kAFS Client

The kafs-client package provides the following features:

• systemd integration:
  • Automatic loading of the client configuration, including @sys and @cell.
  • Automatic loading of the cellservdb to fill out the list of cells in the dynamic root.
  • Automatic mounting on /afs.
• AFS DNS upcall handling, drawing on multiple sources:
  • SRV records.
  • AFSDB records.
  • Static cellservdb configuration.
  Both IPv4 and IPv6 are supported. This requires keyutils-1.6 or better.
• Authentication/log-on support:
  • aklog-kafs.
  • In the future, it will provide PAM integration too.

The sources can be found in a git repository here.

Two systemd unit files are provided. The first, kafs-config.service loads the configuration into the kernel. This is a one-shot service normally executed as a dependency of the second unit. The second unit, afs.mount mounts a dynamic root onto /afs. This starts off inactive, but can be started once with:

systemctl start afs.mount

and enabled for automatic start on boot with:

systemctl enable afs.mount

Configuration files for kafs-client can be found in the /etc/kafs/ directory. In there is a client.conf file that the code actually reads and a client.d/ directory into which the administrator can place configuration. client.conf simply parses the contents of the directory first and then the standard cellservdb file. The format of the files follows the MIT Kerberos profile file form.

As an example, a local configuration could be supplied in a file in client.d/local.conf looking something like the following:

	[defaults]
	thiscell = my.afs.cell
	sysname = fedora28_x86 amd64_linux

	[cells]
	my.afs.cell = {
		use_dns = no
		servers = {
			server1.afs.cell = {
				address = 1111:2222:3333:4444:5555:6666:7777:8888
				address = 1.2.3.4
			}
		}
	}

The configuration can be checked and queried with the kafs-check-config tool.

Authentication tokens can be obtained by getting a kerberos TGT, say with kinit, and then calling the aklog-kafs program to obtain a ticket from that.

aklog-kafs my.afs.cell

If the compat package is installed, this provides a synonym of aklog for the aklog-kafs program.