[OpenAFS-Doc] updating user guide

[Jason Edgecombe]

Hi,

I was looking at the user guide.

Should all references to klog be replaced with kinit;aklog? Should klog
be mentioned at all, or should it be shown as an alternate method?

Should the Doc version and software versions be updated? Which OpenAFS
versions
should be listed?

Thanks,
Jason

[Christopher D. Clausen]

Post by Jason Edgecombe
Should all references to klog be replaced with kinit;aklog? Should
klog be mentioned at all, or should it be shown as an alternate
method?

Technically, a krb5 kinit is not an AFS command. I'm not sure if it
should be mentioned.

Post by Jason Edgecombe
Should the Doc version and software versions be updated?
Which OpenAFS versions should be listed?

I'm not sure I understand what you are asking here.

<<CDC

[Jason Edgecombe]

Post by Christopher D. Clausen

Post by Jason Edgecombe
Should all references to klog be replaced with kinit;aklog? Should
klog be mentioned at all, or should it be shown as an alternate
method?

Technically, a krb5 kinit is not an AFS command. I'm not sure if it
should be mentioned.

I agree kinit is not an AFS command, but it is so integral that it might
as well be.

Looking at:
http://www.openafs.org/pages/doc/UserGuide/auusg005.htm#Header_44

What should the klog line be replaced by? As far as I know, the
recommended way is "kinit;aklog".
If it's not that, then what should it be?

How do klog.krb and the other .krb commands fit in?

Post by Christopher D. Clausen

Post by Jason Edgecombe
Should the Doc version and software versions be updated?
Which OpenAFS versions should be listed?

I'm not sure I understand what you are asking here.

I'm referring to this page:

http://www.openafs.org/pages/doc/UserGuide/auusg000.htm
What should be changed?

[Jeffrey Altman]

Post by Jason Edgecombe
I agree kinit is not an AFS command, but it is so integral that it might
as well be.
http://www.openafs.org/pages/doc/UserGuide/auusg005.htm#Header_44
What should the klog line be replaced by? As far as I know, the
recommended way is "kinit;aklog".
If it's not that, then what should it be?

There isn't one answer. 'kinit' is a Kerberos v5 command. What it does
is dependent upon the implementation of Kerberos v5 that is used.

What I think you want to describe is that 'aklog' can be used to obtain
AFS tokens for a cell once the user has already obtained the appropriate
Kerberos v5 ticket granting ticket.

For many users, the acquisition of the Kerberos v5 TGT is going to be
performed as part of the logon process. There won't be any additional
command for them to execute.

Post by Jason Edgecombe
How do klog.krb and the other .krb commands fit in?

The history is that AFS shipped with kaserver. kaserver is built upon
the Kerberos v4 authentication model but it didn't use the Kerberos v4
authentication protocol. When you use 'klog' you are using the kaserver
protocol which is a variation of Kerberos v4 messaging transmitted via
RX/UDP. If you are using the MIT or Heimdal Kerberos v4 implementation
for the authentication server, then you want to use 'klog.krb' which is
a version of the command that uses the standard Kerberos v4 protocol.

The Windows AFS client always uses the Kerberos v4 protocol and never
uses the RX/UDP kaserver protocol. Even though the command is called
klog and not klog.krb.

Post by Jason Edgecombe

Post by Christopher D. Clausen

Post by Jason Edgecombe
Should the Doc version and software versions be updated?
Which OpenAFS versions should be listed?

I'm not sure I understand what you are asking here.

http://www.openafs.org/pages/doc/UserGuide/auusg000.htm
What should be changed?

It should be altered to remove the IBM AFS versions and it should
describe the versions of OpenAFS that you are describing.

[Russ Allbery]

Post by Jason Edgecombe
I agree kinit is not an AFS command, but it is so integral that it might
as well be.

I agree that in a rewrite of our manuals, we really should talk about
kinit. I think we can mention both methods of obtaining tokens (kinit and
aklog or klog) somewhere, and then refer back to that section. klog does
still work with a Kerberos v5 infrastructure, but given the single DES
limitation, I'm not sure we want to advertise it too much.

Post by Jason Edgecombe
http://www.openafs.org/pages/doc/UserGuide/auusg005.htm#Header_44
What should the klog line be replaced by? As far as I know, the
recommended way is "kinit;aklog". If it's not that, then what should it
be?

I think you're right on the recommendation.

Post by Jason Edgecombe
How do klog.krb and the other .krb commands fit in?

They're obsolete and probably should be only mentioned in an appendix.