[OpenAFS] Heimdal & OpenAFS 1.7.4: Difficult user experience

[Dave Botsch]

I don't know if there's a way to make a "meta-msi" that would wrap up
and install all the sub packages.

But, you can certainly use transforms to customize each of the MSIs with
the default options needed, including a correct krb5.conf, so that users
just double click, install, reboot, done.

On Thu, Jan 26, 2012 at 01:26:28PM -0600, John Tang Boyland wrote:
> As readers to this list know; I teach a class with 40-50 students every
> semester which uses AFS and I have 30+ people trying to install OpenAFS
> on their laptops.  This exposes many usability problems with the
> installation process.  I'm pleased with the quality of the software once
> it starts working, but it's a real struggle to install.
> 
> We need a series of simple instructions for how to install
> OpenAFS on Windows machines.  The download web page is confusing,
> and even if you follow it precisely, the software
> doesn't work out of the box.  
> 
> I had several students dutifully download OpenAFS 1.7.4 and Heimdal KfW
> (as recommended) and then NetworkIdentityManager v2 (three separate
> downloads and installs) only to have NIM say that it can't get AFS
> tokens.  Apparently (and I couldn't see how to get this information from
> NIM), the "allow_weak_crypto" flag has to be explicitly turned on in
> krb5.conf.  The web page is utterly silent on this required step.
> 
> After a lot of searching (searching C:\ takes a LONG time!), I found
> krb5.conf in C:\ProgramData\Kerberos but being a system file, it
> couldn't be edited.  Finally with one student, he was able to make it so
> we could save our changes, but then NIM didn't work at ALL (and "kinit"
> in the command window gave error 22: couldn't initialize the context).
> Even removing allow_weak_crypto again still didn't solve the problem so
> we removed the file and reinstalled, this time with MIT KfW (64 bit from
> secure endpoints, thanks) which doesn't have the disallow-AFS-by-default
> "feature".
> 
> With the next student, we edited the file, saved it under
> a different name, and then used an administrator shell to 
> rename the files.  Then with NIM restarted everything worked.
> 
> Questions:
> 
> (1) Is it really true that OpenAFS tells people to download software
>     that doesn't work without manually fiddling with configuration
>     files?  Or did I do something wrong with the install?
> 
> (2) Instead, could we have the Heimdal installer default
>     "allow_weak_crypto = true" ?
> 
> (3) If we're stuck with (1) and can't do (2), would anyone like me to
>     write up the installation sequence required on the Wiki?  And maybe
>     the download page could point to it so poor lusers could find it?
>     And maybe for MacOSX too, with also requires
>     a manual fiddling with /etc/krb5.conf after installation.
> 
> (4) Is there a plan to finally wean AFS servers off des-cbc-crc ?
> 
> Thanks,
> John
>    
> 
> _______________________________________________
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info
> 

-- 
********************************
David William Botsch
Programmer/Analyst
CNF Computing
botsch@cnf.cornell.edu
********************************