OpenAFS and Kerberos under MAC 10.3 System Requirements and Installation

Transcription

1 Information Technology, Arizona State University OpenAFS and Kerberos under MAC 10.3 System Requirements and Installation COMMUNICATIONS - 10/2004 This document assists in setting up a process for logging into Mac OS 10.3 with Kerberos credentials, for generating a Kerberos 5 ticket, for converting that ticket into an AFS token with a locally build utility called ak5log (raw source available from ftp://achilles.ctd.anl.gov/pub/kerberos.v5), and for accessing personal AFS space in a Finder (GUI) window with another local utility called myasu-afs. This setup is now possible with the use of a single ASUAFSKerb-ak sitx.gz package. This document further describes the use of the ASUAFSKerb-ak sitx.gz package that is how to use its locally developed installers called ASUinstallerA and ASUinstallerB to install/upgrade and configure the OpenAFS client; to configure the Kerberos client; to install and configure ak5log; to create and configure your ASURITE account on the Mac and to install myasu-afs and stop-afs. A summary of the process is as follows: Using a non-asurite administrative account, download ASUAFSKerb-ak sitx.gz. The package in turn consists of a sub-package called OpenAFS.pkg, applications called ASUinstallerA, ASUinstallerB, myasu-afs, stop-afs and other support files. Then execute ASUinstallerA which starts the installer to the OpenAFS client, configures the OpenAFS client, configures the Kerberos client, installs and configures ak5log, installs myasu-afs and stop-afs on the desktop of your Mac's ASURITE account and then reboots the Mac. Using the same non-asurite administrative account execute ASUinstallerB which creates an ASURITE account on the Mac or updates an existing one to a user ID (UID) that matches the one currently assigned to your AFS account. The installer also verifies the ASURITE ID both with AFS and with the Mac, obtains your UID from AFS, encrypts password, and configures account and file attributes and ownership. Furthermore, it installs myasu-afs and stop-afs on the desktop of your local ASURITE account and then reboots the Mac. This step is not required of users with an ASURITE account on the Mac that was configured in the past for use with the OpenAFS client. Using the Mac ASURITE account, login with ASURITE password, go to its desktop and double-click on myasu-afs and access your personal AFS space in a Finder window.

2 More details of the installation process now follows. Please print a copy of this document and use it as a guide to complete the installation. 1. Install the latest Mac OS 10.3 update Verify the version number from the Apple pull-down menu by selecting About This Mac. If you are using a version older than then upgrade by downloading the latest update available from the Apple's Download site. However, if you already have the latest version then skip this step. Note: if your non-asurite administrative account already exists on this Mac then you must skip the next step and go directly to step Create an administrative account that does NOT have the same name as your ASURITE ID To create such an account on the Mac, go to the Apple pull-menu and select System Preferences.

3 Now select Accounts (under System). In the Accounts window if the icon for [Click the lock to make changes] is in the locked position then select it. Enter a password for the account and select [OK] to continue. Now select the button for [+] which is above the lock icon.

4 Enter information into fields such as Name, Short Name, Password and Verify (once the account is created, you won't be able to change the short name). Then select the tab for Security and check the box for [Allow user to administer this computer]. Now select the tab for Picture and assign a picture (optional). Complete the process by first selecting the lock icon and then closing the Accounts window. 3. Log into non-asurite Administrative account and Download package Log into the above administrative account and download the package called ASUAFSKerb-ak sitx.gz from: ad.htm The package may automatically uncompress with StuffIt Expander or you may need to double-click on the package to manually uncompress. As a result a folder called ASUAFSKerb-ak will be created.

5 Now open the ASUAFSKerb-ak folder. Files such as ASUinstallerA, ASUinstallerB, myasu-afs, OpenAFS.pkg and stop- AFS will be displayed. 4. Execute ASUinstallerA, install/configure OpenAFS, Kerberos, ak5log and then reboot In the ASUAFSKerb-ak folder double-click on ASUinstallerA. Enter your ASURITE user id, enter your password twice for your current Mac non-asurite account, read the CAUTION message and then select [INSTALL]. The OpenAFS Installer window will now appear.

6 A series of button selections and windows will permit either the installation or upgrade of your AFS client. During the process a window titled Authenticate will appear. Enter the password for the current administrative account and then select [OK]. The OpenAFS Installer window will complete the installation of its client and in the end display a window with a message that The software was successfully installed.

7 Caution: do not select the [Restart] button to close the OpenAFS installer. Instead go to the top-left corner of the window and select the [X] button. Finally a dialog box similar to the following will be displayed. You are asked to save your work and reboot. Select [OK] to continue. Note: if your ASURITE account already exists on this Mac and you have successfully used it in the past to access your AFS space then you can skip the next step and go directly to step Again log into non-asurite administrative account, execute ASUinstallerB and create or update ASURITE account on Mac After the Mac reboots, you will see an AFS icon on the Desktop.

8 Again go to the ASUAFSKerb-ak folder and now double-click on the application ASUinstallerB. Option A if ASURITE user account doesn't exist on the Mac If the ASURITE user account doesn't exist on the Mac then in the ASUInstallerB window enter your ASURITE user ID, enter the password for your current Mac non-asurite account, enter password twice for the new ASURITE account and then select [INSTALL]. A window with a message similar to the following will appear. Select [YES] to continue.

9 The application then proceeds with the account creation process including setting up the ASURITE account with administrative privileges, updating file ownership and group id, creating a home directory and all the necessary subdirectories and files. Furthermore, applications called myasu-afs and stop-afs, respectively, will also be installed on the desktop of the ASURITE account. Option B if ASURITE user account does exist on the Mac However, if the ASURITE user account already exists on the Mac then in the ASUInstallerB window enter your ASURITE user id, enter the password for your current Mac non-asurite account, and then select [INSTALL]. A window with a message similar to the following will appear. Select [YES] to continue. The application then proceeds with the account update process including updating file ownership and group id. Furthermore, applications called myasu-afs and stop-afs, respectively, will also be installed on the desktop of the ASURITE account. Finally when either Option A or B processes near completion, a dialog box similar to the following will be displayed. You are asked to save your work and reboot. Select [OK] to continue. 6. Log into ASURITE account, execute myasu-afs and access AFS space

10 After logging in with your ASURITE ID and ASURITE password on the Mac, a Kerberos 5 ticket immediately becomes available and you will have access to AFS but not to your personal AFS space. An AFS token is required to access your AFS space. To convert the Kerberos 5 ticket to an AFS token, double-click on the application called myasu-afs that can be found on the Desktop. The application myasu-afs in addition to converting the Kerberos 5 ticket to an AFS token also opens up a Finder window to your AFS space. The folder will have your ASURITE ID as its title-name and will look similar to the following. Note: In some cases depending on network traffic, your AFS folder may take a few minutes to appear. Please be patient! If you need to stop the AFS client perhaps before installation or upgrading another application then double-click on the application called stop-afs that can be found on the Desktop. Notes:

11 1. Please print a copy of this document and use it during installation. 2. During installation, the password to your Mac non-asurite administrative account is required to complete the install, create or upgrade processes. 3. After successfully accessing your AFS space, you may delete the ASUAFSKerb-ak folder from your non-asurite administrative account. However, do not delete the myasu-afs and stop-afs applications from the desktop of your ASURITE account. 4. After the installation is complete only the instructions in step 6 are needed in the future to access to your AFS space. 5. There are several references to the Mac ASURITE account or ASURITE account on the Mac. These 2 mean the same thing. However, the only similarity between this account and the ASURITE account you have at ASU is that they have the same account ID, same UID and can have the same password as well. [ DST Home FYI Home FYI Search ASU Home ] [ Seeking assistance? Help Desk ] [ Problems viewing this page? FYI-Q ] 2004 ABOR Last Modified Wednesday 27 October 2004