[OpenAFS] Stuck in Quick start guide at "fs: You don't have the required access rights on '/afs'"

[Karl-Philipp Richter]

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--A3FM3olIgLEhrEXfSBD9MUNVjwfOFhU2m
Content-Type: multipart/mixed; boundary="ChtOuw6u5gwq7GpcKC52gQL4d8VHgsRSC"
From: Karl-Philipp Richter <richter@richtercloud.de>
To: Benjamin Kaduk <kaduk@mit.edu>
Cc: "openafs-info@openafs.org" <openafs-info@openafs.org>
Message-ID: <56DD8ADB.7040409@richtercloud.de>
Subject: Re: [OpenAFS] Stuck in Quick start guide at "fs: You don't have the
 required access rights on '/afs'"
References: <56DB3E41.2060200@richtercloud.de>
 <6ac019afe3524aa08f6153ea6757a596@sinenomine.net>
 <56DB8551.9010208@richtercloud.de>
 <alpine.GSO.1.10.1603070012031.26829@multics.mit.edu>
In-Reply-To: <alpine.GSO.1.10.1603070012031.26829@multics.mit.edu>

--ChtOuw6u5gwq7GpcKC52gQL4d8VHgsRSC
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable



Am 07.03.2016 um 06:18 schrieb Benjamin Kaduk:
> It is certainly possible to update the quickstart guide.  Concrete
> references to a section number or HTML url wherein you want the change =
to
> be made would help.
>=20
> Looking at http://docs.openafs.org/QuickStartUnix/HDRWQ80.html, I see:
>=20
> % The top-level AFS directory, typically /afs, is a special case: when =
the
> % client is configured to run in dynroot mode (e.g. afsd -dynroot,
> % attempts to set the ACL on this directory will return Connection time=
d
> % out. This is because the dynamically- generated root directory is not=
 a
> % part of the global AFS space, and cannot have an access control list =
set
> % on it.
>=20
> Prior to that is a note about "When the root.afs volume is replicated, =
the
> Cache Manager is programmed to access its read-only version
> (root.afs.readonly) whenever possible.", and a note that mounting the
> read-write copy elsewhere is needed in order to make modifications.
I would appreciate some recovery instructions, since the feedback of
OpenAFS will take time to be intuitive (e.g. this issue mentioned here
was caused by errornous kerberos encryption algorithms in the referenced
post and there's no way of knowing that and kerberos gives sadist
feedback like `kadmind: No such file or directory while initializing,
aborting`).

If the quick start guide becomes too large I'd kick the whole
system-specific service setup routines or move them to another document,
maybe a wiki or a Q&A since it's obsolete already since `systemd` isn't
covered.

Concretely, in section 2.24:

  - So 1. basically wants to say if `-dynroot` is enabled, then 1. isn't
necessary and no alternative action needs to be performed? Anything else
isn't possible, but the reader still wonders why it's not written that
clearly, so that should be done.
  - How am I supposed to get to the replication step if already setting
the ACL on /afs fails with `-dynroot` disabled? Both the explanation and
the commands are after setting those. If creating the read-write mount
point is a precondition to be able to set ACL, then it a tautology
because it depends itself on setting the ACL on / - obviously in my case
only since other people have set up AFS volumes already.

> That posting predates
> http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt; you should n=
ot
> use des-cbc-crc (or des-cbc-md5 or other single-des enctypes) for the A=
FS
> cell-wide key.  (If the Quick Start guide indicates to create a single-=
des
> key, please let me know -- I thought I had removed all such references.=
)
I didn't, but to make sure (since OpenAFS error messages generally don't
explain the reason for the error), how would I purge such a key from the
setup? Is deleting the keytab and recreating it sufficient?

Thanks for you support.

-Kalle


--ChtOuw6u5gwq7GpcKC52gQL4d8VHgsRSC--

--A3FM3olIgLEhrEXfSBD9MUNVjwfOFhU2m
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJW3YrcAAoJEGadKJ8eJ7ZGoFoH/0piKmZGnCmB3nKi3kv/v7y+
yC1SrcbSRHUE+Ocvk7sKYvNLuG7+No3/jEessq0COYNZK+kMZAGBfVz6NktfnBy2
xBIpzmG5xFxgCX1lB7JW0fVRtyXMwaOG60n5+hGBLYTE2SL/c1peZp9rPazkzEjm
h9W+arjTz82VI9tuHtvkY2HEFU8q1bsvLNB6b2Z7UHHJFCThWdP6R/YGUrW7MC+N
WWSMHFDl0JPtT6B88bII+kJUgj8CX2emW2DutW+q3pvX11NbGobiW0d6J1ES9MY/
2rOMwOInfeq1c3tkuaIYV06NHaRBTngw9I1s7M+KvNyX5dX86MyQbVGzHy3xUhI=
=mYPt
-----END PGP SIGNATURE-----

--A3FM3olIgLEhrEXfSBD9MUNVjwfOFhU2m--