Thanks to everyone who responded. I thoroughly appreciate it.
To clarify a few points...
1. We currently have three cell servers. We are shutting down one of the
cell servers and moving it (creating a new one) to/in another building
under a new name and IP. I believe the process outlined by Jeffrey
Hutzelman and Marcus Watts should be sufficient for this change. Thanks.
2. I'm curious as to why no one responded to the problem with xlock and
xscreensavers relating to PAM, K5 tickets, and tokens. Is this some kind
of state secret, or are we the only ones with the problem? To summarize
again...
On Linux the xscreensaver runs as the user but appears to be started
by init. When the screen is locked, then unlocked, the PAM module
generates a new Kerberos 5 ticket, but doesn't use the correct ticket
cache. It seems to always create a new ticket cache. Curious as to why
this was happening, we killed xscreensaver and set the KRB5CCNAME variable,
then restarted xscreensaver thinking it would then use the correct
KRB5CCNAME, but again, it generated a new ticket cache. At this point
xlock and screensaver is just broken. Note: I'm a Windows guy, so I'm
getting all this from our Linux sysadmin.
3. At least one of you suggested that version 1.4.xx (pre-rc10) has
problems and that we should not use it on the cell servers, or for that
matter the file servers either. Here I must say that we are in no good
mood to use any "betas" or "release candidates". If I had emailed my
questions a few weeks later, someone may have responded that pre-rc44
(sarcasm) might have problems too. It sounds to me like we should just
stay with 1.2.13 for the immediate future. Does anyone have any words on
when "the" true production copy of OpenAFS beyond 1.2.13 will see the light
of day?
4. I gather from the responses that we need a "special" AKLOG to remove
the need for the 5 to 4 daemon in a pure K5 environment. I'm unsure what
is meant here by "special". I mean the OpenAFS Windows client ships with
AKLOG. Is it special? Is the Linux version "special"? This is cause for
concern, and leads me to believe that getting rid of the 5 to 4 service is
literally never going to happen, so using pure K5 tickets is just more or
less techno-fluff experimentation for now. The issues seem to be...
a. We need a special AKLOG. Ok, is there one for
Windows? Linux? Solaris?, OSX?, etc?
b. Do all the PAMs for various OSs support this "special"
feature? Or do the PAMs just system out to an existing AKLOG?
Thanks again,
Rodney
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
