Techy Information Anandha Gopalan September 13, 2006

Outline AFS overview AFS overview Departmental software Departmental software Departmental machines Departmental machines The ticket system The ticket system Help !!! Help !!!

AFS overview What is AFS ? What is AFS ? Andrew File SystemAndrew File System Developed at CMU as part of Project Andrew Developed at CMU as part of Project Andrew Transarc Corporation founded to commercialize AFS Transarc Corporation founded to commercialize AFS Transarc acquired by IBM Transarc acquired by IBM IBM releases OpenAFS under the IBM Public License (IPL) IBM releases OpenAFS under the IBM Public License (IPL)

Why AFS ? Security: authentication via Kerberos 4 Security: authentication via Kerberos 4 Fine grained control over file permissions Fine grained control over file permissions Can give individual users access to files and directoriesCan give individual users access to files and directories Accessible via both UNIX and Windows Accessible via both UNIX and Windows More information about clients: More information about clients:

AFS permissions Access Control Lists (ACLs) grant permissions on a per user and group basis. Each directory has an ACL that controls the directory and the files in it Access Control Lists (ACLs) grant permissions on a per user and group basis. Each directory has an ACL that controls the directory and the files in it There are seven permissions that may be granted, to either groups of users or individuals There are seven permissions that may be granted, to either groups of users or individuals System-defined groups exist, but you can define your own groupsSystem-defined groups exist, but you can define your own groups ACLs always are applied to directories rather than to individual filesACLs always are applied to directories rather than to individual files Files are governed by the ACL on their directory Files are governed by the ACL on their directory If you change the ACL on a directory, access to all of its files changesIf you change the ACL on a directory, access to all of its files changes Subdirectories inherit the ACLs of their parent directorySubdirectories inherit the ACLs of their parent directory

AFS permissions AFS ACLs work in conjunction with the standard Unix "owner" permissions. Only the owner permissions have an effect on AFS file access AFS ACLs work in conjunction with the standard Unix "owner" permissions. Only the owner permissions have an effect on AFS file access Unix permissions for "group" and "other" do not affect AFS file access.Unix permissions for "group" and "other" do not affect AFS file access. A user with appropriate AFS permissions can:A user with appropriate AFS permissions can: read a file only if the UNIX "owner read" mode is set. read a file only if the UNIX "owner read" mode is set. write to a file only if the UNIX owner "read" and "write" modes are set. write to a file only if the UNIX owner "read" and "write" modes are set. execute a file only if the UNIX owner "read" and "execute" modes are set. execute a file only if the UNIX owner "read" and "execute" modes are set.

AFS permissions Lookup: l, allows a user to list the contents of the AFS directory, examine the ACL associated with the directory and access subdirectories. Lookup: l, allows a user to list the contents of the AFS directory, examine the ACL associated with the directory and access subdirectories. Insert: i, allows a user to add new files or subdirectories to the directory. Insert: i, allows a user to add new files or subdirectories to the directory. Delete: d, allows a user to remove files and subdirectories from the directory. Delete: d, allows a user to remove files and subdirectories from the directory. Administer: a, allows a user to change the ACL for the directory. Users always have this right on their home directory, even if they accidentally remove themselves from the ACL. Administer: a, allows a user to change the ACL for the directory. Users always have this right on their home directory, even if they accidentally remove themselves from the ACL. Read: r, allows a user to look at the contents of files in a directory and list files in subdirectories. Read: r, allows a user to look at the contents of files in a directory and list files in subdirectories. Write: w, allows a user to modify files in a directory. Write: w, allows a user to modify files in a directory. Lock: k, allows the processor to run programs that need to "flock" files in the directory. Lock: k, allows the processor to run programs that need to "flock" files in the directory.

AFS permissions System-groups in AFS System-groups in AFS system:anyusersystem:anyuser Any user in the world who can gain access to your cell. This is a very broad group, and caution should always be used when granting any access to this group Any user in the world who can gain access to your cell. This is a very broad group, and caution should always be used when granting any access to this group system:authusersystem:authuser Everyone who is currently authenticated in your cell Everyone who is currently authenticated in your cell system:administratorssystem:administrators A few users in the cell who have been designated as AFS system administrators A few users in the cell who have been designated as AFS system administrators

AFS pitfalls I have –rw on my file, but it can still be read by others I have –rw on my file, but it can still be read by others Check the directory permissionsCheck the directory permissions AFS works at the directory level, UNIX permissions are ignoredAFS works at the directory level, UNIX permissions are ignored For a file to be executable, it still needs to have the correct UNIX permissions !!!For a file to be executable, it still needs to have the correct UNIX permissions !!!

AFS pitfalls How do I check if I have safe permissions ? How do I check if I have safe permissions ? /usr/local/bin/checkafsperms directory/usr/local/bin/checkafsperms directory This checks the permission on a directory This checks the permission on a directory /usr/local/bin/checkafshier directory/usr/local/bin/checkafshier directory This checks the permission on a directory hierarchy This checks the permission on a directory hierarchy These commands only work on LinuxThese commands only work on Linux These commands report if any directory has permissions: i,d,w,k,aThese commands report if any directory has permissions: i,d,w,k,a

AFS pitfalls 2 GB file size limitation 2 GB file size limitation Though you don’t really need thisThough you don’t really need this Tokens expire after 24 hours Tokens expire after 24 hours A klog will get you new tokensA klog will get you new tokens tokens will show available tokenstokens will show available tokens Use reauth to run programs > 24 hoursUse reauth to run programs > 24 hours Cannot set recursive permissions  Cannot set recursive permissions  Workaround available To give all permissions to user nemo recursively $ find. -type d -exec fs sa {} nemo all \;

AFS directory setup public public Directory that can be read and listed by allDirectory that can be read and listed by all Contains a directory html under which users can create their web pages etc...Contains a directory html under which users can create their web pages etc... private private Accessible only by the userAccessible only by the user Backup Backup Link in the home directory which contains the backup that is a day oldLink in the home directory which contains the backup that is a day old For older backups, ask techFor older backups, ask tech

Special AFS user agents mailserver mailserver Any process using the mail server has this usernameAny process using the mail server has this username Can be used for spam filtering using spamassasinCan be used for spam filtering using spamassasin webserver webserver Any process using the http protocolAny process using the http protocol Can be used for providing correct access to user web pages, cgi programs etc…Can be used for providing correct access to user web pages, cgi programs etc…

Department software Information about new software installed on Linux/Solaris can be found at: Information about new software installed on Linux/Solaris can be found at: /usr/local/contrib contains software that is used by a small number of people, its either something new or experimental /usr/local/contrib contains software that is used by a small number of people, its either something new or experimental You can contribute by installing s/w in this directory (ask tech about it)You can contribute by installing s/w in this directory (ask tech about it) /usr/local contains software that is needed and used by the majority of people in the department /usr/local contains software that is needed and used by the majority of people in the department

Departmental machines The Linux machines The Linux machines Can be accessed as: linux.cs.pitt.edu or elements.cs.pitt.eduCan be accessed as: linux.cs.pitt.edu or elements.cs.pitt.edu Some machines are: arsenic, antimony, oxygen, hydrogen, nitrogen, selenium Some machines are: arsenic, antimony, oxygen, hydrogen, nitrogen, selenium Solaris 9 machines Solaris 9 machines Can be accessed as: blitz.cs.pitt.edu and javalab.cs.pitt.edu, (need to use your pitt account for javalab.cs.pitt.edu)Can be accessed as: blitz.cs.pitt.edu and javalab.cs.pitt.edu, (need to use your pitt account for javalab.cs.pitt.edu)

The ticket system Any sent to is logged into the ticket system Any sent to is logged into the ticket Issues a ticket number that is used to keep track of this ticketIssues a ticket number that is used to keep track of this ticket Rather than sending an , visit: and login with your AFS username and passwordRather than sending an , visit: and login with your AFS username and password Helps in keeping track of your tickets Helps in keeping track of your tickets Be clear when you ask for something Be clear when you ask for something If necessary, mention your machine name, OS, room number  Trust me, it helpsIf necessary, mention your machine name, OS, room number  Trust me, it helps

HELP !!! In case you are wondering: In case you are wondering: How on this blue-green planet do I do this ?????How on this blue-green planet do I do this ????? Some answers are provided at: Some answers are provided at: Has a link to an FAQ with a lot of answers Has a link to an FAQ with a lot of answers Has a link to the tech newsletter Has a link to the tech newsletter Has a link to the upgrades and software installation by the software TA Has a link to the upgrades and software installation by the software TA

? ? ? ? ?