Skip to content

Instantly share code, notes, and snippets.

@danifr

danifr/CERN_OpenAFS.md

Last active September 9, 2020 21:52
Show Gist options
  • Save danifr/773d7b049454390d1e51 to your computer and use it in GitHub Desktop.
Save danifr/773d7b049454390d1e51 to your computer and use it in GitHub Desktop.
Download ZIP
Install and configure CERN OpenAFS on Fedora 20/21/22 Centos 7/7.1 and RHEL
Raw
CERN_OpenAFS.md

Before you start...

I wrote a small script to automate all this process.

Also...

**********************************************************************************************************
  BUGS, COMMENTS, SUGGESTIONS, PLEASE OPEN AN ISSUE --> https://github.com/danifr/miscellaneous/issues
**********************************************************************************************************

Install and configure CERN OpenAFS on Fedora 20/21/22../30 Centos 7/7.X and RHEL

Prerequisites

Please notice that to avoid any kind of issue, you should execute the following commands as root.

  • su -

Installing Dependencies

  • yum install rpm-build bison flex kernel-devel kernel-devel-x86_64 krb5-devel ncurses-devel pam-devel perl-ExtUtils-Embed perl-devel swig

  • yum groupinstall 'Development Tools'

Installing & configuring Kerberos + OpenAFS

Kerberos Client

Installation

  • yum install krb5-workstation

Configuration

  • wget http://linux.web.cern.ch/linux/docs/krb5.conf -O /etc/krb5.conf

OpenAFS Client

Installation

Go to the OpenAfs official website and download the latest 'src.rpm' package.

  • wget https://www.openafs.org/dl/openafs/1.6.11.1/openafs-1.6.11.1-1.src.rpm

Once downloaded:

  • rpmbuild --rebuild openafs-1.6.11.1-1.src.rpm

Depending on your hardware this step might take a long time. Sit back and relax :)

...

At this point we will basically need to install ALL the generated packages except openafs-kpasswd (because of conflicts issues with krb5-workstation) and openafs-server (not needed):

  • cd ~/rpmbuild/RPMS/x86_64/

  • yum install dkms-openafs-1.6.11.1-1.fc22.x86_64.rpm kmod-openafs-1.6.11.1-1.4.0.4_301.fc22.x86_64.rpm openafs-1.6.11.1-1.fc22.x86_64.rpm openafs-authlibs-1.6.11.1-1.fc22.x86_64.rpm openafs-authlibs-devel-1.6.11.1-1.fc22.x86_64.rpm openafs-client-1.6.11.1-1.fc22.x86_64.rpm openafs-compat-1.6.11.1-1.fc22.x86_64.rpm openafs-debuginfo-1.6.11.1-1.fc22.x86_64.rpm openafs-devel-1.6.11.1-1.fc22.x86_64.rpm openafs-docs-1.6.11.1-1.fc22.x86_64.rpm openafs-kernel-source-1.6.11.1-1.fc22.x86_64.rpm openafs-krb5-1.6.11.1-1.fc22.x86_64.rpm

Configuration

Edit '/usr/vice/etc/ThisCell'...

  • echo "cern.ch" > /usr/vice/etc/ThisCell

... and add the following lines to '/etc/krb5.conf':

[realms]
  CERN.CH = {
    default_domain = cern.ch
    kpasswd_server = afskrb5m.cern.ch
    admin_server = afskrb5m.cern.ch
    kdc = afsdb1.cern.ch        # ADD THIS LINE
    kdc = afsdb2.cern.ch        # ADD THIS LINE
    kdc = afsdb3.cern.ch        # ADD THIS LINE
  }

[domain_realm]
  cern.ch = CERN.CH             # ADD THIS LINE
  .cern.ch = CERN.CH

Finally, start and enable the service.

  • systemctl start openafs-client.service

  • systemctl enable openafs-client.service

Usage

To start using it, you will need valid kerberos ticket:

  • kinit <username>@CERN.CH

And also mount the afs share on the our system:

  • aklog

After doing it, you will be able to access your personal share from:

/afs/cern.ch/user/<first_letter_username>/<username>

@piotrskowronski
Copy link

Hi,

Just tried on FC22. rpm rebuilt ended with this error

CC [M] /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.o
In file included from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/sysincludes.h:131:0,
from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/rx/rx_kcommon.h:156,
from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.c:20:
include/linux/backing-dev.h:25:3: warning: 'printk' is an unrecognized format function type [-Wformat=]
const char *fmt, ...);
^
In file included from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.c:24:0:
/root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/LINUX/osi_compat.h: In function 'do_sync_read':
/root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/LINUX/osi_compat.h:53:12: error: implicit declaration of function 'generic_file_read' [-Werror=implicit-function-declaration]
return generic_file_read(fp, buf, count, offp);

@danifr
Copy link
Author

danifr commented Jun 4, 2016

Sorry for the late response, I just saw your message o_O :/

I think this error was caused because your kernel version (4.2.8) was not supported by the version of openafs you were trying to compile (v1.6.11.1)

You should have picked a newer version from https://www.openafs.org/release/index.html

Anyway, as today (Jun 2016) the latest version of openafs only supports up to kernel 4.4...

@dcsouthwick
Copy link

dcsouthwick commented Jun 14, 2016 •
edited
Loading

Yep - tried with latest public release (1.6.18) on fc23 since fc24 is scheduled for release in a few days - does not pass the recompile against 4.5.6-200.fc23

error: unknown field 'follow_link' specified in initializer
error: unknown field 'put_link' specified in initializer
error: implicit declaration of function 'nd_set_link'
make[6] leaving /usr/src/kernels/4.5.6.-200.fc23.x86_64 FAILURE: make exit code 2

Hmm any advice for those of us that want to try with 4.5.x kernel, or the 4.6x kernel next week?

@eparadas
Copy link

eparadas commented Jun 23, 2016 •
edited
Loading

Instructions are working fine on Fedora 23.
Just a small addition for the aklog command. In my case I had to do:
aklog -c cern.ch -k CERN.CH

Thanks!

@dcsouthwick
Copy link

dcsouthwick commented Jul 5, 2016 •
edited
Loading

Looks like they just added support for 4.5.x kernel! Hopefully they will continue on this pace and add support for 4.6.x kernel that fc24 supports.
@eparadas - I tried explicitly declaring the cell / krb_realm but it still returns Using Kerberos V5 ticket natively. Identical tokens already exist; skipping.

afs so far works as expected with 4.5.x

sidenote: kernel 4.5.5.fc24 cannot install openafs-kpasswd alongside krb5-workstation

@danifr
Copy link
Author

danifr commented Jul 26, 2016 •
edited
Loading

Hi all @dcsouthwick, @eparadas, @piotrskowronski,

sorry, I don't get any notification when new comments are posted here...

I've created this script (https://github.com/danifr/miscellaneous/blob/devel/CERN_OpenAFS/openafs_update.sh) to automate the building and installation process of the newer versions of openAFS.
I tested it on several machines (Fedora 22, Fedora 23 and Fedora 24) and it works great.

I'm very happy with it and I think more people can benefit from it.
Feedback would be highly appreciated!!

@dinojugosloven
Copy link

dinojugosloven commented Sep 7, 2016 •
edited
Loading

This is not working on CentOS 7.2 .
It seems that the fields in krb5.conf file should not be changed.
` CERN.CH = {
default_domain = cern.ch
kpasswd_server = cerndc.cern.ch
admin_server = cerndc.cern.ch
kdc = cerndc.cern.ch

v4_name_convert = {
host = {
rcmd = host
}
}
}`

@danifr
Copy link
Author

danifr commented Sep 22, 2016

Hi @dinojugosloven

This is not working on CentOS 7.2

I updated the script (https://github.com/danifr/miscellaneous/blob/devel/CERN_OpenAFS/openafs_update.sh), tried it, and it works like a charm. Now both Fedora (23,24) and CentOS (7.1 / 7.2) are supported.

Check it out and let me know!

@dinojugosloven
Copy link

Hi Dani,

I confirm that the downloading and installation of OpenAFS with your script works on CENTOS 7.3 out-of-the box. Thank you very much for this!
Dino

@Pigueiras
Copy link

@danifr we love you (L)

@flg
Copy link

flg commented Apr 11, 2017

Successfully installed Openafs 1.6.18.2-1 with kernel 4.4.60-1 (from elrepo) on CentOS 7. Thank you for this, quite useful.

@abunimeh
Copy link

abunimeh commented Sep 27, 2017 •
edited
Loading

On Fedora 26 and CentOS 7 Epel, after installing krb5, do

# dnf copr enable jsbillings/openafs 
# dnf install openafs openafs-client openafs-krb5

enjoy

@stealex
Copy link

stealex commented Dec 21, 2017

Hello! I have tried this by hand and by using your script on CentOS 7.3 and it only works inside a CERN network. When outside CERN I receive :
$ kinit <myname>@CERN.CH
kinit: Cannot contact any KDC for realm
Has anyone encountered this? Is it a network problem? Thank you in advance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment