Instantly share code, notes, and snippets.

Embed
What would you like to do?
Install and configure CERN OpenAFS on Fedora 20/21/22 Centos 7/7.1 and RHEL
**********************************************************************************************************
  BUGS, COMMENTS, SUGGESTIONS, PLEASE OPEN AN ISSUE --> https://github.com/danifr/miscellaneous/issues
**********************************************************************************************************

I wrote a small script to automate all this process, you can find it here: https://github.com/danifr/miscellaneous/blob/devel/CERN_OpenAFS/openafs_update.sh


Install and configure CERN OpenAFS on Fedora 20/21/22 Centos 7/7.1 and RHEL

Prerequisites

Please notice that to avoid any kind of issue, you should execute the following commands as root.

  • su -

Installing Dependencies

  • yum install rpm-build bison flex kernel-devel kernel-devel-x86_64 krb5-devel ncurses-devel pam-devel perl-ExtUtils-Embed perl-devel

  • yum groupinstall 'Development Tools'

Installing & configuring Kerberos + OpenAFS

Kerberos Client

Installation

  • yum install krb5-workstation

Configuration

  • wget http://linux.web.cern.ch/linux/docs/krb5.conf -O /etc/krb5.conf

OpenAFS Client

Installation

Go to the OpenAfs official website and download the latest 'src.rpm' package.

  • wget https://www.openafs.org/dl/openafs/1.6.11.1/openafs-1.6.11.1-1.src.rpm

Once downloaded:

  • rpmbuild --rebuild openafs-1.6.11.1-1.src.rpm

Depending on your hardware this step might take a long time. Sit back and relax :)

...

At this point we will basically need to install ALL the generated packages except openafs-kpasswd (because of conflicts issues with krb5-workstation) and openafs-server (not needed):

  • cd ~/rpmbuild/RPMS/x86_64/

  • yum install dkms-openafs-1.6.11.1-1.fc22.x86_64.rpm kmod-openafs-1.6.11.1-1.4.0.4_301.fc22.x86_64.rpm openafs-1.6.11.1-1.fc22.x86_64.rpm openafs-authlibs-1.6.11.1-1.fc22.x86_64.rpm openafs-authlibs-devel-1.6.11.1-1.fc22.x86_64.rpm openafs-client-1.6.11.1-1.fc22.x86_64.rpm openafs-compat-1.6.11.1-1.fc22.x86_64.rpm openafs-debuginfo-1.6.11.1-1.fc22.x86_64.rpm openafs-devel-1.6.11.1-1.fc22.x86_64.rpm openafs-docs-1.6.11.1-1.fc22.x86_64.rpm openafs-kernel-source-1.6.11.1-1.fc22.x86_64.rpm openafs-krb5-1.6.11.1-1.fc22.x86_64.rpm

Configuration

Edit '/usr/vice/etc/ThisCell'...

  • echo "cern.ch" > /usr/vice/etc/ThisCell

... and add the following lines to '/etc/krb5.conf':

[realms]
  CERN.CH = {
    default_domain = cern.ch
    kpasswd_server = afskrb5m.cern.ch
    admin_server = afskrb5m.cern.ch
    kdc = afsdb1.cern.ch        # ADD THIS LINE
    kdc = afsdb2.cern.ch        # ADD THIS LINE
    kdc = afsdb3.cern.ch        # ADD THIS LINE
  }

[domain_realm]
  cern.ch = CERN.CH             # ADD THIS LINE
  .cern.ch = CERN.CH

Finally, start and enable the service.

  • systemctl start openafs-client.service

  • systemctl enable openafs-client.service

Usage

To start using it, you will need valid kerberos ticket:

  • kinit <username>@CERN.CH

And also mount the afs share on the our system:

  • aklog

After doing it, you will be able to access your personal share from:

/afs/cern.ch/user/<first_letter_username>/<username>

@piotrskowronski

This comment has been minimized.

Copy link

piotrskowronski commented Jan 25, 2016

Hi,

Just tried on FC22. rpm rebuilt ended with this error

CC [M] /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.o
In file included from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/sysincludes.h:131:0,
from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/rx/rx_kcommon.h:156,
from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.c:20:
include/linux/backing-dev.h:25:3: warning: 'printk' is an unrecognized format function type [-Wformat=]
const char *fmt, ...);
^
In file included from /root/rpmbuild/BUILD/openafs-1.6.11.1/src/libafs/MODLOAD-4.2.8-200.fc22.x86_64-SP/rx_kmutex.c:24:0:
/root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/LINUX/osi_compat.h: In function 'do_sync_read':
/root/rpmbuild/BUILD/openafs-1.6.11.1/src/afs/LINUX/osi_compat.h:53:12: error: implicit declaration of function 'generic_file_read' [-Werror=implicit-function-declaration]
return generic_file_read(fp, buf, count, offp);

@danifr

This comment has been minimized.

Copy link
Owner Author

danifr commented Jun 4, 2016

Sorry for the late response, I just saw your message o_O :/

I think this error was caused because your kernel version (4.2.8) was not supported by the version of openafs you were trying to compile (v1.6.11.1)

You should have picked a newer version from https://www.openafs.org/release/index.html

Anyway, as today (Jun 2016) the latest version of openafs only supports up to kernel 4.4...

@dcsouthwick

This comment has been minimized.

Copy link

dcsouthwick commented Jun 14, 2016

Yep - tried with latest public release (1.6.18) on fc23 since fc24 is scheduled for release in a few days - does not pass the recompile against 4.5.6-200.fc23

error: unknown field 'follow_link' specified in initializer
error: unknown field 'put_link' specified in initializer
error: implicit declaration of function 'nd_set_link'
make[6] leaving /usr/src/kernels/4.5.6.-200.fc23.x86_64 FAILURE: make exit code 2

Hmm any advice for those of us that want to try with 4.5.x kernel, or the 4.6x kernel next week?

@eparadas

This comment has been minimized.

Copy link

eparadas commented Jun 23, 2016

Instructions are working fine on Fedora 23.
Just a small addition for the aklog command. In my case I had to do:
aklog -c cern.ch -k CERN.CH

Thanks!

@dcsouthwick

This comment has been minimized.

Copy link

dcsouthwick commented Jul 5, 2016

Looks like they just added support for 4.5.x kernel! Hopefully they will continue on this pace and add support for 4.6.x kernel that fc24 supports.
@eparadas - I tried explicitly declaring the cell / krb_realm but it still returns Using Kerberos V5 ticket natively. Identical tokens already exist; skipping.

afs so far works as expected with 4.5.x

sidenote: kernel 4.5.5.fc24 cannot install openafs-kpasswd alongside krb5-workstation

@danifr

This comment has been minimized.

Copy link
Owner Author

danifr commented Jul 26, 2016

Hi all @dcsouthwick, @eparadas, @piotrskowronski,

sorry, I don't get any notification when new comments are posted here...

I've created this script (https://github.com/danifr/miscellaneous/blob/devel/CERN_OpenAFS/openafs_update.sh) to automate the building and installation process of the newer versions of openAFS.
I tested it on several machines (Fedora 22, Fedora 23 and Fedora 24) and it works great.

I'm very happy with it and I think more people can benefit from it.
Feedback would be highly appreciated!!

@dinojugosloven

This comment has been minimized.

Copy link

dinojugosloven commented Sep 7, 2016

This is not working on CentOS 7.2 .
It seems that the fields in krb5.conf file should not be changed.
` CERN.CH = {
default_domain = cern.ch
kpasswd_server = cerndc.cern.ch
admin_server = cerndc.cern.ch
kdc = cerndc.cern.ch

v4_name_convert = {
host = {
rcmd = host
}
}
}`

@danifr

This comment has been minimized.

Copy link
Owner Author

danifr commented Sep 22, 2016

Hi @dinojugosloven

This is not working on CentOS 7.2

I updated the script (https://github.com/danifr/miscellaneous/blob/devel/CERN_OpenAFS/openafs_update.sh), tried it, and it works like a charm. Now both Fedora (23,24) and CentOS (7.1 / 7.2) are supported.

Check it out and let me know!

@dinojugosloven

This comment has been minimized.

Copy link

dinojugosloven commented Dec 2, 2016

Hi Dani,

I confirm that the downloading and installation of OpenAFS with your script works on CENTOS 7.3 out-of-the box. Thank you very much for this!
Dino

@Pigueiras

This comment has been minimized.

Copy link

Pigueiras commented Dec 21, 2016

@danifr we love you (L)

@flg

This comment has been minimized.

Copy link

flg commented Apr 11, 2017

Successfully installed Openafs 1.6.18.2-1 with kernel 4.4.60-1 (from elrepo) on CentOS 7. Thank you for this, quite useful.

@abunimeh

This comment has been minimized.

Copy link

abunimeh commented Sep 27, 2017

On Fedora 26 and CentOS 7 Epel, after installing krb5, do

# dnf copr enable jsbillings/openafs 
# dnf install openafs openafs-client openafs-krb5

enjoy

@stealex

This comment has been minimized.

Copy link

stealex commented Dec 21, 2017

Hello! I have tried this by hand and by using your script on CentOS 7.3 and it only works inside a CERN network. When outside CERN I receive :
$ kinit <myname>@CERN.CH
kinit: Cannot contact any KDC for realm
Has anyone encountered this? Is it a network problem? Thank you in advance

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment