Afs - Revision history

DeMarko at 21:42, 17 August 2009

2009-08-17T21:42:37Z

DeMarko at 21:41, 17 August 2009

2009-08-17T21:41:57Z

So0s at 20:40, 5 May 2007

2007-05-05T20:40:30Z

So0s at 20:39, 5 May 2007

2007-05-05T20:39:44Z

Rjmccall: Significant embellishment

2007-04-24T20:53:50Z

Significant embellishment

Ed at 00:06, 24 April 2007

2007-04-24T00:06:57Z

Ed at 00:06, 24 April 2007

2007-04-24T00:06:43Z

Eleather at 22:38, 13 December 2006

2006-12-13T22:38:11Z

New page

Some useful unix commands (because CSW doesn't teach you anything anymore). Please add more!

pwd - 'present working directory', gives you the path to your current directory

@@ Line 1: / Line 1: @@
 The '''A'''ndrew '''F'''ile '''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc.  It is one of the pillars of CMU's Andrew computing environment. Like many things bearing his name, the Andrew File System was developed by a team of Andrews, including the founder of our institution and the city of Pittsburgh: Andrew Carnegie. Largely developed in a decade between the 70s and 80s, AFS was originally used to share merry anecdotes of the adventures and mishaps of a certain Texas Ranger whose name has been stricken from these records. Over time it evolved into a giant monster capable of sustaining itself by consuming undergrads and grad students alike by issuing them 'tickets' (detailed below) in exchange for a small part of their soul.
-Recent developments made possible by [[jboning, hero and blanket of the people]] allow us to now [[rntz]] quite liberally on any given night.
+Recent developments made possible by [[jboning|jboning, hero and blanket of the people]] allow us to now [[rntz]] quite liberally on any given night.
 == Tickets ==

← Older revision		Revision as of 21:41, 17 August 2009
Line 1:		Line 1:
−	The '''A'''ndrew '''F'''ile '''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment.	+	The '''A'''ndrew '''F'''ile '''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment. Like many things bearing his name, the Andrew File System was developed by a team of Andrews, including the founder of our institution and the city of Pittsburgh: Andrew Carnegie. Largely developed in a decade between the 70s and 80s, AFS was originally used to share merry anecdotes of the adventures and mishaps of a certain Texas Ranger whose name has been stricken from these records. Over time it evolved into a giant monster capable of sustaining itself by consuming undergrads and grad students alike by issuing them 'tickets' (detailed below) in exchange for a small part of their soul.
		+
		+	Recent developments made possible by [[jboning, hero and blanket of the people]] allow us to now [[rntz]] quite liberally on any given night.

	== Tickets ==		== Tickets ==

← Older revision		Revision as of 20:40, 5 May 2007
Line 1:		Line 1:
−	The '''A'''ndrew '''F'''ile'''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment.	+	The '''A'''ndrew '''F'''ile '''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment.

	== Tickets ==		== Tickets ==

← Older revision		Revision as of 20:39, 5 May 2007
Line 1:		Line 1:
−	The '''A'''ndrew '''F'''ile'''s'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment.	+	The '''A'''ndrew '''F'''ile'''S'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc. It is one of the pillars of CMU's Andrew computing environment.

	== Tickets ==		== Tickets ==

@@ Line 1: / Line 1: @@
-Some useful unix commands (because CSW doesn't teach you anything anymore).  Please add more!
+The '''A'''ndrew '''F'''ile'''s'''ystem is a networked filesystem implementation developed at CMU and later commercialized by Transarc.  It is one of the pillars of CMU's Andrew computing environment.
-pwd - 'present working directory', gives you the path to your current directory
+Authentication under AFS (in fact, under Andrew more generally) is accomplished using the [[Kerberos]] protocol, which means we have to talk about tickets.  The entire world (not just CMU) is divided into Kerberos ''realms'', which are named in a way which closely tracks DNS.  CMU has (at least) four separate realms:  <tt>andrew.cmu.edu</tt> (the campus-wide Andrew network), <tt>cs.cmu.edu</tt> (SCS), <tt>ece.cmu.edu</tt> (the ECE department), and <tt>club.cc.cmu.edu</tt> (the computer club).  Normally, when you login to a Unix machine, you are just logging in to the local machine;  your account information is stored locally, and successfully logging in accomplishes nothing more than granting access to the local machine.  Most of the public machines on campus, however, use a special login service which authenticates to a particular Kerberos realm (usually Andrew, but school-specific clusters often authenticate to their own realms);  logging in to one of these machines grants you ''tickets'' associated with a particular ''principal'' --- usually, this is <tt>username@realm</tt>.  If you need to switch your principal, or if you need to re-authenticate, or if you're just not on a machine whose login service automatically acquires tickets for you, then you can always login using the <tt>kinit</tt> command.
-fs la <directory> - Lists the access control list for a particular directory
+An AFS filesystem associated with a Kerberos realm is called a ''cell''.  All of the public AFS cells in the world should be mounted in the directory <tt>/afs</tt> under the same name as their associated realm;  sometimes this list needs to be updated.
-ACL options.
+Logging in to a Kerberos realm grants you a ticket-granting ticket;  when you try to connect to most Kerberos-enabled services (e.g. Cyrus), the system attempts to use your ticket-granting tickets to grant you a more specific ticket for that service.  AFS cells, however, can be accessed anonymously, so you will sometimes need to instruct the filesystem to acquire AFS tickets when accessing a particular cell;  this can be done with the <tt>cklog</tt>, <tt>aklog</tt>, or <tt>afslog</tt> command (depending on your local configuration).
-r - read
+AFS is much like a normal Unix filesystem, except:
-l - list (show directory contents)
+== Access Control Lists (ACLs) ==
-i - insert files
+An access control list consists of two sets of (principal, permissions) lists:  a '''normal''' rights section, which grants rights to those principals, and a '''negative''' rights section, which denies those rights.  Negative rights take precedence over normal rights.  Principals may either be users (written <tt>username@cell</tt>, or just abbreviated as <tt>username</tt> in the default cell) or groups (<tt>username:groupname@cell</tt>, or abbreviated as <tt>username:groupname</tt>).  There are two special groups:  <tt>system:authuser</tt> applies to any authenticated user, while <tt>system:anyuser</tt> applies to any user (authenticated or not);  note if a user has been denied access to a file, but the <tt>system:anyuser</tt> group has access to it, the user can simply clear his/her tickets to the cell and gain the denied permission.
-d - delete files
+The <tt>system:administrators</tt> group always has an implicit <tt>a</tt> (administrate) privilege on a directory.  The same applies to a  directory's owner, so if you ever accidentally deny yourself privileges to your own directory, know that you can simply change those privileges back.
-w - write to files
+=== Privileges ===
-k - ?
+;a: administrate this directory by changing the entries of its ACL (implicitly granted to the file's owner and the <tt>system:administrators</tt> group)
-a - administrator (able to set ACLs)
+Privileges can be listed with the <tt>fs la</tt> command and modified with the <tt>fs sa</tt> command.
-To get more help, type fs help.
+In general, you can only add entries to an ACL for principals registered with the cell's protection servers.  It '''is''' possible to register a "foreign" principal with that server, but I don't remember how to do it.

← Older revision		Revision as of 00:06, 24 April 2007
Line 3:		Line 3:

	pwd - 'present working directory', gives you the path to your current directory		pwd - 'present working directory', gives you the path to your current directory
		+
		+	fs la <directory> - Lists the access control list for a particular directory
		+	fs sa <directory> <user> <options> - Sets the access control list for a particular directory
		+
		+	ACL options.
		+	r - read
		+	l - list (show directory contents)
		+	i - insert files
		+	d - delete files
		+	w - write to files
		+	k - ?
		+	a - administrator (able to set ACLs)
		+
		+	To get more help, type fs help.