everyone else. The only thing special is that we might get to run critical bug fixes before everyone else, since we get Sine Nomine to fix our problems (which they have been outstanding at) and provide us with the fixes first. But *everything* Sine Nomine does for us gets rolled back into the CVS tree for openafs, and eventually finds it way intto your systems when you upgrade. Not only are we working closely with Sine Nomine to get bugs fixed, we also contribute some of our own fixes (our staff recently submitted several small patches for the Windoze client, for example). In addition, not only are we paying for support, we seperately contract for significant enhancements to the product, for new functionality that we need to make our environment more manageable. In all cases, the changes made on our behalf get rolled into the CVS tree. We do NOT under any circumstances want to be running a "special" version of the OpenAFS product. To do so would be a strategic mistep of the worts kind. We are able to leverage Open Source software precisely because many others use the same code base, and we benefit from bug fixes and enhancements by doing so. Running a special version would reduce or eliminate our ability to benefit from such leverage. From Todd_Lewis@unc.edu Wed Oct 30 14:31:01 2002 From: Todd_Lewis@unc.edu (Todd M. Lewis) Date: Wed, 30 Oct 2002 09:31:01 -0500 Subject: [OpenAFS] cache performance References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> <15807.5072.52967.812237@zappa.ms.com> Message-ID: <3DBFED25.5060608@email.unc.edu> Okay, it's starting to sink in now. I tend to think of us as a largish AFS shop because we have lots of users, but we aren't physically distributed (all our servers are in one room I believe) and we're more concerned with monitoring individual application use rather than volume use (though they are closely related in most cases). I look forward to seeing what you come up with. Sounds like anything that makes managing AFS easier on your scale is probably going to scale down in a way that's useful to the rest of us. Good luck. Phil.Moore@morganstanley.com wrote: > I'm not concerned about the performance overhead, I'm concerned about > the management overhead.... > > What I'm after is a near-complete (I'll take 90-95%) audit of the > usage of my AFS volumes. Your approach would not scale in an > environment as large as ours, simply because of the diversity of apps > we have, and the global nature of our client base. > > The AFS infrastructure is *THE* place to deploy production apps, and > we have 1000's of distinct applications (managed by lots of distinct > groups), running on lots of different platforms, all of which would > have to be wrapped in some fashion. That's a gargantuan task to begin > with. > > Therefore, we're going to focus our energy on server-based auditing > that will meet these needs. Hopefully, if we do it right, you'll just > have to upgrade to the latest OpenAFS server code, and get this new > feature for free. > > Everything we fund for OpenAFS is contributed back to the code base; > we don't do Morgan Stanley specials (been there, done that, paid > millions to undo it). -- +----------------------------------------------------------------+ / Todd_Lewis@unc.edu http://www.unc.edu/~utoddl / /(919) 962-5273 Linux - It's now safe to turn on your computer. / +----------------------------------------------------------------+ From J Michael Mosley Wed Oct 30 14:59:49 2002 From: J Michael Mosley (J Michael Mosley) Date: Wed, 30 Oct 2002 09:59:49 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k Message-ID: <200210301459.g9UExo412840@ms-sm2.uncc.edu> > > Rodney, it seems to me like it would be trivial to have kinit call aklog > after it's gotten you a TGT. Didn't you even consider trying that? And > have you heard the phrase, "If you're not part of the solution, you're > part of the problem?" > I think some clarification is needed here. We HAVE implemented a kinit/aklog solution on the 600 or so clients (Solaris, Windos XP, Linux) we control. Unfortunately, we have have a lot of folks that manage their own machines (so to speak :-)) who access our cell. We were trying to continue to support them seamlessly by using fakeka and ka-forwarder. The plan worked well for the non-Windows clients but unfortunately we didn't take into account that fakeka/ka-forwarder only supports RX. Right now we seem to have 2 choices: A) Hack fakeka and ka-forwarder to support K4 so that the Windows klog will work or B) Educate and convince the folks that fall into this group to install K5 and aklog. Of course, we are open to other ideas as well. > > Rodney, it seems to me like it would be trivial to have kinit call aklog > after it's gotten you a TGT. Didn't you even consider trying that? And > have you heard the phrase, "If you're not part of the solution, you're > part of the problem?" > ------------------------------------- Mike Mosley Email: jmmosley@uncc.edu Systems Software Developer Phone: (704) 687-3522 College of Engineering, UNC-Charlotte Fax: (704) 687-2352 From slack@quackmaster.net Wed Oct 30 15:15:37 2002 From: slack@quackmaster.net (Jack Neely) Date: Wed, 30 Oct 2002 10:15:37 -0500 Subject: [OpenAFS] volserver caused ext3 oops? Message-ID: <20021030101537.E2235@anduril.pams.ncsu.edu> --H+4ONPRPur6+Ovig Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Folks, I'm doing some early testing of using Linux and OpenAFS servers in our environment of all solaris based, transarc servers. We set up a script to do some pounding on by moving a 500MB volume back and forth between it and another server. At 4:00 in the morning looks like volserver caused a kernel oops in the ext3 code. (Which I found to be really weird.) Can anyone shed some light on what might be up here? We are running OpenAFS 1.2.7 on a Red Hat Linux 7.3-ish system, kernel 2.4.18-10. Thanks! Jack Neely -- Jack Neely Linux Realm Kit Administration and Development PAMS Computer Operations at NC State University GPG Fingerprint: 1917 5AC1 E828 9337 7AA4 EA6B 213B 765F 3B6A 5B89 --H+4ONPRPur6+Ovig Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename=openafs-server-oops Oct 30 03:55:45 linux00f kernel: Unable to handle kernel paging request at virtual address 00c782c1 Oct 30 03:55:45 linux00f kernel: printing eip: Oct 30 03:55:45 linux00f kernel: c013a166 Oct 30 03:55:45 linux00f kernel: *pde = 00000000 Oct 30 03:55:45 linux00f kernel: Oops: 0000 Oct 30 03:55:45 linux00f kernel: binfmt_misc openafs autofs 3c59x ide-cd cdrom ext3 jbd Oct 30 03:55:45 linux00f kernel: CPU: 0 Oct 30 03:55:45 linux00f kernel: EIP: 0010:[] Tainted: P Oct 30 03:55:45 linux00f kernel: EFLAGS: 00010206 Oct 30 03:55:45 linux00f kernel: Oct 30 03:55:45 linux00f kernel: EIP is at get_hash_table [kernel] 0x66 (2.4.18-10) Oct 30 03:55:45 linux00f kernel: eax: c9ff0000 ebx: 00000001 ecx: c782bd49 edx: 00c782bd Oct 30 03:55:45 linux00f kernel: esi: 00268298 edi: 00000341 ebp: 0000000d esp: c64d5e18 Oct 30 03:55:45 linux00f kernel: ds: 0018 es: 0018 ss: 0018 Oct 30 03:55:45 linux00f kernel: Process volserver (pid: 1310, stackpage=c64d5000) Oct 30 03:55:45 linux00f kernel: Stack: 00001c94 00000000 00001000 00001000 00000000 c013adcb 00000341 00268298 Oct 30 03:55:45 linux00f kernel: 00001000 0000000c 00001000 c013b10e c7196080 00000000 c013b12f c2a4ada0 Oct 30 03:55:45 linux00f kernel: c2a4ada0 c96dc000 c64d5e70 00001000 0000008b c2a4ada0 000000f0 00000014 Oct 30 03:55:46 linux00f kernel: Call Trace: [] unmap_underlying_metadata [kernel] 0x1b Oct 30 03:55:46 linux00f kernel: [] __block_prepare_write [kernel] 0x11e Oct 30 03:55:46 linux00f kernel: [] __block_prepare_write [kernel] 0x13f Oct 30 03:55:46 linux00f kernel: [] .rodata.str1.1 [jbd] 0x30 Oct 30 03:55:46 linux00f kernel: [] __jbd_kmalloc [jbd] 0x27 Oct 30 03:55:46 linux00f kernel: [] block_prepare_write [kernel] 0x22 Oct 30 03:55:46 linux00f kernel: [] ext3_get_block [ext3] 0x0 Oct 30 03:55:46 linux00f kernel: [] ext3_prepare_write [ext3] 0x7e Oct 30 03:55:46 linux00f kernel: [] ext3_get_block [ext3] 0x0 Oct 30 03:55:46 linux00f kernel: [] generic_file_write [kernel] 0x4ee Oct 30 03:55:46 linux00f kernel: [] ext3_file_write [ext3] 0x22 Oct 30 03:55:46 linux00f kernel: [] sys_write [kernel] 0x96 Oct 30 03:55:46 linux00f kernel: [] sys_getitimer [kernel] 0x21 Oct 30 03:55:46 linux00f kernel: [] sys_time [kernel] 0x12 Oct 30 03:55:46 linux00f kernel: [] system_call [kernel] 0x33 Oct 30 03:55:46 linux00f kernel: Oct 30 03:55:46 linux00f kernel: Oct 30 03:55:46 linux00f kernel: Code: 39 72 04 89 d1 75 f3 0f b7 42 08 3b 44 24 20 75 e9 66 39 7a --H+4ONPRPur6+Ovig-- From david.bear@asu.edu Tue Oct 29 20:44:39 2002 From: david.bear@asu.edu (David Bear) Date: Tue, 29 Oct 2002 13:44:39 -0700 Subject: [OpenAFS] afsd dying on win2k In-Reply-To: References: Message-ID: <200210291344.39361.iddwb@moroni.pp.asu.edu> afs service seems to die whenever a windows logon occurs. I can set tcpd= ump=20 to capture everything on a separate machine if this is what is wanted. S= ince=20 I can reproduce this at will, it shouldn't be too hard to limit the size = of=20 the dump file. =20 To whom should I send it? On 2002 10 29 09:57, Derrick J Brashear wrote: > On Tue, 29 Oct 2002, Rodney M Dyer wrote: > > From the looks of it, I don't think anything is going to be done abo= ut > > the problem since no one on the OpenAFS group cares anything about > > Windoz... > > I don't think that's clear, but I can tell you I certainly don't have t= he > time to care. I know a couple of people who probably care, but I'm not > going to out them; They're welcome to comment themselves or not, and I > have no idea if they can, or have the time, to look into this. > > I don't suppose anyone has an actual recipe for reproducing this, or is > this one of those deals where someone should pray that their network is > the same as yours? > > (Yes, now I'm being sarcastic. How about attaching a hub and a machine > with tcpdump next to a dying client and seeing what's going on as close= to > when it dies as possible?) > > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info --=20 David Bear College of Public Programs/ASU From cameron@ctcnsc.org Wed Oct 30 01:32:50 2002 From: cameron@ctcnsc.org (Frank J. Cameron) Date: 29 Oct 2002 20:32:50 -0500 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #879 - 12 msgs In-Reply-To: <20021029163102.65D9A9D7C@grand.central.org> References: <20021029163102.65D9A9D7C@grand.central.org> Message-ID: <1035941569.1522.12.camel@localhost.localdomain> This doesn't help with the crashing (although frequent crashes have not been my experience with the AFS client on Windows). But, since about patch 3 Transarc installs a utility that allows non administrators to start and stop the service. After installation run this as admin: afsdacl -set Now, normal users can net stop/start the afs service. (This utility, though not included with OpenAFS to my knowledge, works with OpenAFS.) > Date: Mon, 28 Oct 2002 16:10:08 -0700 > From: David Bear > To: afsl > Reply-To: david.bear@asu.edu > Subject: [OpenAFS] afsd dying on win2k > > started or stopped. So, we open a command window, issue=20 > 'net stop "IBM AFS Client"' > > and then as soon as that completes, issue > 'net start "IBM AFS Client"' > > This has to be done with admin priveledge. After completing these comman= > d,=20 > afs works fine. klog gets tokens. the gui gets tokens. Drive maps work= > =2E =20 > > The problem here is twofold > 1) we shouldn't have to do this > 2) you have to have admin priveledge to restart the service. From flash@itp.tu-graz.ac.at Wed Oct 30 15:41:55 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 30 Oct 2002 16:41:55 +0100 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: References: Message-ID: <7gvg3kj5mk.fsf@faeppc20.tu-graz.ac.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Charles Clancy writes: > > There does not exist a "reuse_ccache" option for pam_krb5. > > The official version 1.0 from Frank Cusack's website (http://fcusack.com/) > has that option. > This is probably the reason why i couldn't find it ;-). I have been using pam_krb5-1.56 from RH. Christian - -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Processed by Mailcrypt 3.5.7 iD8DBQE9v/14zNp7/ndBhMQRAm9VAJ0Z6iSoh7v+v7SDunK+su+MKzPHFACfR3gK Dt8jYPdWJFhYK1c9s4ta5mo= =AfkK -----END PGP SIGNATURE----- From shadow@dementia.org Wed Oct 30 15:40:15 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 10:40:15 -0500 (EST) Subject: [OpenAFS] Multiple Cells In-Reply-To: <200210300706.33457.maldrich@reserveamerica.com> Message-ID: On Wed, 30 Oct 2002, Michael Aldrich wrote: > Three different DMZ networks, each seperated by their own firewalls. It depends on what traffic you pass, and how, and the address space you use, then. The AFSLore wiki on www.openafs.org should have the answers. From shadow@dementia.org Wed Oct 30 15:44:53 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 10:44:53 -0500 (EST) Subject: [OpenAFS] afsd dying on win2k In-Reply-To: <200210301459.g9UExo412840@ms-sm2.uncc.edu> Message-ID: On Wed, 30 Oct 2002, J Michael Mosley wrote: > Right now we seem to have 2 choices: > > A) Hack fakeka and ka-forwarder to support K4 so that the Windows klog will work You'll need to issue addressless tickets, and even then I think there's an issue I'm forgetting. From shadow@dementia.org Wed Oct 30 15:47:35 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 10:47:35 -0500 (EST) Subject: [OpenAFS] volserver caused ext3 oops? In-Reply-To: <20021030101537.E2235@anduril.pams.ncsu.edu> Message-ID: On Wed, 30 Oct 2002, Jack Neely wrote: > Folks, > > I'm doing some early testing of using Linux and OpenAFS servers in our > environment of all solaris based, transarc servers. We set up a script > to do some pounding on by moving a 500MB volume back and forth between > it and another server. At 4:00 in the morning looks like volserver > caused a kernel oops in the ext3 code. (Which I found to be really > weird.) > > Can anyone shed some light on what might be up here? It looks like a pretty boring "not our fault" crash; I can't say I've seen such before. Particularly, I can't see how "caused" could be anything other than "happened to be the process that lost since it was the heaviest thing exercising the subsystem." > We are running OpenAFS 1.2.7 on a Red Hat Linux 7.3-ish system, kernel > 2.4.18-10. From shadow@dementia.org Wed Oct 30 15:58:45 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 10:58:45 -0500 (EST) Subject: [OpenAFS] Mounting other filesystems within afs In-Reply-To: <1035987432.599.11.camel@hybris> Message-ID: On 30 Oct 2002, Daniel [ISO-8859-1] Swärd wrote: > That's a bit of a shortcoming isn't it? No, it's not the model. Central servers have your data, not random machines in the field that you re-export from. > > Daniel Swärd writes: > > > > > Is it possible to "export" another network filesystem via afs? > > > > > > i.e. Would it be possible to use ncpmount on the fileserver and > > > exporting Novell directories with afs? > > > > > > Is it also possible to mount a CD on the fileserver and export its > > > contents? > > > > > > /Daniel > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From Phil.Moore@morganstanley.com Wed Oct 30 16:44:51 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Wed, 30 Oct 2002 11:44:51 -0500 Subject: [OpenAFS] cache performance In-Reply-To: <3DBFED25.5060608@email.unc.edu> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> <15807.5072.52967.812237@zappa.ms.com> <3DBFED25.5060608@email.unc.edu> Message-ID: <15808.3203.677721.915585@zappa.ms.com> >>>>> "Todd" == Todd M Lewis writes: Todd> Okay, it's starting to sink in now. I tend to think of us as a Todd> largish AFS shop because we have lots of users, but we aren't Todd> physically distributed (all our servers are in one room I Todd> believe) and we're more concerned with monitoring individual Todd> application use rather than volume use (though they are closely Todd> related in most cases). "Scale" is a very misunderstood concept. Its a mutli-variable space, and you have to be specific about which particular variables are large in any given environment. In fact, I've got a slide that discussed "scale", and what we mean by it, in virtually every talk I've given in the last 10 years. Todd> I look forward to seeing what you come up with. Sounds like Todd> anything that makes managing AFS easier on your scale is Todd> probably going to scale down in a way that's useful to the rest Todd> of us. Good luck. Well, we do try to make our utilities scale down as well as up, becuase we have to support small sites, as well as large ones. For example, I have to architect a campus design for our large MANs, supporting 1000's of machines, but we also need that same architecture to scale down to the small sites, where hosts number on the 10's, not 1000's. From pittmed@pittmed.pitt.edu Wed Oct 30 16:51:58 2002 From: pittmed@pittmed.pitt.edu (Computers in Medicine) Date: Wed, 30 Oct 2002 11:51:58 -0500 Subject: [OpenAFS] Patch for OpenAFS 1.2.7 Message-ID: <006a01c28034$a9c6fbc0$0280000a@pelican> This is a multi-part message in MIME format. ------=_NextPart_000_0067_01C2800A.C085FCF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I would greatly appreciate it if someone would send me the patch to make = OpenAFS 1.2.7 compatible with kernel 2.4.18-17, or post it somewhere. = Thanks. ------=_NextPart_000_0067_01C2800A.C085FCF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I would greatly appreciate it = if someone=20 would send me the patch to make OpenAFS 1.2.7 compatible with kernel = 2.4.18-17,=20 or post it somewhere.  Thanks.
 
------=_NextPart_000_0067_01C2800A.C085FCF0-- From shadow@dementia.org Wed Oct 30 17:04:00 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 12:04:00 -0500 (EST) Subject: [OpenAFS] Patch for OpenAFS 1.2.7 In-Reply-To: <006a01c28034$a9c6fbc0$0280000a@pelican> Message-ID: On Wed, 30 Oct 2002, Computers in Medicine wrote: > I would greatly appreciate it if someone would send me the patch to make OpenAFS 1.2.7 compatible with kernel 2.4.18-17, or post it somewhere. Thanks. It was posted on this list a few days ago, the last time someone asked. An archive is available at www.openafs.org From Phil.Moore@morganstanley.com Wed Oct 30 17:49:26 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Wed, 30 Oct 2002 12:49:26 -0500 Subject: [OpenAFS] cache performance In-Reply-To: <1035932935.1333.9.camel@cessna.rollanet.org> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> <15807.5072.52967.812237@zappa.ms.com> <1035932935.1333.9.camel@cessna.rollanet.org> Message-ID: <15808.7078.142442.752330@zappa.ms.com> >>>>> "Nathan" == Nathan Neulinger writes: Nathan> What sort of additional logging are you looking for in the Nathan> file server? Nathan> Also, how do you plan on handling the "if it's already in the Nathan> cache, the file server probably won't see a request" issue? Nathan> Adding more logging is relatively easy to do, just come up Nathan> with a list. Well, let me first outline what information we glean from the client audits we do today. The goal of our client cache audits is to obtain, for each host, a list of the volumes accessed by that client in the last 24 hours, as well as the amount of data (not so important, but interesting). By collecting this information for all clients in a given cell, I can then determine for each AFS volume in my cell, the list of clients that have accessed that volume in the last 24 hours. Today, by auditing the volume headers cell-wide[*], I can determine the lastaccess timestamp, but not the list of clients accessing it. Now, what I would like to get on the fileserver is additional logging which allows me to generate this kind of report on a daily basis. Additional log entries in the FileLog are probably sufficient, but I would be concerned about the volume of information added to the log, as well as the logfiles volatility. For example, the default behavior is to save *one* FileLog after a restart. Perform more than one restart in a single day, and you lose some logging information. Actually, the more I think about it, the less I like using the FileLog. We really need a mechanism for maintaining these statistics that is more robust. I'm also worried about the volume of information that would be generated into the FileLog, which should be the place to look for problem diagnostics, which you don't want to hide among a cloud of performance/usage statistics. I think a better mechanism would be to have the fileserver maintain this information in memory, and to query it (and reset it) periodically, via a new RPC. Then, I can ask for this data as often as I want, once a day, or maybe once an hour, if I need to do finer grained analysis. Phil [*] Bonus question: anyone know where I'm getting these timestamps? I'll bet you can't guess... From nneul@umr.edu Wed Oct 30 17:55:23 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 30 Oct 2002 11:55:23 -0600 Subject: [OpenAFS] cache performance Message-ID: > Nathan> What sort of additional logging are you looking for in the > Nathan> file server? >=20 > Nathan> Also, how do you plan on handling the "if it's already in the > Nathan> cache, the file server probably won't see a request" issue? >=20 > Nathan> Adding more logging is relatively easy to do, just come up > Nathan> with a list. >=20 > Well, let me first outline what information we glean from the client > audits we do today. >=20 > The goal of our client cache audits is to obtain, for each host, a > list of the volumes accessed by that client in the last 24 hours, as > well as the amount of data (not so important, but interesting). By > collecting this information for all clients in a given cell, I can > then determine for each AFS volume in my cell, the list of clients > that have accessed that volume in the last 24 hours. >=20 > Today, by auditing the volume headers cell-wide[*], I can=20 > determine the > lastaccess timestamp, but not the list of clients accessing it. =20 >=20 > Now, what I would like to get on the fileserver is additional logging > which allows me to generate this kind of report on a daily basis. > Additional log entries in the FileLog are probably sufficient, but I > would be concerned about the volume of information added to the log, > as well as the logfiles volatility. >=20 > For example, the default behavior is to save *one* FileLog after a > restart. Perform more than one restart in a single day, and you lose > some logging information. Actually, the more I think about it, the > less I like using the FileLog. We really need a mechanism for > maintaining these statistics that is more robust. Have you considered using the -syslog log mechanism, or are you running on a platform with a syslogd that can't handle heavy loading.=20 > I'm also worried about the volume of information that would be > generated into the FileLog, which should be the place to look for > problem diagnostics, which you don't want to hide among a cloud of > performance/usage statistics. >=20 > I think a better mechanism would be to have the fileserver maintain > this information in memory, and to query it (and reset it) > periodically, via a new RPC. Then, I can ask for this data as often > as I want, once a day, or maybe once an hour, if I need to do finer > grained analysis. Yeah, that's what Derrick and I were thinking, something similar in nature to fstrace. > Phil >=20 > [*] Bonus question: anyone know where I'm getting these timestamps? > I'll bet you can't guess... dayUseDate? > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From leg+@andrew.cmu.edu Wed Oct 30 17:57:03 2002 From: leg+@andrew.cmu.edu (Lawrence Greenfield) Date: Wed, 30 Oct 2002 12:57:03 -0500 Subject: [OpenAFS] cache performance In-Reply-To: <15808.7078.142442.752330@zappa.ms.com> References: <200210250720.DAA28381@contents-vnder-pressvre.mit.edu> <3DB960A2.4030701@email.unc.edu> <15801.26225.555407.357918@zappa.ms.com> <3DB98B60.2080407@email.unc.edu> <15801.36445.753666.219539@zappa.ms.com> <3DBEFB43.1070909@email.unc.edu> <15807.5072.52967.812237@zappa.ms.com> <1035932935.1333.9.camel@cessna.rollanet.org> <15808.7078.142442.752330@zappa.ms.com> Message-ID: <200210301757.g9UHv3Q9003294@smtp6.andrew.cmu.edu> From: Phil.Moore@morganstanley.com Date: Wed, 30 Oct 2002 12:49:26 -0500 [...] I think a better mechanism would be to have the fileserver maintain this information in memory, and to query it (and reset it) periodically, via a new RPC. Then, I can ask for this data as often as I want, once a day, or maybe once an hour, if I need to do finer grained analysis. I've had some success instrumenting applications to return performance related information via SNMP. This makes it easy to integrate those applications with existing monitoring/graphing applications. Normally I do this by creating a Net-SNMP agentx subagent. The major downside (of course there's a downside or three!) is that SNMP security isn't widely deployed (and the most widely deployed varieties are damn annoying). Larry From nneul@umr.edu Wed Oct 30 17:59:53 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 30 Oct 2002 11:59:53 -0600 Subject: [OpenAFS] cache performance Message-ID: That might be a good idea, but I would say that the subagent in that case would be a client to whatever services the file server provides. You wouldn't want to hook that into the fileserver itself in this case without a pretty hefty security audit.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Lawrence Greenfield [mailto:leg+@andrew.cmu.edu]=20 > Sent: Wednesday, October 30, 2002 11:57 AM > To: openafs-info@openafs.org > Subject: Re: [OpenAFS] cache performance >=20 >=20 > From: Phil.Moore@morganstanley.com > Date: Wed, 30 Oct 2002 12:49:26 -0500 > [...] > I think a better mechanism would be to have the fileserver maintain > this information in memory, and to query it (and reset it) > periodically, via a new RPC. Then, I can ask for this=20 > data as often > as I want, once a day, or maybe once an hour, if I need to do finer > grained analysis. >=20 > I've had some success instrumenting applications to return performance > related information via SNMP. This makes it easy to integrate those > applications with existing monitoring/graphing applications. >=20 > Normally I do this by creating a Net-SNMP agentx subagent. >=20 > The major downside (of course there's a downside or three!) is that > SNMP security isn't widely deployed (and the most widely deployed > varieties are damn annoying). >=20 > Larry >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From slack@quackmaster.net Wed Oct 30 18:04:02 2002 From: slack@quackmaster.net (Jack Neely) Date: Wed, 30 Oct 2002 13:04:02 -0500 Subject: [OpenAFS] volserver caused ext3 oops? In-Reply-To: ; from shadow@dementia.org on Wed, Oct 30, 2002 at 10:47:35AM -0500 References: <20021030101537.E2235@anduril.pams.ncsu.edu> Message-ID: <20021030130402.G2235@anduril.pams.ncsu.edu> On Wed, Oct 30, 2002 at 10:47:35AM -0500, Derrick J Brashear wrote: > On Wed, 30 Oct 2002, Jack Neely wrote: > > > Folks, > > > > I'm doing some early testing of using Linux and OpenAFS servers in our > > environment of all solaris based, transarc servers. We set up a script > > to do some pounding on by moving a 500MB volume back and forth between > > it and another server. At 4:00 in the morning looks like volserver > > caused a kernel oops in the ext3 code. (Which I found to be really > > weird.) > > > > Can anyone shed some light on what might be up here? > > It looks like a pretty boring "not our fault" crash; I can't say I've seen > such before. Particularly, I can't see how "caused" could be anything > other than "happened to be the process that lost since it was the heaviest > thing exercising the subsystem." > > > We are running OpenAFS 1.2.7 on a Red Hat Linux 7.3-ish system, kernel > > 2.4.18-10. Well, I don't find having my afs server fall over boring. Are there any known issues with using ext3 or ext2 for AFS server partitions? Jack Neely -- Jack Neely Linux Realm Kit Administration and Development PAMS Computer Operations at NC State University GPG Fingerprint: 1917 5AC1 E828 9337 7AA4 EA6B 213B 765F 3B6A 5B89 From shadow@dementia.org Wed Oct 30 18:24:28 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 13:24:28 -0500 (EST) Subject: [OpenAFS] volserver caused ext3 oops? In-Reply-To: <20021030130402.G2235@anduril.pams.ncsu.edu> Message-ID: On Wed, 30 Oct 2002, Jack Neely wrote: > > > Can anyone shed some light on what might be up here? > > > > It looks like a pretty boring "not our fault" crash; I can't say I've seen > > such before. Particularly, I can't see how "caused" could be anything > > other than "happened to be the process that lost since it was the heaviest > > thing exercising the subsystem." > > > > > We are running OpenAFS 1.2.7 on a Red Hat Linux 7.3-ish system, kernel > > > 2.4.18-10. > > Well, I don't find having my afs server fall over boring. boring as in no adventurous issues. like, particularly, this doesn't look any different than if you had said "cat > /some/file" and the machine fell over. > Are there any known issues with using ext3 or ext2 for AFS server > partitions? none i know of From matt@cs.auckland.ac.nz Wed Oct 30 18:40:16 2002 From: matt@cs.auckland.ac.nz (Matthew Cocker) Date: Thu, 31 Oct 2002 07:40:16 +1300 Subject: [OpenAFS] afsd dying on win2k References: <200210301459.g9UExo412840@ms-sm2.uncc.edu> Message-ID: <3DC02790.3070605@cs.auckland.ac.nz> > Right now we seem to have 2 choices: > > A) Hack fakeka and ka-forwarder to support K4 so that the Windows klog will work > > or > > B) Educate and convince the folks that fall into this group to install K5 and > aklog. > > > Of course, we are open to other ideas as well. > > We tried these options and did not like then. In the end we just compiled MIT krb with version 4 support and made at least one afs DB server in each geographic site in our cell a MIT kdc server as well. Then the windows users just have to use our standard afsdcell.ini file. Since we moved to this setup we have seen a lot less windows AFS client crashes. We still see a few if we have a network problem with a router etc as the windows client stops as soon as it can not contact the servers. Presently have ~900 windows clients in our labs with ~400000 logins so far this year by upwards of 6000 users who map/access their home directories in afs space at each login with mandatory profiles with favorites, my documents redirected into AFS home directory. Cheers Matt From matt@cs.auckland.ac.nz Wed Oct 30 18:48:21 2002 From: matt@cs.auckland.ac.nz (Matthew Cocker) Date: Thu, 31 Oct 2002 07:48:21 +1300 Subject: [OpenAFS] windows client rants Message-ID: <3DC02975.9080801@cs.auckland.ac.nz> Hi The openafs windows client has issues but don't forget M$ software also has problems. For example Service Pack one for windows XP breaks many windows 2000 fileservers. BTW this same service pack has also slowed down opening an afs share for the first time but it does still work. Isn't there a saying that somewhere that a MS development team hasn't finished a product release until it breaks X (where X is someone elses software). quoted from windows & .NET magazine update october 29, 2002 "According to Microsoft, the connectivity problems aren't related to multiple versions of the redirector code but do involve the Server Message Block (SMB) protocol. The Microsoft article "'File or Network Path No Longer Exists' or 'No Network Provider Accepted the Given Network Path' Error Message When You Copy or Open Files in Windows XP SP1" at http://support.microsoft.com/default.aspx?scid=kb;en-us;q329170 states that the client errors are the result of a bug in how the Win2K system hosting the shared resource processes signed SMB packets from an XP SP1 client. The protocol bug produces many error messages in a variety of circumstances. Clients might also experience delays accessing a remote file, and in some cases, hang and need to be restarted. Find out more about these connectivity problems and how to solve them at the following URL: http://www.winnetmag.com/articles/index.cfm?articleid=27148" Cheers Matt From matt@cs.auckland.ac.nz Wed Oct 30 18:50:40 2002 From: matt@cs.auckland.ac.nz (Matthew Cocker) Date: Thu, 31 Oct 2002 07:50:40 +1300 Subject: [OpenAFS] donations to AFS project Message-ID: <3DC02A00.9030109@cs.auckland.ac.nz> If I was able to talk someone here into forking out some cash for AFS development how would we go about handing over the loot in some sort of official manner that will keep the bean counter happy. Cheers Matt From cchapin@qualcomm.com Wed Oct 30 18:53:33 2002 From: cchapin@qualcomm.com (Chris (Ducky) Chapin) Date: Wed, 30 Oct 2002 10:53:33 -0800 (PST) Subject: [OpenAFS] volserver caused ext3 oops? In-Reply-To: Message-ID: On Wed, 30 Oct 2002, Derrick J Brashear wrote: > On Wed, 30 Oct 2002, Jack Neely wrote: > > Are there any known issues with using ext3 or ext2 for AFS server > > partitions? > none i know of The only thing we've run into when using ext3 was that multiplying the df of /usr/vice by 9/10 to determine what the cache size should be (before afsd is started for the first time) resulted in the partition filling up and OpenAFS complaining about no room left on device. My guess is that the journal eats a percentage of the up disk and that doesn't get taken into account. Since I can't think of a good reason to journal cache data, I just mount /usr/vice as ext2 instead. -- Christopher 'Ducky' Chapin ducky@qualcomm.com Unix Systems Administrator - Qualcomm, Inc. (858) 651-5433 IT Host Services From csnyder@mvpsoft.com Wed Oct 30 18:55:23 2002 From: csnyder@mvpsoft.com (Chris Snyder) Date: Wed, 30 Oct 2002 13:55:23 -0500 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #882 - 12 msgs References: <20021030114102.81BD19C15@grand.central.org> Message-ID: <3DC02B1B.3090608@mvpsoft.com> openafs-info-request@openafs.org wrote: > Send OpenAFS-info mailing list submissions to > openafs-info@openafs.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.openafs.org/mailman/listinfo/openafs-info > or, via email, send a message with subject or body 'help' to > openafs-info-request@openafs.org > > You can reach the person managing the list at > openafs-info-admin@openafs.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of OpenAFS-info digest..." > > > Today's Topics: > > 1. Re: afsd dying on win2k (Rodney M Dyer) > 2. Re: afsd dying on win2k (Ken Hornstein) > 3. Re: cache performance (Lester Barrows) > 4. Re: afsd dying on win2k (Derrick J Brashear) > 5. Re: cache performance (Nathan Neulinger) > 6. Re: cache performance (Warren.Yenson@morganstanley.com) > 7. Re: cache performance (Nathan Neulinger) > 8. Re: cache performance (Derrick J Brashear) > 9. Re: entication weirdness (Charles Clancy) > 10. Re: Re: Kerberos V and xscreensaver/xlock (Charles Clancy) > 11. Re: Authentication weirdness (Tino Schwarze) > 12. Re: Re: Kerberos V and xscreensaver/xlock (Christian Pfaffel) > > --__--__-- > > Message: 1 > Date: Tue, 29 Oct 2002 19:32:28 -0500 > To: Derrick J Brashear > From: Rodney M Dyer > Subject: Re: [OpenAFS] afsd dying on win2k > Cc: openafs-info@openafs.org > > At 11:57 AM 10/29/2002 -0500, you wrote: > >>On Tue, 29 Oct 2002, Rodney M Dyer wrote: >> >> >>> From the looks of it, I don't think anything is going to be done about >> >>the >> >>>problem since no one on the OpenAFS group cares anything about >>>Windoz... >> >>I don't think that's clear, but I can tell you I certainly don't have the >>time to care. > > > Just on the side, my colleagues and I think it's funny that you say > this. Are you paid as an OpenAFS help desk person? You seem to have > enough time to respond to just about everything that hits this list. Do > you ever have time for anything else? ;) > > I can only hope my sting was "mostly harmless", but it was intended to draw > out comments on just what is going on in the group relative to Windows > support. Yes, I am VERY appreciative of the support I'm getting out of > this list. On at least a couple of occasions I've gotten good help. I'm > sorry if I offended anyone. Believe me, the last time we had to get a very > small problem debugged in the Transarc client, it ended up costing us a few > thousand dollars to get fixed. > > I'm glad to hear from Mr. Phil Moore at Morgan Stanley. I'm glad to hear > that someone is pony'ing up for support. But, is the version that Morgan > Stanley using available as open source? Can anyone get a copy of it? Is > it a forked version of OpenAFS? What is different about it? How much > would it cost us? > > We've been in a real push now for over a year to get a single-sign-on > system developed between our Windows/UNIX/Mac machines. Using Kerberos V > as the authentication mechanism and AFS as the filesystem, we've managed to > glue everything together as a working unit. It all works great except now > we are having trouble weaning ourselves away from the kaserver. Seems the > Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" > daemon. This wouldn't be a problem except that it is a real annoyance for > our users to "kinit" then "aklog" at the command line by hand. And, we're > having problems with "aklog" behind a NAT router for some reason I can't > fathom (yes, we've tried addressless tickets). > > BTW, for anyone who cares, if you setup cross-realm authentication for an > AD domain to a Kerberos V realm, you may have trouble with AD domain file > share access. This seems to be caused by a bug/feature/design flaw in the > Kerberos V replay packet detection. Microsoft and MIT are currently > working the issue out. We still need AD domain shares because we store > files and databases there that AFS cannot support because it doesn't have > complete record locking capability. > > Rodney > > >> I know a couple of people who probably care, but I'm not >>going to out them; They're welcome to comment themselves or not, and I >>have no idea if they can, or have the time, to look into this. >> >>I don't suppose anyone has an actual recipe for reproducing this, or is >>this one of those deals where someone should pray that their network is >>the same as yours? >> >>(Yes, now I'm being sarcastic. How about attaching a hub and a machine >>with tcpdump next to a dying client and seeing what's going on as close to >>when it dies as possible?) >> >> >> >> >>_______________________________________________ >>OpenAFS-info mailing list >>OpenAFS-info@openafs.org >>https://lists.openafs.org/mailman/listinfo/openafs-info > > > > --__--__-- > > Message: 2 > To: openafs-info@openafs.org > Subject: Re: [OpenAFS] afsd dying on win2k > Date: Tue, 29 Oct 2002 20:35:49 -0500 > From: Ken Hornstein > >>We've been in a real push now for over a year to get a single-sign-on >>system developed between our Windows/UNIX/Mac machines. Using Kerberos V >>as the authentication mechanism and AFS as the filesystem, we've managed to >>glue everything together as a working unit. It all works great except now >>we are having trouble weaning ourselves away from the kaserver. Seems the >>Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" >>daemon. This wouldn't be a problem except that it is a real annoyance for >>our users to "kinit" then "aklog" at the command line by hand. > > > Rodney, it seems to me like it would be trivial to have kinit call aklog > after it's gotten you a TGT. Didn't you even consider trying that? And > have you heard the phrase, "If you're not part of the solution, you're > part of the problem?" > > >>And, we're >>having problems with "aklog" behind a NAT router for some reason I can't >>fathom (yes, we've tried addressless tickets). > > > I suspect the problem is related to the fact that some versions of the > 524 library wouldn't accept an addressless v5 TGT. > > --Ken > > --__--__-- > > Message: 3 > From: Lester Barrows > Organization: Asani Solutions, LLC > To: openafs-info@openafs.org > Subject: Re: [OpenAFS] cache performance > Date: Tue, 29 Oct 2002 20:06:33 -0700 > > Whenever a file is accessed on the client, I believe it contacts the cach= > e=20 > manager to ensure that it hasn't changed. Perhaps the cache manager, rath= > er=20 > than the file server, would be the most authoritative place to collect th= > is=20 > information. > > Regards, > Lester Barrows > > On Tuesday 29 October 2002 03:08 pm, Nathan Neulinger wrote: > >>What sort of additional logging are you looking for in the file server? >> >>Also, how do you plan on handling the "if it's already in the cache, th= > > e > >>file server probably won't see a request" issue? >> >>Adding more logging is relatively easy to do, just come up with a list. >> >>-- Nathan > > > > --__--__-- > > Message: 4 > Date: Tue, 29 Oct 2002 22:19:53 -0500 (EST) > From: Derrick J Brashear > To: openafs-info@openafs.org > Subject: Re: [OpenAFS] afsd dying on win2k > > On Tue, 29 Oct 2002, Rodney M Dyer wrote: > > >>>I don't think that's clear, but I can tell you I certainly don't have the >>>time to care. >> >>Just on the side, my colleagues and I think it's funny that you say >>this. Are you paid as an OpenAFS help desk person? > > > I have 2 jobs, some percent of one of them is devoted to OpenAFS issues > and the other is also OpenAFS related. > > >>You seem to have >>enough time to respond to just about everything that hits this list. Do >>you ever have time for anything else? ;) > > > Some. > > >>I can only hope my sting was "mostly harmless", but it was intended to draw >>out comments on just what is going on in the group relative to Windows >>support. > > > A lot, but not coherently organized. Perhaps that is part of the problem. > > >>that someone is pony'ing up for support. But, is the version that Morgan >>Stanley using available as open source? Can anyone get a copy of it? Is >>it a forked version of OpenAFS? What is different about it? How much >>would it cost us? > > > It's not (apparently) forked OpenAFS, we got patches from Morgan Stanley > for the real OpenAFS windows client (the incident is still open in the > openafs-bugs queue) > > >>glue everything together as a working unit. It all works great except now >>we are having trouble weaning ourselves away from the kaserver. Seems the >>Transarc/OpenAFS "klog.exe" can't be forwarded to the "fakeka" >>daemon. This wouldn't be a problem except that it is a real annoyance for >>our users to "kinit" then "aklog" at the command line by hand. And, we're >>having problems with "aklog" behind a NAT router for some reason I can't >>fathom (yes, we've tried addressless tickets). > > > I suppose replacing kinit with one that does aklog is right out? We > (OpenAFS) are going to have to deal with this in the near future to > support the Kerberos 5 bridge proposal support which is actually expected > to be useful (though not mandatory) in 1.2.8. > > > > > > --__--__-- > > Message: 5 > Subject: Re: [OpenAFS] cache performance > From: Nathan Neulinger > Cc: openafs-info@openafs.org > Organization: University of Missouri - Rolla > Date: 29 Oct 2002 21:23:15 -0600 > > The cache manager is part of the client. So, yes, it is contacted. > > As long as a callback is still present with the server, there shouldn't > be any communication with the file server. > > So, one possible solution would be a cache manager debug set (fs setset) > that had a very minimal amount of logging generated - to where you could > reasonably run fstrace regularly on clients. i.e. not a full bore - > every access, just file opens. > > -- Nathan > > On Tue, 2002-10-29 at 21:06, Lester Barrows wrote: > >>Whenever a file is accessed on the client, I believe it contacts the cache >>manager to ensure that it hasn't changed. Perhaps the cache manager, rather >>than the file server, would be the most authoritative place to collect this >>information. >> >>Regards, >>Lester Barrows >> >>On Tuesday 29 October 2002 03:08 pm, Nathan Neulinger wrote: >> >>>What sort of additional logging are you looking for in the file server? >>> >>>Also, how do you plan on handling the "if it's already in the cache, the >>>file server probably won't see a request" issue? >>> >>>Adding more logging is relatively easy to do, just come up with a list. >>> >>>-- Nathan >> >>_______________________________________________ >>OpenAFS-info mailing list >>OpenAFS-info@openafs.org >>https://lists.openafs.org/mailman/listinfo/openafs-info > From nneul@umr.edu Wed Oct 30 18:56:26 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 30 Oct 2002 12:56:26 -0600 Subject: [OpenAFS] volserver caused ext3 oops? Message-ID: Well, one _REAL_ good reason to journal /afscache is so it isn't the only non-journalled fs on your machine. That makes a big difference if you have an unclean boot. Especially with large caches.=20 -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Chris (Ducky) Chapin [mailto:cchapin@qualcomm.com]=20 > Sent: Wednesday, October 30, 2002 12:54 PM > To: Derrick J Brashear > Cc: openafs-info@openafs.org > Subject: Re: [OpenAFS] volserver caused ext3 oops? >=20 >=20 >=20 >=20 > On Wed, 30 Oct 2002, Derrick J Brashear wrote: > > On Wed, 30 Oct 2002, Jack Neely wrote: > > > Are there any known issues with using ext3 or ext2 for AFS server > > > partitions? > > none i know of >=20 > The only thing we've run into when using ext3 was that=20 > multiplying the=20 > df of /usr/vice by 9/10 to determine what the cache size=20 > should be (before > afsd is started for the first time) resulted in the partition=20 > filling up > and OpenAFS complaining about no room left on device. >=20 > My guess is that the journal eats a percentage of the up disk and > that doesn't get taken into account. Since I can't think of=20 > a good reason > to journal cache data, I just mount /usr/vice as ext2 instead. >=20 > -- >=20 > Christopher 'Ducky' Chapin ducky@qualcomm.com > Unix Systems Administrator - Qualcomm, Inc. (858) 651-5433 > IT Host Services =20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From csnyder@mvpsoft.com Wed Oct 30 18:56:57 2002 From: csnyder@mvpsoft.com (Chris Snyder) Date: Wed, 30 Oct 2002 13:56:57 -0500 Subject: [OpenAFS] Re: OpenAFS-info digest, Vol 1 #882 - 12 msgs References: <20021030114102.81BD19C15@grand.central.org> <3DC02B1B.3090608@mvpsoft.com> Message-ID: <3DC02B79.5010305@mvpsoft.com> Sorry about that unnecessary message that I just sent. It's simply the entire digest quoted - no text. (dang ctrl+enter shortcut in my email app) From csnyder@mvpsoft.com Wed Oct 30 19:00:02 2002 From: csnyder@mvpsoft.com (Chris Snyder) Date: Wed, 30 Oct 2002 14:00:02 -0500 Subject: [OpenAFS] Re: Authentication weirdness References: <20021030114102.81BD19C15@grand.central.org> Message-ID: <3DC02C32.2090704@mvpsoft.com> > > Is there any reason that the modified mod_auth_pam available at > /afs/tu-chemnitz.de/openafs/AddOn/mod_auth_pam/ > does not work for you? > > Bye, Tino. What versions of Apache will this work with? I'm running 1.3.27 (latest 1.x series). Also, I haven't configured my machines to have access to the global AFS filespace. Is there any other place I can download this? Thanks in advance. From hotz@jpl.nasa.gov Wed Oct 30 19:52:16 2002 From: hotz@jpl.nasa.gov (Henry B. Hotz) Date: Wed, 30 Oct 2002 11:52:16 -0800 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock Message-ID: At 12:01 PM -0500 10/30/02, openafs-info-request@openafs.org wrote: >To: Charles Clancy >Cc: openafs-info@openafs.org >Subject: Re: [OpenAFS] Re: Kerberos V and xscreensaver/xlock >From: Christian Pfaffel >Organization: TU Graz, Inst. f. Theoretische Physik >Date: 30 Oct 2002 16:41:55 +0100 > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Charles Clancy writes: > >> > There does not exist a "reuse_ccache" option for pam_krb5. >> >> The official version 1.0 from Frank Cusack's website (http://fcusack.com/) >> has that option. >> > >This is probably the reason why i couldn't find it ;-). I have been using >pam_krb5-1.56 from RH. > >Christian > And then there is a version 1.2 in the Hiemdal site. The sourceforge version may be the same as the RedHat version, but I haven't looked. Is there a version that compiles clean on MacOS X? (After changing " USENIX might be willing to accept donations on behalf of OpenAFS -- Page 4 of the June 2002 issue of ;login: (http://www.usenix.org/publications/login/2002-06/openpdfs/usenixnews.pdf) describes an arrangement for USENIX to fund development of OpenAFS, contingent upon receipt of matching funds. Ellie might be able to provide more details. -tvb -----Original Message----- From: Matthew Cocker [mailto:matt@cs.auckland.ac.nz] Sent: Wednesday, October 30, 2002 12:51 PM To: openafs-info Subject: [OpenAFS] donations to AFS project If I was able to talk someone here into forking out some cash for AFS development how would we go about handing over the loot in some sort of official manner that will keep the bean counter happy. Cheers Matt _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info From shadow@dementia.org Wed Oct 30 20:57:43 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 15:57:43 -0500 (EST) Subject: [OpenAFS] donations to AFS project In-Reply-To: <3DC02A00.9030109@cs.auckland.ac.nz> Message-ID: On Thu, 31 Oct 2002, Matthew Cocker wrote: > If I was able to talk someone here into forking out some cash for AFS > development how would we go about handing over the loot in some sort of > official manner that will keep the bean counter happy. Generally or for something specific? If it's for something specific you might want to find someone to do it; If it's general, perhaps USENIX might be persuaded to take the money and potentially match in some manner (but given their current money situation, that's a bit unlikely) before redistributing. Others may comment but basically something similar is happening already and there should be some news on how that goes soon. From shadow@dementia.org Wed Oct 30 20:58:34 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 15:58:34 -0500 (EST) Subject: [OpenAFS] volserver caused ext3 oops? In-Reply-To: Message-ID: On Wed, 30 Oct 2002, Chris (Ducky) Chapin wrote: > > > On Wed, 30 Oct 2002, Derrick J Brashear wrote: > > On Wed, 30 Oct 2002, Jack Neely wrote: > > > Are there any known issues with using ext3 or ext2 for AFS server > > > partitions? > > none i know of > > The only thing we've run into when using ext3 was that multiplying the > df of /usr/vice by 9/10 to determine what the cache size should be (before > afsd is started for the first time) resulted in the partition filling up > and OpenAFS complaining about no room left on device. That's client, and he's talking about server. There was actually a more interesting bug with cache size calculation in the client which will be fixed in 1.2.8. From shadow@dementia.org Wed Oct 30 21:00:14 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 16:00:14 -0500 (EST) Subject: [OpenAFS] donations to AFS project In-Reply-To: Message-ID: I see I'm too slow and Travis already explained better. Sorry. From Phil.Moore@morganstanley.com Wed Oct 30 21:17:46 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Wed, 30 Oct 2002 16:17:46 -0500 Subject: [OpenAFS] cache performance In-Reply-To: References: Message-ID: <15808.19578.114390.231941@zappa.ms.com> >>>>> "Nathan" == Neulinger, Nathan writes: Nathan> Have you considered using the -syslog log mechanism, or are Nathan> you running on a platform with a syslogd that can't handle Nathan> heavy loading. I think that option post-dates my hands on administration of AFS :-( That's worth looking into. In my experience, syslogd can take a pretty heavy beating, so I would think that's not a problem. Phil> I'm also worried about the volume of information that would be Phil> generated into the FileLog, which should be the place to look for Phil> problem diagnostics, which you don't want to hide among a cloud of Phil> performance/usage statistics. Phil> I think a better mechanism would be to have the fileserver maintain Phil> this information in memory, and to query it (and reset it) Phil> periodically, via a new RPC. Then, I can ask for this data as often Phil> as I want, once a day, or maybe once an hour, if I need to do finer Phil> grained analysis. Nathan> Yeah, that's what Derrick and I were thinking, something similar in Nathan> nature to fstrace. However, I want to architect the mechanism to be a bit more manageable and robust than a debugging tool, and most importantly, we need to minimize the performance impact, of course. Phil> [*] Bonus question: anyone know where I'm getting these timestamps? Phil> I'll bet you can't guess... Nathan> dayUseDate? Bingo -- unfortunately, this isn't printed by "vos examine", or any vos command at all. I had to write an new daemon for the bosserver: rvolinfod. You can probably guess how it works. rvolinfo (the client) talks to rvolinfod (the server) to remotely run volinfo commands, and this lets me write code that queries the entire AFS cell for volume header information, which I can then slice and dice anyway I want. For RO volumes, you just take the maximum value of the dayUseDate, and you have a lastaccess timestamp for the volume. From shadow@dementia.org Wed Oct 30 21:18:30 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Wed, 30 Oct 2002 16:18:30 -0500 (EST) Subject: [OpenAFS] cache performance In-Reply-To: <15808.19578.114390.231941@zappa.ms.com> Message-ID: On Wed, 30 Oct 2002 Phil.Moore@morganstanley.com wrote: > >>>>> "Nathan" == Neulinger, Nathan writes: > > Nathan> Have you considered using the -syslog log mechanism, or are > Nathan> you running on a platform with a syslogd that can't handle > Nathan> heavy loading. > > I think that option post-dates my hands on administration of AFS :-( Nathan wrote it for OpenAFS, so, yeah, pretty much;-) > Nathan> Yeah, that's what Derrick and I were thinking, something similar in > Nathan> nature to fstrace. > > However, I want to architect the mechanism to be a bit more manageable > and robust than a debugging tool, and most importantly, we need to > minimize the performance impact, of course. Do you consider fstrace robust? From nneul@umr.edu Wed Oct 30 21:25:22 2002 From: nneul@umr.edu (Neulinger, Nathan) Date: Wed, 30 Oct 2002 15:25:22 -0600 Subject: [OpenAFS] cache performance Message-ID: One thing I don't like about fstrace is that it seems like the polling mechanism would be a performance hog. Seems like offering both would be ideal - a. Connect and grab current buffer if enabled or b. Logging only generated when a process is connected, and while it is connected, it receives continual updates. Not sure though which would be less impact on server without writing and testing. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 > -----Original Message----- > From: Derrick J Brashear [mailto:shadow@dementia.org]=20 > Sent: Wednesday, October 30, 2002 3:19 PM > To: openafs-info@openafs.org > Subject: RE: [OpenAFS] cache performance >=20 >=20 > On Wed, 30 Oct 2002 Phil.Moore@morganstanley.com wrote: >=20 > > >>>>> "Nathan" =3D=3D Neulinger, Nathan writes: > >=20 > > Nathan> Have you considered using the -syslog log mechanism, or are > > Nathan> you running on a platform with a syslogd that can't handle > > Nathan> heavy loading. > >=20 > > I think that option post-dates my hands on administration of AFS :-( >=20 > Nathan wrote it for OpenAFS, so, yeah, pretty much;-) >=20 > > Nathan> Yeah, that's what Derrick and I were thinking,=20 > something similar in > > Nathan> nature to fstrace. > >=20 > > However, I want to architect the mechanism to be a bit more=20 > manageable > > and robust than a debugging tool, and most importantly, we need to > > minimize the performance impact, of course. >=20 > Do you consider fstrace robust? >=20 >=20 >=20 > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info >=20 From pittmed@pittmed.pitt.edu Thu Oct 31 06:33:48 2002 From: pittmed@pittmed.pitt.edu (Computers in Medicine) Date: Thu, 31 Oct 2002 01:33:48 -0500 Subject: [OpenAFS] Applying Patch to OpenAFS 1.2.7 Message-ID: <002301c280a7$7879d7e0$0280000a@pelican> I'm trying to apply the patch to OpenAFS 1.2.7 so I can use it with kernel 2.4.17-17-7.x. I got the patch by exporting the list archive to a text file called patchfile using Pine, cutting out the patch, and typing > munpack patchfile I don't remember the name of the file that gave me, but I renamed it to openafs-1.2.7-patch. That file is here: http://www.pittmed.pitt.edu/files/openafs-1.2.7-patch.gz I had the OpenAFS 1.2.7 source file in /usr/src > pwd /usr/src > tar -xf openafs-1.2.7-src.tar > mv openafs-1.2.7 openafs-1.2.7-orig > tar -xf openafs-1.2.7-src.tar > diff -ru openafs-1.2.7 openafs-1.2.7-orig (no differences) > cd openafs-1.2.7 > patch -p1 < ../openafs-1.2.7-patch patching file acconfig.h patching file acinclude.m4 patching file src/afs/LINUX/osi_module.c patching file src/cf/linux-test4.m4 patching file src/libafs/MakefileProto.LINUX.in > cd .. > diff -ru openafs-1.2.7-orig openafs-1.2.7 > newdiff (newdiff is the diff between the original source directory and the patched source directory, expected to be same as openafs-1.2.7-patch, it almost is but not exactly, see below ) > cd openafs-1.2.7 > ./configure --with-linux-kernel-headers=/usr/src/linux-2.4.18-17-7-x > make However, the build fails with the following output Building in directory: MODLOAD-2.4.18-17.7.x-MP make[4]: Entering directory `/usr/src/openafs-1.2.7/src/libafs/MODLOAD-2.4.18-17 .7.x-MP' gcc -O2 -fomit-frame-pointer @LINUX_GCC_KOPTS@ -pipe @P5PLUS_KOPTS@ -D__KERNEL __ -DCPU=586 -DKERNEL -D_KERNEL -DMODULE -DAFS_SMP -D__BOOT_KERNEL_UP=0 -D_ _BOO T_KERNEL_SMP=1 -I. -I../ -I/usr/src/openafs-1.2.7/src/config -c ../afs/afs_atomlist.c; gcc: @LINUX_GCC_KOPTS@: No such file or directory gcc: @P5PLUS_KOPTS@: No such file or directory make[4]: *** [afs_atomlist.o] Error 1 make[4]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs/MODLOAD 2.4.18-17.7.x-MP' make[3]: *** [linux_compdirs] Error 2 make[3]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs' make[2]: *** [libafs] Error 2 make[2]: Leaving directory `/usr/src/openafs-1.2.7' make[1]: *** [build] Error 2 make[1]: Leaving directory `/usr/src/openafs-1.2.7' make: *** [all] Error 2 -------------------------------- Did I apply the patch incorrectly? Here's a diff betwrrn the original patch fule and the newdiff file made by comparing the original source directory and the patched source directory. Thanls if anyone can help. > diff openafs-1.2.7-patch newdiff 2,3c2,3 < --- openafs-1.2.7-orig/acconfig.h 2002-09-11 03:02:15.000000000 -0400 < +++ openafs-1.2.7/acconfig.h 2002-10-18 18:37:09.000000000 -0400 --- > --- openafs-1.2.7-orig/acconfig.h Wed Sep 11 03:02:15 2002 > +++ openafs-1.2.7/acconfig.h Thu Oct 31 00:58:59 2002 15,16c15,16 < --- openafs-1.2.7-orig/acinclude.m4 2002-09-25 23:48:52.000000000 -0400 < +++ openafs-1.2.7/acinclude.m4 2002-10-18 18:42:00.000000000 -0400 --- > --- openafs-1.2.7-orig/acinclude.m4 Wed Sep 25 23:48:52 2002 > +++ openafs-1.2.7/acinclude.m4 Thu Oct 31 00:58:59 2002 74,75c74,75 < --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c 2002-05-02 11:38:45.0000 00000 -0400 < +++ openafs-1.2.7/src/afs/LINUX/osi_module.c 2002-10-18 18:52:13.000000000 -0 400 --- > --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c Thu May 2 11:38:45 2002 > +++ openafs-1.2.7/src/afs/LINUX/osi_module.c Thu Oct 31 00:58:59 2002 203d202 < Only in openafs-1.2.7/src/afs/LINUX: osi_vfs.h 205,206c204,205 < --- openafs-1.2.7-orig/src/cf/linux-test4.m4 2002-09-11 03:02:51.000000000 -0 400 < +++ openafs-1.2.7/src/cf/linux-test4.m4 2002-10-18 18:44:47.000000000 -0 400 --- > --- openafs-1.2.7-orig/src/cf/linux-test4.m4 Wed Sep 11 03:02:51 2002 > +++ openafs-1.2.7/src/cf/linux-test4.m4 Thu Oct 31 00:58:59 2002 278,280d276 < Only in openafs-1.2.7/src/cf: linux-test5.m4 < Only in openafs-1.2.7/src/config: afsconfig.h.in < Only in openafs-1.2.7/src/config: afsconfig.h.in~ 282,283c278,279 < --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in 2002-06-08 00:47 :42.000000000 -0400 < +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in 2002-10-03 12:19:46.0000 00000 -0400 --- > --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in Sat Jun 8 00:47 :42 2002 > +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in Thu Oct 31 00:58:59 2002 344,345d339 < < From shadow@dementia.org Thu Oct 31 06:42:01 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 31 Oct 2002 01:42:01 -0500 (EST) Subject: [OpenAFS] Applying Patch to OpenAFS 1.2.7 In-Reply-To: <002301c280a7$7879d7e0$0280000a@pelican> Message-ID: at the top level, run regen.sh the patch patched autconf configuration and you didn't rebuild configure i'm not sure why the RPMs we ship don't work for you, but we have and announced to openafs-announce new RPMs with this patch a few days ago On Thu, 31 Oct 2002, Computers in Medicine wrote: > I'm trying to apply the patch to OpenAFS 1.2.7 so I can use it with kernel > 2.4.17-17-7.x. I got the patch by exporting the list archive to a text file > called patchfile using Pine, cutting out the patch, and typing > > > munpack patchfile > > I don't remember the name of the file that gave me, but I renamed it to > openafs-1.2.7-patch. That file is here: > > http://www.pittmed.pitt.edu/files/openafs-1.2.7-patch.gz > > I had the OpenAFS 1.2.7 source file in /usr/src > > > pwd > /usr/src > > > tar -xf openafs-1.2.7-src.tar > > mv openafs-1.2.7 openafs-1.2.7-orig > > tar -xf openafs-1.2.7-src.tar > > diff -ru openafs-1.2.7 openafs-1.2.7-orig > > (no differences) > > > cd openafs-1.2.7 > > > patch -p1 < ../openafs-1.2.7-patch > patching file acconfig.h > patching file acinclude.m4 > patching file src/afs/LINUX/osi_module.c > patching file src/cf/linux-test4.m4 > patching file src/libafs/MakefileProto.LINUX.in > > > cd .. > > diff -ru openafs-1.2.7-orig openafs-1.2.7 > newdiff > > (newdiff is the diff between the original source directory and the patched > source directory, expected to be same as openafs-1.2.7-patch, it almost is > but not exactly, see below ) > > > cd openafs-1.2.7 > > ./configure --with-linux-kernel-headers=/usr/src/linux-2.4.18-17-7-x > > make > > However, the build fails with the following output > > Building in directory: MODLOAD-2.4.18-17.7.x-MP > make[4]: Entering directory > `/usr/src/openafs-1.2.7/src/libafs/MODLOAD-2.4.18-17 > .7.x-MP' > gcc -O2 -fomit-frame-pointer @LINUX_GCC_KOPTS@ -pipe > @P5PLUS_KOPTS@ -D__KERNEL > __ -DCPU=586 -DKERNEL -D_KERNEL -DMODULE -DAFS_SMP -D__BOOT_KERNEL_UP=0 -D_ > _BOO > T_KERNEL_SMP=1 -I. -I../ -I/usr/src/openafs-1.2.7/src/config -c > ../afs/afs_atomlist.c; > gcc: @LINUX_GCC_KOPTS@: No such file or directory > gcc: @P5PLUS_KOPTS@: No such file or directory > make[4]: *** [afs_atomlist.o] Error 1 > make[4]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs/MODLOAD > 2.4.18-17.7.x-MP' > make[3]: *** [linux_compdirs] Error 2 > make[3]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs' > make[2]: *** [libafs] Error 2 > make[2]: Leaving directory `/usr/src/openafs-1.2.7' > make[1]: *** [build] Error 2 > make[1]: Leaving directory `/usr/src/openafs-1.2.7' > make: *** [all] Error 2 > > > -------------------------------- > > Did I apply the patch incorrectly? Here's a diff betwrrn the original patch > fule and the newdiff file made by comparing the original source directory > and the patched source directory. Thanls if anyone can help. > > > diff openafs-1.2.7-patch newdiff > > 2,3c2,3 > < --- openafs-1.2.7-orig/acconfig.h 2002-09-11 03:02:15.000000000 -0400 > < +++ openafs-1.2.7/acconfig.h 2002-10-18 18:37:09.000000000 -0400 > --- > > --- openafs-1.2.7-orig/acconfig.h Wed Sep 11 03:02:15 2002 > > +++ openafs-1.2.7/acconfig.h Thu Oct 31 00:58:59 2002 > 15,16c15,16 > < --- openafs-1.2.7-orig/acinclude.m4 2002-09-25 23:48:52.000000000 -0400 > < +++ openafs-1.2.7/acinclude.m4 2002-10-18 18:42:00.000000000 -0400 > --- > > --- openafs-1.2.7-orig/acinclude.m4 Wed Sep 25 23:48:52 2002 > > +++ openafs-1.2.7/acinclude.m4 Thu Oct 31 00:58:59 2002 > 74,75c74,75 > < --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c 2002-05-02 > 11:38:45.0000 > 00000 -0400 > < +++ openafs-1.2.7/src/afs/LINUX/osi_module.c 2002-10-18 > 18:52:13.000000000 -0 > 400 > --- > > --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c Thu May 2 11:38:45 > 2002 > > +++ openafs-1.2.7/src/afs/LINUX/osi_module.c Thu Oct 31 00:58:59 2002 > 203d202 > < Only in openafs-1.2.7/src/afs/LINUX: osi_vfs.h > 205,206c204,205 > < --- openafs-1.2.7-orig/src/cf/linux-test4.m4 2002-09-11 > 03:02:51.000000000 -0 > 400 > < +++ openafs-1.2.7/src/cf/linux-test4.m4 2002-10-18 > 18:44:47.000000000 -0 > 400 > --- > > --- openafs-1.2.7-orig/src/cf/linux-test4.m4 Wed Sep 11 03:02:51 2002 > > +++ openafs-1.2.7/src/cf/linux-test4.m4 Thu Oct 31 00:58:59 2002 > 278,280d276 > < Only in openafs-1.2.7/src/cf: linux-test5.m4 > < Only in openafs-1.2.7/src/config: afsconfig.h.in > < Only in openafs-1.2.7/src/config: afsconfig.h.in~ > 282,283c278,279 > < --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in 2002-06-08 > 00:47 > :42.000000000 -0400 > < +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in 2002-10-03 > 12:19:46.0000 > 00000 -0400 > --- > > --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in Sat Jun 8 > 00:47 > :42 2002 > > +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in Thu Oct 31 00:58:59 > 2002 > 344,345d339 > < > < > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info > From warlord@MIT.EDU Thu Oct 31 14:50:05 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 09:50:05 -0500 Subject: [OpenAFS] Applying Patch to OpenAFS 1.2.7 In-Reply-To: References: Message-ID: Also note that the patch is broken (missing linux-test5.m4) which you need to add in manually. -derek Derrick J Brashear writes: > at the top level, run regen.sh > > the patch patched autconf configuration and you didn't rebuild configure > > i'm not sure why the RPMs we ship don't work for you, but we have and > announced to openafs-announce new RPMs with this patch a few days ago > > > On Thu, 31 Oct 2002, Computers in Medicine wrote: > > > I'm trying to apply the patch to OpenAFS 1.2.7 so I can use it with kernel > > 2.4.17-17-7.x. I got the patch by exporting the list archive to a text file > > called patchfile using Pine, cutting out the patch, and typing > > > > > munpack patchfile > > > > I don't remember the name of the file that gave me, but I renamed it to > > openafs-1.2.7-patch. That file is here: > > > > http://www.pittmed.pitt.edu/files/openafs-1.2.7-patch.gz > > > > I had the OpenAFS 1.2.7 source file in /usr/src > > > > > pwd > > /usr/src > > > > > tar -xf openafs-1.2.7-src.tar > > > mv openafs-1.2.7 openafs-1.2.7-orig > > > tar -xf openafs-1.2.7-src.tar > > > diff -ru openafs-1.2.7 openafs-1.2.7-orig > > > > (no differences) > > > > > cd openafs-1.2.7 > > > > > patch -p1 < ../openafs-1.2.7-patch > > patching file acconfig.h > > patching file acinclude.m4 > > patching file src/afs/LINUX/osi_module.c > > patching file src/cf/linux-test4.m4 > > patching file src/libafs/MakefileProto.LINUX.in > > > > > cd .. > > > diff -ru openafs-1.2.7-orig openafs-1.2.7 > newdiff > > > > (newdiff is the diff between the original source directory and the patched > > source directory, expected to be same as openafs-1.2.7-patch, it almost is > > but not exactly, see below ) > > > > > cd openafs-1.2.7 > > > ./configure --with-linux-kernel-headers=/usr/src/linux-2.4.18-17-7-x > > > make > > > > However, the build fails with the following output > > > > Building in directory: MODLOAD-2.4.18-17.7.x-MP > > make[4]: Entering directory > > `/usr/src/openafs-1.2.7/src/libafs/MODLOAD-2.4.18-17 > > .7.x-MP' > > gcc -O2 -fomit-frame-pointer @LINUX_GCC_KOPTS@ -pipe > > @P5PLUS_KOPTS@ -D__KERNEL > > __ -DCPU=586 -DKERNEL -D_KERNEL -DMODULE -DAFS_SMP -D__BOOT_KERNEL_UP=0 -D_ > > _BOO > > T_KERNEL_SMP=1 -I. -I../ -I/usr/src/openafs-1.2.7/src/config -c > > ../afs/afs_atomlist.c; > > gcc: @LINUX_GCC_KOPTS@: No such file or directory > > gcc: @P5PLUS_KOPTS@: No such file or directory > > make[4]: *** [afs_atomlist.o] Error 1 > > make[4]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs/MODLOAD > > 2.4.18-17.7.x-MP' > > make[3]: *** [linux_compdirs] Error 2 > > make[3]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs' > > make[2]: *** [libafs] Error 2 > > make[2]: Leaving directory `/usr/src/openafs-1.2.7' > > make[1]: *** [build] Error 2 > > make[1]: Leaving directory `/usr/src/openafs-1.2.7' > > make: *** [all] Error 2 > > > > > > -------------------------------- > > > > Did I apply the patch incorrectly? Here's a diff betwrrn the original patch > > fule and the newdiff file made by comparing the original source directory > > and the patched source directory. Thanls if anyone can help. > > > > > diff openafs-1.2.7-patch newdiff > > > > 2,3c2,3 > > < --- openafs-1.2.7-orig/acconfig.h 2002-09-11 03:02:15.000000000 -0400 > > < +++ openafs-1.2.7/acconfig.h 2002-10-18 18:37:09.000000000 -0400 > > --- > > > --- openafs-1.2.7-orig/acconfig.h Wed Sep 11 03:02:15 2002 > > > +++ openafs-1.2.7/acconfig.h Thu Oct 31 00:58:59 2002 > > 15,16c15,16 > > < --- openafs-1.2.7-orig/acinclude.m4 2002-09-25 23:48:52.000000000 -0400 > > < +++ openafs-1.2.7/acinclude.m4 2002-10-18 18:42:00.000000000 -0400 > > --- > > > --- openafs-1.2.7-orig/acinclude.m4 Wed Sep 25 23:48:52 2002 > > > +++ openafs-1.2.7/acinclude.m4 Thu Oct 31 00:58:59 2002 > > 74,75c74,75 > > < --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c 2002-05-02 > > 11:38:45.0000 > > 00000 -0400 > > < +++ openafs-1.2.7/src/afs/LINUX/osi_module.c 2002-10-18 > > 18:52:13.000000000 -0 > > 400 > > --- > > > --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c Thu May 2 11:38:45 > > 2002 > > > +++ openafs-1.2.7/src/afs/LINUX/osi_module.c Thu Oct 31 00:58:59 2002 > > 203d202 > > < Only in openafs-1.2.7/src/afs/LINUX: osi_vfs.h > > 205,206c204,205 > > < --- openafs-1.2.7-orig/src/cf/linux-test4.m4 2002-09-11 > > 03:02:51.000000000 -0 > > 400 > > < +++ openafs-1.2.7/src/cf/linux-test4.m4 2002-10-18 > > 18:44:47.000000000 -0 > > 400 > > --- > > > --- openafs-1.2.7-orig/src/cf/linux-test4.m4 Wed Sep 11 03:02:51 2002 > > > +++ openafs-1.2.7/src/cf/linux-test4.m4 Thu Oct 31 00:58:59 2002 > > 278,280d276 > > < Only in openafs-1.2.7/src/cf: linux-test5.m4 > > < Only in openafs-1.2.7/src/config: afsconfig.h.in > > < Only in openafs-1.2.7/src/config: afsconfig.h.in~ > > 282,283c278,279 > > < --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in 2002-06-08 > > 00:47 > > :42.000000000 -0400 > > < +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in 2002-10-03 > > 12:19:46.0000 > > 00000 -0400 > > --- > > > --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in Sat Jun 8 > > 00:47 > > :42 2002 > > > +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in Thu Oct 31 00:58:59 > > 2002 > > 344,345d339 > > < > > < > > > > _______________________________________________ > > OpenAFS-info mailing list > > OpenAFS-info@openafs.org > > https://lists.openafs.org/mailman/listinfo/openafs-info > > > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 31 14:49:31 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 09:49:31 -0500 Subject: [OpenAFS] Applying Patch to OpenAFS 1.2.7 In-Reply-To: <002301c280a7$7879d7e0$0280000a@pelican> References: <002301c280a7$7879d7e0$0280000a@pelican> Message-ID: Did you try the _NEW_ RPMs (release rhX.y.2)? -derek "Computers in Medicine" writes: > I'm trying to apply the patch to OpenAFS 1.2.7 so I can use it with kernel > 2.4.17-17-7.x. I got the patch by exporting the list archive to a text file > called patchfile using Pine, cutting out the patch, and typing > > > munpack patchfile > > I don't remember the name of the file that gave me, but I renamed it to > openafs-1.2.7-patch. That file is here: > > http://www.pittmed.pitt.edu/files/openafs-1.2.7-patch.gz > > I had the OpenAFS 1.2.7 source file in /usr/src > > > pwd > /usr/src > > > tar -xf openafs-1.2.7-src.tar > > mv openafs-1.2.7 openafs-1.2.7-orig > > tar -xf openafs-1.2.7-src.tar > > diff -ru openafs-1.2.7 openafs-1.2.7-orig > > (no differences) > > > cd openafs-1.2.7 > > > patch -p1 < ../openafs-1.2.7-patch > patching file acconfig.h > patching file acinclude.m4 > patching file src/afs/LINUX/osi_module.c > patching file src/cf/linux-test4.m4 > patching file src/libafs/MakefileProto.LINUX.in > > > cd .. > > diff -ru openafs-1.2.7-orig openafs-1.2.7 > newdiff > > (newdiff is the diff between the original source directory and the patched > source directory, expected to be same as openafs-1.2.7-patch, it almost is > but not exactly, see below ) > > > cd openafs-1.2.7 > > ./configure --with-linux-kernel-headers=/usr/src/linux-2.4.18-17-7-x > > make > > However, the build fails with the following output > > Building in directory: MODLOAD-2.4.18-17.7.x-MP > make[4]: Entering directory > `/usr/src/openafs-1.2.7/src/libafs/MODLOAD-2.4.18-17 > .7.x-MP' > gcc -O2 -fomit-frame-pointer @LINUX_GCC_KOPTS@ -pipe > @P5PLUS_KOPTS@ -D__KERNEL > __ -DCPU=586 -DKERNEL -D_KERNEL -DMODULE -DAFS_SMP -D__BOOT_KERNEL_UP=0 -D_ > _BOO > T_KERNEL_SMP=1 -I. -I../ -I/usr/src/openafs-1.2.7/src/config -c > ../afs/afs_atomlist.c; > gcc: @LINUX_GCC_KOPTS@: No such file or directory > gcc: @P5PLUS_KOPTS@: No such file or directory > make[4]: *** [afs_atomlist.o] Error 1 > make[4]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs/MODLOAD > 2.4.18-17.7.x-MP' > make[3]: *** [linux_compdirs] Error 2 > make[3]: Leaving directory `/usr/src/openafs-1.2.7/src/libafs' > make[2]: *** [libafs] Error 2 > make[2]: Leaving directory `/usr/src/openafs-1.2.7' > make[1]: *** [build] Error 2 > make[1]: Leaving directory `/usr/src/openafs-1.2.7' > make: *** [all] Error 2 > > > -------------------------------- > > Did I apply the patch incorrectly? Here's a diff betwrrn the original patch > fule and the newdiff file made by comparing the original source directory > and the patched source directory. Thanls if anyone can help. > > > diff openafs-1.2.7-patch newdiff > > 2,3c2,3 > < --- openafs-1.2.7-orig/acconfig.h 2002-09-11 03:02:15.000000000 -0400 > < +++ openafs-1.2.7/acconfig.h 2002-10-18 18:37:09.000000000 -0400 > --- > > --- openafs-1.2.7-orig/acconfig.h Wed Sep 11 03:02:15 2002 > > +++ openafs-1.2.7/acconfig.h Thu Oct 31 00:58:59 2002 > 15,16c15,16 > < --- openafs-1.2.7-orig/acinclude.m4 2002-09-25 23:48:52.000000000 -0400 > < +++ openafs-1.2.7/acinclude.m4 2002-10-18 18:42:00.000000000 -0400 > --- > > --- openafs-1.2.7-orig/acinclude.m4 Wed Sep 25 23:48:52 2002 > > +++ openafs-1.2.7/acinclude.m4 Thu Oct 31 00:58:59 2002 > 74,75c74,75 > < --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c 2002-05-02 > 11:38:45.0000 > 00000 -0400 > < +++ openafs-1.2.7/src/afs/LINUX/osi_module.c 2002-10-18 > 18:52:13.000000000 -0 > 400 > --- > > --- openafs-1.2.7-orig/src/afs/LINUX/osi_module.c Thu May 2 11:38:45 > 2002 > > +++ openafs-1.2.7/src/afs/LINUX/osi_module.c Thu Oct 31 00:58:59 2002 > 203d202 > < Only in openafs-1.2.7/src/afs/LINUX: osi_vfs.h > 205,206c204,205 > < --- openafs-1.2.7-orig/src/cf/linux-test4.m4 2002-09-11 > 03:02:51.000000000 -0 > 400 > < +++ openafs-1.2.7/src/cf/linux-test4.m4 2002-10-18 > 18:44:47.000000000 -0 > 400 > --- > > --- openafs-1.2.7-orig/src/cf/linux-test4.m4 Wed Sep 11 03:02:51 2002 > > +++ openafs-1.2.7/src/cf/linux-test4.m4 Thu Oct 31 00:58:59 2002 > 278,280d276 > < Only in openafs-1.2.7/src/cf: linux-test5.m4 > < Only in openafs-1.2.7/src/config: afsconfig.h.in > < Only in openafs-1.2.7/src/config: afsconfig.h.in~ > 282,283c278,279 > < --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in 2002-06-08 > 00:47 > :42.000000000 -0400 > < +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in 2002-10-03 > 12:19:46.0000 > 00000 -0400 > --- > > --- openafs-1.2.7-orig/src/libafs/MakefileProto.LINUX.in Sat Jun 8 > 00:47 > :42 2002 > > +++ openafs-1.2.7/src/libafs/MakefileProto.LINUX.in Thu Oct 31 00:58:59 > 2002 > 344,345d339 > < > < > > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From ellie@usenix.org Thu Oct 31 03:06:05 2002 From: ellie@usenix.org (Ellie Young) Date: Wed, 30 Oct 2002 19:06:05 -0800 Subject: [OpenAFS] donations to AFS project In-Reply-To: References: Message-ID: At 12:09 PM -0800 10/30/02, Broughton, Travis V wrote: >USENIX might be willing to accept donations on behalf of OpenAFS -- Page 4 >of the June 2002 issue of ;login: >(http://www.usenix.org/publications/login/2002-06/openpdfs/usenixnews.pdf) >describes an arrangement for USENIX to fund development of OpenAFS, >contingent upon receipt of matching funds. Ellie might be able to provide >more details. > >-tvb > >-----Original Message----- >From: Matthew Cocker [mailto:matt@cs.auckland.ac.nz] >Sent: Wednesday, October 30, 2002 12:51 PM >To: openafs-info >Subject: [OpenAFS] donations to AFS project > > >If I was able to talk someone here into forking out some cash for AFS >development how would we go about handing over the loot in some sort of >official manner that will keep the bean counter happy. > >Cheers > >Matt Matt: We have received matching grants from Morgan Stanley (in process) and Intel. We are in the process of writing up a press release / announcement. What do you have in mind? USENIX is a non-profit, charitable organization and we can give you the scoop on how to donate funds so your financial folks are happy. Ellie -- ************************************************************************* Ellie Young Executive Director ellie@usenix.org USENIX Association Tel: 510-528-8649 ext 18 2560 Ninth Street, Ste 215 Fax: 510-548-5738 Berkeley, CA 94710 http://www.usenix.org/ From balsa@rit.bme.hu Thu Oct 31 15:14:14 2002 From: balsa@rit.bme.hu (Balazs GAL) Date: 31 Oct 2002 16:14:14 +0100 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock Message-ID: <1036077256.20198.19.camel@balcsi> 2002-10-30, sze keltez=E9ssel Charles Clancy ezt =EDrta: > > I do not even get the TGT if I authenticate to xlock | xscreensaver. > > It never does renew my TGT. klist befor and after xlock show the=20 > > same > > expiration times for it. >=20 > Maybe try adding "reuse_ccache" as an option to pam_krb5. I'm not > entirely sure -- I've not played with pam_krb5 nearly as much as pam_afs. Please read the thread: http://www.stacken.kth.se/lists/heimdal-discuss/2002-08/msg00002.html My heimdal port of Nalin's (RedHat) pam_krb5 have the above feature. >From README: Heimdal port: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D It's now able to get krb5 tgt, convert krb5 tgt to krb4 tgt (krb524), get afs tokens with krb5_afslog, optinal native kth-krb4 ticket grabing.=20 New codes which are not in the main pam_krb5: --------------------------------------------- I wrote a new code which is usefull e.g at ssh with token forwarding. It try to use and convert the forwarded krb5 tgt to krb4 tgt and to afs tokens. (like pam_openafs_session) New refresh_creds option. See more in the README: refresh_creds or refresh_tokens=20 It try to refresh the existent credentials and tokens. If it can't refresh a cred (maybe because the user's principal and the ticket's principal are different) then it will dont save the the cred which was acquired during authentication unless you use the retain_creds option. It is very userfull e.g with xlock. If you unlock the display then it will refresh your creds if possible. You can download my pam_krb5 heimdal port (which i hope works with mit-krb5 too, let me known if not) from: http://www.rit.bme.hu/~balsa/pam_krb5/pam_krb5-heimdal-1_3-rc3.tar.gz Any comments are welcome !! balsa From joerg@alea.gnuu.de Thu Oct 31 14:05:06 2002 From: joerg@alea.gnuu.de (Joerg Sommer) Date: Thu, 31 Oct 2002 14:05:06 +0000 (UTC) Subject: [OpenAFS] switch from memcache to diskcache Message-ID: Hi, is it possible to instruct afsd to use a disk cache, if it was started with -memcache? And better, but I don't belive it is possible, can I tell afsd to leave the disk cache and only use the memcache? AFS lives till the end of init, so it isn't possible to unmount the afs disk cache. If I can tell afs to only use the memcache, I can unmount the partition and reboot the computer in a safer way. Joerg. From joerg@alea.gnuu.de Thu Oct 31 14:05:41 2002 From: joerg@alea.gnuu.de (Joerg Sommer) Date: Thu, 31 Oct 2002 14:05:41 +0000 (UTC) Subject: [OpenAFS] no cache size in cacheinfo, 100% of space Message-ID: Hi, how can I say afsd that it should use the whole partition? And can afsd determine itself the partition size? Joerg. From warlord@MIT.EDU Thu Oct 31 16:16:10 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 11:16:10 -0500 Subject: [OpenAFS] switch from memcache to diskcache In-Reply-To: References: Message-ID: No, you cannot change cache-type without shutting down AFS. What version of AFS are you using? AFS _should_ shutdown cleanly during the normal system shutdown process. -derek Joerg Sommer writes: > Hi, > > is it possible to instruct afsd to use a disk cache, if it was started > with -memcache? > > And better, but I don't belive it is possible, can I tell afsd to leave > the disk cache and only use the memcache? AFS lives till the end of init, > so it isn't possible to unmount the afs disk cache. If I can tell afs to > only use the memcache, I can unmount the partition and reboot the > computer in a safer way. > > Joerg. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 31 16:16:46 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 11:16:46 -0500 Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: References: Message-ID: No, afsd cannot determine the partition size. You need to manually specify the size of the partition in the cacheinfo file. -derek Joerg Sommer writes: > Hi, > > how can I say afsd that it should use the whole partition? And can afsd > determine itself the partition size? > > Joerg. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From rader@ginseng.hep.wisc.edu Thu Oct 31 16:50:36 2002 From: rader@ginseng.hep.wisc.edu (steve rader) Date: Thu, 31 Oct 2002 10:50:36 -0600 Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: Message from Derek Atkins of "31 Oct 2002 11:16:46 EST." Message-ID: <200210311650.KAA04422@ginseng.hep.wisc.edu> > No, afsd cannot determine the partition size. You need to manually > specify the size of the partition in the cacheinfo file. Is there a recipe for correctly calculating the max number to use in the cachinfo file based on something like df?? (With TransArc AFS, I found that using the actual amount available could result in stale files/cache problems. IIRC, I ended up with 89% of available space by trial and error.) steve - - - systems & network guy high energy physics university of wisconsin From Warren.Yenson@morganstanley.com Thu Oct 31 16:56:33 2002 From: Warren.Yenson@morganstanley.com (Warren.Yenson@morganstanley.com) Date: Thu, 31 Oct 2002 11:56:33 -0500 (EST) Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: <200210311650.KAA04422@ginseng.hep.wisc.edu> Message-ID: > > No, afsd cannot determine the partition size. You need to manually > > specify the size of the partition in the cacheinfo file. > > Is there a recipe for correctly calculating the max > number to use in the cachinfo file based on something > like df?? > > (With TransArc AFS, I found that using the actual > amount available could result in stale files/cache > problems. IIRC, I ended up with 89% of available > space by trial and error.) Yes. We have noticed that we can use about 85% of the size of our afs cache partition. In dealing with dedicated partitions, keep in mind that the CacheItems file nor the space for files/directories are themself not included in the limit, and that the -blocks setting for afsd is a soft limit. The cache manager will overshoot that limit, and periodic processing will bring it back under at regular intervals. - Warren From warlord@MIT.EDU Thu Oct 31 17:17:48 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 12:17:48 -0500 Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: References: Message-ID: Yea, 85% is about right. Also note that you have a "finite" (and knowable) number of files on the cache partition, so you can always increase the space usage on a partition by tuning the filesystem and lowering the number of inodes available. However you still need to worry about journal sizes, directory entries, and the CacheItems file(s). -derek writes: > Yes. We have noticed that we can use about 85% of the size of our afs > cache partition. > > In dealing with dedicated partitions, keep in mind that the CacheItems > file nor the space for files/directories are themself not included in the > limit, and that the -blocks setting for afsd is a soft limit. The cache > manager will overshoot that limit, and periodic processing will bring it > back under at regular intervals. > > - Warren > -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From joerg@alea.gnuu.de Thu Oct 31 17:37:33 2002 From: joerg@alea.gnuu.de (Joerg Sommer) Date: Thu, 31 Oct 2002 17:37:33 +0000 (UTC) Subject: [OpenAFS] switch from memcache to diskcache References: Message-ID: Derek Atkins wrote: > No, you cannot change cache-type without shutting down AFS. > What version of AFS are you using? AFS _should_ shutdown cleanly version: Debian openafs 1.2.7-2 > during the normal system shutdown process. That's not possible. We use afs for a diskless client and so it's impossible to unmount /sbin while init is running. (If you see a way, I would be very happy.) So we shutdown all processes and unmount all filesystems, they not needed, and then reboot the computer. So afs is killed and the filesystem with the afs cache is lets unclean. If we unmount the afs cache, it's not possible to bring init to an end because the afs module accesses after unmount the cache and the system crashes. A switch to memcache could prevent the destroying of the filesystem. Joerg. From joerg@alea.gnuu.de Thu Oct 31 17:39:47 2002 From: joerg@alea.gnuu.de (Joerg Sommer) Date: Thu, 31 Oct 2002 17:39:47 +0000 (UTC) Subject: [OpenAFS] no cache size in cacheinfo, 100% of space References: Message-ID: Derek Atkins wrote: > No, afsd cannot determine the partition size. You need to manually > specify the size of the partition in the cacheinfo file. :((( Why? afsd tell me, that I assign more then 95% of the disk size for the cache. So it calculates the disk size. Why it couldn't use it? And why it couldn't use 100% of the disk space? From shadow@dementia.org Thu Oct 31 17:47:45 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 31 Oct 2002 12:47:45 -0500 (EST) Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: Message-ID: On Thu, 31 Oct 2002, Joerg Sommer wrote: > Derek Atkins wrote: > > No, afsd cannot determine the partition size. You need to manually > > specify the size of the partition in the cacheinfo file. > > :((( Why? afsd tell me, that I assign more then 95% of the disk size for > the cache. So it calculates the disk size. Why it couldn't use it? I suspect it could, but it doesn't now, actually. > And why it couldn't use 100% of the disk space? Someone already answered this; You will briefly go above 100% usage before the cache truncation daemon brings things back into line. Several versions ago of Transarc AFS, there was a bug where cache utilization could go considerably over 100%, I think I recall. From joerg@alea.gnuu.de Thu Oct 31 17:49:36 2002 From: joerg@alea.gnuu.de (Joerg Sommer) Date: Thu, 31 Oct 2002 17:49:36 +0000 (UTC) Subject: [OpenAFS] no cache size in cacheinfo, 100% of space References: Message-ID: Derek Atkins wrote: > Yea, 85% is about right. Also note that you have a "finite" (and > knowable) number of files on the cache partition, so you can always > increase the space usage on a partition by tuning the filesystem and > lowering the number of inodes available. However you still need to > worry about journal sizes, directory entries, and the CacheItems > file(s). I give the size given by df -k to afs and then recreate the fs with a lower count of inodes, afer I saw how may files afs creates. Can I calculate this by myself? It I assign more then 100% of disk space to afs, it doesn't woory about this. I then get error messages from the filesystem of unaccessable inodes, but afsd tries to use more then 100% of disk space, even though it determines, that the given size is to great. It's a bug! Joerg. From warlord@MIT.EDU Thu Oct 31 18:32:05 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 13:32:05 -0500 Subject: [OpenAFS] switch from memcache to diskcache In-Reply-To: References: Message-ID: HUH??? I dont understand your file system layout. If you are running diskless (frankly a silly thing to do in this day and age of $100 80-GB disks), then why don't you always run AFS with a memcache? Are you saying that you are: 1) running diskless, and 2) running your _ROOT FILESYSTEM_ out of AFS??? -derek Joerg Sommer writes: > Derek Atkins wrote: > > No, you cannot change cache-type without shutting down AFS. > > What version of AFS are you using? AFS _should_ shutdown cleanly > > version: Debian openafs 1.2.7-2 > > > during the normal system shutdown process. > > > That's not possible. We use afs for a diskless client and so it's > impossible to unmount /sbin while init is running. (If you see a way, I > would be very happy.) So we shutdown all processes and unmount all > filesystems, they not needed, and then reboot the computer. So afs is > killed and the filesystem with the afs cache is lets unclean. If we > unmount the afs cache, it's not possible to bring init to an end because > the afs module accesses after unmount the cache and the system crashes. > > A switch to memcache could prevent the destroying of the filesystem. > > Joerg. > _______________________________________________ > OpenAFS-info mailing list > OpenAFS-info@openafs.org > https://lists.openafs.org/mailman/listinfo/openafs-info -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From warlord@MIT.EDU Thu Oct 31 18:35:01 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 13:35:01 -0500 Subject: [OpenAFS] no cache size in cacheinfo, 100% of space In-Reply-To: References: Message-ID: Joerg Sommer writes: > I give the size given by df -k to afs and then recreate the fs with a > lower count of inodes, afer I saw how may files afs creates. Can I > calculate this by myself? > > It I assign more then 100% of disk space to afs, it doesn't woory about > this. I then get error messages from the filesystem of unaccessable > inodes, but afsd tries to use more then 100% of disk space, even though > it determines, that the given size is to great. It's a bug! No, it's user configuration dain-bramage. How is AFS supposed to know whether the parition filled because of itself of because you decided to drop a large temp-file on the partition? afsd CANNOT know that you're on a dedicated partition, and historically there are sites that DO NOT run with a dedicated cache partition. Just run df, tune down to 85%, and live with the fact that your cache wont use those few extra megabytes. > Joerg. -derek -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From flash@itp.tu-graz.ac.at Thu Oct 31 18:46:25 2002 From: flash@itp.tu-graz.ac.at (Christian Pfaffel) Date: 31 Oct 2002 19:46:25 +0100 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: <1036077256.20198.19.camel@balcsi> References: <1036077256.20198.19.camel@balcsi> Message-ID: <7g8z0e4fb2.fsf@faeppc20.tu-graz.ac.at> Balazs GAL writes: > 2002-10-30, sze keltezéssel Charles Clancy ezt írta: > > > I do not even get the TGT if I authenticate to xlock | xscreensaver. > > > It never does renew my TGT. klist befor and after xlock show the > > > same > > > expiration times for it. > > > > Maybe try adding "reuse_ccache" as an option to pam_krb5. I'm not > > entirely sure -- I've not played with pam_krb5 nearly as much as > pam_afs. > > Please read the thread: > > http://www.stacken.kth.se/lists/heimdal-discuss/2002-08/msg00002.html > > My heimdal port of Nalin's (RedHat) pam_krb5 have the above feature. [...snip...] Hi, I compiled your module and installed it, but i failed to get afs tokens on log in, when i use the same parameters as for the rh supplied pam_krb5 module. I have not had the time to examine your changes, so that i would know why they fail. I just took a small look at them, but as far as i can i tell, it is definitely much more than i did, especially since you have many changes concerning heimdal. regards, Christian -- PGP-Key: http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg From adi@drcomp.erfurt.thur.de Thu Oct 31 20:21:21 2002 From: adi@drcomp.erfurt.thur.de (Adrian Knoth) Date: Thu, 31 Oct 2002 21:21:21 +0100 Subject: [OpenAFS] switch from memcache to diskcache In-Reply-To: References: Message-ID: <20021031202121.GA1913@drcomp.erfurt.thur.de> On Thu, Oct 31, 2002 at 01:32:05PM -0500, Derek Atkins wrote: > I dont understand your file system layout. The kernel creates an initial ramdisk (minix) and loads the AFS-modules. A cache-partition is active. Afterwards, afsd is startet and the whole system from the /afs-tree is bind-mounted over the existing /sbin, /bin and so on. Then init is replaced by the standard init and the system boots. > If you are running diskless (frankly a silly thing to do in this day > and age of $100 80-GB disks), It is not silly. We're running this setup on 15 clients at university. It will be extended to hundred or more clients in the near future. By doing this we have absolutely no administrative efforts/costs, because a centralized installation is used for all clients. Because of some modifications there is even no need for host-specific /etc. > then why don't you always run AFS with a memcache? This would be good if we have more RAM. And a disk-cache is nice for reducing the network-bottleneck, even between reboots. > Are you saying that you are: > 1) running diskless, and > 2) running your _ROOT FILESYSTEM_ out of AFS??? A virtual root-fs, yes. / is ramdisk, but in fact all entries below /bin, /etc, /usr and so is imported via AFS. -- mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver Wer die Hände in den Schoß legt, muß noch lange nicht untätig sein From mpb@est.ibm.com Thu Oct 31 20:49:12 2002 From: mpb@est.ibm.com (Paul Blackburn) Date: Thu, 31 Oct 2002 20:49:12 +0000 Subject: [OpenAFS] no cache size in cacheinfo, 100% of space References: Message-ID: <3DC19748.9000400@est.ibm.com> Joerg Sommer wrote: >Hi, > >how can I say afsd that it should use the whole partition? And can afsd >determine itself the partition size? > >Joerg. >_______________________________________________ >OpenAFS-info mailing list >OpenAFS-info@openafs.org >https://lists.openafs.org/mailman/listinfo/openafs-info > > afsd is not able to use 100% of the disk cache partition. There is some explanation in the Transarc AFS documentation here: http://www.transarc.ibm.com/Library/documentation/afs/3.6/unix/en_US/HTML/QkBegin/auqbg007.htm#HDRWQ146 If you look at the disk cache (eg /usr/vice/cache in Transarc AFS) just after you install and start the AFS Cache Manager and before you start accessing files in /afs, you will find lots of files used by the Cache Manager. The "rule of thumb" for computing the cache size from the disk cache local filesystem size (eg /usr/vice/cache) is 80% for AIX. I wrote some scripts to automate installation of AFS on AIX ( http://www.angelfire.com/hi/plutonic/afs_install.html ). This ksh snippet from afs_install's mk-afs-cli script shows the calculation: > # Compute a value for the cache size to save in /usr/vice/etc/cacheinfo > # For AIX 3.2 the size should be 80% of the filesystem size. > # > # In /usr/vice/cacheinfo, the cachesize is expressed in kilobytes. > # From qhost, afscache_sizeMB is in MB, there are 1024 KB in a MB: > > let cachesize=\(\(${afscache_sizeMB}\*1024\)\*80\)/100 > > doit "echo /afs:${afscachename}:${cachesize} >/usr/vice/etc/cacheinfo" -- cheers paul http://acm.org/~mp From warlord@MIT.EDU Thu Oct 31 20:53:26 2002 From: warlord@MIT.EDU (Derek Atkins) Date: 31 Oct 2002 15:53:26 -0500 Subject: [OpenAFS] switch from memcache to diskcache In-Reply-To: <20021031202121.GA1913@drcomp.erfurt.thur.de> References: <20021031202121.GA1913@drcomp.erfurt.thur.de> Message-ID: First, I don't understand -- if your machines are diskless then how does a "disk cache" save startup time? You're not saving data to any disk -- you HAVE no disk. Based on your design, the only way to shut AFS down cleanly is to umount /etc, /usr, and so forth, _then_ shutdown AFS from within the root ramdisk (the same way it was started), and then complete the shutdown. All you need to do is "unmount /afs" after all references are cleared. Note that AFS was never designed or meant to be a root file system, so you shouldn't complain when it doesn't work ;) Also note that you -can- have "dataless" workstations that have disks -- systems that are centrally administered and maintained, with a centralized image... If you do that then all this goes away. Yes, it adds aboout $100 to the cost of your machines, but frankly it saves your network. There is no way your network could deal with a restart avalanche of 1000 diskless machines! -derek Adrian Knoth writes: > On Thu, Oct 31, 2002 at 01:32:05PM -0500, Derek Atkins wrote: >=20 > > I dont understand your file system layout.=20=20 >=20 > The kernel creates an initial ramdisk (minix) and loads the AFS-modules. > A cache-partition is active. Afterwards, afsd is startet and the whole=20 > system from the /afs-tree is bind-mounted over the existing /sbin, /bin > and so on. Then init is replaced by the standard init and the system > boots. >=20 > > If you are running diskless (frankly a silly thing to do in this day=20 > > and age of $100 80-GB disks), >=20 > It is not silly. We're running this setup on 15 clients at university. > It will be extended to hundred or more clients in the near future. >=20 > By doing this we have absolutely no administrative efforts/costs, because > a centralized installation is used for all clients. Because of some > modifications there is even no need for host-specific /etc. >=20 > > then why don't you always run AFS with a memcache?=20=20 >=20 > This would be good if we have more RAM. And a disk-cache is nice for > reducing the network-bottleneck, even between reboots. >=20 > > Are you saying that you are: > > 1) running diskless, and > > 2) running your _ROOT FILESYSTEM_ out of AFS??? >=20 > A virtual root-fs, yes. / is ramdisk, but in fact all entries below /bin, > /etc, /usr and so is imported via AFS. >=20 >=20 > --=20 > mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver >=20 > Wer die H=E4nde in den Scho=DF legt, mu=DF noch lange nicht unt=E4tig sein --=20 Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord@MIT.EDU PGP key available From adi@drcomp.erfurt.thur.de Thu Oct 31 21:10:45 2002 From: adi@drcomp.erfurt.thur.de (Adrian Knoth) Date: Thu, 31 Oct 2002 22:10:45 +0100 Subject: [OpenAFS] switch from memcache to diskcache In-Reply-To: References: <20021031202121.GA1913@drcomp.erfurt.thur.de> Message-ID: <20021031211045.GB2716@drcomp.erfurt.thur.de> On Thu, Oct 31, 2002 at 03:53:26PM -0500, Derek Atkins wrote: > First, I don't understand -- if your machines are diskless then > how does a "disk cache" save startup time? You're not saving data > to any disk -- you HAVE no disk. Ok, we have no disk for data. There is a 20GB-SCSI-disk. We use it mainly for caching (afsd). > _then_ shutdown AFS from within the root ramdisk (the same way it was > started), I guess there is no easy way to do this, but we'll see. > Note that AFS was never designed or meant to be a root file system, Oh, it works very well in this way. :) If I could add a wish: ACLs for files, not only for directories. SCNR :) > Also note that you -can- have "dataless" workstations that have disks We have. > Yes, it adds aboout $100 to the cost of your machines, but frankly it saves > your network. We migrated from workstation-installation (every node ran SuSE from disk) to the AFS-root-version (now using Debian), so the disks were present right from the beginning. > There is no way your network could deal with a restart avalanche of 1000 > diskless machines! I think so, too. Perhaps with a lot of replication-servers, independend switches and a time-multiplexed boot it would be possible, but to say it again: you don't recognize any speedproblems with this cached approach. It feels very "local" :) -- mail: adi@thur.de http://adi.thur.de PGP: v2-key via keyserver Ich bin nicht arbeitslos! - Jeden Tag kommt eine neue Stellung dazu! From Phil.Moore@morganstanley.com Thu Oct 31 21:19:44 2002 From: Phil.Moore@morganstanley.com (Phil.Moore@morganstanley.com) Date: Thu, 31 Oct 2002 16:19:44 -0500 Subject: [OpenAFS] cache performance In-Reply-To: References: <15808.19578.114390.231941@zappa.ms.com> Message-ID: <15809.40560.165717.232715@zappa.ms.com> >>>>> "Derrick" == Derrick J Brashear writes: Phil> I think that option post-dates my hands on administration of AFS :-( Derrick> Nathan wrote it for OpenAFS, so, yeah, pretty much;-) Someday, I hope to code again, too :-( Nathan> Yeah, that's what Derrick and I were thinking, something similar in Nathan> nature to fstrace. Phil> However, I want to architect the mechanism to be a bit more manageable Phil> and robust than a debugging tool, and most importantly, we need to Phil> minimize the performance impact, of course. Derrick> Do you consider fstrace robust? Well, I don't know -- has anyone ever run it 24x7 to gather data? From nneul@umr.edu Thu Oct 31 21:24:30 2002 From: nneul@umr.edu (Nathan Neulinger) Date: 31 Oct 2002 15:24:30 -0600 Subject: [OpenAFS] cache performance In-Reply-To: <15809.40560.165717.232715@zappa.ms.com> References: <15808.19578.114390.231941@zappa.ms.com> <15809.40560.165717.232715@zappa.ms.com> Message-ID: <1036099470.8601.33.camel@cessna.rollanet.org> > Derrick> Do you consider fstrace robust? > > Well, I don't know -- has anyone ever run it 24x7 to gather data? Not sure about transarc's version, but up till a couple months ago, you'd fill all available memory if you tried running it for more than a half hour or so, as it had a really bad memory leak. Possibly stopping and restarting would work. -- Nathan ------------------------------------------------------------ Nathan Neulinger EMail: nneul@umr.edu University of Missouri - Rolla Phone: (573) 341-4841 Computing Services Fax: (573) 341-4216 From shadow@dementia.org Thu Oct 31 21:42:36 2002 From: shadow@dementia.org (Derrick J Brashear) Date: Thu, 31 Oct 2002 16:42:36 -0500 (EST) Subject: [OpenAFS] cache performance In-Reply-To: <15809.40560.165717.232715@zappa.ms.com> Message-ID: On Thu, 31 Oct 2002 Phil.Moore@morganstanley.com wrote: > Nathan> Yeah, that's what Derrick and I were thinking, something similar in > Nathan> nature to fstrace. > > Phil> However, I want to architect the mechanism to be a bit more manageable > Phil> and robust than a debugging tool, and most importantly, we need to > Phil> minimize the performance impact, of course. > > Derrick> Do you consider fstrace robust? > > Well, I don't know -- has anyone ever run it 24x7 to gather data? Yes, but I haven't pulled all that data from it, only as interesting events happened. From hotz@jpl.nasa.gov Thu Oct 31 23:57:49 2002 From: hotz@jpl.nasa.gov (Henry B. Hotz) Date: Thu, 31 Oct 2002 15:57:49 -0800 Subject: [OpenAFS] Re: Kerberos V and xscreensaver/xlock In-Reply-To: <20021031170103.0525F9C2F@grand.central.org> References: <20021031170103.0525F9C2F@grand.central.org> Message-ID: At 4:14 PM +0100 10/31/02, Balazs GAL wrote: >You can download my pam_krb5 heimdal port (which i hope works with >mit-krb5 too, let me known if not) from: > >http://www.rit.bme.hu/~balsa/pam_krb5/pam_krb5-heimdal-1_3-rc3.tar.gz > >Any comments are welcome !! > >balsa Take a look at /afs/jpl.nasa.gov/home/h/hotz/public/pam/. I took a crude hack at making it work on MacOS X.2 (Jaguar). autogen make distclean ./configure --with-krb5 make >&make.log That's after blanket changing "security" to "pam" everywhere since that's where both the libraries and the includes are on OSX. Looks like some problem with flex/yacc. I'm willing to try any suggestions you have. I also have a request in to Apple for how to link pam modules on OSX since it isn't a gnu linker. -- The opinions expressed in this message are mine, not those of Caltech, JPL, NASA, or the US Government. Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu From marquett@iap.fr Thu Oct 31 17:20:19 2002 From: marquett@iap.fr (Marquette Jean-Baptiste) Date: 31 Oct 2002 18:20:19 +0100 Subject: [OpenAFS] Error message under RedHat 8.0 Message-ID: <1036084819.1354.4.camel@dhcp211.iap.fr> Dear OpenAFS gurus, I have updated my RedHat 8.0 distribution with the 2.4.18-17.8.0 version of the kernel. After reboot I have the message "Failed to load AFS client, not starting AFS services". Thus I have recompiled the openafs source from the latest stable version of the tar-gzipped file but the error message remains the same. Note that AFS works well with the previous 2.4.18-14 kernel. Note also that libafs-2.4.18-17.8.0.o and libafs-2.4.18-17.8.0.mp.o exist in /usr/vice/etc/modload BUT /usr/vice/etc/modload/libafs.map contains : /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: unresolved symbol kallsyms_symbol_to_address /usr/vice/etc/modload/libafs-2.4.18-17.8.0.o: Hint: You are trying to load a module without a GPL compatible license and it has unresolved symbols. Contact the module supplier for assistance, only they can help you. Thus any hint welcome. -- Bien cordialement/Very truly yours/Mit freundlichen Gruessen, Jean-Baptiste Marquette Institut d'Astrophysique de Paris 98bis Bd Arago - 75014 Paris - France Tel +33(0)1 44 32 81 96 - Fax +33(0)1 44 32 80 01 From cameron@ctcnsc.org Thu Oct 31 17:32:59 2002 From: cameron@ctcnsc.org (Frank Cameron) Date: Thu, 31 Oct 2002 12:32:59 -0500 Subject: [OpenAFS] Re: afsdacl In-Reply-To: <200210301714.10741.iddwb@moroni.pp.asu.edu>; from iddwb@moroni.pp.asu.edu on Wed, Oct 30, 2002 at 05:14:10PM -0700 References: <20021029163102.65D9A9D7C@grand.central.org> <1035941569.1522.12.camel@localhost.localdomain> <200210301714.10741.iddwb@moroni.pp.asu.edu> Message-ID: <20021031123259.A904869@sgi2.ctcnsc.org> On Wed, Oct 30, 2002 at 05:14:10PM -0700, David Bear wrote: > On 2002 10 29 18:32, Frank J. Cameron wrote: > > afsdacl -set > > Is this executable available elsewhere -- outside of patch3. > > otherwise, what does it do as to windows that we might otherwise replicate? > If it sets regkey acls I could do that with some other mechanism. You might be able to download Patch 5.1 from here: http://www.transarc.ibm.com/Downloads/afs36/index.html >From the patch README: # Defect 12702 This fix provides a new binary that enables administrators to grant all users permission to start and stop an AFS service on a Windows NT/2000 system. A default security descriptor on the afsd server permits the following access: * Members of the Power Users group and the LocalSystem account have SERVICE_START, SERVICE_PAUSE_CONTINUE, and SERVICE_STOP access, plus the access rights granted to all users. * Members of the Administrators and System Operators groups have SERVICE_ALL_ACCESS access. With this default, only Administrative users can start and stop the afsd_service. To allow all users to start and stop the afsd_service, the DACL of the AFS service object must be modified. The following command changes the DACL: afsdacl [-set] [-revoke] where: -set sets the DACL on AFS service to allow all users in USERS group to start and stop services. -revoke revokes the DACL. Only administrators can start and stop services. The afsdacl binary is installed in AFS/Client/Program. It looks like it modifies the value of this registry key: HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Security\ Security It's hard to tell exactly what it does since this key is in hex. I had a document that described in some detail what was being done; but, I wasn't able to find it this morning. (Also, I can't remember clearly enough if it was from Transarc describing this particular tool or from Microsoft describing service security in general.)