From: Michael Meffie Date: Fri, 2 May 2014 22:25:32 +0000 (-0400) Subject: delete spam X-Git-Url: http://git.openafs.org/?p=openafs-wiki.git;a=commitdiff_plain;h=c1c5db95cf01fa12f4ef29f389beacd08008b43a delete spam --- diff --git a/BetterDocumentation.mdwn b/BetterDocumentation.mdwn index 9470c2c..3b94809 100644 --- a/BetterDocumentation.mdwn +++ b/BetterDocumentation.mdwn @@ -1,36 +1,12 @@ -This project has started and is trying to at least initially move all the [IBM/Transarc Documentation](http://www.openafs.org/doc/index.htm) into latex, and then update it so it actually reflects the [[OpenAFS]] releases. -From the latex sources you can build the manual into whatever format you wish. I believe the [User Guide](http://www.openafs.org/cgi-bin/cvsweb.cgi/openafs-doc/userGuide.tex) is done. +This project has started and is trying to at least initially move all the +[IBM/Transarc Documentation](http://www.openafs.org/doc/index.htm) into latex, +and then update it so it actually reflects the [[OpenAFS]] releases. -Feel free to send patches, corrections, improvements and suggestions to Renato Arruda. +From the latex sources you can build the manual into whatever format you wish. +I believe the [User +Guide](http://www.openafs.org/cgi-bin/cvsweb.cgi/openafs-doc/userGuide.tex) is +done. --- Renato Arruda - 09 Jun 2003 - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Coffres-forts et armoires fortes pour la sécurité Afin de sécuriser efficacement les biens, liquidité, bijoux et les données informatiques contre le vol et contre le risque d'incendie, il est indispensable de faire installer un coffre-fort ignifuge homologué et un coffret à clés. Les faits divers des journaux relatent d'histoires de cambriolages plus ou moins graves. Un coffre-fort certifié A2P est actuellement la meilleur protection pour vos bijoux et autres objets de valeur sentimentale qui vous sont chers. Le site [http://www.infosafe.fr](http://www.infosafe.fr) propose une gamme exceptionnelle de mobilier de sécurité, allant du coffre fort A2P au coffre fort ignifuge ou encore de l'armoire forte et de l'[armoire forte anti feu](http://www.infosafe.fr/Armoirefortedin/Armoirefortedin.htm) qui couvriront les besoins de sécurité qui sont actuellement nécessaire à votre sérénité. +Feel free to send patches, corrections, improvements and suggestions to Renato +Arruda. diff --git a/BuildbotSlaveHowto.mdwn b/BuildbotSlaveHowto.mdwn index 970ebfa..60a6602 100644 --- a/BuildbotSlaveHowto.mdwn +++ b/BuildbotSlaveHowto.mdwn @@ -37,7 +37,6 @@ A quick overview of the process: *Of note:* since BuildBot slaves pull all their information from the master (rather than having it pushed to them by the master), there is no need to open an incoming port on your firewall, etc. As long as the slave can contact the master on the port you're given (which will be explained later), you're good to go! -[Sewa Mobil Jakarta](http://www.awanirentcar.com/pricelist), [GPS Tracking](http://vamostech.com/gps-tracking), [Atap Fiberglass](http://www.goldenfibreglass.com/product-atap-fiberglass.php) _Hardware Requirements_ diff --git a/CacheManagerPorting.mdwn b/CacheManagerPorting.mdwn index 9332eac..8225a0e 100644 --- a/CacheManagerPorting.mdwn +++ b/CacheManagerPorting.mdwn @@ -1,10 +1,32 @@ -- Matt Benjamin - 05 Apr 2010 -The following notes were directed to a potential GSOC participant interested in porting the [[OpenAFS]] cache manager to [[NetBSD]]. There are some remarks specific to [[NetBSD]], and there's a lack of a high-level view of the ancestry of different ports and phases of work, that I think might be useful, among other things. +The following notes were directed to a potential GSOC participant interested in +porting the [[OpenAFS]] cache manager to [[NetBSD]]. There are some remarks +specific to [[NetBSD]], and there's a lack of a high-level view of the ancestry +of different ports and phases of work, that I think might be useful, among +other things. -1. yes, I do have a partial port to [[NetBSD]], based on the [[OpenBSD]] port. It turns out that the [[NetBSD]] port was the original ancestor port of [[OpenBSD]] and possibly influenced our [[FreeBSD]] port, too. Hence it has a good deal in common with several other ports, but may agree more closely in some areas, such as VM integtration. +1. yes, I do have a partial port to [[NetBSD]], based on the [[OpenBSD]] port. +It turns out that the [[NetBSD]] port was the original ancestor port of +[[OpenBSD]] and possibly influenced our [[FreeBSD]] port, too. Hence it has a +good deal in common with several other ports, but may agree more closely in +some areas, such as VM integtration. -2. My port isn't fully viable. Where it might be useful is as a fairly large bucket of copy-paste first-cut solutions to many issues.

Specifically, an [[OpenAFS]] cache manager can be thought of as a collection of cooperating subsystems and internal interface mappings covering a finite set of features. The main body of that platform-specific mapping glue is localized in the various port-specific osi\_\* files (e.g., OBSD/osi\_\*), especially osi\_machdep.h, osi\_vnodeops.c, and osi\_file.c. проститутки Of course, there are parts scattered around, including under rx/<PLATFORM>, rx\_knet.\{h,c\}, in VNOPS, in afs\_pioctl.c, and elsewhere.

One way I would talk about milestones would be to talk about different levels:

1\. complete and reviewed candidate implementations of all the applicable subsystem mappings for a port, taken to a state of compilation but not yet integration tested. Here, you have "solutions" for a bunch of point problems, including (I'm certainly leaving out some): +2. My port isn't fully viable. Where it might be useful is as a fairly large +bucket of copy-paste first-cut solutions to many issues.

Specifically, an [[OpenAFS]] cache manager can be thought of as a collection +of cooperating subsystems and internal interface mappings covering a finite set +of features. The main body of that platform-specific mapping glue is localized +in the various port-specific osi\_\* files (e.g., OBSD/osi\_\*), especially +osi\_machdep.h, osi\_vnodeops.c, and osi\_file.c. + +Of course, there are parts scattered around, including under +rx/<PLATFORM>, rx\_knet.\{h,c\}, in VNOPS, in afs\_pioctl.c, and +elsewhere.

One way I would talk about milestones would be to talk +about different levels:

1\. complete and reviewed candidate +implementations of all the applicable subsystem mappings for a port, taken to a +state of compilation but not yet integration tested. Here, you have "solutions" +for a bunch of point problems, including (I'm certainly leaving out some): 1. internal locking (how glock and subsystem/object locks are implemented) 2. memory allocation (the local KMALLOC often) diff --git a/GitDevelopers.mdwn b/GitDevelopers.mdwn index f788f6c..3531561 100644 --- a/GitDevelopers.mdwn +++ b/GitDevelopers.mdwn @@ -1,10 +1,20 @@ -Git opens up a number of new options for contributing to OpenAFS. For the first time, it is easy to review code that is pending addition to the OpenAFS tree. In fact, reviewing code is one of the best ways to ensure that the releases that OpenAFS ships remain stable and functional. If you are interested purely in reviewing, then please skip to that section towards the end of this document. -[Toko Bunga](http://www.tokobungasabana.com) -[Jasa SEO](http://www.optimaweb.co.id/jasa-seo) -[Blog Teknik](http://adrian-fh98.web.unair.ac.id/) -Git also changes the way that developers interact with the OpenAFS tree. Instead of just having a single version of the tree on your local machine, you have a compressed copy of the entire repository. Additionally, you no longer have to produce patches to send code upstream - any developer can push into the OpenAFS repository directly, through gerrit, our code review tool. - -Whilst git is a far more powerful tool than CVS it is also, inevitably, more complex. This document can only scratch the surface of what's possible with git - there are many, many, documents available that describe git in greater detail, and references to some of them are provided at the end. +Git opens up a number of new options for contributing to OpenAFS. For the first +time, it is easy to review code that is pending addition to the OpenAFS tree. +In fact, reviewing code is one of the best ways to ensure that the releases +that OpenAFS ships remain stable and functional. If you are interested purely +in reviewing, then please skip to that section towards the end of this +document. + +Git also changes the way that developers interact with the OpenAFS tree. +Instead of just having a single version of the tree on your local machine, you +have a compressed copy of the entire repository. Additionally, you no longer +have to produce patches to send code upstream - any developer can push into the +OpenAFS repository directly, through gerrit, our code review tool. + +Whilst git is a far more powerful tool than CVS it is also, inevitably, more +complex. This document can only scratch the surface of what's possible with git +- there are many, many, documents available that describe git in greater +detail, and references to some of them are provided at the end. ## Getting git @@ -70,14 +80,25 @@ To checkout a particular tag git checkout openafs-stable-1_4_10 -Again, whilst a direct checkout of a remote tag is fine for code browsing, it should not be used as a place to start development. If you must do development against a tag, then create a local topic branch with it as a starting point, as is discussed below. However, in general, please don't develop from a particular tag, but instead work from a branch tip. It makes it much easier to integrate your changes! - -Coffres-forts et armoires fortes pour la sécurité Afin de sécuriser efficacement les biens, liquidité, bijoux et les données informatiques contre le vol et contre le risque d'incendie, il est indispensable de faire installer un coffre-fort ignifuge homologué et un coffret à clés. Les faits divers des journaux relatent d'histoires de cambriolages plus ou moins graves. Un coffre-fort certifié A2P est actuellement la meilleur protection pour vos bijoux et autres objets de valeur sentimentale qui vous sont chers. Le site [http://www.infosafe.fr](http://www.infosafe.fr) propose une gamme exceptionnelle de mobilier de sécurité, allant du coffre fort A2P au coffre fort ignifuge ou encore de l'armoire forte et de l'[armoire forte anti feu](http://www.infosafe.fr/Armoirefortedin/Armoirefortedin.htm) qui couvriront les besoins de sécurité qui sont actuellement nécessaire à votre sérénité. - +Again, whilst a direct checkout of a remote tag is fine for code browsing, it +should not be used as a place to start development. If you must do development +against a tag, then create a local topic branch with it as a starting point, as +is discussed below. However, in general, please don't develop from a particular +tag, but instead work from a branch tip. It makes it much easier to integrate +your changes! ## Viewing deltas -OpenAFS's original CVS repository used the concept of deltas as a means of grouping a large number of related changes into a single item, which could be easily fetched and referred to. In git, a delta should be simply a single commit. Deltas are represented by means of a special form of git tag, allowing you to locally view the change and commit message that corresponds to each one. In order to keep down the transfer size, deltas are not included in the repository you get when you do a git clone - there are over 10,000 delta references, and having them in your local repository can cause performance issues. If you really wish to be able to locally browse deltas, then run the following +OpenAFS's original CVS repository used the concept of deltas as a means of +grouping a large number of related changes into a single item, which could be +easily fetched and referred to. In git, a delta should be simply a single +commit. Deltas are represented by means of a special form of git tag, allowing +you to locally view the change and commit message that corresponds to each one. +In order to keep down the transfer size, deltas are not included in the +repository you get when you do a git clone - there are over 10,000 delta +references, and having them in your local repository can cause performance +issues. If you really wish to be able to locally browse deltas, then run the +following git config --add remote.origin.fetch '+refs/deltas/*:refs/remotes/deltas/*' git fetch origin @@ -86,11 +107,17 @@ You can then view a specific delta by doing git show refs/remotes/deltas// -Sadly, historical accidents mean that not all of our deltas can be represented by means of single commit. Where this is the case, a delta-name will have a trailing -part-, where each of these numbers must be used to form the complete delta. This only applies to some deltas created before the git conversion - all deltas created from now on will be single commits. +Sadly, historical accidents mean that not all of our deltas can be represented +by means of single commit. Where this is the case, a delta-name will have a +trailing -part-, where each of these numbers must be used to form the complete +delta. This only applies to some deltas created before the git conversion - all +deltas created from now on will be single commits. ## Introducing yourself to git -Before you begin development, you should let git know who you are. This provides it with a name, and email address, that is used to attribute all commits in your repository, and in any that you share code with. +Before you begin development, you should let git know who you are. This +provides it with a name, and email address, that is used to attribute all +commits in your repository, and in any that you share code with. git config user.name "Joe Bloggs" git config user.email "joe.bloggs@example.org" @@ -100,9 +127,16 @@ If you want to make this settings for all of your repositories, then add the --g git config --global user.name "Joe Bloggs" git config --global user.email "joe.bloggs@example.org" -Note that this email address is the address by which you will be identified in [[OpenAFS]]'s revision history - it is also the address to which the gerrit code review tool will send all email related to the review of your code. +Note that this email address is the address by which you will be identified in +[[OpenAFS]]'s revision history - it is also the address to which the gerrit +code review tool will send all email related to the review of your code. -If you plan on making changes to OpenAFS (and why else would you be reading this?) you should probably also grab The change id hook described in Registering With gerrit below. You can grab and apply the hook before registering, and it'll make sure your pre-registration development has the appropriate change IDs in the log. The hook only applies to your openafs development, so you're not going to mess up any of your non-OpenAFS work. +If you plan on making changes to OpenAFS (and why else would you be reading +this?) you should probably also grab The change id hook described in +Registering With gerrit below. You can grab and apply the hook before +registering, and it'll make sure your pre-registration development has the +appropriate change IDs in the log. The hook only applies to your openafs +development, so you're not going to mess up any of your non-OpenAFS work. ## Helpful git tips @@ -124,7 +158,9 @@ Whitespace handling settings: ## Starting development -We strongly recommend that you do all of your development upon 'topic branches' This allows you to isolate multiple unrelated changes, and makes it easier to keep your tree in sync with the upstream [[OpenAFS]] one. +We strongly recommend that you do all of your development upon 'topic branches' +This allows you to isolate multiple unrelated changes, and makes it easier to +keep your tree in sync with the upstream [[OpenAFS]] one. Before creating a new topic branch, running diff --git a/HowToBuildOpenAfsRpmPackages.mdwn b/HowToBuildOpenAfsRpmPackages.mdwn index 759f4e8..39bd715 100644 --- a/HowToBuildOpenAfsRpmPackages.mdwn +++ b/HowToBuildOpenAfsRpmPackages.mdwn @@ -1,5 +1,5 @@ ## Building RPM packages - + A script called makesrpm.pl is provided to build a source RPM package. You can use the generated source RPM to build the binaries and create the RPM packages for your source code tree of OpenAFS. @@ -19,7 +19,6 @@ The _version_ is the dotted OpenAFS version number, such as 1.6.0, and the _tagname_ is the git tag for the version, such as openafs-stable-1_6_0. The _version_ number for pre-releases are suffixed with pre<number>. For example, to build 1.6.0pre5, create a directory called openafs-1.6.0pre5. -[GPS Tracking](http://vamostech.com/gps-tracking), [Sewa Mobil Jakarta](http://www.awanirentcar.com/pricelist), [Properti Semarang](http://www.raywhitesemarang.com), [Glutera](http://www.grosir-kosmetik.com/62-glutera.html) Next, create a source RPM file. This requires creating a tar file for the source files and a tar file for the documents. Run the makesrpm program diff --git a/IPAccessControl.mdwn b/IPAccessControl.mdwn index 9acff68..afe407a 100644 --- a/IPAccessControl.mdwn +++ b/IPAccessControl.mdwn @@ -1,29 +1,53 @@ -## Social Media Services On Cheaplikes.co.uk -Every company is different, so it makes sense that every company’s social media strategy will be different too. Social Media Delivered offers tailored social media training, consulting and services for all types of companies across all industries, with a focus on developing custom social media strategy that works for your company and your social media services review : >>>>>>> [1nich.blogspot.com]( http://1nich.blogspot.com/) - [buy facebook likes]( http://1nich.blogspot.com/2014/04/complete-review-cheaplikes.html) - [buy youtube likes]( http://1nich.blogspot.com/2014/04/buy-youtube-likes-reviews-on-cheaplikes.html) - [buy instagram likes]( http://1nich.blogspot.com/2014/04/buy-instagram-likes-reviews-on.html) - [buy instagram likes]( http://1nich.blogspot.com/2014/04/buy-pinterest-likes-review-on.html) +# IP Address-Based AFS Access Control for Fun and Profit + +You may have heard that the Andrew File System -- +[AFS](http://www.openafs.org/) -- allows IP address-based entries for directory +ACLs. The idea is that processes running on a machine with a given IP address +can access protected directories without needing further authentication. You +may have even tried it. If you're like me, you were frustrated. Now I've +discovered the secrets, and I'm going to share them with you. You don't even +have to bribe me. + +Why would you want IP-based access? One scenario is that you have files whose +access should be limited to certain machines. Maybe you have software that +should only be run on certain machines because of legal or hardware +limitations. Maybe authentication for certain processes is a drag to work out. +Whatever your reason, this is pretty easy to do after you know the tricks, and +seems to provide a moderate level of security. + + +Some introductory information and relevant links: + +These examples were created under AFS 3.4a and [Sun](http://www.sun.com)'s +[Solaris](http://www.sun.com/software/solaris/) 2.6.
Documentation links +were to Transarc's documentation, until IBM [changed the links and made the +version +3.6](http://www-3.ibm.com/software/stormgmt/afs/manuals/Library/unix/en_US/HTML/AdminRef/auarf002.htm). +Now my documentation links point to the open source version's site, +[OpenAFS](http://www.openafs.org).
Transarc, the original commercial +developer of AFS, is now [IBM](http://www.ibm.com)'s Pittsburgh Lab.
AFS +was first developed at [Carnegie Mellon University](http://www.cmu.edu/) as +part of the [ Andrew Project](http://www.cs.cmu.edu/~AUIS/).
For more +information about AFS, try reading the +[FAQ](http://www.faqs.org/faqs/by-newsgroup/alt/alt.filesystems.afs.html) for +the USENET newsgroup [alt.filesystems.afs](news:alt.filesystems.afs).
+ +All links in this web page should pop up in a single side window, so you won't +have to flip back and forth between pages. I've tried to link every command to +a relevant page, but other references may only be linked at their first +instance. - - [http://cheaplikes.co.uk](http://cheaplikes.co.uk) ->>>>>>> -Every company is different, so it makes sense that every company’s social media strategy will be different too. Social Media services offers tailored social media training, consulting and services for all types of companies across all industries, with a focus on developing custom social media strategy that works for your company and your social media needs. -- See more at [buy facebook likes]( http://cheaplikes.co.uk/buy-facebook-likes/) - [buy youtube likes]( http://cheaplikes.co.uk/buy-youtube-likes/) - [buy instagram likes]( http://cheaplikes.co.uk/buy-instagram-likes/) - [buy instagram likes]( http://cheaplikes.co.uk/buy-pinterest-likes/) - -All links in this web page should pop up in a single side window, so you won't have to flip back and forth between pages. I've tried to link every command to a relevant page, but other references may only be linked at their first instance. ---- -You may have heard that the Andrew File System -- [AFS](http://www.openafs.org/) -- allows IP address-based entries for directory ACLs. The idea is that processes running on a machine with a given IP address can access protected directories without needing further authentication. You may have even tried it. If you're like me, you were frustrated. Now I've discovered the secrets, and I'm going to share them with you. You don't even have to bribe me. - -Why would you want IP-based access? One scenario is that you have files whose access should be limited to certain machines. Maybe you have software that should only be run on certain machines because of legal or hardware limitations. Maybe authentication for certain processes is a drag to work out. Whatever your reason, this is pretty easy to do after you know the tricks, and seems to provide a moderate level of security +Ok, you'll be dealing with just an IP number for the machine that needs access. +No DNS names: AFS wants just an IP address and none of your carefully +thought-out, clever naming scheme. Yeah, I know -- no fun. You'll have to get +over it. Sorry. -These examples were created under AFS 3.4a and [Sun](http://www.sun.com)'s [Solaris](http://www.sun.com/software/solaris/) 2.6.
Documentation links were to Transarc's documentation, until IBM [changed the links and made the version 3.6](http://www-3.ibm.com/software/stormgmt/afs/manuals/Library/unix/en_US/HTML/AdminRef/auarf002.htm). Now my documentation links point to the open source version's site, [OpenAFS](http://www.openafs.org).
Transarc, the original commercial developer of AFS, is now [IBM](http://www.ibm.com)'s Pittsburgh Lab.
AFS was first developed at [Carnegie Mellon University](http://www.cmu.edu/) as part of the [ Andrew Project](http://www.cs.cmu.edu/~AUIS/).
For more information about AFS, try reading the [FAQ](http://www.faqs.org/faqs/by-newsgroup/alt/alt.filesystems.afs.html) for the USENET newsgroup [alt.filesystems.afs](news:alt.filesystems.afs).
- -All links in this web page should pop up in a single side window, so you won't have to flip back and forth between pages. I've tried to link every command to a relevant page, but other references may only be linked at their first instance. ----- - -Ok, you'll be dealing with just an IP number for the machine that needs access. No DNS names: AFS wants just an IP address and none of your carefully thought-out, clever naming scheme. Yeah, I know -- no fun. You'll have to get over it. Sorry. -[Sewa Mobil Jakarta](http://www.awanirentcar.com/pricelist) - [Aksesoris mobil](http://kiosauto.com) - [Cotton bud](http://www.mitracatur.com/product/cotton-bud) - [Glutera](http://www.grosir-kosmetik.com/62-glutera.html) - [Been pink](http://www.grosir-kosmetik.com/63-been-pink-beauty-series.html) - [Toko bunga jakarta](http://www.tokobungasabana.com) - -The IP number must be in your AFS [PTS](http://www.openafs.org/pages/doc/AdminReference/auarf210.htm#HDRPTS_INTRO) database, just like a user. I'll use your-machine.your-domain.com (1.2.3.4) as an example. +The IP number must be in your AFS +[PTS](http://www.openafs.org/pages/doc/AdminReference/auarf210.htm#HDRPTS_INTRO) +database, just like a user. I'll use your-machine.your-domain.com (1.2.3.4) as +an example. [Using klog, get an admin token](http://www.openafs.org/pages/doc/AdminReference/auarf200.htm#HDRKLOG) for your AFS cell. @@ -41,17 +65,34 @@ It's not there. So create it: User 1.2.3.4 has id 2147418256 -The AFS protection database server (PTS) assigns an AFS UID (the number after "User 1.2.3.4 has id ") to the machine. [ Accumulated wisdom recommends](http://www.openafs.org/pages/doc/AdminReference/auarf215.htm#HDRPTS_CREATEUSER) allowing that instead of trying to pick one, so don't use the -id flag unless you're sure know what you're doing and have consulted a [[SysAdmin]] quorum at your site. +The AFS protection database server (PTS) assigns an AFS UID (the number after +"User 1.2.3.4 has id ") to the machine. [ Accumulated wisdom +recommends](http://www.openafs.org/pages/doc/AdminReference/auarf215.htm#HDRPTS_CREATEUSER) +allowing that instead of trying to pick one, so don't use the -id flag unless +you're sure know what you're doing and have consulted a [[SysAdmin]] quorum at +your site. -You can wildcard/subnet these IP-based PTS entries. So you can get PTS ids for IP ranges denoted by, e.g.: +You can wildcard/subnet these IP-based PTS entries. So you can get PTS ids for +IP ranges denoted by, e.g.: 1.2.3.0 1.2.0.0 1.0.0.0 -This is supposed to do what you'd think it would: grant privileges to machines within the IP range denoted by the leading non-zero elements. Now you can easily give thousands of people and machines access when you didn't mean to. If you get the idea of wildcarding everything, as in 0.0.0.0, use system:anyuser instead. God knows why you'd want that, and if you're reading this you really ought to know about system:anyuser anyway, but that's how to do it. I don't know what happens if you need to give access to a machine that has a zero as the last tuple of the IP address. Maybe you should get another IP address for that machine. :) - -OK, now your-machine has an AFS PTS id. But don't put the IP number directly on the ACL. Instead, create an appropriate PTS group and add the machine to it. Don't mix IP and principal entries in the same group; create another group (more on this later). +This is supposed to do what you'd think it would: grant privileges to machines +within the IP range denoted by the leading non-zero elements. Now you can +easily give thousands of people and machines access when you didn't mean to. If +you get the idea of wildcarding everything, as in 0.0.0.0, use system:anyuser +instead. God knows why you'd want that, and if you're reading this you really +ought to know about system:anyuser anyway, but that's how to do it. I don't +know what happens if you need to give access to a machine that has a zero as +the last tuple of the IP address. Maybe you should get another IP address for +that machine. :) + +OK, now your-machine has an AFS PTS id. But don't put the IP number directly on +the ACL. Instead, create an appropriate PTS group and add the machine to it. +Don't mix IP and principal entries in the same group; create another group +(more on this later). I'll create a PTS group: @@ -70,13 +111,37 @@ What does the group your-stuff look like? membership: 0, flags: S-M--, group quota: 0. -I'll ignore everything right now except the flags, which are an access control list for the PTS entry. What's above is my local default for groups. The "S" means anyone can run [pts examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) on the group. The "M" means anyone can run [pts membership](http://www.openafs.org/pages/doc/AdminReference/auarf222.htm#HDRPTS_MEMBERSHIP) on the group. The flags are +I'll ignore everything right now except the flags, which are an access control +list for the PTS entry. What's above is my local default for groups. The "S" +means anyone can run [pts +examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) +on the group. The "M" means anyone can run [pts +membership](http://www.openafs.org/pages/doc/AdminReference/auarf222.htm#HDRPTS_MEMBERSHIP) +on the group. The flags are SOMAR -and affect the operation of the [pts](http://www.openafs.org/pages/doc/AdminReference/auarf210.htm#HDRPTS_INTRO) commands [examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE), [listowned](http://www.openafs.org/pages/doc/AdminReference/auarf221.htm#HDRPTS_LISTOWNED), [membership](http://www.openafs.org/pages/doc/AdminReference/auarf222.htm#HDRPTS_MEMBERSHIP), [adduser](http://www.openafs.org/pages/doc/AdminReference/auarf211.htm#HDRPTS_ADDUSER), and [removeuser](http://www.openafs.org/pages/doc/AdminReference/auarf223.htm#HDRPTS_REMOVEUSER), respectively. The flags can generally have values of uppercase, lowercase, or hyphen. I won't go into the flags much here, but read the man page, and think carefully about what you want to be seen by whom. For instance, if the group is going to be for machines where users will be allowed to run certain software, you might want to make it easy for folks to discover what those machines are. If you're trying to keep users out, you might want to hide the membership from prying eyes. Pay as much attention to this as you would to any other ACL or permission. - -By the way, [ pts examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) works for any entity in the PTS database: groups, principals, and machines. E.g.: +and affect the operation of the +[pts](http://www.openafs.org/pages/doc/AdminReference/auarf210.htm#HDRPTS_INTRO) +commands +[examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE), +[listowned](http://www.openafs.org/pages/doc/AdminReference/auarf221.htm#HDRPTS_LISTOWNED), +[membership](http://www.openafs.org/pages/doc/AdminReference/auarf222.htm#HDRPTS_MEMBERSHIP), +[adduser](http://www.openafs.org/pages/doc/AdminReference/auarf211.htm#HDRPTS_ADDUSER), +and +[removeuser](http://www.openafs.org/pages/doc/AdminReference/auarf223.htm#HDRPTS_REMOVEUSER), +respectively. The flags can generally have values of uppercase, lowercase, or +hyphen. I won't go into the flags much here, but read the man page, and think +carefully about what you want to be seen by whom. For instance, if the group is +going to be for machines where users will be allowed to run certain software, +you might want to make it easy for folks to discover what those machines are. +If you're trying to keep users out, you might want to hide the membership from +prying eyes. Pay as much attention to this as you would to any other ACL or +permission. + +By the way, [pts examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) +works for any entity in the PTS database: groups, principals, and machines. +E.g.: bash-2.02$ pts examine 1.2.3.4 Name: 1.2.3.4, id: 2147418256, owner: system:administrators, creator: admin, @@ -84,9 +149,16 @@ By the way, [ pts examine](http://www.openafs.org/pages/doc/AdminReference/auarf The above flags are my current local default for machine entries. -Since [ pts examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) works for three different types of entries -- machines, principals, and groups -- the man pages get confusing. The flags mean different things depending on what you're examining. +Since [ pts +examine](http://www.openafs.org/pages/doc/AdminReference/auarf217.htm#HDRPTS_EXAMINE) +works for three different types of entries -- machines, principals, and groups +-- the man pages get confusing. The flags mean different things depending on +what you're examining. -
* When using pts examine, keep clearly in mind what type entry you're examining, and pay attention just to the parts of the manual page that speak to your type entry. If you do this and keep your mind clear of distraction, all will be well. :) *
+
* When using pts examine, keep clearly in mind what type entry +you're examining, and pay attention just to the parts of the manual page that +speak to your type entry. If you do this and keep your mind clear of +distraction, all will be well. :) *
I assume you'll want to add 1.2.3.4 to your-stuff: @@ -102,9 +174,16 @@ You'll get back just a prompt. So group your-stuff should now contain 1.2.3.4 -By the way, it's really easy to confuse [pts adduser](http://www.openafs.org/pages/doc/AdminReference/auarf211.htm#HDRPTS_ADDUSER) and [pts createuser](http://www.openafs.org/pages/doc/AdminReference/auarf215.htm#HDRPTS_CREATEUSER). Just like the rest of the AFS command suite, there are too many commands that sound too much alike or don't do exactly what you'd think from the name. Read the man page. Query a local [[SysAdmin]] quorum. Join [Alcoholics Anonymous](http://www.aa.org/). :) +By the way, it's really easy to confuse [pts +adduser](http://www.openafs.org/pages/doc/AdminReference/auarf211.htm#HDRPTS_ADDUSER) +and [pts +createuser](http://www.openafs.org/pages/doc/AdminReference/auarf215.htm#HDRPTS_CREATEUSER). +Just like the rest of the AFS command suite, there are too many commands that +sound too much alike or don't do exactly what you'd think from the name. Read +the man page. Query a local [[SysAdmin]] quorum. -You did have an AFS directory you wanted to protect, right? Let's say that directory's permissions currently look like +You did have an AFS directory you wanted to protect, right? Let's say that +directory's permissions currently look like 
       bash-2.02$ fs listacl /afs/your-domain/your-dir
@@ -120,7 +199,9 @@ Set directory permissions with [fs setacl](http://www.openafs.org/pages/doc/Admi
       bash-2.02$ fs setacl /afs/your-domain/your-dir your-stuff write
-"write" is short for all perms except administer. Now [fs listacl](http://www.openafs.org/pages/doc/AdminReference/auarf148.htm#HDRFS_LISTACL) should return something like +"write" is short for all perms except administer. Now [fs +listacl](http://www.openafs.org/pages/doc/AdminReference/auarf148.htm#HDRFS_LISTACL) +should return something like 
       bash-2.02$ fs listacl /afs/your-domain/your-dir
@@ -141,8 +222,10 @@ Then you get on your-machine.your-domain.com and try. You still can't look at th
 
 This has always been where I scratched my head and said "I don't get it." But I figured it out. I will now attempt to dispel confusion.
 
-
An AFS file server treats ACL IP entries differently from principal entries: 
Changes to ACLs for principals are reflected almost right away.

-    
Changes to ACLs for IP entries are NOT. 

+
An AFS file server treats ACL IP entries differently from
+principal entries: 
Changes to ACLs for principals are reflected almost right
+away.
 
Changes to ACLs for IP entries are NOT.
+

 
 There's a flag to the [fileserver](http://www.openafs.org/pages/doc/AdminReference/auarf129.htm#HDRFILESERVER) instance called -hr:
 
@@ -150,11 +233,16 @@ There's a flag to the [fileserver](http://www.openafs.org/pages/doc/AdminReferen
 >
 > > `Specifies how often the File Server refreshes its knowledge of the machines that belong to protection groups (its "host CPS"). The File Server must update this information to enable users from machines recently added to protection groups to access data for which those Machines now have the necessary ACL permissions. `
 
-Farther down in both the IBM and [[OpenAFS]] documentation mentioned above for the fileserver instance, the default setting for this "-hr" parameter is given as two hours:
+Farther down in both the IBM and [[OpenAFS]] documentation mentioned above for
+the fileserver instance, the default setting for this "-hr" parameter is given
+as two hours:
 
 > > ` The File Server maintains a host current protection subgroup (host CPS) for each client machine from which it has received a data access request. Like the CPS for a user, a host CPS lists all of the Protection Database groups to which the machine belongs, and the File Server compares the host CPS to a directory's ACL to determine in what manner users on the machine are authorized to access the directory's contents. When the pts adduser or pts removeuser command is used to change the groups to which a machine belongs, the File Server must recompute the machine's host CPS in order to notice the change. By default, the File Server contacts the Protection Server every two hours to recompute host CPSs, implying that it can take that long for changed group memberships to become effective. To change this frequency, use the -hr argument. `
 
-Maybe there's some overhead involved in these checks, so they're not done very often. Who knows? Maybe you'll want to diddle this flag for your site's fileserver instances, but probably not, or you'll never get to it, or you don't want to declare a downtime.
+Maybe there's some overhead involved in these checks, so they're not done very
+often. Who knows? Maybe you'll want to diddle this flag for your site's
+fileserver instances, but probably not, or you'll never get to it, or you don't
+want to declare a downtime.
 
 When I ran into this problem, one suggestion was
 
@@ -209,8 +297,10 @@ A few caveats:
 - There's a newly exposed problem on some platforms with occasional loss of IP-based access. The problem is discussed on the [[OpenAFS]]-Devel mailing list in [this thread](https://lists.openafs.org/pipermail/openafs-devel/2006-June/013946.html). Please take a look if you're having problems. Derrick Brashear is currently (30 June 2006) testing a patch, which you can find at
          /afs/andrew.cmu.edu/usr/shadow/ubik-all.diff-2
 
-Was this page useful, or even interesting? Please link to it: it's difficult to find.
+Was this page useful, or even interesting? Please link to it: it's difficult to
+find.
 
-Send comments, questions, bad links, &c. to [me](mailto:jhvilas@gmail.com) if you like, or fix them -- this is a Wiki, after all. And to the many people who've sent comments: Thank you! Your feedback has helped!
+Send comments, questions, bad links, &c. to [me](mailto:jhvilas@gmail.com)
+if you like, or fix them -- this is a Wiki, after all. And to the many people
+who've sent comments: Thank you! Your feedback has helped!
 
--- Joseph H Vilas - 03 Aug 2006
diff --git a/ListOfSitesUsingOpenAFS.mdwn b/ListOfSitesUsingOpenAFS.mdwn
index 11afd87..9c1993a 100644
--- a/ListOfSitesUsingOpenAFS.mdwn
+++ b/ListOfSitesUsingOpenAFS.mdwn
@@ -57,7 +57,6 @@ report for details.
 * ICEMB, Universita' La Sapienza - Rome - Italy
 * Imperial College London
 * IN2P3 production cell
-* [Infosafe](http://www.infosafe.fr) site sur la sécurité et les coffres-forts
 * INFN, KLOE experiment at Laboratori di Frascati
 * INFN, Laboratori Nazionali del Gran Sasso
 * INFN, Laboratori Nazionali di Frascati
diff --git a/ProtocolInfo.mdwn b/ProtocolInfo.mdwn
index c4ac83b..433b315 100644
--- a/ProtocolInfo.mdwn
+++ b/ProtocolInfo.mdwn
@@ -1,9 +1,12 @@
-\* [[ComErrErrors]]
+
+[[ComErrErrors]]
 
 - [[RPCCallNumbers]]
 - [[RxServices]]
-- [[RxKadAuthenticatorTypes]] - to deal with a [cryptographic weakness in Kerberos 4 involving cross-cell authentication](http://www.openafs.org/frameless/security/OPENAFS-SA-2003-001.txt) a new version of rxkad has been defined that works with Kerberos 5 tickets and doesn't require any client changes. It is called rxkad 2b and is described in .
+- [[RxKadAuthenticatorTypes]] - to deal with a [cryptographic weakness in
+  Kerberos 4 involving cross-cell authentication](http://www.openafs.org/frameless/security/OPENAFS-SA-2003-001.txt)
+a new version of rxkad has been defined that works with Kerberos 5 tickets and
+doesn't require any client changes. It is called rxkad 2b and is described in
+.
 - [fcrypt](http://surfvi.com/~ota/fcrypt-paper.txt) - encryption algorithm used for communication security used by rxkad.
 
--- Derrick Brashear - 26 Nov 2002
 -- Ted Anderson - 10 Apr 2003
 -- Ted Anderson - 27 Jun 2006

-[Sewa Mobil Jakarta](http://www.awanirentcar.com/pricelist), [Aksesoris mobil](http://kiosauto.com), [Cotton bud](http://www.mitracatur.com/product/cotton-bud)