welcome: please sign in

Diff for "MemberManual/GettingStarted/AfsExamples"

Differences between revisions 9 and 24 (spanning 15 versions)
⇤ ← Revision 9 as of 2007-11-13 15:08:33 →
Size: 2291
Editor: MichaelOlson
Comment: Use bold when describing variables
← Revision 24 as of 2013-01-13 17:56:00 → ⇥
Size: 3049
Editor: ClintonEbadi
Comment: cat
Deletions are marked like this. Additions are marked like this.
Line 2: Line 2:
Line 5: Line 4:
[[TableOfContents]] <<TableOfContents>>
Line 8: Line 7:
Line 12: Line 10:
Line 19: Line 16:
And then use ~/private/ for your personal data store.
Line 20: Line 18:
Note that the {{{-clear}}} option causes any previously set ACLs to be removed.  The '''<USERNAME> all''' part sets full access to the directory's contents to the specified user.  Therefore, if you have a directory (indicated by '''<DIRECTORY>''') in your home directory that you wish to make only accessible to you (such as {{{~/.ssh}}} or {{{~/documents}}}), use: Note that the {{{-clear}}} option causes any previously set ACLs to be removed. The '''<USERNAME> all''' part sets full access to the directory's contents to the specified user. Therefore, if you have a directory (indicated by '''<DIRECTORY>''') in your home directory that you wish to make only accessible to you (such as {{{~/.ssh}}} or {{{~/documents}}}), use:
Line 25: Line 23:

You may also recursively set ACLs throughout a tree by using '''fsr'''.  It takes the same commands as '''fs'''.		 You may also recursively set ACLs throughout a tree by using '''fsr'''. It takes the same commands as '''fs'''.
Line 29: Line 26:

If you use domtool to set up your domain, there is a way to allow {{{system:anyuser}}} only to list the contents of public_html without breaking your website(s).  By default ACLs '''R''' and '''L''' are given.  Change that in this way: 		 If you use domtool to set up your domain, there is a way to allow {{{system:anyuser}}} only to list the contents of public_html without breaking your website(s). By default ACLs '''R''' and '''L''' are given. Change that in this way:
Line 35: Line 31:

Now, add all permissions for the ''USER.daemon'' principle:		 Now, add all permissions for the ''USERNAME.daemon'' principal:
Line 39: Line 34:
fs setacl ~/public_html <USERNAME>.daemon all fs setacl ~/public_html <USERNAME>.daemon read
Line 41: Line 36:

Be aware that this only works if you use your own domain -- if you use {{{http://deleuze.hcoop.net/~USERNAME}}} to serve your files, then you '''must''' be sure that {{{system:anyuser}}} can read {{{~/public_html}}} and its subdirectories.		 Be aware that this only works if you use your own domain -- if you use {{{http://hcoop.net/~USERNAME}}}/ to serve your files, then you '''must''' be sure that {{{system:anyuser}}} can read {{{~/public_html}}} and its subdirectories (have permission "rl" and not just "l").
Line 45: Line 39:
First, check to see what the permissions are like on the {{{~/.domtool}}} directory:

{{{
fs listacl ~/.domtool
}}}
If you see the line '''system:anyuser rl''', then you are good to go, because any user can read your DomTool settings.

Otherwise, if you see the line '''domtool rl''', then you are also OK. If you don't see these ACL lines, then you will want to run the following command to give the Domtool user read permissions on your {{{~/.domtool}}} directory.
Line 48: Line 50:
fs setacl ~/.domtool domtool.deleuze read
Line 50: Line 51:
Line 52: Line 52:

If you are encountering weird problems, then it is possible that your Kerberos tokens have expired.  One simple way of checking this is to run:		 If you are encountering weird problems, then it is possible that your Kerberos tokens have expired. One simple way of checking this is to run:
Line 58: Line 57:

If it returns without displaying any messages to the screen, you still have valid tokens.  If it displays an error, when you will need to authenticate to both Kerberos and AFS again by doing:		 If it returns without displaying any messages to the screen, you still have valid tokens. If it displays an error, when you will need to authenticate to both Kerberos and AFS again by doing:
Line 65: Line 63:

= Recursive Assignment =

The `fs` command doesn't support recursive assignment. Instead, use `fsr` for that effect. For instance, `fsr sa DIR user all` grants all rights to `user` in every subdirectory (at any depth) of `DIR`.
----
CategoryMemberManual

This page contains some examples on how to solve common problems with AFS.

Contents

  1. Introduction
  2. Making a directory private
  3. Serving a website with added privacy
  4. Setting the rights permissions on your ~/.domtool directory
  5. Checking to see whether your tokens have expired
  6. Recursive Assignment

Introduction

In these examples, <USERNAME> is your HCoop username.

Making a directory private

If you wish to make a directory within your $HOME completely private so that only you can list, read, and write, do this: 

mkdir ~/private
fs setacl -clear ~/private <USERNAME> all

And then use ~/private/ for your personal data store.

Note that the -clear option causes any previously set ACLs to be removed. The <USERNAME> all part sets full access to the directory's contents to the specified user. Therefore, if you have a directory (indicated by <DIRECTORY>) in your home directory that you wish to make only accessible to you (such as ~/.ssh or ~/documents), use: 

fs setacl -clear ~/<DIRECTORY> <USERNAME> all

You may also recursively set ACLs throughout a tree by using fsr. It takes the same commands as fs.

Serving a website with added privacy

If you use domtool to set up your domain, there is a way to allow system:anyuser only to list the contents of public_html without breaking your website(s). By default ACLs R and L are given. Change that in this way: 

fs setacl ~/public_html system:anyuser l

Now, add all permissions for the USERNAME.daemon principal: 

fs setacl ~/public_html <USERNAME>.daemon read

Be aware that this only works if you use your own domain -- if you use http://hcoop.net/~USERNAME/ to serve your files, then you must be sure that system:anyuser can read ~/public_html and its subdirectories (have permission "rl" and not just "l").

Setting the rights permissions on your ~/.domtool directory

First, check to see what the permissions are like on the ~/.domtool directory: 

fs listacl ~/.domtool

If you see the line system:anyuser rl, then you are good to go, because any user can read your DomTool settings.

Otherwise, if you see the line domtool rl, then you are also OK. If you don't see these ACL lines, then you will want to run the following command to give the Domtool user read permissions on your ~/.domtool directory. 

fs setacl ~/.domtool domtool read

Checking to see whether your tokens have expired

If you are encountering weird problems, then it is possible that your Kerberos tokens have expired. One simple way of checking this is to run: 

aklog

If it returns without displaying any messages to the screen, you still have valid tokens. If it displays an error, when you will need to authenticate to both Kerberos and AFS again by doing: 

kinit
aklog

Recursive Assignment

The fs command doesn't support recursive assignment. Instead, use fsr for that effect. For instance, fsr sa DIR user all grants all rights to user in every subdirectory (at any depth) of DIR.

CategoryMemberManual

MemberManual/GettingStarted/AfsExamples (last edited 2013-01-13 17:56:00 by ClintonEbadi)