All,
We are finally in a position to consider making some changes (very soon
now) to our Mosaic Computing OpenAFS setup here in the College of
Engineering at UNC Charlotte. As some of you may already know, I've been
working with OpenAFS and Kerberos 5 for quite some time so some of the
questions I'm asking below are just for verification that I understand the
whole process as well as to get some "don't forget this" answers from
others. Over time, my memory of some of the issues "degrades" (I hate
getting old).
1. We need to upgrade our file servers, and cell servers to 1.4xx (version
we use will be determined by what is available at the time we make the
changes) We are currently at 1.2.13.
For issue 1, we've been running a test file server on 1.4.0 for a while
without issues and we are prepared to upgrade the file servers
already. Does it matter whether the cell servers are upgraded
first? Obviously not, since our existing test server already works. I've
never upgraded a cell server myself, and the person who last upgraded our
cell servers has "left the building". Our current back-end systems guy
just wanted some indication about the sequence of events in which things
should take place. Because of issues with the UBIK quorum, if no accounts,
or volumes are being added, removed, or replicated during an upgrade, is
the sequence of cell server upgrades important? I mean our cell is fairly
small so can we just upgrade each one without worry right?
2. We need to shut down an older cell server and bring up a new one in
another building.
For issue 2, we have set the vlserver prefs on each client so that the
clients won't select the cell server we want to move to another building
(or it will be last in the pref list). Can we just shut down the old cell
server and bring up another (in another building) without much worry about
UBIK issues? This is somewhat similar to issue 1.
3. We'd like to turn off the old KAS from Transarc and rely totally on
Kerb 5 (finally). We are already using Kerb 5 everywhere and none of our
AFS clients use KAS anymore, but we've never actually disabled it.
For issue 3, we are currently already using Kerb5 with AKLOG basically
everywhere, and most of the PAM modules we have work with the exception of
the xscreensaver. We were wondering what others did about xlock and
getting tokens at unlock since the PAM module for the xlock process doesn't
seem to use the KRB5CCNAME variable. Eg, a new ticket cache is created
every time you unlock the workstation...why?
4. We'd like to try real K5 AFS service tickets without using the 5 to 4
daemon.
For issue 4, I am under the impression (from my conversation at the last
BPW) that we can disable our 5 to 4 daemon that AKLOG uses and AKLOG will
just take the K5 encrypted part and just stuff it into the AFS cred
manager. The only thing we need to do is update our key files on the file
servers right? Can AKLOG do what it needs to do without having access to a
5 to 4 daemon?
Thanks,
Rodney
Rodney M. Dyer
Windows Systems Programmer
Mosaic Computing Group
William States Lee College of Engineering
University of North Carolina at Charlotte
Email: [EMAIL PROTECTED]
Web: http://www.coe.uncc.edu/~rmdyer
Phone: (704)687-3518
Help Desk Line: (704)687-3150
FAX: (704)687-2352
Office: Cameron Applied Research Center, Room 232
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
