Difference: UsingAFS (1 vs. 26)

Revision 262016-07-27 - GordonStewart

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

AFS in PPE

Line: 34 to 34
 Normal cron jobs cannot write to the AFS file system, and will only be able to read publicly-accessible files. You can create a cron job with full access to AFS using the kcrontab command.
Added:
>
>

AFS on Mac OS X

OpenAFS clients for recent versions of Mac OS X can be obtained from Auristor:

https://www.auristor.com/openafs/client-installer/

This package should include all the necessary components, but you may find that you need to use the debug version to get it working.

 

External Kerberos Access (Linux / Mac OS X)

You can configure Kerberos on a Linux or Mac OS X machine to enable password-less log-in to remote machines once a Kerberos ticket has been created. To do this, open /etc/krb5.conf (/Library/Preferences/edu.mit.Kerberos under OS X) in a text editor, and add the following to the realms section:

Revision 252016-04-29 - GordonStewart

Line: 1 to 1
 
META TOPICPARENT name="WebHome"
Changed:
<
<

AFS at Glasgow

>
>

AFS in PPE

PPE storage provision is currently under review, and the following is subject to change.

 
Added:
>
>

Introduction

PPE uses AFS (the Andrew File System), and specifically the OpenAFS distribution, as a way to share some home areas and data directories between different machines, both internally and externally.

This page provides specific information about the AFS infrastructure within PPE. For a general introduction to AFS and information about how to use it, please refer to the OpenAFS User Guide.

 

Directory Layout

The local AFS cell (phas.gla.ac.uk, mounted as /afs/phas.gla.ac.uk) contains the following directories:

Line: 27 to 36
 

External Kerberos Access (Linux / Mac OS X)

Changed:
<
<
You can configure Kerberos on a Linux or Mac OS X machine to enable passwordless log-in to remote machines once a Kerberos ticket has been created. To do this, open /etc/krb5.conf (/Library/Preferences/edu.mit.Kerberos under OS X) in a text editor, and add the following to the realms section:
>
>
You can configure Kerberos on a Linux or Mac OS X machine to enable password-less log-in to remote machines once a Kerberos ticket has been created. To do this, open /etc/krb5.conf (/Library/Preferences/edu.mit.Kerberos under OS X) in a text editor, and add the following to the realms section:
 
PHAS.GLA.AC.UK = {

Line: 119 to 128
 
fs setacl <PATHNAME> <USERNAME> <PERMISSIONS> Add an entry to the current directory's ACL.
Changed:
<
<

AFS ACLs (Protecting Data)

AFS file systems use directory based ACLs to determine the access permissions for a given file. The following is taken from the afs documentation (http://docs.openafs.org/AdminGuide/ch15s02.html):

  • The permissions on a directory's ACL apply to all of the files in the directory. When you move a file to a different directory, you effectively change the access permissions that apply to it to those on its new directory's ACL. Changing a directory's ACL changes the protection on all the files in it.
  • When you create a subdirectory, its initial ACL is created as a copy of its parent directory's ACL. You can then change the subdirectory's ACL independently. However, the parent directory's ACL continues to control access to the subdirectory in the following way: the parent directory's ACL must grant the l (lookup) permission to a user (or a group the user belongs to) in order for the user to access the subdirectory at all.

By default the following directories are created in a user's afs home area:

  • private - access only for the user and the system administrator, this is also the default for any new directories.
  • public - public (world wide) access for anyone.
  • public_html - public (world wide) access for anyone, user web pages belong here.
  • public_ppe - readable to the ppe group only.

To see the acl list on a directory use the command fs listacl dir .

To allow a user or group user read access to a directory dir :

fs setacl dir user read

To give write permissions:

fs setacl dir user write

And to remove all permissions for a user or group:

fs setacl dir user none

>
>

AFS Access Control Lists (ACLs)

 
Changed:
<
<
System administrator access is required to all directories to allow backups to be taken.
>
>
AFS uses directory-based ACLs to determine the permissions for the files contained within. Changing the permissions on a directory changes the permissions for all the files it contains, while moving a file from one directory to another may change its permissions. Subdirectories inherit the permissions on their parent directory when created, but may be configured independently thereafter. A detailed description of these permissions can be found in the OpenAFS User Guide.
 
Changed:
<
<
There is a limit of around 20 entries that can be added to an acl list. The exact number depends on the size (in characters) of each acl entry. To get around this user created groups can be used and then the group can be added to the acl list. The cern web page http://information-technology.web.cern.ch/services/fe/afs/howto/work-afs-groups has instructions on how to create groups and add people to them.
>
>
PPE home areas contain the following directories by default:
 
Changed:
<
<

Recursive setting of ACLs

A helper script to recursively set an ACL is available on all the scientific linux desktop machines. Usage is similar to the standard fs setacl command:

fs-recursive-setacl dir user acl

Accessing the CERN afs cell (/afs/cern.ch)

Getting a kerberos ticket for another kerberos realm using kinit will overwrite the existing kerberos tickets file destroying any local Glasgow ticket. To get around this tickets for different kerberos realms have to be written to different files. A couple of helper scripts have been written to made this straight forward: kinit-cern, klist-cern, kdestroy-cern, ssh-cern, kinit-fnal, klist-fnal, kdestroy-fnal, ssh-fnal.

They are used in the same way as the standard kinit, klist and kdestroy. For example:

$ kinit-cern <lxplus user name>@CERN.CH

and after doing the kinit:

$ ssh-cern <lxplus user name>@lxplus.cern.ch
>
>
Directory Description
private Access for the user and system administrators.
public Global access.
public_html Location for personal web pages.
public PPE access.
 
Deleted:
<
<

rsyncing files to afs

 
Changed:
<
<
rsync will copy files to an afs file system in the same way as any other file system. However if directories in the source file system have the stick bit set rsync will complain that it 'failed to set permissions'. A directory with the sticky bit set will have a 's' in the permissions bit field eg:
>
>

Accessing the CERN AFS cell

 
Changed:
<
<
drwxrwsr-x  4 ppemgr ppemgr   45 Jan 14  2009 sl44
>
>
Access to the CERN AFS cell (cern.ch, mounted as /afs/cern.ch) requires you to obtain a ticket for a different Kerberos realm. When obtaining this ticket, it is important that it be written to a different file from default, otherwise it will overwrite your PPE ticket and prevent access to your local files. To simplify this, a number of helper scripts have been provided: kinit-cern, klist-cern, kdestroy-cern, ssh-cern, kinit-fnal, klist-fnal, kdestroy-fnal, and ssh-fnal. These commands work similarly to the standard kinit, klist, kdestroy and ssh commands.
 
Deleted:
<
<
These errors can be safely ignored but they may obscure other errors when rsyncing. To remove stick bits before rsyncing use chmod:
 
Changed:
<
<
chmod a-s _dir_
>
>

Using rsync with AFS

 
Changed:
<
<
replacing _dir_ as required. To recursively remove sticky bits use the -R option.
>
>
rsync will raise a permissions error when attempting to copy files which have the sticky bit set. Such errors can be safely ignored.
 
Deleted:
<
<

Automatic Token Renewal

 
Changed:
<
<
To automatically renew an AFS token for up to 30 days after logging in requires either a small addition the shell login script for ssh logins or for desktop logins a small script to be auto run. Each login change is independent of the others and all can be safely used at the same time.
>
>

Automatic token renewal

 
Changed:
<
<

ssh login

>
>
AFS tokens can be automatically renewed for up to 30 days after log-in. This requires that a small script be configured to run automatically.
 
Changed:
<
<
For bash shell users add the following to the top of .bash_profile:
>
>
Users of the Bash shell should add the following to the start of their .bash_profile:
 
Changed:
<
<
>
>

 if [ -e /bin/ps ] && [ -e /bin/grep ] then kproc=`/bin/ps x -u ${USER} | /bin/grep krenew | /bin/grep ${KRB5CCNAME}`
Line: 211 to 166
  /usr/bin/krenew -K 60 -t -k ${KRB5CCNAME} & fi fi
Changed:
<
<

For csh/tcsh users the untested equivalent is to add the following to the top of .cshrc or .tcshrc:

if ( -e /bin/ps && -e /bin/grep ) then
    setenv kproc `/bin/ps x -u ${USER} | /bin/grep krenew | /bin/grep ${KRB5CCNAME}`
    if ( "${kproc}" == "" && -e /usr/bin/krenew ) then
        /usr/bin/krenew -K 60 -t -k ${KRB5CCNAME} &
    endif
endif

META FILEATTACHMENT attachment="krb5.conf" attr="" comment="" date="1357214218" name="krb5.conf" path="krb5.conf" size="1656" stream="krb5.conf" tmpFilename="/usr/tmp/CGItemp13840" user="AndrewPickford" version="2"
>
>

Revision 242016-04-28 - GordonStewart

Line: 1 to 1
 
META TOPICPARENT name="WebHome"
Changed:
<
<

Using AFS At Glasgow

>
>

AFS at Glasgow

 
Deleted:
<
<

Local AFS Cell (/afs/phas.gla.ac.uk)

 
Changed:
<
<

File System Layout

>
>

Directory Layout

 
Changed:
<
<
Beneath /afs/phas.gla.ac.uk are the following directories:
>
>
The local AFS cell (phas.gla.ac.uk, mounted as /afs/phas.gla.ac.uk) contains the following directories:
 
Changed:
<
<
  • backup : Snap shot backups for user home directories and other files. The snap shot is done each night at 1am.
  • data : Large store area, not backed up.
  • group : Group based storage area, backed up.
  • project :
  • system : Common programs installed system wide.
  • user : User home directories are stored under this directory. The initial quota on home directories is 50GB. Nightly snap shot backups and long term backups.
>
>
Directory Description
backup Nightly back-up of user home areas.
data Large storage areas for research data.
group Storage for PPE data.
project  
system Common programs.
user User home areas.
 
Changed:
<
<

Backups

>
>
Refer to the section on back-ups for a list of those directories which are backed-up, and details of the retention schedule.
 
Deleted:
<
<
Overnight backups of user home areas are taken at 1am each night. These backups are user accessible and can be found in /afs/phas.gla.ac.uk/backup/user/_letter_/_username_. Longer term backups are also done - nightly snapshots of user home directories are retained for 7 days except that the snapshots done on a Saturday are retained for two months and the snapshots done on the first Saturday of each month are retained for six months. These longer term backups are not user accessible please contact ITManagement to request a file to be recovered.
 
Changed:
<
<

Cronjobs

>
>

Cron jobs

 
Changed:
<
<
Normal cronjobs can not write to the afs file system and can only read the publicly accessible parts of the file system. Cronjobs which require access to the afs file system can be created using the kcrontab command.
>
>
Normal cron jobs cannot write to the AFS file system, and will only be able to read publicly-accessible files. You can create a cron job with full access to AFS using the kcrontab command.
 
Deleted:
<
<

Batch system

 
Changed:
<
<
The currrent batch system (acess from the machine ppepbs.physics.gla.ac.uk) will not be able to access the local afs cell. A new batch system has been setup which can access the afs file system and which is accessible from any linux desktop machine that has been moved onto the new system.
>
>

External Kerberos Access (Linux / Mac OS X)

 
Changed:
<
<
To use the new system simply use the normal qsub and qstat commands from any PPE linux desktop that has been moved over the the new system.
>
>
You can configure Kerberos on a Linux or Mac OS X machine to enable passwordless log-in to remote machines once a Kerberos ticket has been created. To do this, open /etc/krb5.conf (/Library/Preferences/edu.mit.Kerberos under OS X) in a text editor, and add the following to the realms section:
 
Changed:
<
<

Home web pages

User's home web pages are served from the directory public_html in their home directory. The web server will use the public_html directory in the afs file system of an account moved over to the afs in preference to the public_html directory in the old account. Until files are moved from the old public_html directory to the new directory a user's web pages will be inaccessible. It is important to move the files under the public_html directory in the old NFS file system to the new public_html directory and not to move the public_html directory itself due to afs file permissions. For example to do this use the command:

mv /home/_username_/public_html/* /afs/phas.gla.ac.uk/user/_letter_/_username_/public_html/

Substituting _letter_ and _username_ as required.

External Kerberos access (linux/mac)

Setting up kerberos on a linux or mac allows for password less login to machines after the initial kerberos ticket has been created.

Edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:

>
>

 PHAS.GLA.AC.UK = { default_domain = phas.gla.ac.uk kdc = kdc2.phas.gla.ac.uk:88 kdc = kdc1.phas.gla.ac.uk:88 admin_server = kdc1.phas.gla.ac.uk }
Changed:
<
<
>
>

In the same file, add the following to the libdefaults section:

  Then add/edit to the libdefaults section:
Changed:
<
<
>
>

 allow_weak_crypto = true default_realm = PHAS.GLA.AC.UK dns_lookup_realm = false
Line: 65 to 51
 renew_lifetime = 672h forwardable = true proxiable = true
Changed:
<
<
>
>
 
Changed:
<
<
For ssh access edit /etc/ssh/ssh_config on linux machines or /etc/ssh_config on macs (root access is required to edit either file) and ensure the follow are set to yes:
>
>
To use Kerberos with SSH, open /etc/ssh/ssh_config (/etc/ssh_config on OS X) and check the following values are set:
 
Changed:
<
<
>
>

 GSSAPIAuthentication yes GSSAPIDelegateCredentials yes GSSAPIKeyExchange yes
Changed:
<
<
>
>
 
Changed:
<
<
Then try to get an kerberos ticket and log into ppelx:
>
>
You will need administrative rights to make any changes to these files.
 
Changed:
<
<
create kerberos ticket then ssh into ppelx
$ kinit username@PHAS.GLA.AC.UK
$ ssh username@ppelx.physics.gla.ac.uk
>
>
To use a Kerberos ticket to log-in to ppelx:
 
Changed:
<
<
Changing username as appropriate.
>
>
$ kinit <USERNAME>@PHAS.GLA.AC.UK
$ ssh <USERNAME>@ppelx.physics.gla.ac.uk
 
Deleted:
<
<

External afs access (linux/mac)

 
Changed:
<
<
To access the phas.gla.ac.uk afs cell from an external linux machine requires first setting up kerberos access as described above and then installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org . For OS X the packages can be downloaded from http://www.openafs.org/macos.html
>
>

External AFS Access (Linux / Mac OS X)

 
Changed:
<
<
After installing the openafs edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:
>
>
Access to the phas.gla.ac.uk AFS cell from a non-PPE machine requires that you first configure Kerberos as described above, then install the appropriate OpenAFS client.
 
Changed:
<
<
Then add/edit to the domain_realm section:
>
>
After installing OpenAFS, open /etc/krb5.conf (/Library/Preferences/edu.mit.Kerberos under OS X) in a text editor, and add the following to the domain_realm section:
 
Changed:
<
<
>
>

  .phas.gla.ac.uk = PHAS.GLA.AC.UK .physics.gla.ac.uk = PHAS.GLA.AC.UK .ppe.gla.ac.uk = PHAS.GLA.AC.UK
Changed:
<
<

Or use this example krb5.conf file which also has the kerberos setting for cern and fermi lab.

>
>
 
Changed:
<
<
Then edit the CellServDB file which can usually be found on a linux machine at /usr/vice/etc/CellServDB or /etc/openafs/CellServDB and for OS X is located at /var/db/openafs/etc/CellServDB and add:
>
>
You will then need to edit your CellServDB file, which can usually be found in either /usr/vice/etc/CellServDB or /etc/openafs/CellServDB (/var/db/openafs/etc/CellServDB under OS X), adding the following lines:
 
Changed:
<
<
>
>

 >phas.gla.ac.uk #Univeristy of Glasgow Physics And Astronomy
194.36.1.27 #afsdb3.phas.gla.ac.uk 194.36.1.19 #afsdb1.phas.gla.ac.uk 194.36.1.33 #afsdb2.phas.gla.ac.uk
Changed:
<
<
>
>
 
Changed:
<
<
either at the top or bottom of the file.
>
>
Finally, edit the ThisCell file which can be found in the same directory, replacing its contents with:
 
Changed:
<
<
Next edit the ThisCell file (/usr/vice/etc/ThisCell or /etc/openafs/ThisCell on linux or /var/db/openafs/etc/ThisCell for OS X) replacing the contents with
>
>

 phas.gla.ac.uk
Changed:
<
<
>
>

Restart the OpenAFS client either by restarting the service, or by rebooting the machine.

 
Changed:
<
<
Restart the openafs client either by restarting the client service or rebooting the machine) and create a kerberos ticket and get an afs token:
>
>
To create a Kerberos ticket and obtain an AFS token, use commands similar to the following:
 
Changed:
<
<
create kerberos ticket then ssh into ppelx
$ kinit username@PHAS.GLA.AC.UK
$ aklog
>
>
$ kinit <USERNAME>@PHAS.GLA.AC.UK
$ aklog
 
Deleted:
<
<
Changing username as appropriate. If both commands are successful then try to access the afs cell:
 
Changed:
<
<
test the afs cell
$ ls /afs/phas.gla.ac.uk/user
>
>

Hints, Tips and Issues

 
Deleted:
<
<

Hints, Tips And Issues

 

Common AFS commands

Changed:
<
<
  • fs lq : List the size and amount used of the volume of the current working directory.
  • fs listacl : List the acl (access control list) for the current working directory.
  • fs setacl dir user/group permissions : Add to the acl of a directory.
>
>
Command Description
fs lq Display information about available and used space for the current directory.
fs listacl Display the ACL (Access Control List) of the current directory.
fs setacl <PATHNAME> <USERNAME> <PERMISSIONS> Add an entry to the current directory's ACL.
 

AFS ACLs (Protecting Data)

Revision 232016-04-26 - GordonStewart

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 246 to 246
 endif
Deleted:
<
<

KDE desktop

Gnome Desktop

-- AndrewPickford - 2009-10-14

 
META FILEATTACHMENT attachment="krb5.conf" attr="" comment="" date="1357214218" name="krb5.conf" path="krb5.conf" size="1656" stream="krb5.conf" tmpFilename="/usr/tmp/CGItemp13840" user="AndrewPickford" version="2"

Revision 222016-04-14 - GordonStewart

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 19 to 19
 

Backups

Changed:
<
<
Overnight backups of user home areas are taken at 1am each night. These backups are user accessible and can be found in /afs/phas.gla.ac.uk/backup/user/_letter_/_username_. Longer term backups are also done - nightly snapshots of user home directories are retained for 7 days except that the snapshots done on a Saturday are retained for two months and the snapshots done on the first Saturday of each month are retained for six months. These longer term backups are not user accessible please contact SystemAdministrators to request a file to be recovered.
>
>
Overnight backups of user home areas are taken at 1am each night. These backups are user accessible and can be found in /afs/phas.gla.ac.uk/backup/user/_letter_/_username_. Longer term backups are also done - nightly snapshots of user home directories are retained for 7 days except that the snapshots done on a Saturday are retained for two months and the snapshots done on the first Saturday of each month are retained for six months. These longer term backups are not user accessible please contact ITManagement to request a file to be recovered.
 

Cronjobs

Revision 212013-07-25 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 67 to 67
 proxiable = true
Changed:
<
<
For ssh access edit /etc/ssh/ssh_config on linux machines or /etc/sshd_config on macs (root access is required to edit either file) and ensure the follow are set to yes:
>
>
For ssh access edit /etc/ssh/ssh_config on linux machines or /etc/ssh_config on macs (root access is required to edit either file) and ensure the follow are set to yes:
 
GSSAPIAuthentication yes
Changed:
<
<
GSSAPICleanupCredentials yes
>
>
GSSAPIDelegateCredentials yes
 GSSAPIKeyExchange yes

Revision 202013-04-18 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 171 to 171
  System administrator access is required to all directories to allow backups to be taken.
Added:
>
>
There is a limit of around 20 entries that can be added to an acl list. The exact number depends on the size (in characters) of each acl entry. To get around this user created groups can be used and then the group can be added to the acl list. The cern web page http://information-technology.web.cern.ch/services/fe/afs/howto/work-afs-groups has instructions on how to create groups and add people to them.
 

Recursive setting of ACLs

A helper script to recursively set an ACL is available on all the scientific linux desktop machines. Usage is similar to the standard fs setacl command:

Revision 192013-02-04 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 232 to 232
 fi
Changed:
<
<
Or for csh/tcsh users add the following to the top of .cshrc or .tcshrc:
>
>
For csh/tcsh users the untested equivalent is to add the following to the top of .cshrc or .tcshrc:
 
if ( -e /bin/ps && -e /bin/grep ) then

Revision 182013-01-31 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 212 to 212
  replacing _dir_ as required. To recursively remove sticky bits use the -R option.
Added:
>
>

Automatic Token Renewal

To automatically renew an AFS token for up to 30 days after logging in requires either a small addition the shell login script for ssh logins or for desktop logins a small script to be auto run. Each login change is independent of the others and all can be safely used at the same time.

ssh login

For bash shell users add the following to the top of .bash_profile:

if [ -e /bin/ps ] && [ -e /bin/grep ]
then
    kproc=`/bin/ps x -u ${USER} | /bin/grep krenew | /bin/grep ${KRB5CCNAME}`
    if [ "${kproc}" == "" ] && [ -e /usr/bin/krenew ]
    then
        /usr/bin/krenew -K 60 -t -k ${KRB5CCNAME} &
    fi
fi

Or for csh/tcsh users add the following to the top of .cshrc or .tcshrc:

if ( -e /bin/ps && -e /bin/grep ) then
    setenv kproc `/bin/ps x -u ${USER} | /bin/grep krenew | /bin/grep ${KRB5CCNAME}`
    if ( "${kproc}" == "" && -e /usr/bin/krenew ) then
        /usr/bin/krenew -K 60 -t -k ${KRB5CCNAME} &
    endif
endif

KDE desktop

Gnome Desktop

  -- AndrewPickford - 2009-10-14

Revision 172013-01-29 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 39 to 39
  Substituting _letter_ and _username_ as required.
Changed:
<
<

External access (linux/mac)

>
>

External Kerberos access (linux/mac)

 
Changed:
<
<
To access the phas.gla.ac.uk afs cell from an external linux machine requires installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org . For OS X the packages can be downloaded from http://www.openafs.org/macos.html
>
>
Setting up kerberos on a linux or mac allows for password less login to machines after the initial kerberos ticket has been created.
 
Changed:
<
<
After installing the openafs on linux edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:
>
>
Edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:
 
PHAS.GLA.AC.UK = {
Line: 67 to 67
 proxiable = true
Added:
>
>
For ssh access edit /etc/ssh/ssh_config on linux machines or /etc/sshd_config on macs (root access is required to edit either file) and ensure the follow are set to yes:

GSSAPIAuthentication yes
GSSAPICleanupCredentials yes 
GSSAPIKeyExchange yes

Then try to get an kerberos ticket and log into ppelx:

create kerberos ticket then ssh into ppelx
$ kinit username@PHAS.GLA.AC.UK
$ ssh username@ppelx.physics.gla.ac.uk

Changing username as appropriate.

External afs access (linux/mac)

To access the phas.gla.ac.uk afs cell from an external linux machine requires first setting up kerberos access as described above and then installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org . For OS X the packages can be downloaded from http://www.openafs.org/macos.html

After installing the openafs edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:

 Then add/edit to the domain_realm section:
Line: 94 to 118
 phas.gla.ac.uk
Changed:
<
<
Restart the openafs client and then try to get an kerberos ticket and an afs token:
>
>
Restart the openafs client either by restarting the client service or rebooting the machine) and create a kerberos ticket and get an afs token:
 
Changed:
<
<
create kerberos ticket then afs token
>
>
create kerberos ticket then ssh into ppelx
 
$ kinit username@PHAS.GLA.AC.UK
$ aklog

Revision 162013-01-28 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 157 to 157
  Getting a kerberos ticket for another kerberos realm using kinit will overwrite the existing kerberos tickets file destroying any local Glasgow ticket. To get around this tickets for different kerberos realms have to be written to different files. A couple of helper scripts have been written to
Changed:
<
<
made this straight forward: kinit-cern, klist-cern, kdestroy-cern, kinit-fnal, klist-fnal, kdestroy-fnal.
>
>
made this straight forward: kinit-cern, klist-cern, kdestroy-cern, ssh-cern, kinit-fnal, klist-fnal, kdestroy-fnal, ssh-fnal.
  They are used in the same way as the standard kinit, klist and kdestroy. For example:
Line: 166 to 166
 $ kinit-cern @CERN.CH
Added:
>
>
and after doing the kinit:

$ ssh-cern <lxplus user name>@lxplus.cern.ch
 

rsyncing files to afs

rsync will copy files to an afs file system in the same way as any other file system. However if directories in the source file system have the stick bit set rsync will complain that it 'failed to set permissions'. A directory with the sticky bit set will have a 's' in the permissions bit field eg:

Revision 152013-01-07 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 43 to 43
  To access the phas.gla.ac.uk afs cell from an external linux machine requires installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org . For OS X the packages can be downloaded from http://www.openafs.org/macos.html
Changed:
<
<
After installing the openafs on linux edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add:
>
>
After installing the openafs on linux edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add/edit to the realms section:
 
PHAS.GLA.AC.UK = {
Line: 54 to 54
  }
Changed:
<
<
To the realms section and add/edit
>
>
Then add/edit to the libdefaults section:
 
allow_weak_crypto = true
Line: 67 to 67
 proxiable = true
Changed:
<
<
to the libdefaults section. Or use this example krb5.conf file which also has the kerberos setting for cern and fermi lab.
>
>
Then add/edit to the domain_realm section:

 .phas.gla.ac.uk = PHAS.GLA.AC.UK
 .physics.gla.ac.uk = PHAS.GLA.AC.UK
 .ppe.gla.ac.uk = PHAS.GLA.AC.UK

Or use this example krb5.conf file which also has the kerberos setting for cern and fermi lab.

  Then edit the CellServDB file which can usually be found on a linux machine at /usr/vice/etc/CellServDB or /etc/openafs/CellServDB and for OS X is located at /var/db/openafs/etc/CellServDB and add:

Revision 142013-01-03 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 49 to 49
 PHAS.GLA.AC.UK = { default_domain = phas.gla.ac.uk kdc = kdc2.phas.gla.ac.uk:88
Deleted:
<
<
kdc = kdc3.phas.gla.ac.uk:88
  kdc = kdc1.phas.gla.ac.uk:88 admin_server = kdc1.phas.gla.ac.uk }
Line: 178 to 177
  -- AndrewPickford - 2009-10-14
Changed:
<
<
META FILEATTACHMENT attachment="krb5.conf" attr="" comment="" date="1353686275" name="krb5.conf" path="krb5.conf" size="1687" stream="krb5.conf" tmpFilename="/usr/tmp/CGItemp5866" user="AndrewPickford" version="1"
>
>
META FILEATTACHMENT attachment="krb5.conf" attr="" comment="" date="1357214218" name="krb5.conf" path="krb5.conf" size="1656" stream="krb5.conf" tmpFilename="/usr/tmp/CGItemp13840" user="AndrewPickford" version="2"

Revision 132012-12-18 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 39 to 39
  Substituting _letter_ and _username_ as required.
Changed:
<
<

External access (linux)

>
>

External access (linux/mac)

 
Changed:
<
<
To access the phas.gla.ac.uk afs cell from an external linux machine requires installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org
>
>
To access the phas.gla.ac.uk afs cell from an external linux machine requires installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org . For OS X the packages can be downloaded from http://www.openafs.org/macos.html
 
Changed:
<
<
After installing the openafs edit the file /etc/krb5.conf and add:
>
>
After installing the openafs on linux edit the file /etc/krb5.conf or for OS X edit /Library/Preferences/edu.mit.Kerberos and add:
 
PHAS.GLA.AC.UK = {
Line: 55 to 55
  }
Changed:
<
<
To the realms section and add
>
>
To the realms section and add/edit
 
allow_weak_crypto = true
Added:
>
>
default_realm = PHAS.GLA.AC.UK dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 25h renew_lifetime = 672h forwardable = true proxiable = true
 

to the libdefaults section. Or use this example krb5.conf file which also has the kerberos setting for cern and fermi lab.

Changed:
<
<
The edit the CellServDB file which can usually be found at /usr/vice/etc/CellServDB or /etc/openafs/CellServDB and add:
>
>
Then edit the CellServDB file which can usually be found on a linux machine at /usr/vice/etc/CellServDB or /etc/openafs/CellServDB and for OS X is located at /var/db/openafs/etc/CellServDB and add:
 
>phas.gla.ac.uk         #Univeristy of Glasgow Physics And Astronomy
Line: 72 to 79
 194.36.1.33 #afsdb2.phas.gla.ac.uk
Changed:
<
<
either at the top or bottom of the file. Restart the openafs client and then try to get an kerberos ticket and an afs token:
>
>
either at the top or bottom of the file.

Next edit the ThisCell file (/usr/vice/etc/ThisCell or /etc/openafs/ThisCell on linux or /var/db/openafs/etc/ThisCell for OS X) replacing the contents with

phas.gla.ac.uk

Restart the openafs client and then try to get an kerberos ticket and an afs token:

 
create kerberos ticket then afs token

Revision 122012-11-23 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 39 to 39
  Substituting _letter_ and _username_ as required.
Added:
>
>

External access (linux)

To access the phas.gla.ac.uk afs cell from an external linux machine requires installing the openafs client and editing a couple of config files all of which will require root access. Packages exist for all the major linux distributions just use the distributions software installer. If that fails try the openafs web site: https://www.openafs.org

After installing the openafs edit the file /etc/krb5.conf and add:

PHAS.GLA.AC.UK = {
  default_domain = phas.gla.ac.uk
  kdc = kdc2.phas.gla.ac.uk:88
  kdc = kdc3.phas.gla.ac.uk:88
  kdc = kdc1.phas.gla.ac.uk:88
  admin_server = kdc1.phas.gla.ac.uk
 }

To the realms section and add

allow_weak_crypto = true

to the libdefaults section. Or use this example krb5.conf file which also has the kerberos setting for cern and fermi lab.

The edit the CellServDB file which can usually be found at /usr/vice/etc/CellServDB or /etc/openafs/CellServDB and add:

>phas.gla.ac.uk         #Univeristy of Glasgow Physics And Astronomy
194.36.1.27                     #afsdb3.phas.gla.ac.uk
194.36.1.19                     #afsdb1.phas.gla.ac.uk
194.36.1.33                     #afsdb2.phas.gla.ac.uk

either at the top or bottom of the file. Restart the openafs client and then try to get an kerberos ticket and an afs token:

create kerberos ticket then afs token
$ kinit username@PHAS.GLA.AC.UK
$ aklog

Changing username as appropriate. If both commands are successful then try to access the afs cell:

test the afs cell
$ ls /afs/phas.gla.ac.uk/user
 

Hints, Tips And Issues

Common AFS commands

Line: 114 to 163
 

-- AndrewPickford - 2009-10-14 \ No newline at end of file

Added:
>
>
META FILEATTACHMENT attachment="krb5.conf" attr="" comment="" date="1353686275" name="krb5.conf" path="krb5.conf" size="1687" stream="krb5.conf" tmpFilename="/usr/tmp/CGItemp5866" user="AndrewPickford" version="1"

Revision 112012-09-25 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 85 to 85
 

Accessing the CERN afs cell (/afs/cern.ch)

Changed:
<
<
To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:
>
>
Getting a kerberos ticket for another kerberos realm using kinit will overwrite the existing kerberos tickets file destroying any local Glasgow ticket. To get around this tickets for different kerberos realms have to be written to different files. A couple of helper scripts have been written to made this straight forward: kinit-cern, klist-cern, kdestroy-cern, kinit-fnal, klist-fnal, kdestroy-fnal.

They are used in the same way as the standard kinit, klist and kdestroy. For example:

 
Changed:
<
<
$ kinit @CERN.CH $ aklog
>
>
$ kinit-cern @CERN.CH
 

rsyncing files to afs

Revision 102012-08-16 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 61 to 61
 
  • public_html - public (world wide) access for anyone, user web pages belong here.
  • public_ppe - readable to the ppe group only.
Changed:
<
<
To see the acl list on a directory use the command fs listacl dir . The allow a user or group user read access to a directory dir :
>
>
To see the acl list on a directory use the command fs listacl dir .

To allow a user or group user read access to a directory dir :

  fs setacl dir user read
Line: 75 to 77
  System administrator access is required to all directories to allow backups to be taken.
Added:
>
>

Recursive setting of ACLs

A helper script to recursively set an ACL is available on all the scientific linux desktop machines. Usage is similar to the standard fs setacl command:

fs-recursive-setacl dir user acl

 

Accessing the CERN afs cell (/afs/cern.ch)

To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:

Revision 92012-07-05 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 39 to 39
  Substituting _letter_ and _username_ as required.
Added:
>
>

Hints, Tips And Issues

 
Changed:
<
<

Common AFS commands

>
>

Common AFS commands

 
  • fs lq : List the size and amount used of the volume of the current working directory.
  • fs listacl : List the acl (access control list) for the current working directory.
  • fs setacl dir user/group permissions : Add to the acl of a directory.
Changed:
<
<

AFS ACLs (Protecting Data)

>
>

AFS ACLs (Protecting Data)

  AFS file systems use directory based ACLs to determine the access permissions for a given file. The following is taken from the afs documentation (http://docs.openafs.org/AdminGuide/ch15s02.html):
Line: 74 to 75
  System administrator access is required to all directories to allow backups to be taken.
Changed:
<
<

Accessing the CERN afs cell (/afs/cern.ch)

>
>

Accessing the CERN afs cell (/afs/cern.ch)

  To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:
Line: 83 to 84
 $ aklog
Added:
>
>

rsyncing files to afs

rsync will copy files to an afs file system in the same way as any other file system. However if directories in the source file system have the stick bit set rsync will complain that it 'failed to set permissions'. A directory with the sticky bit set will have a 's' in the permissions bit field eg:

drwxrwsr-x  4 ppemgr ppemgr   45 Jan 14  2009 sl44

These errors can be safely ignored but they may obscure other errors when rsyncing. To remove stick bits before rsyncing use chmod:

chmod a-s _dir_

replacing _dir_ as required. To recursively remove sticky bits use the -R option.

  -- AndrewPickford - 2009-10-14 \ No newline at end of file

Revision 82012-07-03 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 33 to 33
 

Home web pages

Changed:
<
<
User's home web pages are served from the directory public_html in their home directory. The web server will use the public_html directory in the afs file system of an account moved over to the afs in preference to the public_html directory in the old account. Until files are moved from the old public_html directory to the new a user's web pages will be inaccessible. It is important to move the files under the public_html directory in the old NFS file system to the new public_html directory and not to move the public_html directory itself due to afs file permissions. For example to do this use the command:
>
>
User's home web pages are served from the directory public_html in their home directory. The web server will use the public_html directory in the afs file system of an account moved over to the afs in preference to the public_html directory in the old account. Until files are moved from the old public_html directory to the new directory a user's web pages will be inaccessible. It is important to move the files under the public_html directory in the old NFS file system to the new public_html directory and not to move the public_html directory itself due to afs file permissions. For example to do this use the command:
  mv /home/_username_/public_html/* /afs/phas.gla.ac.uk/user/_letter_/_username_/public_html/

Revision 72012-07-02 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 60 to 60
 
  • public_html - public (world wide) access for anyone, user web pages belong here.
  • public_ppe - readable to the ppe group only.
Changed:
<
<
To see the acl list on a directory use the command fs listacl dir . The allow the ppe group read access to a directory fs setacl dir ppe rl. Replacing dir as appropriate.
>
>
To see the acl list on a directory use the command fs listacl dir . The allow a user or group user read access to a directory dir :

fs setacl dir user read

To give write permissions:

fs setacl dir user write

And to remove all permissions for a user or group:

fs setacl dir user none

  System administrator access is required to all directories to allow backups to be taken.

Revision 62012-07-02 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 8 to 8
 

File System Layout

Changed:
<
<
Beneath /afs/pgas.gla.ac.uk are the following directories:
>
>
Beneath /afs/phas.gla.ac.uk are the following directories:
 
  • backup : Snap shot backups for user home directories and other files. The snap shot is done each night at 1am.
  • data : Large store area, not backed up.
Line: 17 to 17
 
  • system : Common programs installed system wide.
  • user : User home directories are stored under this directory. The initial quota on home directories is 50GB. Nightly snap shot backups and long term backups.
Added:
>
>

Backups

Overnight backups of user home areas are taken at 1am each night. These backups are user accessible and can be found in /afs/phas.gla.ac.uk/backup/user/_letter_/_username_. Longer term backups are also done - nightly snapshots of user home directories are retained for 7 days except that the snapshots done on a Saturday are retained for two months and the snapshots done on the first Saturday of each month are retained for six months. These longer term backups are not user accessible please contact SystemAdministrators to request a file to be recovered.

 

Cronjobs

Normal cronjobs can not write to the afs file system and can only read the publicly accessible parts of the file system. Cronjobs which require access to the afs file system can be created using the kcrontab command.

Revision 52012-06-29 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Added:
>
>
 

Local AFS Cell (/afs/phas.gla.ac.uk)

File System Layout

Line: 12 to 14
 
  • data : Large store area, not backed up.
  • group : Group based storage area, backed up.
  • project :
Changed:
<
<
  • system :
>
>
  • system : Common programs installed system wide.
 
  • user : User home directories are stored under this directory. The initial quota on home directories is 50GB. Nightly snap shot backups and long term backups.
Added:
>
>

Cronjobs

Normal cronjobs can not write to the afs file system and can only read the publicly accessible parts of the file system. Cronjobs which require access to the afs file system can be created using the kcrontab command.

Batch system

The currrent batch system (acess from the machine ppepbs.physics.gla.ac.uk) will not be able to access the local afs cell. A new batch system has been setup which can access the afs file system and which is accessible from any linux desktop machine that has been moved onto the new system.

To use the new system simply use the normal qsub and qstat commands from any PPE linux desktop that has been moved over the the new system.

Home web pages

User's home web pages are served from the directory public_html in their home directory. The web server will use the public_html directory in the afs file system of an account moved over to the afs in preference to the public_html directory in the old account. Until files are moved from the old public_html directory to the new a user's web pages will be inaccessible. It is important to move the files under the public_html directory in the old NFS file system to the new public_html directory and not to move the public_html directory itself due to afs file permissions. For example to do this use the command:

mv /home/_username_/public_html/* /afs/phas.gla.ac.uk/user/_letter_/_username_/public_html/

Substituting _letter_ and _username_ as required.

Common AFS commands

  • fs lq : List the size and amount used of the volume of the current working directory.
  • fs listacl : List the acl (access control list) for the current working directory.
  • fs setacl dir user/group permissions : Add to the acl of a directory.

AFS ACLs (Protecting Data)

AFS file systems use directory based ACLs to determine the access permissions for a given file. The following is taken from the afs documentation (http://docs.openafs.org/AdminGuide/ch15s02.html):

  • The permissions on a directory's ACL apply to all of the files in the directory. When you move a file to a different directory, you effectively change the access permissions that apply to it to those on its new directory's ACL. Changing a directory's ACL changes the protection on all the files in it.
  • When you create a subdirectory, its initial ACL is created as a copy of its parent directory's ACL. You can then change the subdirectory's ACL independently. However, the parent directory's ACL continues to control access to the subdirectory in the following way: the parent directory's ACL must grant the l (lookup) permission to a user (or a group the user belongs to) in order for the user to access the subdirectory at all.

By default the following directories are created in a user's afs home area:

  • private - access only for the user and the system administrator, this is also the default for any new directories.
  • public - public (world wide) access for anyone.
  • public_html - public (world wide) access for anyone, user web pages belong here.
  • public_ppe - readable to the ppe group only.

To see the acl list on a directory use the command fs listacl dir . The allow the ppe group read access to a directory fs setacl dir ppe rl. Replacing dir as appropriate.

System administrator access is required to all directories to allow backups to be taken.

 

Accessing the CERN afs cell (/afs/cern.ch)

To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:

Line: 24 to 69
 $ aklog
Deleted:
<
<

Command AFS commands

  • fs lq : List the size and amount used of the volume of the current working directory.
  • fs listacl : List the acl (access control list) for the current working directory.
  • fs setacl dir user/group permissions : Add to the acl of a directory.
  -- AndrewPickford - 2009-10-14

Revision 42012-05-28 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Line: 25 to 24
 $ aklog
Added:
>
>

Command AFS commands

  • fs lq : List the size and amount used of the volume of the current working directory.
  • fs listacl : List the acl (access control list) for the current working directory.
  • fs setacl dir user/group permissions : Add to the acl of a directory.
 -- AndrewPickford - 2009-10-14

Revision 32012-05-28 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Changed:
<
<

Accessing the CERN afs cell

>
>

Local AFS Cell (/afs/phas.gla.ac.uk)

 
Changed:
<
<
To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:
>
>

File System Layout

 
Changed:
<
<
$ kinit
$ aklog
>
>
Beneath /afs/pgas.gla.ac.uk are the following directories:

  • backup: Snap shot backups for user home directories and other files. The snap shot is done each night at 1am.
  • data: Large store area, not backed up.
  • group: Group based storage area, backed up.
  • project:
  • system:
  • user: User home directories are stored under this directory. The initial quota on home directories is 50GB. Nightly snap shot backups and long term backups.
 
Changed:
<
<
If your cern lxplus user name is different from your Glasgow ppe user name then it needs to be given as a parameter to kinit:
>
>

Accessing the CERN afs cell (/afs/cern.ch)

To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:

 
Changed:
<
<
$ kinit
>
>
$ kinit @CERN.CH $ aklog
 

-- AndrewPickford - 2009-10-14 \ No newline at end of file

Revision 22009-10-29 - AndrewPickford

Line: 1 to 1
 
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

Added:
>
>

Accessing the CERN afs cell

To get an afs token to use with the cern afs cell (/afs/cern.ch) from any ppe linux machine do:

$ kinit
$ aklog

If your cern lxplus user name is different from your Glasgow ppe user name then it needs to be given as a parameter to kinit:

$ kinit <lxplus user name>
 -- AndrewPickford - 2009-10-14

Revision 12009-10-14 - AndrewPickford

Line: 1 to 1
Added:
>
>
META TOPICPARENT name="WebHome"

Using AFS At Glasgow

-- AndrewPickford - 2009-10-14

 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2020 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback