X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/4d7418e60b0250a38bebb78ec0c9b938e49ffba8..4dd96cd39d905ed54397bb6d27e8cd5ccf40c9b2:/doc/AFSAndYou

diff --git a/doc/AFSAndYou b/doc/AFSAndYou
index c7fd941..e016739 100644
--- a/doc/AFSAndYou
+++ b/doc/AFSAndYou
@@ -20,8 +20,8 @@ For the most part using AFS, particularly at MIT, is well-hidden and can be used
 
 = The Basics =
 
-== The Layout of an MIT User Locker ==
-Every Athena user has a locker (their home directory) which mounts at {{{/mit/<username>}}} From a technical standpoint, its stored in the volume {{{user.<username>}}} which is located at {{{/afs/athena.mit.edu/user/<first letter>/<second letter>/<user name>}}} For example, the user {{{sipbtest}}} has a home directory that mounts at {{{/mit/sipbtest}}, is volume {{{user.sipbtest}}, and is accessible at {{{/afs/user/s/i/sipbtest}}}.
+== The Layout of a Typical MIT Locker ==
+Every Athena user has a locker (their home directory) which mounts at {{{/mit/<username>}}} From a technical standpoint, its stored in the volume {{{user.<username>}}} which is located at {{{/afs/athena.mit.edu/user/<first letter>/<second letter>/<user name>}}} For example, the user {{{sipbtest}}} has a home directory that mounts at {{{/mit/sipbtest}}, is volume {{{user.sipbtest}}, and is accessible at {{{/afs/user/s/i/sipbtest}}}. Projects, Dorms, Classes, etc. are all mounted at {{{/mit/<lockername>}}} and stored at various places in AFS
 
 Within this folder there are 4 special subdirectories you want to care about
 
@@ -32,9 +32,68 @@ Within this folder there are 4 special subdirectories you want to care about
  '''{{{OldFiles}}}'''::
   This folder is a link to a read-only copy of a backup of your files (created nightly at 3 a.m.) This copy can not be edited and does not count towards your quota. (From a technical standpoint, this is a separate volume, user.<username>.backup and is stored only as changes against the current copy). 
  '''{{{www}}}'''::
-  Where you should put a website, if you want one. There is very little special about this directory from an AFS standpoint, but it is world readable (like Public) and is linked directly if someone goes to {{{http://www.mit.edu/~<username>}}} (e.g. http://www.mit.edu/)
+  Where you should put a website, if you want one. There is very little special about this directory from an AFS standpoint, but it is world readable (like Public) and is linked directly if someone goes to {{{http://www.mit.edu/~<username>}}}
+
+
+== Accessing Lockers ==
+
+=== From Athena ===
+
+On Athena you can access a locker either as its full AFS path, if you know it ( e.g. /afs/athena.mit.edu/course/6/6.01 ) or under {{{/mit}}} if it is "attached." Yet a third way is to use tilde expansion and simply {{{ cd ~<locker> }}} (e.g. {{{cd ~6.01}}}) which will take you to the full path. Often, however, you want to attach lockers because it is easier to refer to them outside of the shell (in a script, for example) and software is set-up to run with a path under {{{/mit}}}. There are a few ways to attach a locker: 
+
+ * If you are running on a [http://debathena.mit.edu Debathena] machine, such as [http://linerva.mit.edu linerva.mit.edu], then simply {{{cd /mit/<locker>}}} and it will be auto-attached.
+ * If you are on another Athena machine and don't want to run software out of the locker, than simply type {{{attach <locker>}}} and then `cd` to it.
+ * If, however, you want to use software in the locker, you will be better served by running {{{add <locker>}}} (e.g. {{{add ruby-lang}}}). This will attach the locker at {{{/mit/<locker>}}} and will add the `bin` directory (for your architecture) of that locker to your PATH. What this means is that you should be able to run any software thereafter by simply typing the name of the program at the command line.
+
+
+=== From the Web ===
+
+Generally any locker that you would access on Athena as {{{/mit/<locker>}}} is accessible on the web as {{{{http://web.mit.edu/<locker>}}}. For example, the barnowl locker is at [http://web.mit.edu/barnowl]. As you can see, if there is no index.html (see below), the files in the directory are listed. By default, however, none of the contents are readable except in the `www` and `Public` folders.
+
+Also, you may access something in one of the MIT AFS cells by taking its full AFS path after web.mit.edu ([http://web.mit.edu/afs/athena.mit.edu/activity/c/chess-club]). (That link also shows that if you have a text file named README readable, as a link to Public/README for example, its contents will be displayed below the directory listing).
+
+If these options are good enough for you, then you are done. If not, read on.
 
 = Common Tasks =
 
+== Controlling Who can Access Files ==
+You may be familiar with Unix permissions. Sad to say, but that knowledge is basically useless here. Whereas Unix permissions, are per-file, AFS permissions are controlled by '''Access Control List'''s ('''ACL'''s) on a per-directory basis. 
+
+To view the ACL for a given directory (where you have permission to do so), run {{{fs listacl}}} or {{{fs la}}}, for short. For a typical user locker, the ACL in the top level will look like this 
+{{{
+user@host:~$ fs la
+Access list for . is
+Normal rights:
+  system:expunge ld
+  system:anyuser l
+  user rlidwka
+}}}
+
+This is a list of users or [#MakinganAFSGroup AFS groups] and their permissions in this directory (and subdirectories that don't have their own ACL modifications). In AFS there are seven permissions as follows
+
+ ||'''r'''||  read   ||   user or members of group can read files in the directory    (i.e. see the contents of files)                  ||
+ ||'''l'''||  list   ||   user or members of group can list files in the directory    (i.e. see the names of files)                     ||
+ ||'''i'''||  insert ||   user or members of group can create files (or subdirectories) in the directory                                ||
+ ||'''d'''||  delete ||   user or members of group can delete files in the directory                                                    ||
+ ||'''w'''||  write  ||   user or members of group can modify files in the directory  (i.e. change the contents of files)               ||
+ ||'''k'''||  lock   ||   user or members of group can lock files in the directory   (you will likely never use this)                   ||
+ ||'''a'''||  admin  ||   user or members of group can see and change permissions. It does '''not''' affect pre-existing subdirectories.||
+
+To add a user or group to the ACL for a given directory simply run {{{fs setacl}}} or {{{fs sa}}} as follows:
+{{{
+fs sa <directory> <user or group> <permissions>
+}}}
+
+ {{{<directory>}}}::
+  can be an absolute or relative path, usually you will want {{{.}}}
+ {{{<user or group>}}}::
+  can be any user or group. Some you probably want to know: system:anyuser means EVERYONE (the entire AFS-using world plus the entire world wide web), system:expunge is the daemon for MIT's delete/lsdel/undelete utilities to work in a given directory.
+ {{{<permissions>}}}::
+ can be a string of the above letters (in any order) or any of the words `read`, `write`, `all` and `none` which are equivalent to `rl`, `rlidwk`, `rlidwka` and the empty string, respectively 
+
+
+= Troubleshooting =
+=== I'm trying to access my files, {{{fs la}}} says I should have permissions here, but it still says {{{: Permission denied}}} ===
+There are two likely possibilities. First, its likely that your tokens may have expired. To get new tokens, make sure you have valid kerberos tickets and then run {{{aklog}}}. Another possibility is that you have tokens but not for the correct cell. {{{tokens}}} will tell you what tokens you already have. In all likelihood, if you are reading this, you want {{{aklog athena sipb}}}
 
 = Advanced Tasks =