AFS Introduction

AFS is based on the client/server model:

  • Client Machines are workstations or other machines running software to connect to servers (AFS clients).

  • Server Machines are the machines that provide access to volumes.

AFS Client machines are normal workstations with local, non-shared disk space dedicated to running the Client software; AFS Cache Manager daemons are active on these machines, presenting the end user with an additional directory: “/afs.” All the files and directories that make up /afs are physically present on AFS File Server machines, geographically dispersed around the world. The local Cache Manager’s function is to communicate with these machines and provide the remote files locally to the user.

Cache Manager

The cache manager process ensures a reduction in the number of requests to the server’s network. The cache manager requests files from the server and copies them to your machine. You work on a copy, not the original, which is on the server. When you close or save, the server will modify the original.

AFS cells structure

In AFS, a cell is a collection of clients and servers. We can think of it as a tree structure where the root is called /afs, all cells are visible at the second level of the AFS tree, and we can use the cd (change direct) command to navigate to each cell, just like changing directories in Unix. From a user’s perspective, the /afs directory is no different from any other Unix directory. The main difference is that AFS allows for a more refined permissions scheme and therefore more selective access control than normal Unix directories. Generally, a cell corresponds to the same domain name. The DNS (Domain Name System) is a hierarchical and distributed method of organizing space on the Internet. The DNS administratively groups HOSTS according to a hierarchical chain of authority that allows for the distribution and updating of addresses and other information. Our cell is called enea.it. A grouping of related cells is called a “site.” To switch from one cell to another, use the cd /afs/cellname command.

File space

A cell has its own file space and can connect to the file spaces of other cells defined in AFS. Authorization to access the AFS file space is granted by assigning a token, which serves as proof to all file servers that the user is authenticated. If the user does not have a token, AFS treats them as an anonymous user (member of the system:anyuser group). Each token has a limited validity period. To check its expiration date, use the command:

tokens

which also provides the name of the user associated with the token and the name of the cell in which it is valid. The default value is set by the system administrator.

A token can be renewed at any time with the command:

klog

which, after requesting the user’s password and verifying its correctness, replaces the old token with the new one. This command can also be used if the old token is about to expire and the user wishes to run a very long job in the background. If we are using X windows on a workstation the token is associated with a session on your HOST COMPUTER and the opening of other windows we do not need to send the KLOG command, because we are always authenticated.

Volumes

Unix divides physical disks into logical partitions, AFS divides partitions into subsections called volumes. A volume therefore contains a subtree of directories and files. Access to a volume is provided by the “Mount Point,” which points to the location (server machine and partition) of the volume; it can therefore be compared to a Unix directory. Volumes have a defined quota and an associated ACL; the quota is assigned by the system administrator and represents the maximum amount of disk space the volume can contain. To check a volume’s quota, use the command:

fs listquota

The command responds with the name of the volume containing the specified directory, the quota, the used portion, the used percentage, and the used percentage of space on the partition containing the volume.

fs lq /afs/enea.it/frascati/info           <
Volume Name             Quota    Used    % Used   Partition
frascati.info.readonly  5000      28        1%         80%

Note

Quantities are measured in kilobytes.

File protection

AFS uses KERBEROS and ACL mechanisms for file and directory access. The combination of Kerberos and ACL provides superior security. This mechanism is based on a control list, called an Access Control List (ACL), which consists of a list of users with corresponding access rights to the directory. For each directory in the AFS file system, an ACL is defined that applies to all files and subdirectories within that directory. All files inherit the access rights associated with the parent directory; if a file is moved from one directory to another, it acquires the access rights of the new directory. If the ACL on a directory is changed, the protection of all its files is also changed. When a subdirectory is created, it automatically inherits the access rights of the parent directory.

There are two types of groups: regular and unprefixed. Regular group names consist of two parts separated by the : character, such as:

owner-name:group-name

where the first part indicates the name of the group owner while the second provides the name of the group. Group names without a prefix consist of just the “group-name” part; such groups can only be created by system administrators. Generally, groups are created by users, but three are created automatically by the system:

  • system:anyuser - This group includes anyone who can access this cell, including users who are logged in on a local workstation but are not authorized to use AFS (they do not have a valid token).

  • system:authuser - This group includes all users currently authorized to work in AFS (they have a valid token).

  • system:administrators - This group includes only people designated as system administrators.

Access Permissions

The protection of an individual file depends on the combination of the rights specified in the ACL and the access rights allowed by Unix, which, as we recall, are read, write, and execute. The ACL specifies seven access rights associated with the directory (and therefore all files and subdirectories within that directory). These rights can be divided into two levels:

  • The first level controls access to the directory (LOOKUP, INSERT, DELETE, and ADMINISTER);

  • The second level controls access to the files within the directory (READ, WRITE, and LOCK).

Each access right can be abbreviated to a single character as shown in brackets in the definition below.

ACCESS

MEANING

READ (r)

read (and copy) the contents of files in the directory.

LOOKUP (l)
look to list (ls) directory and look at the ACL.
You must have l access to use other access rights, e.g., to read you must have rl.

INSERT (i)

insert files or subdirectories (create new files, move existing ones).

DELETE (d)

delete files or subdirectories from the directory.

WRITE (w)

write or edit the contents of files in the directory.

LOCK (k)

lock. Sets an advisory lock on a file.

ADMINISTER (a)

administer to change access in the ACL.

These access rights can be combined with each other in various ways, but the most commonly used combinations are the following:

PTS group name

ACCESS

projadmin:site-project_name

rlidwka

projadmin:site-project_name-write

rlidwk

projadmin:site-project_name-read

rl

projadmin:site-project_name-insert

rli

To access their own subdirectories at any time, each user must have at least LOOKUP access to their directories; they must then be authorized in one of the following 3 ways:

  1. Is part of a system group (system:anyuser or system:authuser);

  2. Is authorized as an individual user;

  3. Is part of an authorized user group defined by other users.

AFS controls access to its files using 2 lists:

  • Normal Rights contains the user or user group that can perform the specified actions;

  • Negative Rights contains the user or user group that is prohibited from performing the specified actions.

Note

Since the file server checks Normal Rights first and then Negative Rights, if, for example, you want to grant READ access to all but one person in a group, you can add the group to the Normal Rights list and the individual person to the Negative Rights list. Therefore, there are two ways to deny access to a directory:

  • Remove the user or group from the Normal Rights list;

  • Add the user or group to the Negative Rights list.