Research and Development Network

h1. How To Add Users to the Kerberos/AFS Servers

The steps in this guide should work on any machine with properly setup Kerberos and AFS clients: [[AFS_Clients]]

It is also possible to ssh login to gryla.dev.objid.net and do everything there.

h2. Add a Kerberos principal for the new user

* guide: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-adduser-ticket

# use the kerberos administration tool (for admin password see [[Kerberos]]):

<pre>

$ kadmin -p root/admin

Authenticating as principal root/admin with password.

Password for root/admin@DEV.RU.IS: 

kadmin:

</pre>

# add new user principle <pre>addprinc -policy user <USERNAME></pre>

# log off <pre>quit</pre>

h2. Use the newuser-batch.sh script

In the devnet project under Machines/AFSCELL1 there is a script called newuser-batch.sh.  This takes care of most of the AFS creation opetations.

It still needs some work to be robust.

h2. Add user to AFS and create a home directory

* guide: http://techpubs.spinlocksolutions.com/dklar/afs.html#afs-install-client

# get AFS admin privileges (see [[Kerberos]] for admin password): <pre>$ kinit root/admin; aklog</pre>

# check if you have the token:

<pre>

$ tokens 

Tokens held by the Cache Manager:

User's (AFS ID 1) tokens for afs@dev.ru.is [Expires Mar 31 01:16]

   --End of list--

</pre>

# create AFS user (*use the same user id!*)

<pre>$ pts createuser <USERNAME></pre>

# create a volume for the user (20000 is the quota in kB)

<pre>$ vos create gryla.dev.objid.net a user.<USERNAME> 20000</pre>

# check with

<pre>vos examine user.USERNAME</pre>

# mount the volume to a proper location

** we will use the hashed schema with <DIR>=<FIRSTLETTER>/<FIRSTLETTER><SECONDLETTER>, where <FIRSTLETTER> and <SECONDLETTER> are the first and second letter of the user id

<pre>

$ cd /afs/dev.ru.is/user

$ mkdir -p <DIR>

$ fs mkm <DIR>/<USERNAME> user.<USERNAME> -rw

</pre>

# set permissions to allow the user full access

<pre>

$ fs sa <DIR>/<USERNAME> <USERNAME> all

</pre>

# check permissions

<pre>

$ fs la <DIR>/<USERNAME>

Access list for <DIR>/<USERNAME> is

Normal rights:

  system:administrators rlidwka

  <USERNAME> rlidwka

</pre>

# check if it works (switch from admin to <USERNAME> and try to create and read a file)

<pre>

$ unlog; kdestroy

$ kinit <USERNAME>; aklog

Password for <USERNAME>@DEV.RU.IS: 

$ cd /afs/dev.ru.is/user/<DIR>/<USERNAME>

$ echo IT WORKS > test

$ cat test

IT WORKS

$ rm test

</pre>