OpenAFS for 10.5
This document presents a basic outline of installing OpenAFS, and is presented to provided general support. You should contact your site administrators for site specific data, and please be aware that this information is only what I've managed to cobble together--your mileage may vary. This should also work for 10.4 installations.
Getting OpenAFS
Binaries and source code for OpenAFS are provided from OpenAFS.org. The most stable release is the Maintenance release, but the Features release has the most features. Use the latter if you're adventurous, but usually either is fine.
Basic Installation
Assuming you're using the binary package, it's a straight forward installation--you just run the installer as you would for any other package. The installer will do the following:
- Set up the afs files in /var/db/openafs (note, this is different from some setups following the original transarc layout, which store the afs files in /usr/vice.
- Set your machine to start afs on boot by building /Library/StartupItems/OpenAFS
Configuring AFS
If this is a new installation, you'll need to edit a couple of files to tell OpenAFS what cell you use and where the afs servers are located. If your just upgrading an existing installation, you can skip this step.
First, you'll need to add your home cell name to the ThisCell file. Using a text editor (in this example, I'm using vi) and as root, open the file:
sudo vi /var/db/openafs/etc/ThisCell
Put a single line in this file with your cell name, eg. isis.unc.edu for isis users, or cs.unc.edu if you're using the UNC-CH Comp Sci cell. If you're using a different cell, contact your local support group for cell and and server information.
Next, you'll need to make sure that the cells you want to use are listed in the CellServDB file. The file provided has many cels listed, but most folks only use one or two cells, and the list is rather confusing as provided.
Again as root, make a backup of the current CellServDB file, and then open it with a text editor:
sudo mv /var/db/openafs/etc/CellServDB /var/db/openafs/etc/CellServDB.orig sudo vi /var/db/openafs/etc/CellServDB
Then add your cell data to the file (if you don't know this, you may have to contact your site administrators).
>cs.unc.edu # University of North Carolina Computer Science >isis.unc.edu # University of North Carolina Project Isis 152.2.1.5 #db0.isis.unc.edu 152.2.1.6 #db1.isis.unc.edu 152.2.1.7 #db2.isis.unc.edu
Note: The first entry is for the cs.unc.edu cell, and we provide afs server location data via DNS. So you just need to include the line listing the name of the cell in CellServDB in order to get an entry in /afs for the cs.unc.edu cell, and OpenAFS will use DNS to find the servers. Last I checked, ITS doesn't provide this information in DNS for the isis.unc.edu cell, so we're adding the servers to that entry explicitly.
Then save the changes. Your basic configuration is complete, and you can reboot and try them out. If everything worked, once you've booted the machine (on the network, afs doesn't start if there's no network!), you should have a /afs subdirectory in the command line. If you want to see AFS in the Finder's sidebar, go to Finder's preferences, and in the Sidebar tab, enable Computer under Devices. Then AFS will be visible as an icon in the Sidebar when you click on your computer at the top of the devices list.
At this point, you should have a working installation of AFS. To use the afs space, tho, you'll need to login. There are two authentication methods for OpenAFS, and which you use depends on how your cell is configured.
- The old school method of doing this is to use "klog" from the command line, but this won't work if the cell doesn't support the older K4 authentication.
- If klog doesn't work for you, you'll need to integrate afs and kerberos. This is the currently preferred method and relies on first authenticating against a Kerberos v5 realm, and then using the ticket you get to check out an afs token.
If you'd like a GUI interface for OpenAFS, I suggest you try AFSCommander, this is a preference pane for OSX that you can use to get tokens (via the System Preferences, or if you enable the menu item, from the Menu Bar). For more information, see the 10.5 version of how to integrate afs and kerberos.
Tweaking AFS: Some different options you might try
These steps are completely optional
Matching UIDs
At this point you should be able to perform most all operations from the CLI. But if you try to copy files to and from AFS space from Finder, you may encounter errors. This is probably due to a mismatch in the UID for your accounts. Ideally, you'll want not only your usernames on both your OS X machine and your AFS account to match, but also the UIDs for each.
By default, Mac OS X will start assigning UIDs at 501, so it's most likely that that's what your UID is. If, in a terminal window, you cd to your AFS home space, and do an "ls -l" you'll likely see something like this:
[localhost] hays% cd /afs/cs.unc.edu/home/hays [localhost:cs.unc.edu/home/hays] hays% ls -l total 211 drwxr-xr-x 3 5420 1003 2048 Jul 24 2000 DesktopFolderDB -rw-r--r-- 1 5420 1003 32768 Sep 7 2000 Fall200Scheduler.doc drwxrwxr-x 3 daemon 1003 10240 Feb 12 10:48 autoremedy drwxr-xr-x 2 5420 daemon 2048 Jul 25 2000 bin drwxr-xr-x 2 5420 1003 2048 Sep 21 2000 bin-hp700_hpux
In the listing above, the number 5420 represents the UID in use by hays in AFS space. If you try to copy files via Finder, Finder sees that the local UID and the UID in AFS space do not match, and generates an error. In order to fix this, you need to change your local UID to match the UID in the AFS cell. Warning! This procedure is a bit dangerous--what we're going to do is change the ownership of the files on your system on the file. You should have a good backup before you start this!
- The first step is to find out what your UID is in afs space.
You can also find out what your UID is on most unix servers that
support afs (such as isis.unc.edu or login.cs.unc.edu) by using the
command:
pts examine your_username
Make a note of your UID in the afs system.
- Enable the root account using NetInfo manager. If you don't know how to do this, see Apple's instructions. You'll need to be able to log in as root if something goes wrong here.
- Open a terminal window on your mac.
- Type "cd" to go to your home directory.
- su to root. It's important that you keep this window up and open during this procedure.
- Open NetInfo manager (if it's not already open). Under Domain, Security, use the Authenticate open to authenticate yourself.
- In the Directory Browser, go to /users and find your username and select it with the mouse.
- In the lower part of the window, find the Property "uid" and
then click on the associated Value. Mostly likely it's set to 501.
Change this to the UID you have in AFS space. Here's an example,
but I'm 502 on this machine:
- Quit NetInfo Manager and save the changes
- Now in the terminal window where you are logged in as root,
type:
%su %find / -xdev -user <old Mac uid> -print -exec chown <AFS uid> {} \;
Give this some time to run, it can take a while. (And thanks to Brian Biswas for coming up with this method.) - Finally, log out and back in again, and try things out. If everything's good, disable root login!
Making access easier
You won't want to have to navigate the entire cell's tree regularly, so you'll want to make access easier. There are a couple of things you can do.
- I do not recommend this, but if you want to use your afs space as your home directory, you can set up your mac to do that, see ITS's document. This is a good approach if you use any mac labs that also use afs as home dir space, but doesn't work for laptop users that might not have afs access. (the problem with making your OS X home dir in your afs space is that mac store a rather large number of files in your home dir, and it's very easiy to overrun your quota in afs).
- If you want to use your local HD as your home directory, you
can set up a softlink to your afs space or other afs directories in
your home account space. From the terminal window:
ln -s /afs/your.cell.here/path/to/your/afs/space/ /Users/yourlogin/your_choice
That way you can access the afs space from your home directory easily. You can create similar links to any common afs areas, such as department project space. - An softlink created on your local drive system can be put into your dock, or on your desktop
Integrating Login
See the Kerberos Integration doc for information on getting afs tokens automatically.
Last modified: 06 March 2010