Noted the ubuntu command update-rc.d which can be used when installing init.d scripts, like:

update-rc.d mydns defaults

Started copying files from my afs server to the regular filesystem on cumulus.

eth0 will be LAN, and eth1 Internet interfaces.

Started setting up two MyDNS servers. Made the /etc/init.d/mydns into two files /etc/init.d/mydns-lan and /etc/init.d/mydns-internet. Made them use different conf files, /etc/mydns-lan.conf and /etc/mydns-internet.conf. The conf files access the shared database (port 3306) or my database (port 3307).

Next task is to import the external DNS info into the right MyDNS database. I'll try to pull the info from Mårten's DNS server so I don't get the intranet version.

Building mydns on Cirrus:

wget http://downloads.sourceforge.net/project/mydns-ng/mydns/1.2.8.27/mydns-1.2.8.27.tar.gz?use_mirror=sunet
tar -xf mydns-1.2.8.27.tar.gz
cd mydns-1.2.8
sudo apt-get install g++ gcc libmysqlclient15-dev
./configure
nice make -j4
sudo make install

Then finally ran this on cumulus:

sudo mydnsimport --axfr=www.stenius.org --conf=/etc/mydns-internet.conf --replace --verbose lewin.nu

Seems to have worked. Do the same for the other zones, but pulled some of them from ns1.lewin.nu. Then import the intranet zones:

sudo mydnsimport --axfr=sol --conf=/etc/mydns-lan.conf --replace --verbose lewin.nu

In theory, all the DNS data should be in the databases, and replicated to cirrus. Checked it, looks good.

Next step is to try to serve lewin.nu intranet DNS from the new server.

Having problems specifying port for mydns server. Will continue with this later.

Continuing the OpenAFS debugging.

The problem is that when starting up afs, the salvaging runs continuously, because fileserver with (from FileLog):

VL_RegisterAddrs rpc failed; The IP address exists on a different server; repair it
VL_RegisterAddrs rpc failed; See VLLog for details
Fatal error in library initialization, exiting!!

I'm guessing it has something to do with my server having two IP-addresses: one intranet and one Internet (it acts as a firewall/router). In order to prevent having the intranet address sent to extranet servers, I've specified the extranet address in the NetRestrict configuration file.

I'm also experiencing the strangeness reported in this post, that even though it looks like I have only one IP address (the extranet one) when I do vos listvldb, when I do changeaddr, only some of them change.

I had a similar problem recently, when the fix in the post worked, but it doesn't now.

I ran volserver in the debugger, and it seems to have a list of addresses which is incorrent.

And then, all of a sudden, it worked. The fileserver is up and running. I guess I'll have to revisit this next time I get this problem. Argh.

Everything is giving me trouble, now it's OpenAFS, latest stable version 1.4.4

One bugfix: src/bozo/bosserver.c:1109, fclose should be moved up to the first part of the preceding if statement, gives SEGFAULT if log file can't be opened.

I'd like to get Apache 2 to access files on my AFS file system. Ideally both when no user is authenticated, and with user's credentials when a user has authenticated via Kerberos 5.

I have authentication via Kerberos 5 working with the auth_kerb_module (mod_auth_kerb.so).

I can't quite wrap my head around how ticket caches and afs PAGs (Process Authentication Groups) work.

Here's a writeup on PAGs and web server authentication.

Questions: How are PAGs related to the actual credentials? By the KRB5CCNAME environment variable? (I'm running the Heimdal Kerberos implementation).

Ideally the auth_kerb_module could for each access make sure the apache process/thread has tokens/PAG for either the authenticated user or the www kerberos/afs user.

In theory the mod would do k_hasafs to intialize library, k_setpag() to create a new (empty) PAG, get the proper kerberos 5 credentials (either for the user or Apache's srvtab), convert them to afs tickets with krb5_afslog, perform the request, and then after the request destroy the pag with k_unlog.

More to come (I hope)...