From 1ff087245a05855890b5f95a1120057fcbfe3c10 Mon Sep 17 00:00:00 2001 From: Craig Cook Date: Thu, 28 Apr 2005 18:23:04 +0000 Subject: [PATCH] none --- AFSLore/AFSQuickStartGuideforUNIX.mdwn | 41 + AFSLore/BuildingAFSintotheDigitalUNIXKernel.mdwn | 111 ++ AFSLore/BuildingAFSintotheHP-UXKernel.mdwn | 73 ++ AFSLore/BuildingAFSintotheIRIXKernel.mdwn | 40 + AFSLore/ConfiguringServerVolumesonAIX.mdwn | 19 + AFSLore/ConfiguringServerVolumesonDigitalUNIX.mdwn | 19 + AFSLore/ConfiguringServerVolumesonHP-UX.mdwn | 9 + AFSLore/ConfiguringServerVolumesonIRIX.mdwn | 38 + AFSLore/ConfiguringServerVolumesonLinux.mdwn | 19 + AFSLore/ConfiguringServerVolumesonSolaris.mdwn | 21 + ...ngtheAFS-modifiedfsckProgramonHP-UXSystems.mdwn | 38 + ...theAFS-modifiedfsckProgramonSolarisSystems.mdwn | 114 +++ AFSLore/ConfiguringtheCache.mdwn | 57 ++ AFSLore/ConfiguringtheCacheManager.mdwn | 68 ++ AFSLore/ConfirmCacheManagerInitialization.mdwn | 26 + AFSLore/CreatingtheClientCellServDBFile.mdwn | 46 + AFSLore/EnablingAFSLoginonAIXSystems.mdwn | 59 ++ AFSLore/EnablingAFSLoginonDigitalUNIXSystems.mdwn | 21 + AFSLore/EnablingAFSLoginonHP-UXSystems.mdwn | 71 ++ AFSLore/EnablingAFSLoginonIRIXSystems.mdwn | 11 + AFSLore/EnablingAFSLoginonLinuxSystems.mdwn | 192 ++++ AFSLore/EnablingAFSLoginonSolarisSystems.mdwn | 132 +++ AFSLore/InitializationScriptonAIX.mdwn | 30 + AFSLore/InitializationScriptonDigitalUNIX.mdwn | 25 + AFSLore/InitializationScriptonHP-UX.mdwn | 25 + AFSLore/InitializationScriptonIRIX.mdwn | 42 + AFSLore/InitializationScriptonLinux.mdwn | 32 + AFSLore/InitializationScriptonSolaris.mdwn | 34 + AFSLore/InstallingAdditionalClientMachines.mdwn | 370 +++++++ AFSLore/InstallingAdditionalServerMachines.mdwn | 652 ++++++++++++ AFSLore/InstallingtheFirstAFSMachine.mdwn | 1069 ++++++++++++++++++++ AFSLore/LoadingAFSintotheAIXKernel.mdwn | 29 + AFSLore/LoadingAFSintotheIRIXKernel.mdwn | 101 ++ AFSLore/LoadingAFSintotheLinuxKernel.mdwn | 21 + AFSLore/LoadingAFSintotheSolarisKernel.mdwn | 43 + .../ReplacingthefsckProgramHelperonAIXSystems.mdwn | 13 + ...eplacingthefsckProgramonDigitalUNIXSystems.mdwn | 27 + 37 files changed, 3738 insertions(+) create mode 100644 AFSLore/BuildingAFSintotheDigitalUNIXKernel.mdwn create mode 100644 AFSLore/BuildingAFSintotheHP-UXKernel.mdwn create mode 100644 AFSLore/BuildingAFSintotheIRIXKernel.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonAIX.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonDigitalUNIX.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonHP-UX.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonIRIX.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonLinux.mdwn create mode 100644 AFSLore/ConfiguringServerVolumesonSolaris.mdwn create mode 100644 AFSLore/ConfiguringtheAFS-modifiedfsckProgramonHP-UXSystems.mdwn create mode 100644 AFSLore/ConfiguringtheAFS-modifiedfsckProgramonSolarisSystems.mdwn create mode 100644 AFSLore/ConfiguringtheCache.mdwn create mode 100644 AFSLore/ConfiguringtheCacheManager.mdwn create mode 100644 AFSLore/ConfirmCacheManagerInitialization.mdwn create mode 100644 AFSLore/CreatingtheClientCellServDBFile.mdwn create mode 100644 AFSLore/EnablingAFSLoginonAIXSystems.mdwn create mode 100644 AFSLore/EnablingAFSLoginonDigitalUNIXSystems.mdwn create mode 100644 AFSLore/EnablingAFSLoginonHP-UXSystems.mdwn create mode 100644 AFSLore/EnablingAFSLoginonIRIXSystems.mdwn create mode 100644 AFSLore/EnablingAFSLoginonLinuxSystems.mdwn create mode 100644 AFSLore/EnablingAFSLoginonSolarisSystems.mdwn create mode 100644 AFSLore/InitializationScriptonAIX.mdwn create mode 100644 AFSLore/InitializationScriptonDigitalUNIX.mdwn create mode 100644 AFSLore/InitializationScriptonHP-UX.mdwn create mode 100644 AFSLore/InitializationScriptonIRIX.mdwn create mode 100644 AFSLore/InitializationScriptonLinux.mdwn create mode 100644 AFSLore/InitializationScriptonSolaris.mdwn create mode 100644 AFSLore/InstallingAdditionalClientMachines.mdwn create mode 100644 AFSLore/InstallingAdditionalServerMachines.mdwn create mode 100644 AFSLore/LoadingAFSintotheAIXKernel.mdwn create mode 100644 AFSLore/LoadingAFSintotheIRIXKernel.mdwn create mode 100644 AFSLore/LoadingAFSintotheLinuxKernel.mdwn create mode 100644 AFSLore/LoadingAFSintotheSolarisKernel.mdwn create mode 100644 AFSLore/ReplacingthefsckProgramHelperonAIXSystems.mdwn create mode 100644 AFSLore/ReplacingthefsckProgramonDigitalUNIXSystems.mdwn diff --git a/AFSLore/AFSQuickStartGuideforUNIX.mdwn b/AFSLore/AFSQuickStartGuideforUNIX.mdwn index 4f80cba..edcb1e9 100644 --- a/AFSLore/AFSQuickStartGuideforUNIX.mdwn +++ b/AFSLore/AFSQuickStartGuideforUNIX.mdwn @@ -1,4 +1,45 @@ - [[Installing the First AFS Machine|Main/InstallingTheFirstAFSMachine]] - [[Installing Additional Server Machines|Main/InstallingAdditionalServerMachines]] +- [[Installing Additional Client Machines|Main/InstallingAdditionalClientMachines]] + +# Sub Documents linked from the above docs - Do not use them directly + +- [[Loading AFS into the AIX Kernel|Main/LoadingAFSIntoTheAIXKernel]] +- [[Enabling AFS Login on AIX Systems|Main/EnablingAFSLoginOnAIXSystems]] +- [[Building AFS into the Digital UNIX Kernel|Main/BuildingAFSIntoTheDigitalUNIXKernel]] +- [[Enabling AFS Login on Digital UNIX Systems|Main/EnablingAFSLoginOnDigitalUNIXSystems]] + +- [[Building AFS into the HP-UX Kernel|Main/BuildingAFSIntoTheHP-UXKernel]] +- [[Enabling AFS Login on HP-UX Systems|Main/EnablingAFSLoginOnHP-UXSystems]] +- [[Loading AFS into the IRIX Kernel|Main/LoadingAFSIntoTheIRIXKernel]] +- [[Building AFS into the IRIX Kernel|Main/BuildingAFSIntoTheIRIXKernel]] +- [[Enabling AFS Login on IRIX Systems|Main/EnablingAFSLoginOnIRIXSystems]] + +- [[Loading AFS into the Linux Kernel|Main/LoadingAFSIntoTheLinuxKernel]] +- [[Enabling AFS Login on Linux Systems|Main/EnablingAFSLoginOnLinuxSystems]] + +- [[Loading AFS into the Solaris Kernel|Main/LoadingAFSIntoTheSolarisKernel]] +- [[Enabling AFS Login on Solaris Systems|Main/EnablingAFSLoginOnSolarisSystems]] + +- [[Creating the Client CellServDB File|Main/CreatingTheClientCellServDBFile]] +- [[Configuring the Cache|Main/ConfiguringTheCache]] +- [[Configuring the Cache Manager|Main/ConfiguringTheCacheManager]] +- [[Initialization Script on AIX|Main/InitializationScriptOnAIX]] +- [[Initialization Script on IRIX|Main/InitializationScriptOnIRIX]] +- [[Initialization Script on Digital UNIX|Main/InitializationScriptOnDigitalUNIX]] +- [[Initialization Script on HP-UX|Main/InitializationScriptOnHP-UX]] +- [[Initialization Script on Linux|Main/InitializationScriptOnLinux]] +- [[Initialization Script on Solaris|Main/InitializationScriptOnSolaris]] +- [[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] +- [[Configuring Server Volumes on AIX|Main/ConfiguringServerVolumesOnAIX]] +- [[Configuring Server Volumes on IRIX|Main/ConfiguringServerVolumesOnIRIX]] +- [[Configuring Server Volumes on Digital UNIX|Main/ConfiguringServerVolumesOnDigitalUNIX]] +- [[Configuring Server Volumes on HP-UX|Main/ConfiguringServerVolumesOnHP-UX]] +- [[Configuring Server Volumes on Linux|Main/ConfiguringServerVolumesOnLinux]] +- [[Configuring Server Volumes on Solaris|Main/ConfiguringServerVolumesOnSolaris]] +- [[Configuring the AFS-modified fsck Program on Solaris Systems|Main/ConfiguringTheAFS-modifiedFsckProgramOnSolarisSystems]] +- [[configuring the AFS-modified fsck Program on HP-UX Systems|Main/ConfiguringTheAFS-modifiedFsckProgramOnHP-UXSystems]] +- [[Replacing the fsck Program on Digital UNIX Systems|Main/ReplacingTheFsckProgramOnDigitalUNIXSystems]] +- [[Replacing the fsck Program Helper on AIX Systems|Main/ReplacingTheFsckProgramHelperOnAIXSystems]] -- [[CraigCook]] - 30 Mar 2005 diff --git a/AFSLore/BuildingAFSintotheDigitalUNIXKernel.mdwn b/AFSLore/BuildingAFSintotheDigitalUNIXKernel.mdwn new file mode 100644 index 0000000..24f5cf7 --- /dev/null +++ b/AFSLore/BuildingAFSintotheDigitalUNIXKernel.mdwn @@ -0,0 +1,111 @@ +The sysconfig program is the dynamic kernel loader provided for Digital UNIX systems. + +For AFS to function correctly, the sysconfig program must run each time the machine reboots, so the AFS initialization script (included on the AFS CD-ROM) invokes it automatically. In this section you copy the appropriate AFS library file to the location where the sysconfig program accesses it and then run the script. + +## Building AFS into the Digital UNIX Kernel + +Use the following instructions to build AFS modifications into the kernel on a Digital UNIX system. + +1. Create a copy called AFS of the basic kernel configuration file included in the Digital UNIX distribution as /usr/sys/conf/machine\_name, where machine\_name is the machine's hostname in all uppercase letters. + + # cd /usr/sys/conf + + # cp machine_name AFS + +1. Add AFS to the list of options in the configuration file you created in the previous step, so that the result looks like the following: + + . . + . . + options UFS + options NFS + options AFS + . . + . . + +1. Add an entry for AFS to two places in the file /usr/sys/conf/files. + +\* Add a line for AFS to the list of OPTIONS, so that the result looks like the following: + + . . . + . . . + OPTIONS/nfs optional nfs + OPTIONS/afs optional afs + OPTIONS/nfs_server optional nfs_server + . . . + . . . + +\* Add an entry for AFS to the list of MODULES, so that the result looks like the following: + + . . . . + . . . . + # + MODULE/nfs_server optional nfs_server Binary + nfs/nfs_server.c module nfs_server optimize -g3 + nfs/nfs3_server.c module nfs_server optimize -g3 + # + MODULE/afs optional afs Binary + afs/libafs.c module afs + # + +1. Add an entry for AFS to two places in the file /usr/sys/vfs/vfs\_conf.c. + +\* Add AFS to the list of defined file systems, so that the result looks like the following: + + . . + . . + #include + #if defined(AFS) && AFS + extern struct vfsops afs_vfsops; + #endif + . . + . . + +\* Put a declaration for AFS in the vfssw[] table's MOUNT\_ADDON slot, so that the result looks like the following: + + . . . + . . . + &fdfs_vfsops, "fdfs", /* 12 = MOUNT_FDFS */ + #if defined(AFS) + &afs_vfsops, "afs", + #else + (struct vfsops *)0, "", /* 13 = MOUNT_ADDON */ + #endif + #if NFS && INFS_DYNAMIC + &nfs3_vfsops, "nfsv3", /* 14 = MOUNT_NFS3 */ + +1. Mount the AFS CD-ROM for Digital UNIX on the local /cdrom directory. For instructions on mounting CD-ROMs (either locally or remotely via NFS), see your Digital UNIX documentation. Then change directory as indicated. + + # cd /cdrom/alpha_dux40/root.client + +1. Copy the AFS initialization script to the local directory for initialization files (by convention, /sbin/init.d on Digital UNIX machines). Note the removal of the .rc extension as you copy the script. + + # cp usr/vice/etc/afs.rc /sbin/init.d/afs + +1. Copy the AFS kernel module to the local /usr/sys/BINARY directory. + +If the machine's kernel supports NFS server functionality: + + # cp bin/libafs.o /usr/sys/BINARY/afs.mod + +If the machine's kernel does not support NFS server functionality: + + # cp bin/libafs.nonfs.o /usr/sys/BINARY/afs.mod + +1. Configure and build the kernel. Respond to any prompts by pressing . The resulting kernel resides in the file /sys/AFS/vmunix. + + # doconfig -c AFS + +1. Rename the existing kernel file and copy the new, AFS-modified file to the standard location. + + # mv /vmunix /vmunix_noafs + + # cp /sys/AFS/vmunix /vmunix + +10. Reboot the machine to start using the new kernel, and login again as the superuser root. + + # cd / + + # shutdown -r now + + login: root + Password: root_password diff --git a/AFSLore/BuildingAFSintotheHP-UXKernel.mdwn b/AFSLore/BuildingAFSintotheHP-UXKernel.mdwn new file mode 100644 index 0000000..3b88aaa --- /dev/null +++ b/AFSLore/BuildingAFSintotheHP-UXKernel.mdwn @@ -0,0 +1,73 @@ +Use the following instructions to build AFS modifications into the kernel on an HP-UX system. + +On HP-UX systems, you must build AFS modifications into a new static kernel; HP-UX does not support dynamic loading. If the machine's hardware and software configuration exactly matches another HP-UX machine on which AFS is already built into the kernel, you can choose to copy the kernel from that machine to this one. In general, however, it is better to build AFS modifications into the kernel on each machine according to the following instructions. + +1. Move the existing kernel-related files to a safe location. + + # cp /stand/vmunix /stand/vmunix.noafs + + # cp /stand/system /stand/system.noafs + +1. Mount the AFS CD-ROM for HP-UX on the local /cdrom directory. For instructions on mounting CD-ROMs (either locally or remotely via NFS), see your HP-UX documentation. Then change directory as indicated. + + # cd /cdrom/hp_ux110/root.client + +1. Copy the AFS initialization file to the local directory for initialization files (by convention, /sbin/init.d on HP-UX machines). Note the removal of the .rc extension as you copy the file. + + # cp usr/vice/etc/afs.rc /sbin/init.d/afs + +1. Copy the file afs.driver to the local /usr/conf/master.d directory, changing its name to afs as you do. + + # cp usr/vice/etc/afs.driver /usr/conf/master.d/afs + +1. Copy the AFS kernel module to the local /usr/conf/lib directory. + +If the machine's kernel supports NFS server functionality: + + # cp bin/libafs.a /usr/conf/lib + +If the machine's kernel does not support NFS server functionality, change the file's name as you copy it: + + # cp bin/libafs.nonfs.a /usr/conf/lib/libafs.a + +1. Incorporate the AFS driver into the kernel, either using the SAM program or a series of individual commands. + +\* To use the SAM program: + +1. 1. 1. 1. 1. Invoke the SAM program, specifying the hostname of the local machine as local\_hostname. The SAM graphical user interface pops up. + + # sam -display local_hostname:0 + +1. 1. 1. 1. 1. Choose the Kernel Configuration icon, then the Drivers icon. From the list of drivers, select afs. + +1. 1. 1. 1. 1. Open the pull-down Actions menu and choose the Add Driver to Kernel option. + +1. 1. 1. 1. 1. Open the Actions menu again and choose the Create a New Kernel option. + +1. 1. 1. 1. 1. Confirm your choices by choosing Yes and OK when prompted by subsequent pop-up windows. The SAM program builds the kernel and reboots the system. + +1. 1. 1. 1. 1. Login again as the superuser root. + + login: root + Password: root_password + +\* To use individual commands: + +1. 1. 1. 1. 1. Edit the file /stand/system, adding an entry for afs to the Subsystems section. + +1. 1. 1. 1. 1. Change to the /stand/build directory and issue the mk\_kernel command to build the kernel. + + # cd /stand/build + + # mk_kernel + +1. 1. 1. 1. 1. Move the new kernel to the standard location (/stand/vmunix), reboot the machine to start using it, and login again as the superuser root. + + # mv /stand/build/vmunix_test /stand/vmunix + + # cd / + + # shutdown -r now + + login: root + Password: root_password diff --git a/AFSLore/BuildingAFSintotheIRIXKernel.mdwn b/AFSLore/BuildingAFSintotheIRIXKernel.mdwn new file mode 100644 index 0000000..38dbe12 --- /dev/null +++ b/AFSLore/BuildingAFSintotheIRIXKernel.mdwn @@ -0,0 +1,40 @@ +Use the following instructions to build AFS modifications into the kernel on an IRIX system. + +1. Copy the kernel initialization file afs.sm to the local /var/sysgen/system directory, and the kernel master file afs to the local /var/sysgen/master.d directory. + + # cp -p bin/afs.sm /var/sysgen/system + + # cp -p bin/afs /var/sysgen/master.d + +1. Copy the appropriate AFS kernel library file to the local file /var/sysgen/boot/afs.a; the IPxx portion of the library file name must match the value previously returned by the uname -m command. Also choose the file appropriate to whether the machine's kernel supports NFS server functionality (NFS must be supported for the machine to act as an NFS/AFS Translator). Single- and multiprocessor machines use the same library file. + +If the machine's kernel supports NFS server functionality: + + # cp -p bin/libafs.IPxx.a /var/sysgen/boot/afs.a + +If the machine's kernel does not support NFS server functionality: + + # cp -p bin/libafs.IPxx.nonfs.a /var/sysgen/boot/afs.a + +1. Issue the chkconfig command to deactivate the afsml configuration variable. + + # /etc/chkconfig -f afsml off + +If the machine is to function as an NFS/AFS Translator and the kernel supports NFS server functionality, activate the afsxnfs variable. + + # /etc/chkconfig -f afsxnfs on + +1. Copy the existing kernel file, /unix, to a safe location. Compile the new kernel, which is created in the file /unix.install. It overwrites the existing /unix file when the machine reboots in the next step. + + # cp /unix /unix_noafs + + # autoconfig + +1. Reboot the machine to start using the new kernel, and login again as the superuser root. + + # cd / + + # shutdown -i6 -g0 -y + + login: root + Password: root_password diff --git a/AFSLore/ConfiguringServerVolumesonAIX.mdwn b/AFSLore/ConfiguringServerVolumesonAIX.mdwn new file mode 100644 index 0000000..d02bd83 --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonAIX.mdwn @@ -0,0 +1,19 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +To configure server partitions on an AIX system, perform the following procedures: + +1. Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat the command for each partition. + + # mkdir /vicepxx + +1. Use the SMIT program to create a journaling file system on each partition to be configured as an AFS server partition. + +1. Mount each partition at one of the /vicepxx directories. Choose one of the following three methods: + +\* Use the SMIT program + +\* Use the mount -a command to mount all partitions at once + +\* Use the mount command on each partition in turn + +Also configure the partitions so that they are mounted automatically at each reboot. For more information, refer to the AIX documentation. diff --git a/AFSLore/ConfiguringServerVolumesonDigitalUNIX.mdwn b/AFSLore/ConfiguringServerVolumesonDigitalUNIX.mdwn new file mode 100644 index 0000000..2c9d35e --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonDigitalUNIX.mdwn @@ -0,0 +1,19 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +1. Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat the command for each partition. + + # mkdir /vicepxx + +1. Add a line with the following format to the file systems registry file, /etc/fstab, for each directory just created. The entry maps the directory name to the disk partition to be mounted on it. + + /dev/disk /vicepxx ufs rw 0 2 + +The following is an example for the first partition being configured. + + /dev/rz3a /vicepa ufs rw 0 2 + +1. Create a file system on each partition that is to be mounted at a /vicepxx directory. The following command is probably appropriate, but consult the Digital UNIX documentation for more information. + + # newfs -v /dev/disk + +1. Mount each partition by issuing either the mount -a command to mount all partitions at once or the mount command to mount each partition in turn. diff --git a/AFSLore/ConfiguringServerVolumesonHP-UX.mdwn b/AFSLore/ConfiguringServerVolumesonHP-UX.mdwn new file mode 100644 index 0000000..06c1220 --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonHP-UX.mdwn @@ -0,0 +1,9 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +1. Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat the command for each partition. + + # mkdir /vicepxx + +1. Use the SAM program to create a file system on each partition. For instructions, consult the HP-UX documentation. + +1. On some HP-UX systems that use logical volumes, the SAM program automatically mounts the partitions. If it has not, mount each partition by issuing either the mount -a command to mount all partitions at once or the mount command to mount each partition in turn. diff --git a/AFSLore/ConfiguringServerVolumesonIRIX.mdwn b/AFSLore/ConfiguringServerVolumesonIRIX.mdwn new file mode 100644 index 0000000..6e343da --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonIRIX.mdwn @@ -0,0 +1,38 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +AFS supports use of both EFS and XFS partitions for housing AFS volumes. SGI encourages use of XFS partitions. + +1. Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat the command for each partition. + + # mkdir /vicepxx + +1. Add a line with the following format to the file systems registry file, /etc/fstab, for each partition (or logical volume created with the XLV volume manager) to be mounted on one of the directories created in the previous step. + +For an XFS partition or logical volume: + + /dev/dsk/disk /vicepxx xfs rw,raw=/dev/rdsk/disk 0 0 + +For an EFS partition: + + /dev/dsk/disk /vicepxx efs rw,raw=/dev/rdsk/disk 0 0 + +The following are examples of an entry for each file system type: + + /dev/dsk/dks0d2s6 /vicepa xfs rw,raw=/dev/rdsk/dks0d2s6 0 0 + /dev/dsk/dks0d3s1 /vicepb efs rw,raw=/dev/rdsk/dks0d3s1 0 0 + +1. Create a file system on each partition that is to be mounted on a /vicepxx directory. The following commands are probably appropriate, but consult the IRIX documentation for more information. In both cases, raw\_device is a raw device name like /dev/rdsk/dks0d0s0 for a single disk partition or /dev/rxlv/xlv0 for a logical volume. + +For XFS file systems, include the indicated options to configure the partition or logical volume with inodes large enough to accommodate AFS-specific information: + + # mkfs -t xfs -i size=512 -l size=4000b raw_device + +For EFS file systems: + + # mkfs -t efs raw_device + +1. Mount each partition by issuing either the mount -a command to mount all partitions at once or the mount command to mount each partition in turn. + +1. (Optional) If you have configured partitions or logical volumes to use XFS, issue the following command to verify that the inodes are configured properly (are large enough to accommodate AFS-specific information). If the configuration is correct, the command returns no output. Otherwise, it specifies the command to run in order to configure each partition or logical volume properly. + + # /usr/afs/bin/xfs_size_check diff --git a/AFSLore/ConfiguringServerVolumesonLinux.mdwn b/AFSLore/ConfiguringServerVolumesonLinux.mdwn new file mode 100644 index 0000000..3633fa2 --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonLinux.mdwn @@ -0,0 +1,19 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +1. Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat the command for each partition. + + # mkdir /vicepxx + +1. Add a line with the following format to the file systems registry file, /etc/fstab, for each directory just created. The entry maps the directory name to the disk partition to be mounted on it. + + /dev/disk /vicepxx ext2 defaults 0 2 + +The following is an example for the first partition being configured. + + /dev/sda8 /vicepa ext2 defaults 0 2 + +1. Create a file system on each partition that is to be mounted at a /vicepxx directory. The following command is probably appropriate, but consult the Linux documentation for more information. + + # mkfs -v /dev/disk + +1. Mount each partition by issuing either the mount -a command to mount all partitions at once or the mount command to mount each partition in turn. diff --git a/AFSLore/ConfiguringServerVolumesonSolaris.mdwn b/AFSLore/ConfiguringServerVolumesonSolaris.mdwn new file mode 100644 index 0000000..8db8319 --- /dev/null +++ b/AFSLore/ConfiguringServerVolumesonSolaris.mdwn @@ -0,0 +1,21 @@ +Every AFS file server machine must have at least one partition or logical volume dedicated to storing AFS volumes. Each server partition is mounted at a directory named /vicepxx, where xx is one or two lowercase letters. The /vicepxx directories must reside in the file server machine's root directory, not in one of its subdirectories (for example, /usr/vicepa is not an acceptable directory location). For additional information, see Performing Platform-Specific Procedures. + +If this AFS server it is not going to be a file server you can skip this step. + +Create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). Repeat this command for each partition. + + # mkdir /vicepxx + +Add a line with the following format to the file systems registry file, /etc/vfstab, for each partition to be mounted on a directory created in the previous step. Note the value afs in the fourth field, which tells Solaris to use the AFS-modified fsck program on this partition. + + /dev/dsk/disk /dev/rdsk/disk /vicepxx afs boot_order yes - + +The following is an example for the first partition being configured. + + /dev/dsk/c0t6d0s1 /dev/rdsk/c0t6d0s1 /vicepa afs 3 yes - + +Create a file system on each partition that is to be mounted at a /vicepxx directory. The following command is probably appropriate, but consult the Solaris documentation for more information. + + # newfs -v /dev/rdsk/disk + +Issue the mountall command to mount all partitions at once. diff --git a/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonHP-UXSystems.mdwn b/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonHP-UXSystems.mdwn new file mode 100644 index 0000000..1266b4c --- /dev/null +++ b/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonHP-UXSystems.mdwn @@ -0,0 +1,38 @@ +In this section, you make modifications to guarantee that the appropriate fsck program runs on AFS server partitions. The fsck program provided with the operating system must never run on AFS server partitions. Because it does not recognize the structures that the File Server uses to organize volume data, it removes all of the data. To repeat: + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +On HP-UX systems, there are several configuration files to install in addition to the AFS-modified fsck program (the vfsck binary). + +1. Create the command configuration file /sbin/lib/mfsconfig.d/afs. Use a text editor to place the indicated two lines in it: + + format_revision 1 + fsck 0 m,P,p,d,f,b:c:y,n,Y,N,q, + +1. Create and change directory to an AFS-specific command directory called /sbin/fs/afs. + + # mkdir /sbin/fs/afs + + # cd /sbin/fs/afs + +1. Copy the AFS-modified version of the fsck program (the vfsck binary) and related files from the distribution directory to the new AFS-specific command directory. + + # cp -p /cdrom/hp_ux110/root.server/etc/* . + +1. Change the vfsck binary's name to fsck and set the mode bits appropriately on all of the files in the /sbin/fs/afs directory. + + # mv vfsck fsck + + # chmod 755 * + +1. Edit the /etc/fstab file, changing the file system type for each AFS server partition from hfs to afs. This ensures that the AFS-modified fsck program runs on the appropriate partitions. + +The sixth line in the following example of an edited file shows an AFS server partition, /vicepa. + + /dev/vg00/lvol1 / hfs defaults 0 1 + /dev/vg00/lvol4 /opt hfs defaults 0 2 + /dev/vg00/lvol5 /tmp hfs defaults 0 2 + /dev/vg00/lvol6 /usr hfs defaults 0 2 + /dev/vg00/lvol8 /var hfs defaults 0 2 + /dev/vg00/lvol9 /vicepa afs defaults 0 2 + /dev/vg00/lvol7 /usr/vice/cache hfs defaults 0 2 diff --git a/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonSolarisSystems.mdwn b/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonSolarisSystems.mdwn new file mode 100644 index 0000000..f1b581a --- /dev/null +++ b/AFSLore/ConfiguringtheAFS-modifiedfsckProgramonSolarisSystems.mdwn @@ -0,0 +1,114 @@ +In this section, you make modifications to guarantee that the appropriate fsck program runs on AFS server partitions. The fsck program provided with the operating system must never run on AFS server partitions. Because it does not recognize the structures that the File Server uses to organize volume data, it removes all of the data. To repeat: + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +1. Create the /usr/lib/fs/afs directory to house the AFS-modified fsck program and related files. + + # mkdir /usr/lib/fs/afs + + # cd /usr/lib/fs/afs + + 2. Copy the vfsck binary to the newly created directory, changing the name as you do so. + + # cp /cdrom/sysname/dest/root.server/etc/vfsck fsck + +1. Working in the /usr/lib/fs/afs directory, create the following links to Solaris libraries: + + # ln -s /usr/lib/fs/ufs/clri + # ln -s /usr/lib/fs/ufs/df + # ln -s /usr/lib/fs/ufs/edquota + # ln -s /usr/lib/fs/ufs/ff + # ln -s /usr/lib/fs/ufs/fsdb + # ln -s /usr/lib/fs/ufs/fsirand + # ln -s /usr/lib/fs/ufs/fstyp + # ln -s /usr/lib/fs/ufs/labelit + # ln -s /usr/lib/fs/ufs/lockfs + # ln -s /usr/lib/fs/ufs/mkfs + # ln -s /usr/lib/fs/ufs/mount + # ln -s /usr/lib/fs/ufs/ncheck + # ln -s /usr/lib/fs/ufs/newfs + # ln -s /usr/lib/fs/ufs/quot + # ln -s /usr/lib/fs/ufs/quota + # ln -s /usr/lib/fs/ufs/quotaoff + # ln -s /usr/lib/fs/ufs/quotaon + # ln -s /usr/lib/fs/ufs/repquota + # ln -s /usr/lib/fs/ufs/tunefs + # ln -s /usr/lib/fs/ufs/ufsdump + # ln -s /usr/lib/fs/ufs/ufsrestore + # ln -s /usr/lib/fs/ufs/volcopy + +1. Append the following line to the end of the file /etc/dfs/fstypes. + + afs AFS Utilities + +1. Edit the /sbin/mountall file, making two changes. + +\* Add an entry for AFS to the case statement for option 2, so that it reads as follows: + + case "$2" in + ufs) foptions="-o p" + ;; + afs) foptions="-o p" + ;; + s5) foptions="-y -t /var/tmp/tmp$$ -D" + ;; + *) foptions="-y" + ;; + +### Solaris 6 + +\* Edit the file so that all AFS and UFS partitions are checked in parallel. Replace the following section of code: + + # For fsck purposes, we make a distinction between ufs and + # other file systems + # + if [ "$fstype" = "ufs" ]; then + ufs_fscklist="$ufs_fscklist $fsckdev" + saveentry $fstype "$OPTIONS" $special $mountp + continue + fi + +with the following section of code: + + # For fsck purposes, we make a distinction between ufs/afs + # and other file systems. + # + if [ "$fstype" = "ufs" -o "$fstype" = "afs" ]; then + ufs_fscklist="$ufs_fscklist $fsckdev" + saveentry $fstype "$OPTIONS" $special $mountp + continue + fi + +### Solaris 9 + +\* Edit the file so that all AFS and UFS partitions are checked in parallel. + +You must copy /usr/lib/fs/ufs/fsckall to /usr/lib/fs/afs/fsckall and change the word ufs to afs in file /usr/lib/fs/afs/fsckall as indicated below. This ensures that AFS fsck is called on vice partitions. + +1. 1. 1. Copy /usr/lib/fs/ufs/fsckall to /usr/lib/fs/afs/fsckall. + + cp /usr/lib/fs/ufs/fsckall /usr/lib/fs/afs/fsckall + +1. 1. 1. Edit /usr/lib/fs/afs/fsckall and replace ufs with afs as indicated below. + +Original: + + for fsckdev in $*; do + /usr/sbin/fsck -m -F ufs $fsckdev >/dev/null 2>&1 + +Modified: + + for fsckdev in $*; do + /usr/lib/fs/afs/fsck -m -F afs $fsckdev >/dev/null 2>&1 + +Also, this section of the same file: + +Original: + + echo "checking ufs filesystems" + /usr/sbin/fsck -o p $ufs_fscklist + +Modified: + + echo "checking afs filesystems" + /usr/lib/fs/afs/fsck -o p $ufs_fscklist diff --git a/AFSLore/ConfiguringtheCache.mdwn b/AFSLore/ConfiguringtheCache.mdwn new file mode 100644 index 0000000..900fa60 --- /dev/null +++ b/AFSLore/ConfiguringtheCache.mdwn @@ -0,0 +1,57 @@ +The Cache Manager uses a cache on the local disk or in machine memory to store local copies of files fetched from file server machines. As the afsd program initializes the Cache Manager, it sets basic cache configuration parameters according to definitions in the local /usr/vice/etc/cacheinfo file. The file has three fields: + +1. The first field names the local directory on which to mount the AFS filespace. The conventional location is the /afs directory. + +1. The second field defines the local disk directory to use for the disk cache. The conventional location is the /usr/vice/cache directory, but you can specify an alternate directory if another partition has more space available. There must always be a value in this field, but the Cache Manager ignores it if the machine uses a memory cache. + +1. The third field specifies the number of kilobyte (1024 byte) blocks to allocate for the cache. + +The values you define must meet the following requirements. + +\* On a machine using a disk cache, the Cache Manager expects always to be able to use the amount of space specified in the third field. Failure to meet this requirement can cause serious problems, some of which can be repaired only by rebooting. You must prevent non-AFS processes from filling up the cache partition. The simplest way is to devote a partition to the cache exclusively. + +\* The amount of space available in memory or on the partition housing the disk cache directory imposes an absolute limit on cache size. + +\* The maximum supported cache size can vary in each AFS release; see the IBM AFS Release Notes for the current version. + +\* For a disk cache, you cannot specify a value in the third field that exceeds 95% of the space available on the partition mounted at the directory named in the second field. If you violate this restriction, the afsd program exits without starting the Cache Manager and prints an appropriate message on the standard output stream. A value of 90% is more appropriate on most machines. Some operating systems (such as AIX) do not automatically reserve some space to prevent the partition from filling completely; for them, a smaller value (say, 80% to 85% of the space available) is more appropriate. + +\* For a memory cache, you must leave enough memory for other processes and applications to run. If you try to allocate more memory than is actually available, the afsd program exits without initializing the Cache Manager and produces the following message on the standard output stream. + + afsd: memCache allocation failure at number KB + +The number value is how many kilobytes were allocated just before the failure, and so indicates the approximate amount of memory available. + +Within these hard limits, the factors that determine appropriate cache size include the number of users working on the machine, the size of the files with which they work, and (for a memory cache) the number of processes that run on the machine. The higher the demand from these factors, the larger the cache needs to be to maintain good performance. + +Disk caches smaller than 10 MB do not generally perform well. Machines serving multiple users usually perform better with a cache of at least 60 to 70 MB. The point at which enlarging the cache further does not really improve performance depends on the factors mentioned previously and is difficult to predict. + +Memory caches smaller than 1 MB are nonfunctional, and the performance of caches smaller than 5 MB is usually unsatisfactory. Suitable upper limits are similar to those for disk caches but are probably determined more by the demands on memory from other sources on the machine (number of users and processes). Machines running only a few processes possibly can use a smaller memory cache. + +## Configuring a Disk Cache + +Note: Not all file system types that an operating system supports are necessarily supported for use as the cache partition. For possible restrictions, see the IBM AFS Release Notes. + +To configure the disk cache, perform the following procedures: + +1. Create the local directory to use for caching. The following instruction shows the conventional location, /usr/vice/cache. If you are devoting a partition exclusively to caching, as recommended, you must also configure it, make a file system on it, and mount it at the directory created in this step. + + # mkdir /usr/vice/cache + +1. Create the cacheinfo file to define the configuration parameters discussed previously. The following instruction shows the standard mount location, /afs, and the standard cache location, /usr/vice/cache. + + # echo "/afs:/usr/vice/cache:#blocks" > /usr/vice/etc/cacheinfo + +The following example defines the disk cache size as 50,000 KB: + + # echo "/afs:/usr/vice/cache:50000" > /usr/vice/etc/cacheinfo + +## Configuring a Memory Cache + +To configure a memory cache, create the cacheinfo file to define the configuration parameters discussed previously. The following instruction shows the standard mount location, /afs, and the standard cache location, /usr/vice/cache (though the exact value of the latter is irrelevant for a memory cache). + + # echo "/afs:/usr/vice/cache:#blocks" > /usr/vice/etc/cacheinfo + +The following example allocates 25,000 KB of memory for the cache. + + # echo "/afs:/usr/vice/cache:25000" > /usr/vice/etc/cacheinfo diff --git a/AFSLore/ConfiguringtheCacheManager.mdwn b/AFSLore/ConfiguringtheCacheManager.mdwn new file mode 100644 index 0000000..528ad58 --- /dev/null +++ b/AFSLore/ConfiguringtheCacheManager.mdwn @@ -0,0 +1,68 @@ +By convention, the Cache Manager mounts the AFS filespace on the local /afs directory. In this section you create that directory. + +The afsd program sets several cache configuration parameters as it initializes the Cache Manager, and starts daemons that improve performance. You can use the afsd command's arguments to override the parameters' default values and to change the number of some of the daemons. Depending on the machine's cache size, its amount of RAM, and how many people work on it, you can sometimes improve Cache Manager performance by overriding the default values. For a discussion of all of the afsd command's arguments, see its reference page in the IBM AFS Administration Reference. + +The afsd command line in the AFS initialization script on each system type includes an OPTIONS variable. You can use it to set nondefault values for the command's arguments, in one of the following ways: + +\* You can create an afsd options file that sets values for arguments to the afsd command. If the file exists, its contents are automatically substituted for the OPTIONS variable in the AFS initialization script. The AFS distribution for some system types includes an options file; on other system types, you must create it. + +You use two variables in the AFS initialization script to specify the path to the options file: CONFIG and AFSDOPT. On system types that define a conventional directory for configuration files, the CONFIG variable indicates it by default; otherwise, the variable indicates an appropriate location. + +List the desired afsd options on a single line in the options file, separating each option with one or more spaces. The following example sets the -stat argument to 2500, the -daemons argument to 4, and the -volumes argument to 100. + + -stat 2500 -daemons 4 -volumes 100 + +\* On a machine that uses a disk cache, you can set the OPTIONS variable in the AFS initialization script to one of $SMALL, $MEDIUM, or $LARGE. The AFS initialization script uses one of these settings if the afsd options file named by the AFSDOPT variable does not exist. In the script as distributed, the OPTIONS variable is set to the value $MEDIUM. + +
+
+
+
Note
+
Do not set the OPTIONS variable to $SMALL, $MEDIUM, or $LARGE on a machine that uses a memory cache. The arguments it sets are appropriate only on a machine that uses a disk cache.
+
+
+
+ +The script (or on some system types the afsd options file named by the AFSDOPT variable) defines a value for each of SMALL, MEDIUM, and LARGE that sets afsd command arguments appropriately for client machines of different sizes: + + o SMALL is suitable for a small machine that serves one or two users and has approximately 8 MB of RAM and a 20-MB cache + + o MEDIUM is suitable for a medium-sized machine that serves two to six users and has 16 MB of RAM and a 40-MB cache + + o LARGE is suitable for a large machine that serves five to ten users and has 32 MB of RAM and a 100-MB cache + +\* You can choose not to create an afsd options file and to set the OPTIONS variable in the initialization script to a null value rather than to the default $MEDIUM value. You can then either set arguments directly on the afsd command line in the script, or set no arguments (and so accept default values for all Cache Manager parameters). + +1. Create the local directory on which to mount the AFS filespace, by convention /afs. If the directory already exists, verify that it is empty. + + # mkdir /afs + +1. On AIX systems, add the following line to the /etc/vfs file. It enables AIX to unmount AFS correctly during shutdown. + + afs 4 none none + +1. On Linux systems, copy the afsd options file from the /usr/vice/etc directory to the /etc/sysconfig directory, removing the .conf extension as you do so. + + # cp /usr/vice/etc/afs.conf /etc/sysconfig/afs + +1. Edit the machine's AFS initialization script or afsd options file to set appropriate values for afsd command parameters. The script resides in the indicated location on each system type: + +- On AIX systems, /etc/rc.afs + +- On Digital UNIX systems, /sbin/init.d/afs + +- On HP-UX systems, /sbin/init.d/afs + +- On IRIX systems, /etc/init.d/afs + +- On Linux systems, /etc/sysconfig/afs (the afsd options file) + +- On Solaris systems, /etc/init.d/afs + +Use one of the methods described in the introduction to this section to add the following flags to the afsd command line. If you intend for the machine to remain an AFS client, also set any performance-related arguments you wish. + +\* Add the -nosettime flag, because this is a file server machine that is also a client. The flag prevents the machine from picking a file server machine in the cell as its source for the correct time, which client machines normally do. File server machines instead use NTPD (as controlled by the runntp process) or another protocol to synchronize their clocks. + +\* Add the -memcache flag if the machine is to use a memory cache. + +\* Add the -verbose flag to display a trace of the Cache Manager's initialization on the standard output stream. diff --git a/AFSLore/ConfirmCacheManagerInitialization.mdwn b/AFSLore/ConfirmCacheManagerInitialization.mdwn new file mode 100644 index 0000000..b1eafd4 --- /dev/null +++ b/AFSLore/ConfirmCacheManagerInitialization.mdwn @@ -0,0 +1,26 @@ +Wait for the message that confirms that Cache Manager initialization is complete. + +On machines that use a disk cache, it can take a while to initialize the Cache Manager for the first time, because the afsd program must create all of the Vn files in the cache directory. Subsequent Cache Manager initializations do not take nearly as long, because the Vn files already exist. + +As a basic test of correct AFS functioning, issue the klog command to authenticate as the admin user. Provide the password (admin\_passwd) you defined in Initializing Cell Security. + + # /usr/afs/bin/klog admin + Password: admin_passwd + +Issue the tokens command to verify that the klog command worked correctly. If it did, the output looks similar to the following example for the abc.com cell, where admin's AFS UID is 1. If the output does not seem correct, resolve the problem. Changes to the AFS initialization script are possibly necessary. The AFS Product Support group can provide assistance as necessary. + + # /usr/afs/bin/tokens + Tokens held by the Cache Manager: + + User's (AFS ID 1) tokens for afs@abc.com [Expires May 22 11:52] + --End of list-- + +Issue the bos status command to verify that the output for each process reads Currently running normally. + + # /usr/afs/bin/bos status + +Change directory to the local file system root (/) and issue the fs checkvolumes command. + + # cd / + + # /usr/afs/bin/fs checkvolumes diff --git a/AFSLore/CreatingtheClientCellServDBFile.mdwn b/AFSLore/CreatingtheClientCellServDBFile.mdwn new file mode 100644 index 0000000..f3aafef --- /dev/null +++ b/AFSLore/CreatingtheClientCellServDBFile.mdwn @@ -0,0 +1,46 @@ +The /usr/vice/etc/CellServDB file on a client machine's local disk lists the database server machines for each cell that the local Cache Manager can contact. If there is no entry in the file for a cell, or if the list of database server machines is wrong, then users working on this machine cannot access the cell. The chapter in the IBM AFS Administration Guide about administering client machines explains how to maintain the file after creating it. + +As the afsd program initializes the Cache Manager, it copies the contents of the [[CellServDB]] file into kernel memory. The Cache Manager always consults the list in kernel memory rather than the [[CellServDB]] file itself. Between reboots of the machine, you can use the fs newcell command to update the list in kernel memory directly; see the chapter in the IBM AFS Administration Guide about administering client machines. + +The AFS distribution includes the file [[CellServDB]].sample, and you have already copied it to the /usr/vice/etc directory. It includes an entry for all AFS cells that agreed to share their database server machine information at the time your AFS CD-ROM was created. The AFS Product Support group also maintains a copy of the file, updating it as necessary. If you are interested in participating in the global AFS namespace, it is a good policy to consult the file occasionally for updates. Ask the AFS Product Support group for a pointer to its location. + +The [[CellServDB]].sample file can be a good basis for the client [[CellServDB]] file, because all of the entries in it use the correct format. You can add or remove cell entries as you see fit. Later (in Enabling Access to Foreign Cells) you perform additional steps that enable the Cache Manager actually to reach the cells. + +In this section, you add an entry for the local cell to the local [[CellServDB]] file. The current working directory is still /usr/vice/etc. + +1. Remove the symbolic link created in Starting the BOS Server and rename the [[CellServDB]].sample file to [[CellServDB]]. + + # rm CellServDB + + # mv CellServDB.sample CellServDB + +1. Add an entry for the local cell to the [[CellServDB]] file. One easy method is to use the cat command to append the contents of the server /usr/afs/etc/CellServDB file to the client version. + + # cat /usr/afs/etc/CellServDB >> CellServDB + +Then open the file in a text editor to verify that there are no blank lines, and that all entries have the required format, which is described just following. The ordering of cells is not significant, but it can be convenient to have the client machine's home cell at the top; move it there now if you wish. + +\* The first line of a cell's entry has the following format: + + >cell_name #organization + +where cell\_name is the cell's complete Internet domain name (for example, abc.com) and organization is an optional field that follows any number of spaces and the number sign (#). By convention it names the organization to which the cell corresponds (for example, the ABC Corporation). + +\* After the first line comes a separate line for each database server machine. Each line has the following format: + + IP_address #machine_name + +where IP\_address is the machine's IP address in dotted decimal format (for example, 192.12.105.3). Following any number of spaces and the number sign (#) is machine\_name, the machine's fully-qualified hostname (for example, db1.abc.com). In this case, the number sign does not indicate a comment; machine\_name is a required field. + +1. If the file includes cells that you do not wish users of this machine to access, remove their entries. + +The following example shows entries for two cells, each of which has three database server machines: + + >abc.com #ABC Corporation (home cell) + 192.12.105.3 #db1.abc.com + 192.12.105.4 #db2.abc.com + 192.12.105.55 #db3.abc.com + >stateu.edu #State University cell + 138.255.68.93 #serverA.stateu.edu + 138.255.68.72 #serverB.stateu.edu + 138.255.33.154 #serverC.stateu.edu diff --git a/AFSLore/EnablingAFSLoginonAIXSystems.mdwn b/AFSLore/EnablingAFSLoginonAIXSystems.mdwn new file mode 100644 index 0000000..170aea8 --- /dev/null +++ b/AFSLore/EnablingAFSLoginonAIXSystems.mdwn @@ -0,0 +1,59 @@ +Follow the instructions in this section to incorporate AFS modifications into the AIX secondary authentication system. + +1. Issue the ls command to verify that the afs\_dynamic\_auth and afs\_dynamic\_kerbauth programs are installed in the local /usr/vice/etc directory. + + # ls /usr/vice/etc + +If the files do not exist, mount the AFS CD-ROM for AIX (if it is not already), change directory as indicated, and copy them. + + # cd /cdrom/rs_aix42/root.client/usr/vice/etc + + # cp -p afs_dynamic* /usr/vice/etc + +1. Edit the local /etc/security/user file, making changes to the indicated stanzas: + +\* In the default stanza, set the registry attribute to DCE (not to AFS), as follows: + + registry = DCE + +\* In the default stanza, set the SYSTEM attribute as indicated. + +If the machine is an AFS client only, set the following value: + + SYSTEM = "AFS OR (AFS[UNAVAIL] AND compat[SUCCESS])" + +If the machine is both an AFS and a DCE client, set the following value (it must appear on a single line in the file): + + SYSTEM = "DCE OR DCE[UNAVAIL] OR AFS OR (AFS[UNAVAIL] \ + AND compat[SUCCESS])" + +\* In the root stanza, set the registry attribute as follows. It enables the local superuser root to log into the local file system only, based on the password listed in the local password file. + + root: + registry = files + +1. Edit the local /etc/security/login.cfg file, creating or editing the indicated stanzas: + +\* In the DCE stanza, set the program attribute as follows. + +If you use the AFS Authentication Server (kaserver process): + + DCE: + program = /usr/vice/etc/afs_dynamic_auth + +If you use a Kerberos implementation of AFS authentication: + + DCE: + program = /usr/vice/etc/afs_dynamic_kerbauth + +\* In the AFS stanza, set the program attribute as follows. + +If you use the AFS Authentication Server (kaserver process): + + AFS: + program = /usr/vice/etc/afs_dynamic_auth + +If you use a Kerberos implementation of AFS authentication: + + AFS: + program = /usr/vice/etc/afs_dynamic_kerbauth diff --git a/AFSLore/EnablingAFSLoginonDigitalUNIXSystems.mdwn b/AFSLore/EnablingAFSLoginonDigitalUNIXSystems.mdwn new file mode 100644 index 0000000..a951b1f --- /dev/null +++ b/AFSLore/EnablingAFSLoginonDigitalUNIXSystems.mdwn @@ -0,0 +1,21 @@ +## Enabling AFS Login on Digital UNIX Systems + +On Digital UNIX systems, the AFS initialization script automatically incorporates the AFS authentication library file into the Security Integration Architecture (SIA) matrix on the machine, so that users with AFS accounts obtain a token at login. In this section you copy the library file to the appropriate location. + +For more information on SIA, see the Digital UNIX reference page for matrix.conf, or consult the section on security in your Digital UNIX documentation. Note: If the machine runs both the DCE and AFS client software, AFS must start after DCE. Consult the AFS initialization script for suggested symbolic links to create for correct ordering. Also, the system startup script order must initialize SIA before any long-running process that uses authentication. + +Perform the following steps to enable AFS login. + +1. Mount the AFS CD-ROM for Digital UNIX on the local /cdrom directory, if it is not already. Change directory as indicated. + + # cd /cdrom/alpha_dux40/lib/afs + +1. Copy the appropriate AFS authentication library file to the local /usr/shlib directory. + +If you use the AFS Authentication Server (kaserver process) in the cell: + + # cp libafssiad.so /usr/shlib + +If you use a Kerberos implementation of AFS authentication, rename the library file as you copy it: + + # cp libafssiad.krb.so /usr/shlib/libafssiad.so diff --git a/AFSLore/EnablingAFSLoginonHP-UXSystems.mdwn b/AFSLore/EnablingAFSLoginonHP-UXSystems.mdwn new file mode 100644 index 0000000..e1194ff --- /dev/null +++ b/AFSLore/EnablingAFSLoginonHP-UXSystems.mdwn @@ -0,0 +1,71 @@ +At this point you incorporate AFS into the operating system's Pluggable Authentication Module (PAM) scheme. PAM integrates all authentication mechanisms on the machine, including login, to provide the security infrastructure for authenticated access to and from the machine. + +Explaining PAM is beyond the scope of this document. It is assumed that you understand the syntax and meanings of settings in the PAM configuration file (for example, how the other entry works, the effect of marking an entry as required, optional, or sufficient, and so on). + +The following instructions explain how to alter the entries in the PAM configuration file for each service for which you wish to use AFS authentication. Other configurations possibly also work, but the instructions specify the recommended and tested configuration. Note: The instructions specify that you mark each entry as optional. However, marking some modules as optional can mean that they grant access to the corresponding service even when the user does not meet all of the module's requirements. In some operating system revisions, for example, if you mark as optional the module that controls login via a dial-up connection, it allows users to login without providing a password. See the IBM AFS Release Notes for a discussion of any limitations that apply to this operating system. + +Also, with some operating system versions you must install patches for PAM to interact correctly with certain authentication programs. For details, see the IBM AFS Release Notes. + +The recommended AFS-related entries in the PAM configuration file make use of one or more of the following three attributes. + + try_first_pass + +This is a standard PAM attribute that can be included on entries after the first one for a service; it directs the module to use the password that was provided to the first module. For the AFS module, it means that AFS authentication succeeds if the password provided to the module listed first is the user's correct AFS password. For further discussion of this attribute and its alternatives, see the operating system's PAM documentation. + + ignore_root + +This attribute, specific to the AFS PAM module, directs it to ignore not only the local superuser root, but also any user with UID 0 (zero). + + setenv_password_expires + +This attribute, specific to the AFS PAM module, sets the environment variable PASSWORD\_EXPIRES to the expiration date of the user's AFS password, which is recorded in the Authentication Database. + +Perform the following steps to enable AFS login. + +1. Mount the AFS CD-ROM for HP-UX on the /cdrom directory, if it is not already. Then change directory as indicated. + + # cd /usr/lib/security + +1. Copy the AFS authentication library file to the /usr/lib/security directory. Then create a symbolic link to it whose name does not mention the version. Omitting the version eliminates the need to edit the PAM configuration file if you later update the library file. + +If you use the AFS Authentication Server (kaserver process) in the cell: + + # cp /cdrom/hp_ux110/lib/pam_afs.so.1 . + + # ln -s pam_afs.so.1 pam_afs.so + +If you use a Kerberos implementation of AFS authentication: + + # cp /cdrom/hp_ux110/lib/pam_afs.krb.so.1 . + + # ln -s pam_afs.krb.so.1 pam_afs.so + +1. Edit the Authentication management section of the HP-UX PAM configuration file, /etc/pam.conf by convention. The entries in this section have the value auth in their second field. + +First edit the standard entries, which refer to the HP-UX PAM module (usually, the file /usr/lib/security/libpam\_unix.1) in their fourth field. For each service for which you want to use AFS authentication, edit the third field of its entry to read optional. The pam.conf file in the HP-UX distribution usually includes standard entries for the login and ftp services, for instance. + +If there are services for which you want to use AFS authentication, but for which the pam.conf file does not already include a standard entry, you must create that entry and place the value optional in its third field. For instance, the HP-UX pam.conf file does not usually include standard entries for the remsh or telnet services. + +Then create an AFS-related entry for each service, placing it immediately below the standard entry. The following example shows what the Authentication Management section looks like after you have you edited or created entries for the services mentioned previously. Note that the example AFS entries appear on two lines only for legibility. + + login auth optional /usr/lib/security/libpam_unix.1 + login auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root setenv_password_expires + ftp auth optional /usr/lib/security/libpam_unix.1 + ftp auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + remsh auth optional /usr/lib/security/libpam_unix.1 + remsh auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + telnet auth optional /usr/lib/security/libpam_unix.1 + telnet auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root setenv_password_expires + +1. If you use the Common Desktop Environment (CDE) on the machine and want users to obtain an AFS token as they log in, also add or edit the following four entries in the Authentication management section. Note that the AFS-related entries appear on two lines here only for legibility. + + dtlogin auth optional /usr/lib/security/libpam_unix.1 + dtlogin auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + dtaction auth optional /usr/lib/security/libpam_unix.1 + dtaction auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root diff --git a/AFSLore/EnablingAFSLoginonIRIXSystems.mdwn b/AFSLore/EnablingAFSLoginonIRIXSystems.mdwn new file mode 100644 index 0000000..a1681c6 --- /dev/null +++ b/AFSLore/EnablingAFSLoginonIRIXSystems.mdwn @@ -0,0 +1,11 @@ +The standard IRIX command-line login program and the graphical xdm login program both automatically grant an AFS token when AFS is incorporated into the machine's kernel. However, some IRIX distributions use another login utility by default, and it does not necessarily incorporate the required AFS modifications. If that is the case, you must disable the default utility if you want AFS users to obtain AFS tokens at login. For further discussion, see the IBM AFS Release Notes. + +If you configure the machine to use an AFS-modified login utility, then the afsauthlib.so and afskauthlib.so files (included in the AFS distribution) must reside in the /usr/vice/etc directory. Issue the ls command to verify. + + # ls /usr/vice/etc + +If the files do not exist, mount the AFS CD-ROM for IRIX (if it is not already), change directory as indicated, and copy them. + + # cd /cdrom/sgi_65/root.client/usr/vice/etc + + # cp -p *authlib* /usr/vice/etc diff --git a/AFSLore/EnablingAFSLoginonLinuxSystems.mdwn b/AFSLore/EnablingAFSLoginonLinuxSystems.mdwn new file mode 100644 index 0000000..042f112 --- /dev/null +++ b/AFSLore/EnablingAFSLoginonLinuxSystems.mdwn @@ -0,0 +1,192 @@ +At this point you incorporate AFS into the operating system's Pluggable Authentication Module (PAM) scheme. PAM integrates all authentication mechanisms on the machine, including login, to provide the security infrastructure for authenticated access to and from the machine. + +Explaining PAM is beyond the scope of this document. It is assumed that you understand the syntax and meanings of settings in the PAM configuration file (for example, how the other entry works, the effect of marking an entry as required, optional, or sufficient, and so on). + +The following instructions explain how to alter the entries in the PAM configuration file for each service for which you wish to use AFS authentication. Other configurations possibly also work, but the instructions specify the recommended and tested configuration. + +The recommended AFS-related entries in the PAM configuration file make use of one or more of the following three attributes. + + try_first_pass + +This is a standard PAM attribute that can be included on entries after the first one for a service; it directs the module to use the password that was provided to the first module. For the AFS module, it means that AFS authentication succeeds if the password provided to the module listed first is the user's correct AFS password. For further discussion of this attribute and its alternatives, see the operating system's PAM documentation. + + ignore_root + +This attribute, specific to the AFS PAM module, directs it to ignore not only the local superuser root, but also any user with UID 0 (zero). + + ignore_uid uid + +This option is an extension of the "ignore\_root" switch. The additional parameter is a limit. Users with a uid up to the given parameter are ignored by pam\_afs.so. Thus, a system administrator still has the opportunity to add local user accounts to his system by choosing between "low" and "high" user ids. An example /etc/passwd file for "ignore\_uid 100" may have entries like these: + + . + . + afsuserone:x:99:100::/afs/afscell/u/afsuserone:/bin/bash + afsusertwo:x:100:100::/afs/afscell/u/afsusertwo:/bin/bash + localuserone:x:101:100::/home/localuserone:/bin/bash + localusertwo:x:102:100::/home/localusertwo:/bin/bash + . + . + +AFS accounts should be locked in the file /etc/shadow like this: + + . + . + afsuserone:!!:11500:0:99999:7::: + afsusertwo:!!:11500:0:99999:7::: + localuserone::11500:0:99999:7::: + localusertwo::11500:0:99999:7::: + . + . + +There is no need to store a local key in this file since the AFS password is sent and verfied at the AFS cell server! + + setenv_password_expires + +This attribute, specific to the AFS PAM module, sets the environment variable PASSWORD\_EXPIRES to the expiration date of the user's AFS password, which is recorded in the Authentication Database. + + set_token + +Some applications don't call pam\_setcred() in order to retrieve the appropriate credentials (here the AFS token) for their session. This switch sets the credentials already in pam\_sm\_authenticate() obsoleting a call to pam\_setcred(). Caution: Don't use this switch for applications which do call pam\_setcred()! One example for an application not calling pam\_setcred() are older versions of the samba server. Nevertheless, using applications with working pam session management is recommended as this setup conforms better with the PAM definitions. + + refresh_token + +This options is identical to "set\_token" except that no new PAG is generated. This is necessary to handle processes like xlock or xscreensaver. It is not enough to give the screen and the keyboard free for the user who reactivated his screen typing in the correct AFS password, but one may also need fresh tokens with full livetime in order to work on, and the new token must be refreshed in the already existing PAG for the processes that have been started. This is achieved using this option. + + use_klog + +Activating this switch the authentication is done by calling the external program "klog". One program requiring this is for example kdm of KDE 2.x. + + dont_fork + +Usually, the password verification and the establishment of the token is performed in a sub process. Using this option pam\_afs does not fork and performs all actions in a single process. Only use this options in case you notice serious problems caused by the sub process. This option has been developed in respect to the "mod\_auth\_pam"-project (see also mod\_auth\_pam). The mod\_auth\_pam module enables PAM authentication for the apache http server package. + +Session Management + + no_unlog + +Normally the tokens are deleted (in memory) after the session ends. Using this options the tokens are left untouched. This behaviour has been the default in pam\_afs until openafs-1.1.1! + + remainlifetime sec + +The tokens are kept active for sec seconds before they are deleted. X display managers i.e. are used to inform the applications started in the X session before the logout and then end themselves. If the token was deleted immediately the applications would have no chance to write back their settings to i.e. the user's AFS home space. This option may help to avoid the problem. + +Perform the following steps to enable AFS login. + +1. Mount the AFS CD-ROM for Linux on the /cdrom directory, if it is not already. Then change to the directory for PAM modules, which depends on which Linux distribution you are using. + +If you are using a Linux distribution from Red Hat Software: + + # cd /lib/security + +If you are using another Linux distribution: + + # cd /usr/lib/security + +1. Copy the appropriate AFS authentication library file to the directory to which you changed in the previous step. Create a symbolic link whose name does not mention the version. Omitting the version eliminates the need to edit the PAM configuration file if you later update the library file. + +If you use the AFS Authentication Server (kaserver process): + + # cp /cdrom/i386_linux22/lib/pam_afs.so.1 . + + # ln -s pam_afs.so.1 pam_afs.so + +If you use a Kerberos implementation of AFS authentication: + + # cp /cdrom/i386_linux22/lib/pam_afs.krb.so.1 . + + # ln -s pam_afs.krb.so.1 pam_afs.so + +1. For each service with which you want to use AFS authentication, insert an entry for the AFS PAM module into the auth section of the service's PAM configuration file. (Linux uses a separate configuration file for each service, unlike some other operating systems which list all services in a single file.) Mark the entry as sufficient in the second field. + +Place the AFS entry below any entries that impose conditions under which you want the service to fail for a user who does not meet the entry's requirements. Mark these entries required. Place the AFS entry above any entries that need to execute only if AFS authentication fails. + +Insert the following AFS entry if using the Red Hat distribution: + + auth sufficient /lib/security/pam_afs.so try_first_pass ignore_root + +Insert the following AFS entry if using another distribution: + + auth sufficient /usr/lib/security/pam_afs.so try_first_pass ignore_root + +Check the PAM config files also for "session" entries. If there are lines beginning with "session" then please insert this line too: + + session optional /lib/security/pam_afs.so + +or + + session optional /usr/lib/security/pam_afs.so + +This guaranties that the user's tokens are deleted from memory after his session ends so that no other user coincidently gets those tokens without authorization! The following examples illustrate the recommended configuration of the configuration file for several services: + +Authentication Management (/etc/pam.d/login) + + #%PAM-1.0 + auth required /lib/security/pam_securetty.so + auth required /lib/security/pam_nologin.so + auth sufficient /lib/security/pam_afs.so try_first_pass ignore_root + # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + #This enables AFS authentication for every user but root + auth required /lib/security/pam_pwdb.so shadow nullok + account required /lib/security/pam_pwdb.so + password required /lib/security/pam_cracklib.so + password required /lib/security/pam_pwdb.so shadow nullok use_authtok + session optional /lib/security/pam_afs.so + #Make sure tokens are deleted after the user logs out + session required /lib/security/pam_pwdb.so + +(/etc/pam.d/samba) + + auth required /lib/security/pam_afs.so ignore_uid 100 set_token + # ^^^^^^^^^^^^^^^^^^^^^^^^ + #Here, users with uid>100 are considered to belong to the AFS and users + #with uid<=100 are ignored by pam_afs. The token is retrieved already in + #pam_sm_authenticate() (this is an example pam config for a samba version + #that does not call pam_setcred(), it also does no sense to include session + #entries here since they would be ignored by this version of samba ). + account required /lib/security/pam_pwdb.so + +(/etc/pam.d/xscreensaver) + + auth sufficient /lib/security/pam_afs.so ignore_uid 100 refresh_token + # ^^^^^^^^^^^^^ + #Avoid generating a new PAG for the new tokens, use the already existing PAG and + #establish a fresh token in it. + auth required /lib/security/pam_pwdb.so try_first_pass + +(/etc/pam.d/httpd) + + auth required /lib/security/pam_afs.so ignore_uid 100 dont_fork + # ^^^^^^^^^ + #Don't fork for the verification of the password. + +Session Management (/etc/pam.d/su) + + auth sufficient /lib/security/pam_afs.so ignore_uid 100 + auth required /lib/security/pam_pwdb.so try_first_pass + account required /lib/security/pam_pwdb.so + password required /lib/security/pam_cracklib.so + password required /lib/security/pam_pwdb.so use_authtok + session required /lib/security/pam_pwdb.so + session optional /lib/security/pam_afs.so no_unlog + # ^^^^^^^^ + #Don't delete the token in this case, since the user may still + #need it (for example if somebody logs in and changes to root + #afterwards he may still want to access his home space in AFS). + session required /lib/security/pam_login_access.so + session optional /lib/security/pam_xauth.so + +(/etc/pam.d/xdm) + + auth required /lib/security/pam_nologin.so + auth required /lib/security/pam_login_access.so + auth sufficient /lib/security/pam_afs.so ignore_uid 100 use_klog + auth required /lib/security/pam_pwdb.so try_first_pass + account required /lib/security/pam_pwdb.so + password required /lib/security/pam_cracklib.so + password required /lib/security/pam_pwdb.so shadow nullok use_authtok + session optional /lib/security/pam_afs.so remainlifetime 10 + # ^^^^^^^^^^^^^^^^^ + #Wait 10 seconds before deleting the AFS tokens in order to give + #the programs of the X session some time to save their settings + #to AFS. + session required /lib/security/pam_pwdb.so diff --git a/AFSLore/EnablingAFSLoginonSolarisSystems.mdwn b/AFSLore/EnablingAFSLoginonSolarisSystems.mdwn new file mode 100644 index 0000000..8163437 --- /dev/null +++ b/AFSLore/EnablingAFSLoginonSolarisSystems.mdwn @@ -0,0 +1,132 @@ +At this point you incorporate AFS into the operating system's Pluggable Authentication Module (PAM) scheme. PAM integrates all authentication mechanisms on the machine, including login, to provide the security infrastructure for authenticated access to and from the machine. + +Explaining PAM is beyond the scope of this document. It is assumed that you understand the syntax and meanings of settings in the PAM configuration file (for example, how the other entry works, the effect of marking an entry as required, optional, or sufficient, and so on). + +The following instructions explain how to alter the entries in the PAM configuration file for each service for which you wish to use AFS authentication. Other configurations possibly also work, but the instructions specify the recommended and tested configuration. Note: The instructions specify that you mark each entry as optional. However, marking some modules as optional can mean that they grant access to the corresponding service even when the user does not meet all of the module's requirements. In some operating system revisions, for example, if you mark as optional the module that controls login via a dial-up connection, it allows users to login without providing a password. See the IBM AFS Release Notes for a discussion of any limitations that apply to this operating system. + +Also, with some operating system versions you must install patches for PAM to interact correctly with certain authentication programs. For details, see the IBM AFS Release Notes. + +The recommended AFS-related entries in the PAM configuration file make use of one or more of the following three attributes. + + try_first_pass + +This is a standard PAM attribute that can be included on entries after the first one for a service; it directs the module to use the password that was provided to the first module. For the AFS module, it means that AFS authentication succeeds if the password provided to the module listed first is the user's correct AFS password. For further discussion of this attribute and its alternatives, see the operating system's PAM documentation. + + ignore_root + +This attribute, specific to the AFS PAM module, directs it to ignore not only the local superuser root, but also any user with UID 0 (zero). + + setenv_password_expires + +This attribute, specific to the AFS PAM module, sets the environment variable PASSWORD\_EXPIRES to the expiration date of the user's AFS password, which is recorded in the Authentication Database. + +Perform the following steps to enable AFS login. + +1. Mount the AFS CD-ROM for Solaris on the /cdrom directory, if it is not already. Then change directory as indicated. + + # cd /usr/lib/security + +1. Copy the AFS authentication library file to the /usr/lib/security directory. Then create a symbolic link to it whose name does not mention the version. Omitting the version eliminates the need to edit the PAM configuration file if you later update the library file. + +If you use the AFS Authentication Server (kaserver process): + + # cp /cdrom/sysname/dest/lib/pam_afs.so.1 . + + # ln -s pam_afs.so.1 pam_afs.so + +If you use a Kerberos implementation of AFS authentication: + + # cp /cdrom/sysname/dest/lib/pam_afs.krb.so.1 . + + # ln -s pam_afs.krb.so.1 pam_afs.so + +If the pam library is owned by the wrong group, it will fail to be called when you login. + +## Solaris 9 + + # chown root:bin pam_afs.krb.so.1 + +## Solaris 8 + + # chown root:sys pam_afs.krb.so.1 + +# Edit pam.conf + +Edit the Authentication management section of the Solaris PAM configuration file, /etc/pam.conf by convention. The entries in this section have the value auth in their second field. + +First edit the standard entries, which refer to the Solaris PAM module (usually, the file /usr/lib/security/pam\_unix.so.1) in their fourth field. For each service for which you want to use AFS authentication, edit the third field of its entry to read optional. The pam.conf file in the Solaris distribution usually includes standard entries for the login, rlogin, and rsh services, for instance. + +If there are services for which you want to use AFS authentication, but for which the pam.conf file does not already include a standard entry, you must create that entry and place the value optional in its third field. For instance, the Solaris pam.conf file does not usually include standard entries for the ftp or telnet services. + +Then create an AFS-related entry for each service, placing it immediately below the standard entry. The following example shows what the Authentication Management section looks like after you have you edited or created entries for the services mentioned previously. Note that the example AFS entries appear on two lines only for legibility. + +## pam.conf configuration for Solaris 9 + +Note: leave the full path to the library intact for afs. This will allow it to work for both 32 bit and 64 bit Solaris. + +The "other" section is used by SSH authentication. + +Solaris 9 will not allow the line continuation char "\\" in pam.conf + + login auth required pam_unix_auth.so.1 + login auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root setenv_password_expires + + rlogin auth required pam_unix_auth.so.1 + rlogin auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root setenv_password_expires + + rsh auth required pam_unix_auth.so.1 + rsh auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root + + # + # Used when service name is not explicitly mentioned for authenctication + # + other auth requisite pam_authtok_get.so.1 + other auth required pam_dhkeys.so.1 + other auth required pam_unix_auth.so.1 + other auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root setenv_password_expires + + # ftp auth optional /usr/lib/security/pam_unix.so.1 + # ftp auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root + # telnet auth optional /usr/lib/security/pam_unix.so.1 + # telnet auth optional /usr/lib/security/pam_afs.so try_first_pass ignore_root setenv_password_expires + +## pam.conf configuration for Solaris 6 + + login auth optional /usr/lib/security/pam_unix.so.1 + login auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root setenv_password_expires + rlogin auth optional /usr/lib/security/pam_unix.so.1 + rlogin auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root setenv_password_expires + rsh auth optional /usr/lib/security/pam_unix.so.1 + rsh auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + ftp auth optional /usr/lib/security/pam_unix.so.1 + ftp auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + telnet auth optional /usr/lib/security/pam_unix.so.1 + telnet auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root setenv_password_expires + +1. If you use the Common Desktop Environment (CDE) on the machine and want users to obtain an AFS token as they log in, also add or edit the following four entries in the Authentication management section. Note that the AFS-related entries appear on two lines here only for legibility. + + dtlogin auth optional /usr/lib/security/pam_unix.so.1 + dtlogin auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + dtsession auth optional /usr/lib/security/pam_unix.so.1 + dtsession auth optional /usr/lib/security/pam_afs.so \ + try_first_pass ignore_root + +1. Some Solaris distributions include a script that locates and removes unneeded files from various file systems. Its conventional location is /usr/lib/fs/nfs/nfsfind. The script generally uses an argument to the find command to define which file systems to search. In this step you modify the command to exclude the /afs directory. Otherwise, the command traverses the AFS filespace of every cell that is accessible from the machine, which can take many hours. The following alterations are possibilities, but you must verify that they are appropriate for your cell. + +The first possible alteration is to add the -local flag to the existing command, so that it looks like the following: + + find $dir -local -type f -name .nfs\* -mtime +7 -mount -exec rm -f {} \; + +Another alternative is to exclude any directories whose names begin with the lowercase letter a or a non-alphabetic character. + + find /[A-Zb-z]* remainder of existing command + +Do not use the following command, which still searches under the /afs directory, looking for a subdirectory of type 4.2. + + find / -fstype 4.2 /* do not use */ diff --git a/AFSLore/InitializationScriptonAIX.mdwn b/AFSLore/InitializationScriptonAIX.mdwn new file mode 100644 index 0000000..2142f79 --- /dev/null +++ b/AFSLore/InitializationScriptonAIX.mdwn @@ -0,0 +1,30 @@ +Reboot the machine and log in again as the local superuser root. + + # cd / + + # shutdown -r now + + login: root + Password: root_password + +Run the AFS initialization script. + + # /etc/rc.afs + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +Edit the AIX initialization file, /etc/inittab, adding the following line to invoke the AFS initialization script. Place it just after the line that starts NFS daemons. + + rcafs:2:wait:/etc/rc.afs > /dev/console 2>&1 # Start AFS services + +(Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /etc directories. If you want to avoid potential confusion by guaranteeing that they are always the same, create a link between them. You can always retrieve the original script from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm rc.afs + + # ln -s /etc/rc.afs diff --git a/AFSLore/InitializationScriptonDigitalUNIX.mdwn b/AFSLore/InitializationScriptonDigitalUNIX.mdwn new file mode 100644 index 0000000..00ec0d1 --- /dev/null +++ b/AFSLore/InitializationScriptonDigitalUNIX.mdwn @@ -0,0 +1,25 @@ +Run the AFS initialization script. + + # /sbin/init.d/afs start + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +Change to the /sbin/init.d directory and issue the ln -s command to create symbolic links that incorporate the AFS initialization script into the Digital UNIX startup and shutdown sequence. + + # cd /sbin/init.d + + # ln -s ../init.d/afs /sbin/rc3.d/S67afs + + # ln -s ../init.d/afs /sbin/rc0.d/K66afs + +(Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /sbin/init.d directories. If you want to avoid potential confusion by guaranteeing that they are always the same, create a link between them. You can always retrieve the original script from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm afs.rc + + # ln -s /sbin/init.d/afs afs.rc diff --git a/AFSLore/InitializationScriptonHP-UX.mdwn b/AFSLore/InitializationScriptonHP-UX.mdwn new file mode 100644 index 0000000..1fbd392 --- /dev/null +++ b/AFSLore/InitializationScriptonHP-UX.mdwn @@ -0,0 +1,25 @@ +Run the AFS initialization script. + + # /sbin/init.d/afs start + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +Change to the /sbin/init.d directory and issue the ln -s command to create symbolic links that incorporate the AFS initialization script into the HP-UX startup and shutdown sequence. + + # cd /sbin/init.d + + # ln -s ../init.d/afs /sbin/rc2.d/S460afs + + # ln -s ../init.d/afs /sbin/rc2.d/K800afs + +(Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /sbin/init.d directories. If you want to avoid potential confusion by guaranteeing that they are always the same, create a link between them. You can always retrieve the original script from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm afs.rc + + # ln -s /sbin/init.d/afs afs.rc diff --git a/AFSLore/InitializationScriptonIRIX.mdwn b/AFSLore/InitializationScriptonIRIX.mdwn new file mode 100644 index 0000000..a702fbb --- /dev/null +++ b/AFSLore/InitializationScriptonIRIX.mdwn @@ -0,0 +1,42 @@ +If you have configured the machine to use the ml dynamic loader program, reboot the machine and log in again as the local superuser root. + + # cd / + + # shutdown -i6 -g0 -y + + login: root + Password: root_password + +Issue the chkconfig command to activate the afsserver configuration variable. + + # /etc/chkconfig -f afsserver on + +If you have configured this machine as an AFS client and want to it remain one, also issue the chkconfig command to activate the afsclient configuration variable. + + # /etc/chkconfig -f afsclient on + +Run the AFS initialization script. + + # /etc/init.d/afs start + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +Change to the /etc/init.d directory and issue the ln -s command to create symbolic links that incorporate the AFS initialization script into the IRIX startup and shutdown sequence. + + # cd /etc/init.d + + # ln -s ../init.d/afs /etc/rc2.d/S35afs + + # ln -s ../init.d/afs /etc/rc0.d/K35afs + +(Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /etc/init.d directories. If you want to avoid potential confusion by guaranteeing that they are always the same, create a link between them. You can always retrieve the original script from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm afs.rc + + # ln -s /etc/init.d/afs afs.rc diff --git a/AFSLore/InitializationScriptonLinux.mdwn b/AFSLore/InitializationScriptonLinux.mdwn new file mode 100644 index 0000000..953e836 --- /dev/null +++ b/AFSLore/InitializationScriptonLinux.mdwn @@ -0,0 +1,32 @@ +Reboot the machine and log in again as the local superuser root. + + # cd / + + # shutdown -r now + + login: root + Password: root_password + +Run the AFS initialization script. + + # /etc/rc.d/init.d/afs start + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +Issue the chkconfig command to activate the afs configuration variable. Based on the instruction in the AFS initialization file that begins with the string #chkconfig, the command automatically creates the symbolic links that incorporate the script into the Linux startup and shutdown sequence. + + # /sbin/chkconfig --add afs + +(Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /etc/rc.d/init.d directories, and copies of the afsd options file in both the /usr/vice/etc and /etc/sysconfig directories. If you want to avoid potential confusion by guaranteeing that the two copies of each file are always the same, create a link between them. You can always retrieve the original script or options file from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm afs.rc afs.conf + + # ln -s /etc/rc.d/init.d/afs afs.rc + + # ln -s /etc/sysconfig/afs afs.conf diff --git a/AFSLore/InitializationScriptonSolaris.mdwn b/AFSLore/InitializationScriptonSolaris.mdwn new file mode 100644 index 0000000..277fdcf --- /dev/null +++ b/AFSLore/InitializationScriptonSolaris.mdwn @@ -0,0 +1,34 @@ +Reboot the machine and log in again as the local superuser root. + + # cd / + + # shutdown -i6 -g0 -y + + login: root + Password: root_password + +Run the AFS initialization script. + + # /etc/init.d/afs start + +[[Confirm Cache Manager Initialization|Main/ConfirmCacheManagerInitialization]] + +## Automatically Start AFS on System Boot + +Now that you have confirmed that the AFS initialization script works correctly, take the action necessary to have it run automatically at each reboot. + +1. 1. 1. Change to the /etc/init.d directory and issue the ln -s command to create symbolic links that incorporate the AFS initialization script into the Solaris startup and shutdown sequence. + + # cd /etc/init.d + + # ln -s ../init.d/afs /etc/rc3.d/S99afs + + # ln -s ../init.d/afs /etc/rc0.d/K66afs + +1. 1. 1. (Optional) There are now copies of the AFS initialization file in both the /usr/vice/etc and /etc/init.d directories. If you want to avoid potential confusion by guaranteeing that they are always the same, create a link between them. You can always retrieve the original script from the AFS CD-ROM if necessary. + + # cd /usr/vice/etc + + # rm afs.rc + + # ln -s /etc/init.d/afs afs.rc diff --git a/AFSLore/InstallingAdditionalClientMachines.mdwn b/AFSLore/InstallingAdditionalClientMachines.mdwn new file mode 100644 index 0000000..e2e0955 --- /dev/null +++ b/AFSLore/InstallingAdditionalClientMachines.mdwn @@ -0,0 +1,370 @@ +# Installing Additional Client Machines + +This chapter describes how to install AFS client machines after you have installed the first AFS machine. Some parts of the installation differ depending on whether or not the new client is of the same AFS system type (uses the same AFS binaries) as a previously installed client machine. Summary of Procedures + +1. Incorporate AFS into the machine's kernel + +1. Define the machine's cell membership + +1. Define cache location and size + +1. Create the /usr/vice/etc/CellServDB file, which determines which foreign cells the client can access in addition to the local cell + +1. Create the /afs directory and start the Cache Manager + +1. Create and mount volumes for housing AFS client binaries (necessary only for clients of a new system type) + +1. Create a link from the local /usr/afsws directory to the AFS directory housing the AFS client binaries + +1. Modify the machine's authentication system to enable AFS users to obtain tokens at login + +# Creating AFS Directories on the Local Disk + +Create the /usr/vice/etc directory on the local disk, to house client binaries and configuration files. Subsequent instructions copy files from the AFS CD-ROM into them. Create the /cdrom directory as a mount point for the CD-ROM, if it does not already exist. + + # mkdir /usr/vice + + # mkdir /usr/vice/etc + + # mkdir /cdrom + +# Performing Platform-Specific Procedures + +Every AFS client machine's kernel must incorporate AFS modifications. Some system types use a dynamic kernel loader program, whereas on other system types you build AFS modifications into a static kernel. Some system types support both methods. + +Also modify the machine's authentication system so that users obtain an AFS token as they log into the local file system. Using AFS is simpler and more convenient for your users if you make the modifications on all client machines. Otherwise, users must perform a two-step login procedure (login to the local file system and then issue the klog command). For further discussion of AFS authentication, see the chapter in the IBM AFS Administration Guide about cell configuration and administration issues. + +For convenience, the following sections group the two procedures by system type. Proceed to the appropriate section. + +\* Getting Started on AIX Systems + +\* Getting Started on Digital UNIX Systems + +\* Getting Started on HP-UX Systems + +\* Getting Started on IRIX Systems + +\* Getting Started on Linux Systems + +\* Getting Started on Solaris Systems + +# Getting Started on AIX Systems + +In this section you load AFS into the AIX kernel. Then incorporate AFS modifications into the machine's secondary authentication system, if you wish to enable AFS login. + +## Loading AFS into the AIX Kernel + +[[Loading AFS into the AIX Kernel|Main/LoadingAFSIntoTheAIXKernel]] + +## Enabling AFS Login on AIX Systems + +[[Enabling AFS Login on AIX Systems|Main/EnablingAFSLoginOnAIXSystems]] + +Proceed to Loading and Creating Client Files. + +# Getting Started on Digital UNIX Systems + +In this section you build AFS into the Digital UNIX kernel. Then incorporate AFS modifications into the machine's Security Integration Architecture (SIA) matrix, if you wish to enable AFS login. + +## Building AFS into the Digital UNIX Kernel + +[[Building AFS into the Digital UNIX Kernel|Main/BuildingAFSIntoTheDigitalUNIXKernel]] + +## Enabling AFS Login on Digital UNIX Systems + +[[Enabling AFS Login on Digital UNIX Systems|Main/EnablingAFSLoginOnDigitalUNIXSystems]] + +Proceed to Loading and Creating Client Files. + +# Getting Started on HP-UX Systems + +In this section you build AFS into the HP-UX kernel. Then incorporate AFS modifications into the machine's Pluggable Authentication Module (PAM) system, if you wish to enable AFS login. + +## Building AFS into the HP-UX Kernel + +[[Building AFS into the HP-UX Kernel|Main/BuildingAFSIntoTheHP-UXKernel]] + +## Enabling AFS Login on HP-UX Systems + +[[Enabling AFS Login on HP-UX Systems|Main/EnablingAFSLoginOnHP-UXSystems]] + +Proceed to Loading and Creating Client Files. + +# Getting Started on IRIX Systems + +## Loading AFS Into The IRIX Kernel + +[[Loading AFS into the IRIX Kernel|Main/LoadingAFSIntoTheIRIXKernel]] + +## Enabling AFS Login on IRIX Systems + +[[Enabling AFS Login on IRIX Systems|Main/EnablingAFSLoginOnIRIXSystems]]. + +After taking any necessary action, proceed to Loading and Creating Client Files. + +# Getting Started on Linux Systems + +In this section you load AFS into the Linux kernel. Then incorporate AFS modifications into the machine's Pluggable Authentication Module (PAM) system, if you wish to enable AFS login. + +## Loading AFS into the Linux Kernel + +[[Loading AFS into the Linux Kernel|Main/LoadingAFSIntoTheLinuxKernel]] + +## Enabling AFS Login on Linux Systems + +[[Enabling AFS Login on Linux Systems|Main/EnablingAFSLoginOnLinuxSystems]] + +Proceed to Loading and Creating Client Files. + +# Getting Started on Solaris Systems + +In this section you load AFS into the Solaris kernel. Then incorporate AFS modifications into the machine's Pluggable Authentication Module (PAM) system, if you wish to enable AFS login. + +## Loading AFS into the Solaris Kernel + +[[Loading AFS into the Solaris Kernel|Main/LoadingAFSIntoTheSolarisKernel]] + +## Enabling AFS Login on Solaris Systems + +[[Enabling AFS Login on Solaris Systems|Main/EnablingAFSLoginOnSolarisSystems]] + +Proceed to Loading and Creating Client Files. + +# Loading and Creating Client Files + +Now copy files from the AFS CD-ROM to the /usr/vice/etc directory. On some platforms that use a dynamic loader program to incorporate AFS modifications into the kernel, you have already copied over some the files. Copying them again does no harm. + +Every AFS client machine has a copy of the /usr/vice/etc/ThisCell file on its local disk to define the machine's cell membership for the AFS client programs that run on it. Among other functions, this file determines the following: + +\* The cell in which users authenticate when they log onto the machine, assuming it is using an AFS-modified login utility + +\* The cell in which users authenticate by default when they issue the klog command + +\* The cell membership of the AFS server processes that the AFS command interpreters on this machine contact by default + +Similarly, the /usr/vice/etc/CellServDB file on a client machine's local disk lists the database server machines in each cell that the local Cache Manager can contact. If there is no entry in the file for a cell, or the list of database server machines is wrong, then users working on this machine cannot access the cell. The chapter in the IBM AFS Administration Guide about administering client machines explains how to maintain the file after creating it. A version of the client [[CellServDB]] file was created during the installation of your cell's first machine (in Creating the Client [[CellServDB]] File). It is probably also appropriate for use on this machine. + +Remember that the Cache Manager consults the /usr/vice/etc/CellServDB file only at reboot, when it copies the information into the kernel. For the Cache Manager to perform properly, the [[CellServDB]] file must be accurate at all times. Refer to the chapter in the IBM AFS Administration Guide about administering client machines for instructions on updating this file, with or without rebooting. + +1. On the local /cdrom directory, mount the AFS CD-ROM for this machine's system type, if it is not already. For instructions on mounting CD-ROMs (either locally or remotely via NFS), consult the operating system documentation. + +1. Copy files to the local /usr/vice/etc directory. + +This step places a copy of the AFS initialization script (and related files, if applicable) into the /usr/vice/etc directory. In the preceding instructions for incorporating AFS into the kernel, you copied the script directly to the operating system's conventional location for initialization files. When you incorporate AFS into the machine's startup sequence in a later step, you can choose to link the two files. + +On some system types that use a dynamic kernel loader program, you previously copied AFS library files into a subdirectory of the /usr/vice/etc directory. On other system types, you copied the appropriate AFS library file directly to the directory where the operating system accesses it. The following commands do not copy or recopy the AFS library files into the /usr/vice/etc directory, because on some system types the library files consume a large amount of space. If you want to copy them, add the -r flag to the first cp command and skip the second cp command. + +# cd /cdrom/sysname/root.client/usr/vice/etc + +# cp -p \* /usr/vice/etc + +# cp -rp C /usr/vice/etc + +1. Create the /usr/vice/etc/ThisCell file. + +# echo "cellname" > /usr/vice/etc/ThisCell + +1. Create the /usr/vice/etc/CellServDB file. Use a network file transfer program such as ftp or NFS to copy it from one of the following sources, which are listed in decreasing order of preference: + +\* Your cell's central [[CellServDB]] source file (the conventional location is /afs/cellname/common/etc/CellServDB) + +\* The global [[CellServDB]] file maintained by the AFS Product Support group + +\* An existing client machine in your cell + +\* The [[CellServDB]].sample file included in the sysname/root.client/usr/vice/etc directory of each AFS CD-ROM; add an entry for the local cell by following the instructions in [[Creating the Client CellServDB File|Main/CreatingTheClientCellServDBFile]] + +## Configuring the Cache + +[[Configuring the Cache|Main/ConfiguringTheCache]] + +## Configuring the Cache Manager + +[[Configuring the Cache Manager|Main/ConfiguringTheCacheManager]] + +## Starting the Cache Manager and Installing the AFS Initialization Script + +In this section you run the AFS initialization script to start the Cache Manager. If the script works correctly, perform the steps that incorporate it into the machine's startup and shutdown sequence. If there are problems during the initialization, attempt to resolve them. The AFS Product Support group can provide assistance if necessary. + +On machines that use a disk cache, it can take a while for the afsd program to run the first time on a machine, because it must create all of the Vn files in the cache directory. Subsequent Cache Manager initializations do not take nearly as long, because the Vn files already exist. + +On system types that use a dynamic loader program, you must reboot the machine before running the initialization script, so that it can freshly load AFS modifications into the kernel. + +Proceed to the instructions for your system type: + +\* Running the Script on AIX Systems + +\* Running the Script on Digital UNIX Systems + +\* Running the Script on HP-UX Systems + +\* Running the Script on IRIX Systems + +\* Running the Script on Linux Systems + +\* Running the Script on Solaris Systems + +## Running the Script on AIX Systems + +[[Initialization Script on AIX|Main/InitializationScriptOnAIX]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +## Running the Script on Digital UNIX Systems + +[[Initialization Script on Digital UNIX|Main/InitializationScriptOnDigitalUNIX]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +## Running the Script on HP-UX Systems + +[[Initialization Script on HP-UX|Main/InitializationScriptOnHP-UX]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +## Running the Script on IRIX Systems + +[[Initialization Script on IRIX|Main/InitializationScriptOnIRIX]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +## Running the Script on Linux Systems + +[[Initialization Script on Linux|Main/InitializationScriptOnLinux]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +## Running the Script on Solaris Systems + +[[Initialization Script on Solaris|Main/InitializationScriptOnSolaris]] + +If a volume for housing AFS binaries for this machine's system type does not already exist, proceed to Setting Up Volumes and Loading Binaries into AFS. Otherwise, the installation is complete. + +# Setting Up Volumes and Loading Binaries into AFS + +In this section, you link /usr/afsws on the local disk to the directory in AFS that houses AFS binaries for this system type. The conventional name for the AFS directory is /afs/cellname/sysname/usr/afsws. + +If this machine is an existing system type, the AFS directory presumably already exists. You can simply create a link from the local /usr/afsws directory to it. Follow the instructions in Linking /usr/afsws on an Existing System Type. + +If this machine is a new system type (there are no AFS machines of this type in your cell), you must first create and mount volumes to store its AFS binaries, and then create the link from /usr/afsws to the new directory. See Creating Binary Volumes for a New System Type. + +You can also store UNIX system binaries (the files normally stored in local disk directories such as /bin, /etc, and /lib) in volumes mounted under /afs/cellname/sysname. See Storing System Binaries in AFS . + +Linking /usr/afsws on an Existing System Type + +If this client machine is an existing system type, there is already a volume mounted in the AFS filespace that houses AFS client binaries for it. + +1. Create /usr/afsws on the local disk as a symbolic link to the directory /afs/cellname/@sys/usr/afsws. You can specify the actual system name instead of @sys if you wish, but the advantage of using @sys is that it remains valid if you upgrade this machine to a different system type. + +# ln -s /afs/cellname/@sys/usr/afsws /usr/afsws + +1. (Optional) If you believe it is helpful to your users to access the AFS documents in a certain format via a local disk directory, create /usr/afsdoc on the local disk as a symbolic link to the documentation directory in AFS (/afs/cellname/afsdoc/format\_name). + +# ln -s /afs/cellname/afsdoc/format\_name /usr/afsdoc + +An alternative is to create a link in each user's home directory to the /afs/cellname/afsdoc/format\_name directory. + +# Creating Binary Volumes for a New System Type + +If this client machine is a new system type, you must create and mount volumes for its binaries before you can link the local /usr/afsws directory to an AFS directory. + +To create and mount the volumes, you use the klog command to authenticate as an administrator and then issue commands from the vos and fs command suites. However, the command binaries are not yet available on this machine (by convention, they are accessible via the /usr/afsws link that you are about to create). You have two choices: + +\* Perform all steps except the last one (Step 10) on an existing AFS machine. On a file server machine, the klog, fs and vos binaries reside in the /usr/afs/bin directory. On client machines, the klog and fs binaries reside in the /usr/afsws/bin directory and the vos binary in the /usr/afsws/etc directory. Depending on how your PATH environment variable is set, you possibly need to precede the command names with a pathname. + +If you work on another AFS machine, be sure to substitute the new system type name for the sysname argument in the following commands, not the system type of the machine on which you are issuing the commands. + +\* Copy the necessary command binaries to a temporary location on the local disk, which enables you to perform the steps on the local machine. The following procedure installs them in the /tmp directory and removes them at the end. Depending on how your PATH environment variable is set, you possibly need to precede the command names with a pathname. + +Perform the following steps to create a volume for housing AFS binaries. + +1. Working either on the local machine or another AFS machine, mount the AFS CD-ROM for the new system type on the /cdrom directory, if it is not already. For instructions on mounting CD-ROMs (either locally or remotely via NFS), consult the operating system documentation. + +1. If working on the local machine, copy the necessary binaries to a temporary location on the local disk. Substitute a different directory name for /tmp if you wish. + +# cd /cdrom/new\_sysname/root.server/usr/afs/bin + +# cp -p klog /tmp + +# cp -p fs /tmp + +# cp -p vos /tmp + +1. Authenticate as the user admin. + +# klog admin + +
+
Password
+
admin_password
+
+ +1. Issue the vos create command to create volumes for storing the AFS client binaries for this system type. The following example instruction creates volumes called sysname, sysname.usr, and sysname.usr.afsws. Refer to the IBM AFS Release Notes to learn the proper value of sysname for this system type. + +# vos create sysname + +# vos create sysname.usr + +# vos create sysname.usr.afsws + +1. Issue the fs mkmount command to mount the newly created volumes. Because the root.cell volume is replicated, you must precede the cellname part of the pathname with a period to specify the read/write mount point, as shown. Then issue the vos release command to release a new replica of the root.cell volume, and the fs checkvolumes command to force the local Cache Manager to access them. + +# fs mkmount -dir /afs/.cellname/sysname -vol sysname + +# fs mkmount -dir /afs/.cellname/sysname/usr -vol sysname.usr + +# fs mkmount -dir /afs/.cellname/sysname/usr/afsws -vol sysname.usr.afsws + +# vos release root.cell + +# fs checkvolumes + +1. Issue the fs setacl command to grant the l (lookup) and r (read) permissions to the system:anyuser group on each new directory's ACL. + +# cd /afs/.cellname/sysname + +# fs setacl -dir . usr usr/afsws -acl system:anyuser rl + +1. Issue the fs setquota command to set an unlimited quota on the volume mounted at the /afs/cellname/sysname/usr/afsws directory. This enables you to copy all of the appropriate files from the CD-ROM into the volume without exceeding the volume's quota. + +If you wish, you can set the volume's quota to a finite value after you complete the copying operation. At that point, use the vos examine command to determine how much space the volume is occupying. Then issue the fs setquota command to set a quota that is slightly larger. + +# fs setquota /afs/.cellname/sysname/usr/afsws 0 + +1. Copy the contents of the indicated directories from the CD-ROM into the /afs/cellname/sysname/usr/afsws directory. + +# cd /afs/.cellname/sysname/usr/afsws + +# cp -rp /cdrom/sysname/bin . + +# cp -rp /cdrom/sysname/etc . + +# cp -rp /cdrom/sysname/include . + +# cp -rp /cdrom/sysname/lib . + +1. Issue the fs setacl command to set the ACL on each directory appropriately. To comply with the terms of your AFS License agreement, you must prevent unauthorized users from accessing AFS software. To enable access for locally authenticated users only, set the ACL on the etc, include, and lib subdirectories to grant the l and r permissions to the system:authuser group rather than the system:anyuser group. The system:anyuser group must retain the l and r permissions on the bin subdirectory to enable unauthenticated users to access the klog binary. To ensure that unauthorized users are not accessing AFS software, check periodically that the ACLs on these directories are set properly. + +# cd /afs/.cellname/sysname/usr/afsws + +# fs setacl -dir etc include lib -acl system:authuser rl system:anyuser none + +10. Perform this step on the new client machine even if you have performed the previous steps on another machine. Create /usr/afsws on the local disk as a symbolic link to the directory /afs/cellname/@sys/usr/afsws. You can specify the actual system name instead of @sys if you wish, but the advantage of using @sys is that it remains valid if you upgrade this machine to a different system type. + +# ln -s /afs/cellname/@sys/usr/afsws /usr/afsws + +11. (Optional) To enable users to issue commands from the AFS suites (such as fs) without having to specify a pathname to their binaries, include the /usr/afsws/bin and /usr/afsws/etc directories in the PATH environment variable you define in each user's shell initialization file (such as .cshrc). + +12. (Optional) If you believe it is helpful to your users to access the AFS documents in a certain format via a local disk directory, create /usr/afsdoc on the local disk as a symbolic link to the documentation directory in AFS (/afs/cellname/afsdoc/format\_name). + +# ln -s /afs/cellname/afsdoc/format\_name /usr/afsdoc + +An alternative is to create a link in each user's home directory to the /afs/cellname/afsdoc/format\_name directory. + +13. (Optional) If working on the local machine, remove the AFS binaries from the temporary location. They are now accessible in the /usr/afsws directory. + +# cd /tmp + +# rm klog fs vos + +� IBM Corporation 2000. All Rights Reserved diff --git a/AFSLore/InstallingAdditionalServerMachines.mdwn b/AFSLore/InstallingAdditionalServerMachines.mdwn new file mode 100644 index 0000000..1136286 --- /dev/null +++ b/AFSLore/InstallingAdditionalServerMachines.mdwn @@ -0,0 +1,652 @@ +
+ +
+ +# Installing Additional Server Machines + +Instructions for the following procedures appear in the indicated section of this chapter. + +- Installing an Additional File Server Machine + +- Installing Database Server Functionality + +- Removing Database Server Functionality + +The instructions make the following assumptions. + +- You have already installed your cell's first file server machine by following the instructions in Installing the First AFS Machine + +- You are logged in as the local superuser root + +- You are working at the console + +- A standard version of one of the operating systems supported by the current version of AFS is running on the machine + +- You can access the data on the AFS CD-ROMs, either through a local CD-ROM drive or via an NFS mount of a CD-ROM drive attached to a machine that is accessible by network + +- All files on the CD-ROM are owned by root. i.e. The files that you install should be owned by root, or the standard application user for the system. + +# Installing an Additional File Server Machine + +The procedure for installing a new file server machine is similar to installing the first file server machine in your cell. There are a few parts of the installation that differ depending on whether the machine is the same AFS system type as an existing file server machine or is the first file server machine of its system type in your cell. The differences mostly concern the source for the needed binaries and files, and what portions of the Update Server you install: + +- On a new system type, you must load files and binaries from the AFS CD-ROM. You install the server portion of the Update Server to make this machine the binary distribution machine for its system type. + +- On an existing system type, you can copy files and binaries from a previously installed file server machine, rather than from the CD-ROM. You install the client portion of the Update Server to accept updates of binaries, because a previously installed machine of this type was installed as the binary distribution machine. + +These instructions are brief; for more detailed information, refer to the corresponding steps in Installing the First AFS Machine. + +To install a new file server machine, perform the following procedures: + +1. Copy needed binaries and files onto this machine's local disk + +1. Incorporate AFS modifications into the kernel + +1. Configure partitions for storing volumes + +1. Replace the standard fsck utility with the AFS-modified version on some system types + +1. Start the Basic [[OverSeer]] (BOS) Server + +1. Start the appropriate portion of the Update Server + +1. Start the fs process, which incorporates three component processes: the File Server, Volume Server, and Salvager + +1. Start the controller process (called runntp) for the Network Time Protocol Daemon, which synchronizes clocks + +After completing the instructions in this section, you can install database server functionality on the machine according to the instructions in Installing Database Server Functionality. + +# Creating AFS Directories and Performing Platform-Specific Procedures + +Create the /usr/afs and /usr/vice/etc directories on the local disk. Subsequent instructions copy files from the AFS distribution CD-ROM into them, at the appropriate point for each system type. + + # mkdir /usr/afs + + # mkdir /usr/afs/bin + + # mkdir /usr/vice + + # mkdir /usr/vice/etc + + # mkdir /cdrom + +As on the first file server machine, the initial procedures in installing an additional file server machine vary a good deal from platform to platform. For convenience, the following sections group together all of the procedures for a system type. Most of the remaining procedures are the same on every system type, but differences are noted as appropriate. The initial procedures are the following. + +- Incorporate AFS modifications into the kernel, either by using a dynamic kernel loader program or by building a new static kernel + +- Configure server partitions to house AFS volumes + +- Replace the operating system vendor's fsck program with a version that recognizes AFS data + +- If the machine is to remain an AFS client machine, modify the machine's authentication system so that users obtain an AFS token as they log into the local file system. (For this procedure only, the instructions direct you to the platform-specific section in Installing the First AFS Machine.) + +To continue, proceed to the section for this system type: + +- Getting Started on AIX Systems + +- Getting Started on Digital UNIX Systems + +- Getting Started on HP-UX Systems + +- Getting Started on IRIX Systems + +- Getting Started on Linux Systems + +- Getting Started on Solaris Systems + +# Getting Started on AIX Systems + +[[Loading AFS into the AIX Kernel|Main/LoadingAFSIntoTheAIXKernel]] + +## Replacing the fsck Program Helper on AIX Systems + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +[[Replacing the fsck Program Helper on AIX Systems|Main/ReplacingTheFsckProgramHelperOnAIXSystems]] + +## Configuring Server Volumes on AIX Systems + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on AIX|Main/ConfiguringServerVolumesOnAIX]] + +If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on AIX Systems|Main/EnablingAFSLoginOnAIXSystems]]. + +Proceed to Starting Server Programs. + +# Getting Started on Digital UNIX Systems + +Begin by building AFS modifications into the kernel, then configure server partitions and replace the Digital UNIX fsck program with a version that correctly handles AFS volumes. + +If the machine's hardware and software configuration exactly matches another Digital UNIX machine on which AFS is already built into the kernel, you can copy the kernel from that machine to this one. In general, however, it is better to build AFS modifications into the kernel on each machine according to the following instructions. + +[[Building AFS into the Digital UNIX Kernel|Main/BuildingAFSIntoTheDigitalUNIXKernel]] + +## Replacing the fsck Program on Digital UNIX Systems + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +[[Replacing the fsck Program on Digital UNIX Systems|Main/ReplacingTheFsckProgramOnDigitalUNIXSystems]] + +## Configuring Server Volumes on Digital UNIX Systems + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on Digital UNIX|Main/ConfiguringServerVolumesOnDigitalUNIX]] + +If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on Digital UNIX Systems|Main/EnablingAFSLoginOnDigitalUNIXSystems]]. + +Proceed to Starting Server Programs. + +# Getting Started on HP-UX Systems + +Begin by building AFS modifications into the kernel, then configure server partitions and replace the HP-UX fsck program with a version that correctly handles AFS volumes. + +[[Building AFS into the HP-UX Kernel|Main/BuildingAFSIntoTheHP-UXKernel]] + +## Configuring the AFS-modified fsck Program on HP-UX Systems + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +[[Configuring the AFS-modified fsck Program on HP-UX Systems|Main/ConfiguringTheAFS-modifiedFsckProgramOnHP-UXSystems]] + +## Configuring Server Volumes on HP-UX Systems + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on HP-UX|Main/ConfiguringServerVolumesOnHP-UX]] + +If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on HP-UX Systems|Main/EnablingAFSLoginOnHP-UXSystems]]. + +Proceed to Starting Server Programs. + +# Getting Started on IRIX Systems + +Begin by incorporating AFS modifications into the kernel. Either use the ml dynamic loader program, or build a static kernel. Then configure partitions to house AFS volumes. AFS supports use of both EFS and XFS partitions for housing AFS volumes. SGI encourages use of XFS partitions. + +You do not need to replace IRIX fsck program, because the version that SGI distributes handles AFS volumes properly. + +[[Loading AFS into the IRIX Kernel|Main/LoadingAFSIntoTheIRIXKernel]] + +## Configuring Server Volumes on IRIX Systems + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on IRIX|Main/ConfiguringServerVolumesOnIRIX]] + +1. If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on IRIX Systems|Main/EnablingAFSLoginOnIRIXSystems]]. + +1. Proceed to Starting Server Programs. + +# Getting Started on Linux Systems + +[[Loading AFS into the Linux Kernel|Main/LoadingAFSIntoTheLinuxKernel]] + +## Configuring Server Volumes on Linux Systems + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on Linux|Main/ConfiguringServerVolumesOnLinux]] + +If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on Linux Systems|Main/EnablingAFSLoginOnLinuxSystems]]. + +Proceed to Starting Server Programs. + +# Getting Started on Solaris Systems + +[[Loading AFS into the Solaris Kernel|Main/LoadingAFSIntoTheSolarisKernel]] + +## Configuring the AFS-modified fsck Program on Solaris Systems + +Never run the standard fsck program on AFS server partitions. It discards AFS volumes. + +[[Configuring the AFS-modified fsck Program on Solaris Systems|Main/ConfiguringTheAFS-modifiedFsckProgramOnSolarisSystems]] + +## Configuring Server Volumes On Solaris + +If this system is going to be used as a file server to share some of its disk space, create a directory called /vicepxx for each AFS server partition you are configuring (there must be at least one). If it is not going to be a file server you can skip this step. + +[[Configuring Server Volumes on Solaris|Main/ConfiguringServerVolumesOnSolaris]] + +If the machine is to remain an AFS client, incorporate AFS into its authentication system, following the instructions in [[Enabling AFS Login on Solaris Systems|Main/EnablingAFSLoginOnSolarisSystems]]. + +Proceed to Starting Server Programs. + +# Starting Server Programs + +In this section you initialize the BOS Server, the Update Server, the controller process for NTPD, and the fs process. You begin by copying the necessary server files to the local disk. + +- Copy file server binaries to the local /usr/afs/bin directory. + +- On a machine of an existing system type, you can either load files from the AFS CD-ROM or use a remote file transfer protocol to copy files from an existing server machine of the same system type. To load from the CD-ROM, see the instructions just following for a machine of a new system type. If using a remote file transfer protocol, copy the complete contents of the existing server machine's /usr/afs/bin directory. + +- On a machine of a new system type, you must use the following instructions to copy files from the AFS CD-ROM. + +- - On the local /cdrom directory, mount the AFS CD-ROM for this machine's system type, if it is not already. For instructions on mounting CD-ROMs (either locally or remotely via NFS), consult the operating system documentation. + +- - Copy files from the CD-ROM to the local /usr/afs directory. + + # cd /cdrom//dest/root.server/usr/afs + + # cp -rp * /usr/afs + +1. Copy the contents of the /usr/afs/etc directory from an existing file server machine, using a remote file transfer protocol such as ftp or NFS. If you use a system control machine, it is best to copy the contents of its /usr/afs/etc directory. If you choose not to run a system control machine, copy the directory's contents from any existing file server machine. + +1. Change to the /usr/afs/bin directory and start the BOS Server (bosserver process). Include the -noauth flag to prevent the AFS processes from performing authorization checking. This is a grave compromise of security; finish the remaining instructions in this section in an uninterrupted pass. + + # cd /usr/afs/bin + + # ./bosserver -noauth & + +1. If you run a system control machine, create the upclientetc process as an instance of the client portion of the Update Server. It accepts updates of the common configuration files stored in the system control machine's /usr/afs/etc directory from the upserver process (server portion of the Update Server) running on that machine. The cell's first file server machine was installed as the system control machine in Starting the Server Portion of the Update Server. (If you do not run a system control machine, you must update the contents of the /usr/afs/etc directory on each file server machine, using the appropriate bos commands.) + +By default, the Update Server performs updates every 300 seconds (five minutes). Use the -t argument to specify a different number of seconds. For the machine name argument, substitute the name of the machine you are installing. The command appears on multiple lines here only for legibility reasons. + + # ./bos create upclientetc simple \ + "/usr/afs/bin/upclient \ + [-t