412013-01-13 17:55:10ClintonEbadicat402013-01-13 17:06:14ClintonEbadithe openafs docs broke all of our beautiful links392011-04-22 23:13:13ClintonEbadiRevert to revision 36.382011-04-22 11:50:21ec2-175-41-141-30.ap-southeast-1.compute.amazonaws.comIn awe of that awsner! Really cool!372011-04-21 17:01:38h54.hostsharing.netFtr6fq <a href="http://rcacgbwlyxno.com/">rcacgbwlyxno</a>362011-04-21 05:56:32ClintonEbadiRevert to revision 34.352011-04-21 05:55:10dopilganger.zinio.com7dBVfG THX that's a great asnwer!342009-12-19 14:01:17AdamChlipalaRemove some more332009-12-19 14:00:23AdamChlipalaGood information, but it doesn't seem to make the cut of things every new member should read right away.322009-12-18 20:56:4893-172-9-115.bb.netvision.net.il312009-07-27 19:43:21anonymizer2.blutmagie.defix link to afs guide302008-07-07 04:28:00localhostconverted to 1.6 markup292008-01-22 01:19:38DavorOcelic282008-01-19 20:13:31AdamChlipalaBilling support272007-12-29 02:47:58AdamChlipalaNo per-file permissions262007-12-16 19:31:17AdamChlipalaNo ssh public keys252007-12-16 18:28:12AdamChlipalaStress token expiration242007-12-15 17:21:23AdamChlipalamembers2 -> members232007-11-15 03:17:50RyanMikulovskynote chmod and chgrp are not used on AFS shares222007-10-31 04:16:53MichaelOlsonDescribe JoinUs link212007-10-28 01:18:13MichaelOlsonSince there aren't steps on the FAQ after all, link to a new page where that info should be added.202007-10-28 01:03:26MichaelOlsonPromote headings192007-10-27 19:09:09AdamChlipalaIt's still confusing.182007-10-27 18:25:48MichaelOlsonMake it more clear that AFS user guide is optional reading172007-10-27 18:24:14MichaelOlsonClarfiy "steps" question re: ProspectiveMemberFaq162007-10-27 17:44:29AdamChlipalaDone with pass through page152007-10-27 17:39:42AdamChlipalaRemove mention of Bugzilla; get there through the portal, which warns about which other pages you might _really_ want142007-10-27 17:20:42AdamChlipalaWhoever wrote this needs a refresher on comma rules. :P132007-10-25 16:24:51MichaelOlson122007-10-25 16:24:20MichaelOlsonLet up-to-date members skip Joining section112007-10-25 15:52:48MichaelOlsonAdd section on joining HCoop102007-10-25 15:33:37MichaelOlsons/RealSecurity/DistributedSecurity/92007-10-25 05:19:03RyanMikulovskymake it clear that Bugzilla is not the right place to lodge support requests for personal computer issues, but only issues caused by the servers.82007-10-25 04:36:07RyanMikulovskyuse bugzilla instead of sysadmin list for reporting denyhosts issues72007-10-25 04:26:39MichaelOlsonDocument denyhosts62007-10-25 04:14:51MichaelOlsonMention RealSecurity52007-10-25 03:59:34MichaelOlsonMore bugzilla42007-10-25 03:56:29MichaelOlsonAdd bugzilla section32007-10-25 03:41:17MichaelOlsonFurther hacking22007-10-25 03:35:12MichaelOlsonDocument AFS and Kerberos12007-10-25 00:04:29MichaelOlsonCopy initial contents hereThis is the chapter of the MemberManual that describes things that new and current members must know about HCoop's setup. It is considered required reading before contacting HCoop administrators or filing support requests.

The pages in this section describe the joining process. If you are an HCoop member who is familiar with the portal and is getting announcement email from us, you may skip this section and move on to the good stuff. Prospective Member FAQ: Learn more about HCoop. Join HCoop: Join HCoop by completing a web form. New member: After your request is approved, you need to complete the joining process by making an account. Account created: After completing the joining process and making an account, you need to read a very quick summary about email forwarding, pledges, and mailing lists. These are the absolute essentials for being an up-to-date member.

HCoop now uses AFS, a distributed filesystem, to implement much of our infrastucture. Home directories and email are stored in AFS. AFS allows for fine-grained access control and the ability to access your files from any machine that has an AFS/Kerberos client (including your local workstation, thus avoiding the need for SSH-ing in). That said, chmod and chgrp are not used at all. Read more to learn what this means. Permissions in AFS are a bit different than standard UNIX file permissions. Basically, the group of a file and the standard read/write/execute permissions do not matter at all. In place of these, there is an access control list (called an ACL) for each directory, which is a listing of a role or person and the permissions that it has. An AFS ACL uses seven types of permissions: r (read), l (lookup), i (insert), d (delete), w (write), k (lock), and a (administer). "Read" and "write" are the same as their UNIX equivalents, and "lookup" is similar to the "execute" permission in UNIX -- it permits the files contained in the directory to be accessed. If you want to learn more about AFS permissions, see the relevant section of the AFS User Guide. When a new directory is created inside $HOME, it receives a clone of the ACL for its parent directory. Every member's home directory starts life initialized with an ACL that allows listing by any authenticated party on HCoop, without granting any other permissions. However, you can change the ACL for your home directory or any of its subdirectories. Just remember that, if you don't take special actions to the contrary, every subdirectory of your home directory will be listable by anyone, and no file will be readable by anyone but you and the HCoop admins. Individual files do not have ACLs; instead, files inherit the ACLs of the directories they are in. This is worth repeating: despite what you may be used to in UNIX, it's impossible to set per-file permissions in AFS. Instead, set permissions on the directories where files are found. This may require thinking about rearranging your directory structure. If you wish to view the ACL of a specific directory, use: ]]>Please continue on to the AFS examples page for some annotated examples on how to set AFS permissions.

SSH access to our system, as well as authentication to anything else at HCoop, is managed by Kerberos. You get a Kerberos ticket automatically whenever you log in. Tickets expire in 10 hours, and can also keep automatically renewing to last you a week. After 7 days since creation, your Kerberos tickets will expire and it will not be able to renew the any more; you'll have to create them anew manually, by providing the password. To see your Kerberos tickets, run klist -5 and to invoke initialization or renewal, run: and type your password. Kerberos and AFS work together. So if your Kerberos ticket expires, so will your "token" for access to AFS. Such an expiration isn't abnormal; you should expect it to happen to SSH sessions less than a day after log-in (after 10 hours, to be specific). That's worth saying again in bold: It's expected that long-running ssh sessions will stop working unless you take special action. To get AFS access back after renewing your Kerberos ticket with kinit, be sure to type At this point, please read the Distributed Security page to understand the consequences that using AFS and Kerberos may have on your HCoop experience. We feel the gains in security to be worth the slight learning curve. More information on automatic token renewal can be found in MemberManual/RunningUnattendedCommands. You mostly just need to run the k5start program with the proper arguments. This section of this page could probably stand to be improved, as its topic is a common source of confusion. Also note that ssh public key authentication won't work as you might expect on our servers. You can log in just fine, but you won't have any AFS tokens. You can still grab them manually with kinit and aklog, but this won't work so well with non-interactive users of ssh like scp. You can do passwordless login with the -K flag to ssh, which enables Kerberos authentication. See MemberManual/ShellAccess for more information.

To manage all aspects of the Internet domains that our members own, we use a software suite called Domtool that we developed and maintain. Domtool allows us to easily share services among our members and enforce standards of correctness and security on configuration provided by members. Domtool facilitates DNS, email, and web serving, provided that you have a domain. You may perhaps be familiar with Domtool version 1, which was used on our old setup. What we currently use is Domtool version 2, which is a complete rewrite. The syntax for these files has changed dramatically, in favor of more uniform syntax and semantics. A major benefit to this new format is that you only have to edit one file per domain, rather than an entire directory. Please consult the Domtool User Guide at this point, so you can get an idea of what Domtool configuration files look like. When you are ready to set up your domain, the Domtool examples page should prove helpful.

Our web portal at is where you will go to manage your account balance, request new domains, request Debian packages to be installed on our systems, and view various statistics about your website. You can log into the portal with the same username and password that you use to ssh to our machines.

Whenever you have any problem using your HCoop account, first ask yourself this question: Is this problem specific to HCoop, or is the answer probably general knowledge among people familiar with Linux and the Internet? If your problem falls into the "general knowledge" category, feel free to ask about it on our hcoop-misc mailing list or in our IrcChannel. However, we don't consider our admins to hold any responsibility for answering this sort of question. If you have a genuine HCoop-specific problem, you should poke around this wiki some first to see if the solution is already documented. You might also try our IrcChannel, if you aren't sure that a solution requires admin intervention. If neither of these approaches helps, then visit the support page on the portal, which will direct you to the proper place to report your issue. Please never e-mail any of our admins directly about any problem. The support page leads you to several automated systems that help us manage workflow much better than we can with ad-hoc e-mail. Only in the event that some of our web-based support machinery is unavailable should you use e-mail, and then you should e-mail all admins at once at admins@hcoop.net . You will often find admins in our IrcChannel, but they are under no obligation to provide any support there, as managing support tickets through IRC is close to impossible. It's worth stating explicitly that the support policy is no different for billing issues and other social administrative concerns. The same support page is the right place to start to report this kind of problem, and you will probably end up following the link to report a Bugzilla bug. Please use the "Financial" Bugzilla component for billing inquiries.

We use the DenyHosts package to help protect your account from brute-force SSH attacks. If someone fails to log in as a particular user several times in a row, the original IP address will be blacklisted in order to prevent additional attempts within a certain time period. If this happens to you and you try to log in again, you will see something similar to this: The blacklist expires IPs after a predetermined period of time. Typically, most users will not be affected by the blacklisting, but if you are, you will want to file a report. CategoryMemberManual