[OpenAFS] SuSe 9.0 &Heimdal.6
ted creedon
tcreedon@easystreet.com
Sun, 21 Dec 2003 12:24:17 -0800
This is a multi-part message in MIME format.
------=_NextPart_000_0009_01C3C7BD.5A665C70
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Any one having luck with the following instructions buried in the =
sources
for openafs from SuSe:
=20
SuSE.txt tells how to create tickets for afs, deletes the sha1 =
encryption
for afs and exports them to the KeyFile
=20
Running tokens does show an afs token and the everything seems to work =
until
one does
=20
kinit admin
=20
shemya: fs setacl /afs system:anyuser rl
fs: You don't have the required access rights on '/afs'
=20
not only does system not have fs rights you can't ls /afs either - you =
get a
permission denied error
=20
Any clues? Could it be that /afs is in a reiserfs?
=20
Thanks
=20
Tedc
=20
SuSE>TXT=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Here is described installation of openafs server and client on SuSE =
linux.
This text is based on AFS Quick Start Guide. The differences are:
- paths are adapted to SuSE installation
- uses Kerberos 5 authentization
Complete OpenAFS documentation is at http://openafs.org
SERVER SETUP
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
# create a partition for AFS filesystem and mount it under /vicepa
# start bosserver
/usr/sbin/bosserver -noauth &
# setup basic cell information
bos setcellname your.afs.server your.cell.name -noauth=20
# setup database servers processes
bos create your.afs.server ptserver simple /usr/lib/openafs/ptserver =
-cell
your.cell.name -noauth
bos create your.afs.server buserver simple /usr/lib/openafs/buserver =
-cell
your.cell.name -noauth
bos create your.afs.server vlserver simple /usr/lib/openafs/vlserver =
-cell
your.cell.name -noauth
#bos addkey your.afs.server -kvno 0 -cell your.cell.name -noauth
# setup authentication against heimdal krb5 server
# Here you can set up kerberos realm if you dont have any
# kstash
# kadmin -l
# init YOUR.KERBEROS.REALM
# enable 524 protocol in heimdal
# edit /etc/krb5.conf and add these lines:
----------------cut--------------------
[kdc]
enable-524 =3D true=20
use_2b =3D {
afs@YOUR.KERBEROS.REALM =3D yes
}
----------------cut--------------------
# restart kdc
rckdc restart
# create afs principal in kerberos database
kadmin -l
add -r afs@YOUR.KERBEROS.REALM
del_enctype afs@YOUR.KERBEROS.REALM des3-cbc-sha1
ext_keytab afs@YOUR.KERBEROS.REALM # write afs key to /etc/krb5.keytab
ext_keytab -k AFSKEYFILE:/etc/openafs/server/KeyFile
afs@YOUR.KERBEROS.REALM # give the afs key to bosserver
add admin #create user admin
# give admin the permissions to control bosserver
bos adduser your.afs.server admin -cell your.cell.name -noauth
# add admin to group system:administrators
pts createuser -name admin -id <user id> -cell your.cell.name -noauth
pts adduser admin system:administrators -cell your.cell.name -noauth
# restart bos server
bos restart your.afs.server -all -cell your.cell.name -noauth
# create fileserver processes
bos create your.afs.server fs fs /usr/lib/openafs/fileserver
/usr/lib/openafs/volserver /usr/lib/openafs/salvager -cell =
your.cell.name
-noauth
# create root volume
vos create your.afs.server /vicepa root.afs -cell your.cell.name -noauth
# restart bosserver with security enabled
rcafs-server restart
CLIENT SETUP
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
edit /etc/sysconfig/afs-client, set at least
REGENERATE_CELL_INFO=3D"yes"
THIS_CELL=3D"your.cell.name"
THIS_CELL_SERVER=3D"your.afs.server"
If you are configuring first afs server and the volume root.cell does =
not
exist yet, you have to set also DYNROOT=3Dno. After finishing the =
server=20
installaton it is better to change DYNROOT back to 'yes' as the client
behaves better on startup with network outage.
# start afs client
rcafs-client start
# login as admin
kinit admin
To enable transparent login via pam, install package pam_krb5
and add 'call_modules=3Dkrb5afs' to /etc/security/pam_unix2.conf
For details look at pam_krb5afs(5), pam_krb5afs(8) and pam_unix2(8)
manpages.
Now you have working afs server and client. You can continue with =
chapter
"Configuring the Top Levels of the AFS Filespace" of AFS Quick Start =
Guide.
=20
END =
SUSE.TXT=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
/etc/pam.d/login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D\
#%PAM-1.0
auth requisite pam_unix2.so nullok #set_secrpc
auth required pam_securetty.so
auth required pam_nologin.so
auth required pam_krb5afs.so try_first_pass #ignore root =
left
out tgc
#auth sufficient pam_afs.so try_first_pass #ignore root left out =
tgc
#auth required pam_homecheck.so
auth required pam_env.so
auth required pam_mail.so
account required pam_unix2.so
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass
use_authtok
session required pam_unix2.so none # debug or trace
session required pam_limits.so
session optional pam_krb5.so debug
END
/etc/pam.d/login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
/etc/sysconfig/afs-client=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
## Path: Network/File systems/AFS client
## Description: AFS client configuration
## Type: yesno
## Default: no
#
# Set to "yes" if you want to generate CellServDB and ThisCell files
# from THIS_CELL and THIS_CELL_SERVER variables.
# If you want more complicated setting, set REGENERATE_CELL_INFO to "no"
# and edit the files manually.
#
REGENERATE_CELL_INFO=3D"yes"
## Type: string
## Default: ""
#
# This cell name
#
THIS_CELL=3D"ted-cell"
## Type: string
## Default: ""
#
# IP address of afs server for this cell
#
THIS_CELL_SERVER=3D"10.1.1.116"
## Type: string
## Default: ""
#
# DNS name of afs server for this cell
#
THIS_CELL_SERVER_NAME=3D"shemya"
## Type: yesno
## Default: yes
#
# Set to "yes" if you want to use data encription (secure, slower)
#
DATA_ENCRYPTION=3D"yes"
## Type: yesno
## Default: yes
#
# Set to "yes" if you want to generate cacheinfo file
#
REGENERATE_CACHE_INFO=3D"yes"
## Type: string
## Default: ""
#
# AFS client configuration options
#
XXLARGE=3D"-stat 4000 -dcache 4000 -daemons 6 -volumes 256 -files 50000"
XLARGE=3D"-stat 3600 -dcache 3600 -daemons 5 -volumes 196 -files 50000"
LARGE=3D"-stat 2800 -dcache 2400 -daemons 5 -volumes 128"
MEDIUM=3D"-stat 2000 -dcache 800 -daemons 3 -volumes 70"
SMALL=3D"-stat 300 -dcache 100 -daemons 2 -volumes 50"
## Type: yesno
## Default: yes
#
# Instead of mounting the home cell's root.afs volume at the AFS mount=20
# point (typically /afs) a fake root is constructed from information=20
# available in the client's CellServDB.
# With this option enabled openafs can start up even on network outage.
#
DYNROOT=3D"no"
## Type: yesno
## Default: yes
#
# use memory-only cache
#
MEMCACHE=3D"yes"
## Type: string(AUTOMATIC)
## Default: AUTOMATIC
#
# if you set CACHESIZE to "AUTOMATIC", it will automatically be chosen
# deduced by parition sizes (does not work if your cache is on / or=20
# /usr or /var) or by machine memory size for memory-only cache,
# otherwise the values specified here will be used.
#
CACHESIZE=3D"AUTOMATIC"
## Type: string(AUTOMATIC,$XXLARGE,$XLARGE,$LARGE,$MEDIUM,$SMALL)
## Default: AUTOMATIC
#
# If you set OPTIONS to "AUTOMATIC", the init script will choose a set
# of options based on the cache size, otherwise the values specified =
here=20
# will be used.
#
OPTIONS=3D"AUTOMATIC"
## Type: string(/var/cache/openafs)
## Default: /var/cache/openafs
#
# Path to cache directory, it is recommended to use separate partition.
# It does not work on reiserfs. A valid directory must be specified=20
# even if memory only cache is used.
# Recommended cache directory is "/var/cache/openafs"
#
CACHEDIR=3D"/var/cache/openafs"
## Type: string(/afs)
## Default: /afs
#
# AFS directory. You should never need to change this=20
#
AFSDIR=3D"/afs"
## Type: yesno
## Default: no=20
#
# Set to "yes" for a lot of debugging information from afsd. Only
# useful for debugging as it prints _a lot_ of information.
#
VERBOSE=3D"no"
END
/etc/sysconfig/afs-client=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D=3D=3D=3D=3D
/etc/security/pam_unix2.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D
# pam_unix2 config file
#
# This file contains options for the pam_unix2.so module.
# It contains a list of options for every type of management group,
# which will be used for authentication, account management and
# password management. Not all options will be used from all types of
# management groups.
#
# At first, pam_unix2 will read this file and then uses the local
# options. Not all options can be set her global.
#
# Allowed options are:
#
# debug (account, auth, password, session)
# nullok (auth)
# md5 (password)
# bigcrypt (password)
# blowfish (password)
# crypt_rounds=3DXX
# none (session)
# trace (session)
# call_modules=3Dx,y,z (account, auth, password)
#
# Example:
# auth: nullok
# account:
# password: nullok blowfish crypt_rounds=3D8
# session: none
#
auth: use_ldap nullok call_modules=3Dkrb5afs
account: use_ldap
password: use_ldap nullok
session: none
END/etc/security/pam_unix2.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
=3D=3D=3D=3D=3D=3D
/var/heimdal/kdc.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D
[libdefaults]
default_realm =3D TED-DORIS.FAM
[realms]
TED-DORIS.FAM =3D {
kdc =3D 10.1.1.116:88
admin_server =3D 10.1.1.116:749
default_domain =3D ted-doris.fam
}
[domain_realm]
ted-doris.fam =3D TED-DORIS.FAM
.ted-doris.fam =3D TED-DORIS.FAM
END
/var/heimdal/kdc.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D
/etc/krb5.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D=3D=3D=3D=3D
[libdefaults]
default_realm =3D TED-DORIS.FAM
clockskew =3D 300
=20
[realms]
TED-DORIS.FAM =3D {
admin_server =3D shemya
kpasswd_server =3D shemya
default_domain =3D ted-doris.fam
kdc =3D shemya
}
[domain_realm]
.ted-doris.fam =3D TED-DORIS.FAM
ted-doris.fam =3D TED-DORIS.FAM
[logging]
default =3D SYSLOG:NOTICE:DAEMON
kdc =3D FILE:/var/log/kdc.log
kadmind =3D FILE:/var/log/kadmind.log
[appdefaults]
pam =3D {
ticket_lifetime =3D 1d
renew_lifetime =3D 1d
forwardable =3D true
proxiable =3D false
retain_after_close =3D false
minimum_uid =3D 0
afs_cells =3D ted_cell
}
=20
END
/etc/krb5.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D=3D=3D=3D=3D=3D
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
------=_NextPart_000_0009_01C3C7BD.5A665C70
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=3DEN-US link=3Dblue vlink=3Dpurple>
<div class=3DSection1>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Any one having luck with the following instructions =
buried
in the sources for openafs from SuSe:</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>SuSE.txt tells how to create tickets for afs, =
deletes
the sha1 encryption for afs and exports them to the =
KeyFile</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Running tokens does show an afs token and the =
everything
seems to work until one does</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>kinit admin</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>shemya: fs setacl /afs system:anyuser rl<br>
fs: You don't have the required access rights on =
'/afs'</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>not only does system not have fs rights you can’t ls /afs =
either -
you get a permission denied error</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>Any clues? Could it be that /afs is in a reiserfs?<br>
</span></font><font face=3DArial><span =
style=3D'font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Thanks</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Tedc</span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>SuSE>TXT=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</sp=
an></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>Here is described installation of openafs server and client on =
SuSE
linux.<br>
<br>
This text is based on AFS Quick Start Guide. The differences are:<br>
- paths are adapted to SuSE installation<br>
- uses Kerberos 5 authentization<br>
<br>
Complete OpenAFS documentation is at http://openafs.org<br>
<br>
SERVER SETUP<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
# create a partition for AFS filesystem and mount it under /vicepa<br>
<br>
# start bosserver<br>
/usr/sbin/bosserver -noauth &<br>
<br>
# setup basic cell information<br>
bos setcellname your.afs.server your.cell.name -noauth <br>
<br>
# setup database servers processes<br>
bos create your.afs.server ptserver simple /usr/lib/openafs/ptserver =
-cell
your.cell.name -noauth<br>
bos create your.afs.server buserver simple /usr/lib/openafs/buserver =
-cell
your.cell.name -noauth<br>
bos create your.afs.server vlserver simple /usr/lib/openafs/vlserver =
-cell
your.cell.name -noauth<br>
<br>
#bos addkey your.afs.server -kvno 0 -cell your.cell.name -noauth<br>
<br>
# setup authentication against heimdal krb5 server<br>
<br>
# Here you can set up kerberos realm if you dont have any<br>
# kstash<br>
# kadmin -l<br>
# init YOUR.KERBEROS.REALM<br>
<br>
# enable 524 protocol in heimdal<br>
# edit /etc/krb5.conf and add these lines:<br>
----------------cut--------------------<br>
[kdc] &n=
bsp; &nb=
sp; &nbs=
p;  =
; =
&=
nbsp; &n=
bsp;
&=
nbsp; &n=
bsp; &nb=
sp; &nbs=
p;  =
; =
&=
nbsp; &n=
bsp; <br>
enable-524 =3D true <br>
use_2b =3D {<br>
&=
nbsp;
afs@YOUR.KERBEROS.REALM =3D yes<br>
}<br>
----------------cut--------------------<br>
<br>
# restart kdc<br>
rckdc restart<br>
<br>
# create afs principal in kerberos database<br>
kadmin -l<br>
add -r afs@YOUR.KERBEROS.REALM<br>
del_enctype afs@YOUR.KERBEROS.REALM des3-cbc-sha1<br>
ext_keytab afs@YOUR.KERBEROS.REALM # write afs key to =
/etc/krb5.keytab<br>
ext_keytab -k AFSKEYFILE:/etc/openafs/server/KeyFile
afs@YOUR.KERBEROS.REALM # give the afs key to bosserver<br>
add admin #create user admin<br>
<br>
# give admin the permissions to control bosserver<br>
bos adduser your.afs.server admin -cell your.cell.name -noauth<br>
<br>
# add admin to group system:administrators<br>
pts createuser -name admin -id <user id> -cell your.cell.name =
-noauth<br>
pts adduser admin system:administrators -cell your.cell.name -noauth<br>
<br>
# restart bos server<br>
bos restart your.afs.server -all -cell your.cell.name -noauth<br>
<br>
# create fileserver processes<br>
bos create your.afs.server fs fs /usr/lib/openafs/fileserver
/usr/lib/openafs/volserver /usr/lib/openafs/salvager -cell =
your.cell.name
-noauth<br>
<br>
# create root volume<br>
vos create your.afs.server /vicepa root.afs -cell your.cell.name =
-noauth<br>
<br>
# restart bosserver with security enabled<br>
rcafs-server restart<br>
<br>
<br>
CLIENT SETUP<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
edit /etc/sysconfig/afs-client, set at least<br>
REGENERATE_CELL_INFO=3D"yes"<br>
THIS_CELL=3D"your.cell.name"<br>
THIS_CELL_SERVER=3D"your.afs.server"<br>
<br>
If you are configuring first afs server and the volume root.cell =
does
not<br>
exist yet, you have to set also DYNROOT=3Dno. After finishing the =
server <br>
installaton it is better to change DYNROOT back to 'yes' as the =
client<br>
behaves better on startup with network outage.<br>
<br>
# start afs client<br>
rcafs-client start<br>
<br>
# login as admin<br>
kinit admin<br>
<br>
To enable transparent login via pam, install package pam_krb5<br>
and add 'call_modules=3Dkrb5afs' to /etc/security/pam_unix2.conf<br>
For details look at pam_krb5afs(5), pam_krb5afs(8) and pam_unix2(8) =
manpages.<br>
<br>
Now you have working afs server and client. You can continue with =
chapter<br>
"Configuring the Top Levels of the AFS Filespace" of AFS Quick =
Start
Guide.<br>
</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>END =
SUSE.TXT=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>/etc/pam.d/login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D\</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>#%PAM-1.0<br>
auth requisite =
pam_unix2.so &=
nbsp; nullok
#set_secrpc<br>
auth required pam_securetty.so<br>
auth =
required
pam_nologin.so<br>
auth required =
pam_krb5afs.so =
try_first_pass
#ignore root left out tgc<br>
#auth sufficient =
pam_afs.so try_first_pass
#ignore root left out tgc<br>
#auth required pam_homecheck.so<br>
auth =
required
pam_env.so<br>
auth required pam_mail.so<br>
account required =
pam_unix2.so<br>
password required =
pam_pwcheck.so =
nullok<br>
password required =
pam_unix2.so &=
nbsp; nullok
use_first_pass use_authtok<br>
session required =
pam_unix2.so &=
nbsp; none
# debug or trace<br>
session required =
pam_limits.so<br>
session optional =
pam_krb5.so debug</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>END =
/etc/pam.d/login=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>/etc/sysconfig/afs-client=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>## Path: Network/File
systems/AFS client<br>
## Description: AFS client configuration<br>
## Type: yesno<br>
## Default: no<br>
#<br>
# Set to "yes" if you want to generate CellServDB and ThisCell
files<br>
# from THIS_CELL and THIS_CELL_SERVER variables.<br>
# If you want more complicated setting, set REGENERATE_CELL_INFO to
"no"<br>
# and edit the files manually.<br>
#<br>
REGENERATE_CELL_INFO=3D"yes"<br>
<br>
## Type: string<br>
## Default: ""<br>
#<br>
# This cell name<br>
#<br>
THIS_CELL=3D"ted-cell"<br>
<br>
## Type: string<br>
## Default: ""<br>
#<br>
# IP address of afs server for this cell<br>
#<br>
THIS_CELL_SERVER=3D"10.1.1.116"<br>
<br>
## Type: string<br>
## Default: ""<br>
#<br>
# DNS name of afs server for this cell<br>
#<br>
THIS_CELL_SERVER_NAME=3D"shemya"<br>
<br>
## Type: yesno<br>
## Default: yes<br>
#<br>
# Set to "yes" if you want to use data encription (secure, =
slower)<br>
#<br>
DATA_ENCRYPTION=3D"yes"<br>
<br>
## Type: yesno<br>
## Default: yes<br>
#<br>
# Set to "yes" if you want to generate cacheinfo file<br>
#<br>
REGENERATE_CACHE_INFO=3D"yes"<br>
<br>
## Type: string<br>
## Default: ""<br>
#<br>
# AFS client configuration options<br>
#<br>
XXLARGE=3D"-stat 4000 -dcache 4000 -daemons 6 -volumes 256 -files
50000"<br>
XLARGE=3D"-stat 3600 -dcache 3600 -daemons 5 -volumes 196 -files =
50000"<br>
LARGE=3D"-stat 2800 -dcache 2400 -daemons 5 -volumes 128"<br>
MEDIUM=3D"-stat 2000 -dcache 800 -daemons 3 -volumes 70"<br>
SMALL=3D"-stat 300 -dcache 100 -daemons 2 -volumes 50"<br>
<br>
## Type: yesno<br>
## Default: yes<br>
#<br>
# Instead of mounting the home cell's root.afs volume at the AFS mount =
<br>
# point (typically /afs) a fake root is constructed from information =
<br>
# available in the client's CellServDB.<br>
# With this option enabled openafs can start up even on network =
outage.<br>
#<br>
DYNROOT=3D"no"<br>
<br>
## Type: yesno<br>
## Default: yes<br>
#<br>
# use memory-only cache<br>
#<br>
MEMCACHE=3D"yes"<br>
<br>
## Type: string(AUTOMATIC)<br>
## Default: AUTOMATIC<br>
#<br>
# if you set CACHESIZE to "AUTOMATIC", it will automatically =
be
chosen<br>
# deduced by parition sizes (does not work if your cache is on / or <br>
# /usr or /var) or by machine memory size for memory-only cache,<br>
# otherwise the values specified here will be used.<br>
#<br>
CACHESIZE=3D"AUTOMATIC"<br>
<br>
## Type: =
string(AUTOMATIC,$XXLARGE,$XLARGE,$LARGE,$MEDIUM,$SMALL)<br>
## Default: AUTOMATIC<br>
#<br>
# If you set OPTIONS to "AUTOMATIC", the init script will =
choose a
set<br>
# of options based on the cache size, otherwise the values specified =
here <br>
# will be used.<br>
#<br>
OPTIONS=3D"AUTOMATIC"<br>
<br>
## Type: =
string(/var/cache/openafs)<br>
## Default: /var/cache/openafs<br>
#<br>
# Path to cache directory, it is recommended to use separate =
partition.<br>
# It does not work on reiserfs. A valid directory must be specified <br>
# even if memory only cache is used.<br>
# Recommended cache directory is "/var/cache/openafs"<br>
#<br>
CACHEDIR=3D"/var/cache/openafs"<br>
<br>
## Type: string(/afs)<br>
## Default: /afs<br>
#<br>
# AFS directory. You should never need to change this <br>
#<br>
AFSDIR=3D"/afs"<br>
<br>
## Type: yesno<br>
## Default: no <br>
#<br>
# Set to "yes" for a lot of debugging information from afsd. =
Only<br>
# useful for debugging as it prints _a lot_ of information.<br>
#<br>
VERBOSE=3D"no"<br>
END =
/etc/sysconfig/afs-client=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>/etc/security/pam_unix2.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'># pam_unix2 config file<br>
#<br>
# This file contains options for the pam_unix2.so module.<br>
# It contains a list of options for every type of management group,<br>
# which will be used for authentication, account management and<br>
# password management. Not all options will be used from all types =
of<br>
# management groups.<br>
#<br>
# At first, pam_unix2 will read this file and then uses the local<br>
# options. Not all options can be set her global.<br>
#<br>
# Allowed options are:<br>
#<br>
# =
debug &n=
bsp; (account,
auth, password, session)<br>
# nullok =
(auth)<br>
# md5 =
(password)<br>
# bigcrypt (password)<br>
# blowfish (password)<br>
# crypt_rounds=3DXX<br>
# =
none &nb=
sp; (session)<br>
# =
trace &n=
bsp; (session)<br>
# call_modules=3Dx,y,z (account, auth, password)<br>
#<br>
# Example:<br>
# auth: nullok<br>
# account:<br>
# password: nullok blowfish =
crypt_rounds=3D8<br>
# session: none<br>
#<br>
auth: use_ldap nullok call_modules=3Dkrb5afs<br>
account: use_ldap<br>
password: use_ldap nullok<br>
session: none<br>
END/etc/security/pam_unix2.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>/var/heimdal/kdc.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>[libdefaults]<br>
default_realm =3D TED-DORIS.FAM<br>
<br>
[realms]<br>
TED-DORIS.FAM =3D {<br>
kdc =3D 10.1.1.116:88<br>
admin_server =3D 10.1.1.116:749<br>
default_domain =3D ted-doris.fam<br>
}<br>
<br>
[domain_realm]<br>
ted-doris.fam =3D TED-DORIS.FAM<br>
.ted-doris.fam =3D TED-DORIS.FAM<br>
END =
/var/heimdal/kdc.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>/etc/krb5.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>[libdefaults]<br>
default_realm =3D TED-DORIS.FAM<br>
clockskew =3D 300<br>
<br>
[realms]<br>
TED-DORIS.FAM =3D {<br>
admin_server =3D shemya<br>
kpasswd_server =3D shemya<br>
default_domain =3D ted-doris.fam<br>
kdc =3D shemya<br>
}<br>
<br>
[domain_realm]<br>
.ted-doris.fam =3D TED-DORIS.FAM<br>
ted-doris.fam =3D TED-DORIS.FAM<br>
<br>
[logging]<br>
default =3D SYSLOG:NOTICE:DAEMON<br>
kdc =3D FILE:/var/log/kdc.log<br>
kadmind =3D FILE:/var/log/kadmind.log<br>
<br>
[appdefaults]<br>
pam =3D {<br>
ticket_lifetime =3D 1d<br>
renew_lifetime =3D 1d<br>
forwardable =3D true<br>
proxiable =3D false<br>
retain_after_close =3D false<br>
minimum_uid =3D 0<br>
afs_cells =3D ted_cell<br>
}<br>
</span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'>END =
/etc/krb5.conf=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<=
/span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoPlainText><font size=3D2 face=3D"Courier New"><span =
style=3D'font-size:
10.0pt'> </span></font></p>
<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>
</div>
</body>
</html>
------=_NextPart_000_0009_01C3C7BD.5A665C70--