Page History

...

Kerberos is also required on Linux and must be configured with a krb5.conf file. The exact format of your Kerberos configuration file may vary depending on if you are using MIT Kerberos or Heimdal Kerberos. Regardless, the following must be defined in your Kerberos config file:

[libdefaults]
allow_weak_crypto = true
 ticket_lifetime = 30d
 renew_lifetime = 30d
 forwardable = true
 renewable = true

[realms]
 CIT.CORNELL.EDU = {
  kdc = kerberos.cit.cornell.edu:88
  kdc = kerberos2.cit.cornell.edu:88
  admin_server = kerberos.cit.cornell.edu:749
  default_domain = cit.cornell.edu
 }

CNF.CORNELL.EDU = {
        kdc = hole.cnf.cornell.edu:88
        kdc = smoke.cnf.cornell.edu:88
        kdc = mist.cnf.cornell.edu:88
        admin_server = hole.cnf.cornell.edu:749
        default_domain = cnf.cornell.edu
}

CORNELL.EDU = {
  kdc = ad2.cornell.edu
  kdc = ad1.cornell.edu
  default_domain = cornell.edu
 }    

GUEST.CORNELL.EDU = {
    kdc = obsidian1.cit.cornell.edu:88
        kdc = obsidian2.cit.cornell.edu:88
    admin_server = obsidian1.cit.cornell.edu
    default_domain = guest.cornell.edu
}

[domain_realm]
 .cit.cornell.edu = CIT.CORNELL.EDU
 cit.cornell.edu = CIT.CORNELL.EDU
 .mail.cornell.edu = CIT.CORNELL.EDU
 mail.cornell.edu = CIT.CORNELL.EDU
.cnf.cornell.edu = CNF.CORNELL.EDU
 cnf.cornell.edu = CNF.CORNELL.EDU

If using MIT Kerberos, you must also set the following in your krb5.conf (Heimdal uses a different syntax for the capaths section):

[capaths]
CIT.CORNELL.EDU = {
    CNF.CORNELL.EDU = .
}

GUEST.CORNELL.EDU = {
    CNF.CORNELL.EDU = .
}

CORNELL.EDU = {
    CIT.CORNELL.EDU = .
    CNF.CORNELL.EDU = CIT.CORNELL.EDU
}

...

1. NOW, REBOOT. After rebooting, your firewall may prompt you to allow the various afs applications access to the network. You should choose to Always Allow these.
2. OPTIONAL, set up a drive mapping (must be done AFTER REBOOTING)
   1. Right click on My Network Places
   2. Map drive
   3. To follow the CNF convention, set the drive letter to X
   4. Set the path to \\afs\cnf.cornell.edu
   5. Choose to Reconnect the drives
   6. Done

Mac OS 10.7 (Lion) / 10.8 (Mountain Lion) / 10.9 (Mavericks)

1. Install the Mountain Lion krb5.conffile to /private/etc/krb5.conf
   1. The /private/etc folder is hidden... to get to it from the Finder...
   2. From the "Go" menu choose "Go to Folder"
   3. Type in /private/etc
   4. You can now copy the krb5.conf file over... you will be prompted for administrator credentials
2. Install the Mountain Lion edu.mit.Kerberosfile to /Library/Preferences/edu.mit.Kerberos
   1. You may first have to delete any existing edu.mit.Kerberos file (Finder may not let you overwrite the existing file)
   2. The deletion operation will require typing in an administrative username and password
   3. Copying over the new file will require typing in an administrative username and password
3. Download OpenAFS 1.6.5 or 9 or greater from the openafs.org website (10.7 / 10.8) OR Download 1.6.5.2 9 for Mavericks from this link (10.9)
4. Run the OpenAFS package installer
   1. Specify cnf.cornell.edu as the cell name and cnf as the cell alias
   2. No reboot is necessary (unless you are running Mavericks, Mac OS 10.9) - AFS will start running when the installer finishes
5. To show the AFS icon on the Desktop...
   1. Finder - Preferences
   2. General tab
   3. Check "Connected Servers"
6. Download the gui AFSTokens app for SnowLeopard (afstokens-64bit.zip) from https://forge.cornell.edu/sf/projects/afs_tokens 
   1. File Releases tab
   2. The AFSTokens app is no longer maintained, but is still the best way to obtain AFS tokens.
   3. Obtaining tokens works under the latest version of Mac OS X Mavericks. However, deleting tokens crashes the app.

   4. Renewing existing tokens does not work. You must first delete any AFS tokens and Kerberos tickets by running the following two commands from a Terminal prompt commandline:

      Code Block
      unlog kdestroy

   5. Viewing your AFS group membership works under the latest version of OS X Mavericks.
7. We are in process of testing the built in AFS control panel under System Preferences.
8. To show the AFS icon on your desktop, in Finder Preferences - General, make sure "Connected servers" is checked.