Tools for AFS and OS X

This page is an attempt to track some of the tools various folks have developed to improve integration of OS X and AFS (wether Arla or OpenAFS). Your mileage may vary, and some of these tools are not for the faint of heart.

Please note: Some of these items are no longer maintained, or maintained only intermittently. If you try something and it doesn't work as advertised, please send email to "b at unc dot edu" and I'll give it a try and make a note here.

If you modify the source code for any of this applications, and those modifications might be useful to others, please let us know about the updates.

Some of the software is archived locally, but try to get the software from the original site posted. The local copies here might be out of date.

Some general guidelines about the software listed here:

Installation and Setup

AFS Commander

A must have, especially with 10.5,  this is a set of tools used from the System Preferences to get tokens, integrate kerberos 5 and afs with login, and alter setting for openafs via the GUI

Kerberos Extras

Also not really an AFS tool, the Kerberos extra package provides a GUI to the kerberos system. Since most mac users in afs cells are also authenticating against kerberos, this is very handy.

afsinstall

This one is really misnamed--it should be named afsconfigure. You can run this after running the OpenAFS installater, but before the reboot. The program allows the user to configure the afs cell name, afs alias, edit the CellServDB, and set afsd.options through a GUI (instead of hand editing the various files with a text editor). On my last test, this did not run under 10.5 on an intel based system.

Using AFS

Contextual Menu Plug-in for Finder

From NCSU, this is a Univeral Binary build of a Contextual Menu Plug-in that works with OpenAFS and the MacOS X 10.3/4/5 Finder to provide some fs and pts functions, specifically access list and volume quota information. AFS access control lists can be added, modified, and deleted. Volume information on user quota and disk space usage are available. To install simply unzip and drop AFSCMPlugIn.plugin into /Library/Contextual Menu Items. Then control click on a folder in any OpenAFS container.

Mount_AFS

With current versions of OpenAFS this isn't really needed any longer, since it's well behaved on laptops, and the core functionality is in AFS Commander (listed above) instead.

Primarily for laptop users. If AFS is started with -nomount as an option, this tool will "mount" afs to the directory specified in /var/db/openafs/etc/cacheinfo. This tool cannot be used to unmount afs.

Also, it's very important that if you try to mount afs when it already mounted, you can cause sytems problems (under 10.2 and 10.3 this usually causes a kernel panic) This is a GUI version of an older commandline tool released by others.

afstokens

Graphical tokens/group management. One can obtain/destroy tokens in cells listed in the CellServDB, or view group membership and create/edit/destroy owned pts groups. Afstokens requires kaserver or fakeka in its current incarnation. It also requires the cell to be in CellServDB.

OpenAFSController

A simple GUI front end to start and stop openafs, run klog unlog, or to reference a script you specify. Interesting start, crude but effective, but this is supplanted largely by AFS Commander. Also, I believe this only works in afs cells using the older style kaserver, which is deprecated.

Other Related Tools

LoginWindow Manager

Not really a tool for AFS, but this program provides a GUI interface to some of the parameters for the loginwindow under 10.4. One use for it is to set a script that runs on login or logout (so if you're authenticating against kerberos, you can call a script to get tokens, or call a script that sets up directories for lab machines, etc). For an example of how a login hook can be used to get afs tokens, look under option C in the Kerberos/AFS Login Additions to OS X 10.4.x doc.

Kerberos LoginLogout Plugins

Under OS X 10.2/3/4 (but not as far as I know, not with 10.5!) it is possible to authenticate against Kerberos servers either as a requirement or as an option additional step to local authentication. It is possible to call plugins as part of this process which can be used to obtain AFS tokens or call scripts. For the various versions of OS X there are a lot of options for this, see the Kerberos/AFS Login Additions to OS X doc

Untested bits

These are mainly things I've run across and haven't really tested well.

Natkeep

Natkeep is a combination of a daemon and configuration tool that can be used to generate packets at a regular interval in order to keep the UDP/IP/Port mappings in a NAT device active. If you have trouble making AFS work from behind a NAT, it might help. See the Natkeep doc for more information.

Attach

Haven't touched it, just thought it sounded interesting enough to want to make a note of it.
http://tech.ait.iastate.edu/macosx/how-to/attach.shtml


Last modified: 06 March 2010