The OpenAFS Gatekeepers are pleased to announce the availability of OpenAFS version 1.4.12.

[...]

OpenAFS 1.4.12 is the current recommended release for all Unix platforms; For Windows, we recommend use of the current 1.5 series release for best performance, and we do not expect to provide OpenAFS 1.4 series binaries for Windows.

[Quelle: Derrick via openafs-annouce]

The OpenAFS Gatekeepers announce the availability of the fourth release candidate for OpenAFS version 1.4.12.

[...]

A large number of bugfixes, including in the Linux cache manager and the fileserver, are included, as well as a Preferences Pane for MacOS.
Since 1.4.12pre3, an issue which could trigger a MacOS bug and hang Finder, an issue with Linux file locking, an issue with Linux 2.6.33 kernel module builds, an erroneous crash in the fileserver when checking for corruption in the host list, a race on detecting deleted hosts in the fileserver host list, and a client retry issue for idle Rx connections have been addressed.

[Quelle: Derrick via openafs-annouce]

In 2009, OpenAFS converted to git for our revision control needs, and it has greatly improved code submission and review.

However, for those of you who wish to create repository forks for development, wish to collaborate on it, but do not wish to maintain your own git installation, things were a bit harder.

To improve this situation as well as to make available github’s visualization tools, OpenAFS git changes are now being pushed to github upon commit. You can visit

http://github.com/openafs/openafs

to view any changes as well as to create a fork to develop on, and then push changes to OpenAFS gerrit later when you are ready for review and submission. The git.openafs.org tree remains the canonical repository.

[Quelle: Derrick via openafs-annouce]

Clone-URL: git://github.com/openafs/openafs.git
git clone git://github.com/openafs/openafs.git

1.5.72 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows 7 and Windows Server 2008 R2 including both 32-bit and 64-bit architectures. The 1.5.72 release restores AFSDB support for kaserver users. The 1.5.72 Windows client is fully compatible with all AFS server versions.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11.

Please visit openafs.org/windows for up to date information on the status of the OpenAFS for Windows client.

[Quelle: Derrick via openafs-annouce]

The OpenAFS Gatekeepers announce the availability of the third release candidate for OpenAFS version 1.4.12.

[...]

A large number of bugfixes, including in the Linux cache manager and the fileserver, are included, as well as a Preferences Pane for MacOS.
Since 1.4.12pre2, a Linux bug regarding cache access when SELinux is enabled, and a MacOS issue when enumerating /afs in Finder have been addressed.

[Quelle: Derrick via openafs-annouce]

The installation of the client on modern Linux distributions is pretty straight forward.

1. get the packages
2. compile the kernel module
3. mess around in some config files

First step: get the packages
sudo apt-get install
openafs-client openafs-doc openafs-modules-dkms openafs-krb5 krb5-clients krb5-config krb5-user krb5-doc
(Yes, we’ll install the -doc-Packages, because everyone likes documentation)

Last step: the config files
Open /etc/krb5.conf and edit the sections containing the following:

1
2
3
4
5
6
7
8
9
10
11
12

[libdefaults]
        default_realm = MYCELL.NET
[realms]
        MYCELL.NET = {
                kdc = kdc1.mycell.net
                kdc = kdc2.mycell.net
                admin_server = kdc1.mycell.net
                default_domain = mycell.net
        }
[domain_realm]
        .mycell.net = MYCELL.NET
        mycell.net = MYCELL.NET

You should translate mycell.net to your local cell settings, but you already knew that, right? Ask your AFS Admin, if you are not sure about the correct values.

You may also take a look at /etc/openafs/afs.conf.client, /etc/openafs/ThisCell and /etc/openafs/CellServDB, but in most cases there’s no need to change something within these three files. If you need to get an updated version of /etc/openafs/CellServDB, just get it via FTP from grand.central.org.
wget -O /etc/openafs/CellServDB
ftp://ftp.central.org/pub/cellservdb/CellServDB

The very last step: restart the client
sudo /etc/init.d/openafs-client restart
Now the magic happens. The missing kernel module will be compiled in time and the OpenAFS-Client gets started. The benefit: remember updating your kernel and updating every single module again and again? dkms will help you, that you only need to update the kernel – the modules will be upgraded automagicly.

You’re done! kinit and aklog will be your best friends from now on!

OpenAFS 1.5.71 is also up on OpenAFS.org. We don’t recommend updating Linux clients at this time, though.

Dies war allerdings kein offizielles Announcement, daher wohl auch die Empfehlung Linux-Maschinen noch nicht upzudaten (denglisch, olé). Wer sich’s trotzdem schon ansehen möchte, 1.5.71 befindet sich bei den unstable releases.

The OpenAFS Gatekeepers announce the availability of the second release candidate for OpenAFS version 1.4.12.

[...]

A large number of bugfixes, including in the Linux cache manager and the fileserver, are included, as well as a Preferences Pane for MacOS.
Since 1.4.12 pre1, several Rx bugs including computing connection idle times have been fixed; support for Kerberos 1.8 DES enabling has been added; and support for updated Linux kernel kmem cache creation is now available.

[Quelle: Derrick via openafs-annouce]

The installation of the client on modern Linux distributions is pretty straight forward.

1. get the packages
2. compile the kernel module
3. mess around in some config files

First step: get the packages
sudo apt-get install
openafs-client openafs-doc openafs-modules-source openafs-krb5 krb5-clients krb5-config krb5-user krb5-doc
(Yes, we’ll install the -doc-Packages, because everyone likes documentation)

Next step: build the kernel module
Maybe you’ll need some more packages for this step:
sudo apt-get install module-assistant build-essential
Now start the module assistant, to build the openafs-module.
sudo module-assistant

The first entries “UPDATE” and “PREPARE” could take a few minutes, because eventually missing packages (e.g. kernel sources or headers, or the compiler-chain) will be installed. “SELECT” will open the next window, where you should search the module and select it.

Now build the module. The next question will be “would you like to install the build module?”, but you should now have a guess what to do
You should now exit the module assistant.

Last step: the config files
Open /etc/krb5.conf and edit the sections containing the following:

1
2
3
4
5
6
7
8
9
10
11
12

[libdefaults]
        default_realm = MYCELL.NET
[realms]
        MYCELL.NET = {
                kdc = kdc1.mycell.net
                kdc = kdc2.mycell.net
                admin_server = kdc1.mycell.net
                default_domain = mycell.net
        }
[domain_realm]
        .mycell.net = MYCELL.NET
        mycell.net = MYCELL.NET

You should translate mycell.net to your local cell settings, but you already knew that, right? Ask your AFS Admin, if you are not sure about the correct values.

You may also take a look at /etc/openafs/afs.conf.client, /etc/openafs/ThisCell and /etc/openafs/CellServDB, but in most cases there’s no need to change something within these three files. If you need to get an updated version of /etc/openafs/CellServDB, just get it via FTP from grand.central.org.
wget -O /etc/openafs/CellServDB
ftp://ftp.central.org/pub/cellservdb/CellServDB

The very last step: restart the client
sudo /etc/init.d/openafs-client restart
Stopping AFS services:.
Starting AFS services: openafs afsd.
afsd: All AFS daemons started.

You’re done! kinit and aklog will be your best friends from now on!

1.5.69 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows 7 and Windows Server 2008 R2 including both 32-bit and 64-bit architectures. The 1.5.69 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability. The 1.5.69 Windows client is fully compatible with all AFS server versions.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11.

Please visit openafs.org/windows for up to date information on the status of the OpenAFS for Windows client.

[Quelle: Derrick via openafs-annouce]

Das Changelog findet sich wie immer auf openafs.org.

The OpenAFS Gatekeepers announce the availability of the first release candidate for OpenAFS version 1.4.12.

[...]

A large number of bugfixes, including in the Linux cache manager and the fileserver, are included, as well as a Preferences Pane for MacOS.

[Quelle: Derrick via openafs-annouce]

1.5.68 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.68 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.68 Windows client is fully compatible with all AFS server versions.

[Quelle: Jeff via openafs-annouce]

This production release is a major release. Important changes since
1.5.66 (there was no 1.5.67) include:

• Set the DOS Readonly attribute on a file/directory whenever the unix mode combined with the mask 0200 is true. Previously there was a discrepency between the mask used for test

# vos listaddrs
volserver01.standort1.example.com
192.168.0.1
volserver02.standort1.example.com
192.168.0.2
volserver01.standort2.example.com

Die Lösung bieten hier die zwei Dateien NetInfo und NetRestrict, unter Debian in /var/lib/openafs/local/ zu finden.

# cat /var/lib/openafs/local/NetInfo
1.2.3.4
# cat /var/lib/openafs/local/NetRestrict
192.168.0.1

Die Einträge in diesen beiden Dateien sagen in etwa folgendes:
Lieber vos, Du darfst Dich an die IP-Adresse 1.2.3.4 binden, aber lass’ die Finger weg von 192.168.0.1!

Mehrere IP-Adressen einfach in mehrere Zeilen schreiben, jeder nur ein Kreuz. Ob die Konfiguration funktioniert hat, sieht man nach einem Neustart z.B. mittels /etc/init.d/openafs-fileserver restart mit dem Befehl vos listaddrs.

# vos listaddrs
volserver01.standort1.example.com
volserver02.standort1.example.com
volserver01.standort2.example.com

Wer sich sein OpenAFS-Paket selbst gebaut hat, und/oder auf transarc-Pfade steht, der findet den richtigen Ort für die beiden Files in /usr/afs/local.

Zeit: 13.-15. September 2010
Ort: Pilsen, Czech Republic

Mehr Informationen

Who should attend?

• Everyone interested in deploying a globally accessible file system.
• Everyone interested in learning more about real-world usage of Kerberos authentication in a single realm and federated single sign-on environments.
• Everyone who wants to share their knowledge and experience with other members of the AFS and Kerberos communities.
• Everyone who wants to find out sbout the latest developments affecting AFS and Kerberos.
• Everyone who wants to enjoy great time and finest beer from Pilsen.

Folge 38 noch nicht angehört?! Ab zu iTunes oder auf der Website anhören, dann zurück hier her, wir warten so lange …
So … angehört? Willkommen zurück!

Unter anderem haben Constantin und ich uns über Cloud Computing unterhalten, über den Ansatz den meine Firma gewählt hat und über Lösungsansätze von anderen Firmen. Doch leider bin ich bei der Erklärung unseres Setups etwas vom eigentlichen Gedanken abgekommen.
Dann muß ich das wohl nach liefern

Ein einfaches wolkiges Setup sieht in etwa so aus:
(… und ja, genau genommen ist ein solches Setup bereits eine Cloud!)

Load Balancer bringen Anfragen aus dem Internet auf eine Anzahl von Web-Servern die sich – je nach Applikation und Sicherheitsregeln – auf Datenbanken oder besser gleich Cluster verbinden. Eigentlich recht einfach, jedoch skaliert das in meinen Augen nicht weit genug, allein schon, weil man zig Web-Server aktualisieren muß, wenn sich z.B. ein Wordpress Update ankündigt.

Hier heißt die Lösung “shared storage“:
Wir nutzen OpenAFS um diesen shared storage bereit zu stellen. OpenAFS skaliert nahezu unbegrenzt und enthält von Haus aus alle Mittel um globalen Storage zu betreiben.

AFS is a distributed filesystem product, pioneered at Carnegie Mellon University and supported and developed as a product by Transarc Corporation (now IBM Pittsburgh Labs). It offers a client-server architecture for federated file sharing and replicated read-only content distribution, providing location independence, scalability, security, and transparent migration capabilities. AFS is available for a broad range of heterogeneous systems including UNIX, Linux, MacOS X, and Microsoft Windows
IBM branched the source of the AFS product, and made a copy of the source available for community development and maintenance. They called the release OpenAFS.

Genug Werbung! Mehr Details gibt’s in den anderen Beiträgen zu AFS die man hier so findet.

Wer sich für den Einstieg in diese Materie interessiert, dem sei das Buch “Distributed Services with OpenAFS: For Enterprise and Education” von Wolfgang Gehrke ans Herz gelegt.

1.5.66 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.66 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.66 Windows client is fully compatible with all AFS server versions.

[Quelle: Jeff via openafs-annouce]

Welche Möglichkeiten gibt es denn ein Volume von einem Server auf einen anderen Server zu verschieben, respektive in eine andere Partition auf dem gleichen Server?

OpenAFS bringt hier das vos move-Kommando mit, was eigentlich genau diesen Job erledigt. Sogar die Syntax ist relativ einfach:
vos move data.$foo -fromserver A -frompartition a -toserver B -topartition a

Allerdings scheint das – zumindest in meiner Zelle – nur mit kleinen Volumes zu funktionieren. Bei größeren Volumes bricht vos move mit einer wenig aussagekräftigen Meldung ab:

Failed to move data for the volume 0815
   : No such file or directory
vos move: operation interrupted, cleanup in progress...
clear transaction contexts
move incomplete - attempt cleanup of target partition - no guarantee
cleanup complete - user verify desired result

Ein etwas umständlicher, aber zumindest hier erfolgreicher Weg ist das ganze in drei Schritte aufzusplitten:

1. vos addsite
2. vos convertROtoRW
3. vos remsite

Im ersten Schritt wird auf dem üblichen Weg eine RO-Kopie des Volumes data.$foo erstellt:
vos addsite -server B -partition a -id data.$foo

Nun wird diese RO-Kopie zum RW promoted:
vos convertROtoRW -server B -partition a -id data.$foo

Und letzendlich das alte RW-Volume – nun ja eine RO-Kopie – entfernt:
vos remsite -server A -partition a -id data.$foo

Etwas umständlicher, ja. Aber es funktioniert.

1.5.65 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.65 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.65 Windows client is fully compatible with all AFS server versions.

[Quelle: Jeff via openafs-annouce]

Was bedeutet das nun:
Hier wird nicht der User bzw. Kerberos-Prinzipal mit ACLs versehen, sondern die Quell-IP des anfragenden Systems.

Anstatt

pts createuser JohnDoe
pts adduser JohnDoe Marketing
fs setacl $foo $bar $baz

wird für eine einzelne IP (z.B. einen dedizierten Server für einen Dienst, der sich nicht wirklich kerberisieren lässt)

pts creategroup HardToKerberize
pts createuser 172.23.42.666
pts adduser 172.23.42.666 HardToKerberize
fs setacl $foo $bar $baz

Um die Übersicht zu behalten bietet es sich an, neben exzessiver Dokumentation der eigenen Zelle (ja, das war ein Zaunpfahl), für IPs Gruppen zu erstellen, allein schon weil OpenAFS nicht mit der CIDR-Notation klar kommt.

Und bevor nun jemand ganze IP-Ranges von Hand eintippt:

1
2
3
4
5
6
7
8
9
10
11
12

#!/usr/bin/env python
# encoding: utf-8
 
def main():
  print "pts creategroup LAN-172.31"
  for i in range(0, 256):
    for j in range(0, 256):
      print "pts createuser 172.31." + str(i) + "." + str(j)
      print "pts adduser 172.31." + str(i) + "." + str(j) + " LAN-172.31"
 
if __name__ == '__main__':
	main()

Natürlich – wie immer – erst denken, dann anpassen, dann abtippen, dann ausführen.

11:44 < sur5r> shl: es gibt btw. nen video stream
11:44 < shl> wooh, cool
11:44 < sur5r> link is auf der agenda-seite
11:45 < sur5r> dann im linken formular nen nick eintragen und den butten klicken
11:47 < sur5r> und das is schnell
11:47 < sur5r> wenn man das hier aufruft is das vllt. 0.5 sek hinter echtzeit

Zu finden auf der Agenda-Seite.

1.5.64 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.64 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.64 Windows client is fully compatible with all AFS server versions.

[Quelle: Derrick via openafs-annouce]

1.5.63 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.63 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.63 Windows client is fully compatible with all AFS server versions.

[Quelle: Jeff via openafs-annouce]

Mit dem Update auf OpenAFS 10.5.62 funktioniert der OpenAFS-Client absolut zufriedenstellend. Ich habe vorsorglich zuerst den OpenAFS-Client und danach das Betriebssystem geupdated, aber das sollte relativ egal sein. Was leider nicht funktioniert, ist der AFS-Commander. Hier wird sicherlich recht zeitnah ein Update erscheinen, aber Stand heute: es funktioniert nicht. Schade – aber damit sollte man leben können.

Was mich wirklich trifft, ist die Tatsache, daß Apple ZFS wirklich komplett aus Snow Leopard entfernt hat. Selbst mit tiefem graben findet man keine Überreste, es ist alles weg – so als hätte es in 10.5 nie Support gegeben.

Aber noch eine gute Nachricht: StarCraft läuft immernoch.

• Production Version for Windows
• Test Version for other platforms

1.5.62 is the recommended production-ready release of OpenAFS for Microsoft Windows users. It supports all Microsoft Windows operating systems from Windows 2000 through Windows Vista SP1 and Windows Server 2008 including both 32-bit and 64-bit architectures. The 1.5.62 release continues the recent efforts at optimizing the performance of the Windows client and improving its scalability.

For UNIX, Linux, and MacOS X (including Snow Leopard) the recommended production-ready release of OpenAFS is 1.4.11. The 1.5.62 Windows client is fully compatible with all AFS server versions.

[Quelle: Jeff via openafs-annouce]