[OpenAFS-Doc] Re: [OpenAFS] Quick Start Guide updated for Kerberos v5

[Jason Edgecombe]

I've just made an HTML version of the current OpenAFS Quick Start
Guide for Unix available at
http://homepages.inf.ed.ac.uk/sxw/OpenAFSQuickStart/book1.html
This includes a load of changes that were made a few months ago to
update the guide so that it describes the process of setting up a cell
using Kerberos 5, rather than kaserver. As the main author of those
modifications, I'd welcome feedback about those instructions.

Hi Simon,

Thanks for doing this. I've done a quick read of your document. Here are
my notes:

chapter1:
* about upgrading OS:
**Should the namei fileserver be mentioned? Is namei the
recommended way?


chapter 2:
* getting started on solaris:
** it still mentions copying files from cd-rom (grep for "CD-ROM")
**only mentions solaris 7, it should mention 8, 9 &
10/opensolaris or just say 7 & later versions
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

(I could only review solaris & linux. I don't know AIX, HPUX, or IRIX)


"The entry for AFS server processes, called either *afs* or
*afs//cell/*. No user logs in under this identity, but it is used to
encrypt the server tickets that granted to AFS clients for presentation
to server processes during mutual authentication."

should that be "...that are granted to AFS clients..."?

I read up through "Initializing the Protection Database". I'll finish
reading it later.

Jason

[Jason Edgecombe]

I've just made an HTML version of the current OpenAFS Quick Start
Guide for Unix available at
http://homepages.inf.ed.ac.uk/sxw/OpenAFSQuickStart/book1.html

<http://homepages.inf.ed.ac.uk/sxw/OpenAFSQuickStart/book1.html>

This includes a load of changes that were made a few months ago to
update the guide so that it describes the process of setting up

a cell

using Kerberos 5, rather than kaserver. As the main author of those
modifications, I'd welcome feedback about those instructions.

Hi Simon,
Thanks for doing this. I've done a quick read of your document. Here are
(a bunch of things which have nothing to do with Kerberos 5)
Erm?

Nothing, I guess. Just trying to be helpful.

:P

Jason

[Derrick Brashear]

Post by Jason Edgecombe

I've just made an HTML version of the current OpenAFS Quick Start
Guide for Unix available at
http://homepages.inf.ed.ac.uk/sxw/OpenAFSQuickStart/book1.html
This includes a load of changes that were made a few months ago to
update the guide so that it describes the process of setting up a cell
using Kerberos 5, rather than kaserver. As the main author of those
modifications, I'd welcome feedback about those instructions.

Hi Simon,
Thanks for doing this. I've done a quick read of your document. Here are

(a bunch of things which have nothing to do with Kerberos 5)

Erm?

[Russ Allbery]

Post by Jason Edgecombe
**Should the namei fileserver be mentioned? Is namei the
recommended way?

inode is still recommended for Solaris. namei is recommended in all other
cases, and generally is the only possible method.

Post by Jason Edgecombe
** it still mentions copying files from cd-rom (grep for "CD-ROM")

Yeah, this needs to get fixed throughout the manual, replaced with
instructions about how to start from the downloaded binary build or to
build from source.

Post by Jason Edgecombe
**only mentions solaris 7, it should mention 8, 9 &
10/opensolaris or just say 7 & later versions

Yup.

Post by Jason Edgecombe
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

Solaris can use either, so yes, clarification is needed. I'm fairly sure
you don't need the custom fsck if you use namei.

Post by Jason Edgecombe
"The entry for AFS server processes, called either *afs* or
*afs//cell/*. No user logs in under this identity, but it is used to
encrypt the server tickets that granted to AFS clients for presentation
to server processes during mutual authentication."
should that be "...that are granted to AFS clients..."?

Yup.

The source for this is in DocBook in the OpenAFS CVS head, and patches are
certainly welcome.

[Derrick Brashear]

Post by Russ Allbery

Post by Jason Edgecombe
**Should the namei fileserver be mentioned? Is namei the
recommended way?

inode is still recommended for Solaris. namei is recommended in all other
cases, and generally is the only possible method.

Actually, inode also still works on HPUX 11 and IRIX 6.5, and we only do
inode builds for IRIX.

Post by Russ Allbery

Post by Jason Edgecombe
** it still mentions copying files from cd-rom (grep for

"CD-ROM")
Yeah, this needs to get fixed throughout the manual, replaced with
instructions about how to start from the downloaded binary build or to
build from source.

Post by Jason Edgecombe
**only mentions solaris 7, it should mention 8, 9 &
10/opensolaris or just say 7 & later versions

Yup.

Post by Jason Edgecombe
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

Solaris can use either, so yes, clarification is needed. I'm fairly sure
you don't need the custom fsck if you use namei.

Correct.

Post by Russ Allbery

Post by Jason Edgecombe
"The entry for AFS server processes, called either *afs* or
*afs//cell/*. No user logs in under this identity, but it is used to
encrypt the server tickets that granted to AFS clients for presentation
to server processes during mutual authentication."
should that be "...that are granted to AFS clients..."?

Yup.
The source for this is in DocBook in the OpenAFS CVS head, and patches are
certainly welcome.

[Douglas E. Engert]

Post by Russ Allbery

Post by Jason Edgecombe
**Should the namei fileserver be mentioned? Is namei the
recommended way?

inode is still recommended for Solaris. namei is recommended in all other
cases, and generally is the only possible method.

You should consider recommending namei on Solaris too. inode only
works on ufs and you must have logging turned off. If you want to
use zfs then you must use namei.

Post by Russ Allbery

Post by Jason Edgecombe
** it still mentions copying files from cd-rom (grep for "CD-ROM")

Yeah, this needs to get fixed throughout the manual, replaced with
instructions about how to start from the downloaded binary build or to
build from source.

Post by Jason Edgecombe
**only mentions solaris 7, it should mention 8, 9 &
10/opensolaris or just say 7 & later versions

Yup.

Post by Jason Edgecombe
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

Solaris can use either, so yes, clarification is needed. I'm fairly sure
you don't need the custom fsck if you use namei.

Correct. It makes me feel more comfortable using the vendor's fsck
rather then a modified fsck.

Post by Russ Allbery

Post by Jason Edgecombe
"The entry for AFS server processes, called either *afs* or
*afs//cell/*. No user logs in under this identity, but it is used to
encrypt the server tickets that granted to AFS clients for presentation
to server processes during mutual authentication."
should that be "...that are granted to AFS clients..."?

Yup.
The source for this is in DocBook in the OpenAFS CVS head, and patches are
certainly welcome.

[chas williams - CONTRACTOR]

Post by Russ Allbery

Post by Jason Edgecombe
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

Solaris can use either, so yes, clarification is needed. I'm fairly sure
you don't need the custom fsck if you use namei.

you do not need the custom fsck for namei. further, namei only works
for ufs nonlogging filesystems. if you have say zfs perhaps, namei
is your only choice. given this, i think its reasonable to suggest
that people just use namei only.

[Jeffrey Altman]

Post by chas williams - CONTRACTOR

Post by Russ Allbery

Post by Jason Edgecombe
** about fsck: does solaris use inode, namei or both? Is
clarification needed?

Solaris can use either, so yes, clarification is needed. I'm fairly sure
you don't need the custom fsck if you use namei.

you do not need the custom fsck for namei. further, namei only works
for ufs nonlogging filesystems. if you have say zfs perhaps, namei
is your only choice. given this, i think its reasonable to suggest
that people just use namei only.

Except that when you use memcache you lose the benefits of the cache
between restarts. There are many organizations that use cache sizes
large enough so that the entire 90+% of the data needed for the
operating system and applications comes from the cache.

After a restart all that is then required is for a series of FetchStatus
calls to be performed.

Jeffrey Altman