</ol>
<li><a href="#Troubleshooting">Troubleshooting</a>
<ol>
- <li><a href="#ImtryingtoaccessmyfilesfslasaysIshouldhavepermissionsherebutitstillsays">I'm trying to access my files, <tt>fs la</tt> says I should have permissions …</a></li>
+ <li><a href="#ImtryingtoaccessmyfilesfslasaysIshouldhavepermissionsherebutitstillsays">I'm trying to access my files, <tt>fs listacl</tt> says I should have permissions …</a></li>
<li><a href="#IdreallypreferthatnoteveryonecouldlistmyfileshowshouldIstopthis">I'd really prefer that not everyone could list my files, how should I stop …</a></li>
<li><a href="#Itwasaround6amonaSundaymorningandsuddenlyIcouldntaccessmyfiles">It was around 6am on a Sunday morning and suddenly I couldn't access my …</a></li>
<li><a href="#ItisntSundayandIcantgettomyfiles">It isn't Sunday and I can't get to my files</a></li>
You may be familiar with Unix permissions. Sad to say, but that knowledge is more or less useless here. While Unix permissions are per-file, AFS permissions are controlled by <strong>Access Control List</strong>s (<strong>ACL</strong>s) on a per-directory basis. (AFS does however, attend to the e<stong>x</strong>ecute Unix permission on a file. )
</p>
<p>
-To view the ACL for a given directory (where you have permission to do so), run <tt>fs listacl</tt> or <tt>fs la</tt>, for short. For a typical user locker, the ACL in the top level will look like this
+To view the ACL for a given directory (where you have permission to do so), run <tt>fs listacl</tt>, or <tt>fs la</tt> for short. For a typical user locker, the ACL in the top level will look like this
</p>
-<pre>user@host:~$ fs la
+<pre>user@host:~$ fs listacl
Access list for . is
Normal rights:
system:expunge ld
To add a user or group to the ACL for a given directory simply run <tt>fs setacl</tt> or <tt>fs sa</tt> as follows:
</p>
-<pre>fs sa <directory> <user or group> <permissions> [<user or group> <permissions>]*
+<pre>fs setacl -dir <directory> [<directory>]* -acl <user or group> <permissions> [<user or group> <permissions>]*
</pre><dl><dt><tt><directory></tt></dt><dd>
can be an absolute or relative path, usually you will want <tt>.</tt>
</dd><dt><tt><user or group></tt></dt><dd>
For example, if <tt>user</tt> wants his friends <tt>sipbtest</tt> and <tt>jarandom</tt> to be able to read and write files and anyone to be able to read files in his <tt>awesome_project</tt> directory, he might have a session that looks like this
</p>
<pre>user@host:~$ cd awesome_project/
-user@host:~/awesome_project$ fs sa . system:anyuser read
-user@host:~/awesome_project$ fs sa . jarandom write
-user@host:~/awesome_project$ fs sa . sipbtest write
-user@host:~/awesome_project$ #alternatively: fs sa . system:anyuser read jarandom write sipbtest write
-user@host:~/awesome_project$ fs la
+user@host:~/awesome_project$ fs setacl -dir . -acl system:anyuser read
+user@host:~/awesome_project$ fs setacl -dir . -acl jarandom write
+user@host:~/awesome_project$ fs setacl -dir . -acl sipbtest write
+user@host:~/awesome_project$ #alternatively: fs setacl -dir . -acl system:anyuser read jarandom write sipbtest write
+user@host:~/awesome_project$ fs listacl
Access list for . is
Normal rights:
system:expunge ld
</pre><p>
See also: <tt>man 1 fs</tt>, <tt>fs help <command></tt>, <tt>man fs_listacl</tt>.
-There is also such thing as negative permissions to deny rights to certain members of a larger group to which positive permissions are granted. In the words of the fs_setacl manpage, however, <blockquote>Setting negative permissions is generally unnecessary and not recommended. Simply omitting a user or group from the "Normal rights" section of the ACL is normally adequate to prevent access. In particular, note that it is futile to deny permissions that are granted to members of the system:anyuser group on the same ACL; the user needs only to issue the unlog command to receive the denied permissions.</blockquote> For an example of negative permissions used on Athena run <tt>fs la /afs/athena.mit.edu/contrib/games/</tt>.
+There is also such thing as negative permissions to deny rights to certain members of a larger group to which positive permissions are granted. In the words of the fs_setacl manpage, however, <blockquote>Setting negative permissions is generally unnecessary and not recommended. Simply omitting a user or group from the "Normal rights" section of the ACL is normally adequate to prevent access. In particular, note that it is futile to deny permissions that are granted to members of the system:anyuser group on the same ACL; the user needs only to issue the unlog command to receive the denied permissions.</blockquote> For an example of negative permissions used on Athena run <tt>fs listacl /afs/athena.mit.edu/contrib/games/</tt>.
</p>
<h2 id="CreatinganAFSGroup">Creating an AFS Group</h2>
<p>
-The "normal" way to make an AFS group would be with a command similar to <tt>pts creategroup <your user name>:<group name></tt> and then add people with <tt>pts adduser <user> <full group name></tt>(e.g. If Donald Guy wanted to created a group for people to edit his www directory (including <tt>sipbtest</tt> and <tt>jflorey</tt>, he might use the following chain of commands <tt>pts creategroup fawkes:www ; pts adduser sipbtest fawkes:www; pts adduser jflorey fawkes:www; fs sa /mit/fawkes/www fawkes:www write</tt>
+The "normal" way to make an AFS group would be with a command similar to <tt>pts creategroup <your user name>:<group name></tt> and then add people with <tt>pts adduser <user> <full group name></tt>(e.g. If Donald Guy wanted to created a group for people to edit his www directory (including <tt>sipbtest</tt> and <tt>jflorey</tt>, he might use the following chain of commands <tt>pts creategroup fawkes:www; pts adduser sipbtest fawkes:www; pts adduser jflorey fawkes:www; fs setacl -dir /mit/fawkes/www -acl fawkes:www write</tt>
</p>
<p>
You can see general information about a group by running <tt>pts examine <group></tt> and see the membership of a group by running <tt>pts membership <group></tt>. In the above example:
fawkes@dr-wily:~$ pts examine fawkes:www
Name: fawkes:www, id: -33555072, owner: fawkes, creator: fawkes,
membership: 2, flags: S-M--, group quota: 0.
-fawkes@dr-wily:~$ pts mem fawkes:www
+fawkes@dr-wily:~$ pts membership fawkes:www
Members of fawkes:www (id: -33555072) are:
jflorey
sipbtest
</p>
<ul><li>You can require that the user have valid certificates:
-<pre> <limit GET>
- require valid-user
- </limit>
+<pre>require valid-user
</pre></li></ul><ul><li>You can require the reader be (a) specific user(s), for example:
-<pre> <limit GET>
- require user fawkes jflorey sipbtest jarandom
- </limit>
-
+<pre>require user fawkes jflorey sipbtest jarandom
</pre></li><li>You can require that the reader be a member of one of certain moira groups (notice these are <strong>moira</strong> groups, there is no "system:". For example:
-<pre> <limit GET>
- require group sipb-staff sipb-prospectives
- </limit>
+<pre>require group sipb-staff sipb-prospectives
</pre></li></ul><p>
-<p>Note that you cannot mix users and groups in the same directory</p>.
+<p>Note that you cannot mix users and groups in the same directory.</p>
-<p>Finally <tt>fs sa <dir> system:htaccess.mit read </tt>.</p>
+<p>Finally <tt>fs setacl -dir <dir> -acl system:htaccess.mit read</tt>.</p>
Thereafter, the users should be able to get to the folders at <tt>http<b>s</b>://web.mit.edu/<locker>/<path to folder></tt> if they have certificates and no one should be able to reach it via http. Make sure to add yourself if you are going to be accessing it.
see also: <a href="http://ist.mit.edu/services/web/reference/web-resources/https">http://ist.mit.edu/services/web/reference/web-resources/https</a>
</p>
<h2 id="Troubleshooting">Troubleshooting</h2>
-<h3 id="ImtryingtoaccessmyfilesfslasaysIshouldhavepermissionsherebutitstillsays">I'm trying to access my files, <tt>fs la</tt> says I should have permissions here, but it still says <tt>: Permission denied</tt></h3>
+<h3 id="ImtryingtoaccessmyfilesfslasaysIshouldhavepermissionsherebutitstillsays">I'm trying to access my files, <tt>fs litacl</tt> says I should have permissions here, but it still says <tt>: Permission denied</tt></h3>
<p>
There are two likely possibilities. First, its likely that your tokens may have expired. You can check this by running <tt>tokens</tt>. If they are, in fact, expired (or missing) get new tokens as follows: first, make sure you have valid kerberos tickets and then run <tt>aklog</tt>. Another possibility is that you have tokens but not for the correct cell. <tt>tokens</tt> will tell you what tokens you already have. In all likelihood, if you are reading this, you probably want <tt>aklog athena sipb</tt>. Finally, a third possibility is that your group membership has changed since you acquired tokens. Try running <tt>aklog -force</tt>
<meta http-equiv="Refresh" content="0; url=http://web.mit.edu/<lockername>/www">
</head>
<body>
- <p>Please go to my <a href="http://web.mit.edu/<lockername>/www">www/a>!</p>
+ <p>Please go to my <a href="http://web.mit.edu/<lockername>/www">www</a>!</p>
</body>
</html>
</p>
<h2 id="Findouttechnicalinformationaboutmylocker">Find out technical information about my locker</h2>
-<p>Figure out the volume name of the locker. One way to do this is to run <tt>fs lq .</tt> in the directory and look in the left column. Once you have the volume name, run <tt>vos examine <volume name></tt>. This will tell you information such as what server it is located on, its ID numbers, when it was last accessed, when it was last backed up, etc. For example:
+<p>Figure out the volume name of the locker. One way to do this is to run <tt>fs listquota .</tt> in the directory and look in the left column. Once you have the volume name, run <tt>vos examine <volume name></tt>. This will tell you information such as what server it is located on, its ID numbers, when it was last accessed, when it was last backed up, etc. For example:
<pre>
$ vos examine user.sipbtest
user.sipbtest 537058147 RW 69785 K On-line