From: Jeffrey Altman 
The AFS configuration panel for each Kerberos 5 identity is +
The AFS configuration panel for each Kerberos v5 identity is used to configure which cells credentials should be obtained for and how they should be obtained. If the cell to realm mapping cannot be automatically determined, it can be explicitly -specified. If the cell does not support -Kerberos 5 tickets as tokens, then a krb524 service can be configured.
+specified. If the cell does not support Kerberos +v5 tickets as tokens, then a krb524 service can be configured.
The AFS plug-in configuration panel provider can be used to +
The OpenAFS Provider configuration panel can be used to check the status of the AFS Client Service and its version. An optional checkbox is provided that will prevent the AFS System Tray Tool from being started by Windows after @@ -965,10 +970,11 @@ Use of the Microsoft Loopback Adapter by the AFS Client ServiceBy itself the OpenAFS Client Service does not provide robust behavior in a plug-n-play network environment. Changes to the number of network adapters or their assigned IP addresses will cause the service to -terminate unexpectedly. To avoid this behavior OpenAFS for Windows installs -a single instance of the Microsoft Loopback Adapter (MLA) on the machine. -With the MLA installed, the OpenAFS Client Service will not be affected by the -configuration changes of other network adapters installed on the system.
+terminate unexpectedly. To avoid this behavior OpenAFS for Windows +installs a single instance of the Microsoft Loopback Adapter (MLA) on the +machine. With the MLA installed, the OpenAFS Client Service will not be +affected by the configuration changes of other network adapters installed on +the system.The MLA is installed with a name of "AFS" and a pre-assigned IP address in the 10.x.x.x range. The MLA is bound to the @@ -1041,12 +1047,12 @@ volume from mount points and symlinks stored in the local registry.
modified as cells are accessed. When the fake "root.afs" volume is initially constructed it will only contain two mount points: a regular path and read-write path mount point used to access the -"root.cell" volume of the default AFS cell. Any attempt to -access a valid cell name will result in a new mount point being created in the -fake "root.afs" volume. If the cellname begins with a -"." the mount point will be a read-write path; otherwise the -mount point will be a regular path. These mount points are -preserved in the registry at key: +"root.cell" volume of the default AFS cell. Any attempt to access +a valid cell name will result in a new mount point being created in the fake +"root.afs" volume. If the cellname begins with a "." +the mount point will be a read-write path; otherwise the mount point +will be a regular path. These mount points are preserved in the +registry at key:HKLM\SOFTWARE\OpenAFS\Client\Freelance
@@ -1107,10 +1113,10 @@ Obtaining AFS Tokens as a Integrated Part of Windows Logon< provide Single Sign-On functionality (aka Integrated Logon.) Integrated Logon can be used when the Windows username and password match the username and password associated with the default cell's Kerberos realm. For example, -if the Windows username is "jaltman" and the default cell is "athena.mit.edu", -then Integrated Logon can be successfully used if the windows password matches -the password assigned to the Kerberos principal "jaltman@ATHENA.MIT.EDU". +if the Windows username is "jaltman" and the default cell is +"athena.mit.edu", then Integrated Logon can be successfully used if +the windows password matches the password assigned to the Kerberos principal +"jaltman@ATHENA.MIT.EDU". The realm ATHENA.MIT.EDU is obtained by performing a domain name to realm mapping on the hostname of one of the cell's Volume Database servers. @@ -1120,10 +1126,10 @@ provide tools for synchronizing the Windows and Kerberos user accounts and passwords.When KFW is configured, Integrated Logon will use it to -obtain tokens. Use of KFW for Integrated Logon can be -disabled via the EnableKFW registry -value. Use of the krb524 service can be -configured via the Use524 registry value.
+obtain tokens. Use of KFW for Integrated Logon can be disabled via the EnableKFW registry value. Use of the krb524 service can be configured +via the Use524 registry value.Integrated Logon will not preserve the Kerberos v5 tickets. KFW 3.1 and above implements that functionality.
@@ -1143,6 +1149,11 @@ name="_Toc115417048">3.6. AFS System Tray Command Line Options +The AFS System Tray Tool
+(afscreds.exe) has been deprecated in favor of Network Identity Manager. afscreds.exe will be removed from the OpenAFS
+in a future release.
The AFS System Tray tool (afscreds.exe) supports several command line options:
@@ -1175,8 +1186,8 @@ afsd_service is not already running tokens when afscreds.exe is started. afscreds.exe will attempt to utilize tickets stored in the MSLSA credentials cache; any existing CCAPI credentials cache; and finally display an Obtain Tokens dialog to the user. When used -in combination with IP address change detection, afscreds.exe will attempt to -acquire AFS tokens whenever the IP address list changes and the Kerberos KDC is +in combination with IP address change detection, afscreds.exe will attempt to acquire +AFS tokens whenever the IP address list changes and the Kerberos KDC is accessible.The renew drive maps option is used to ensure that the user @@ -1254,9 +1265,9 @@ font-family:"Times New Roman"'> trace style='font-size:9.0pt;font-family:Symbol'>· minidump
-The creation or removal of mount points and symlinks in the -Freelance root.afs volume are also restricted to members of the AFS Client -Admins group.
+The creation or removal of mount points and symlinks in the Freelance +root.afs volume are also restricted to members of the AFS Client Admins +group.
The initial membership of the "AFS Client Admins" group when created by the installer is equivalent to the local @@ -1264,8 +1275,8 @@ group when created by the installer is equivalent to the local "Administrators" group after the creation of the "AFS Client Admin" group, that user will not be an AFS Client Administrator. Only users that are members of the "AFS Client Admins" group are AFS -Client Administrators. The local "SYSTEM" account is an -implicit member of the "AFS Client Admins" group.
+Client Administrators. The local "SYSTEM" account is an implicit +member of the "AFS Client Admins" group.Setting the default sysname for a machine should be done via the registry and not via "fs @@ -1300,11 +1311,11 @@ language.
name="_Toc115416115">3.9. -OpenAFS includes aklog.exe +aklog.exeThe OpenAFS Client ships with its own version of aklog.exe which should be used in preference to those obtained by other sources. -The OpenAFS aklog.exe supports Kerberos 5 as well as the ability to +The OpenAFS aklog.exe supports Kerberos v5 as well as the ability to auto-generate AFS IDs within foreign PTS databases.
Usage: aklog [-d] [[-cell | -c] cell [-k krb_realm]]
@@ -1357,17 +1368,16 @@ service (bosctlsvc.exe) will be installed and configured. The TransarcAFSServer service will auto-start the traditional AFS bos server. The former AFS Server Configuration wizard makes assumptions that no longer hold -true. As a result, the installation -process will fail. However, following -the instructions for installing the AFS Servers on UNIX it is possible to -properly configure the AFS Servers on Microsoft Windows. The AFS Server binaries, configuration files, -and log files are installed under %Program Files%\OpenAFS\Server. kaserver is deprecated and its -use is strongly discouraged. -Instead, Active Directory or some other Kerberos 5 KDC should be used in -its place. +true and it has therefore been disabled. +However, following the instructions for installing the AFS Servers on +UNIX it is possible to properly configure the AFS Servers on Microsoft +Windows. The AFS Server binaries, +configuration files, and log files are installed under %Program +Files%\OpenAFS\Server. kaserver has been deprecated and its use is strongly +discouraged. Instead, +Active Directory or some other Kerberos v5 KDC should be used in its place.The AFS Server and related tools only support the built in kaserver (Kerberos IV). If kaserver is being used, MIT Kerberos for Windows should not be installed or must be disabled via the EnableKFW registry value.
+href="#_Toc126872361">EnableKFW registry value. + +· The AFS +Servers are not aware of power management events nor are they aware of network +configuration changes. It is strongly +advised that the AFS servers be installed only on systems that will not be +shutdown or suspended unexpectedly. An inadvertent +shutdown will corrupt volume data.
The OpenAFS for Windows installer by default activates a weak form of encrypted data transfer between the AFS client and the AFS @@ -1458,12 +1476,12 @@ style='mso-bookmark:_Toc152605055'>3.14 Authenticated Access to the OpenAFS Client Service
OpenAFS authenticates SMB connections using either NTLM or -GSS SPNEGO (NTLM). In previous versions of OpenAFS, the SMB connections were -unauthenticated which opened the door for several attacks which could be used -to obtain access to another user's tokens on shared machines. -
+GSS SPNEGO (NTLM). In previous versions of OpenAFS, the SMB connections +were unauthenticated which opened the door for several attacks which could be +used to obtain access to another user's tokens on shared +machines. -When GSS SPNEGO attempts a Kerberos 5 authentication, the +
When GSS SPNEGO attempts a Kerberos v5 authentication, the Windows SMB client will attempt to retrieve service tickets for "cifs/afs@REALM" (if the loopback adapter is in use) or "cifs/machine-afs@REALM" (if the loopback adapter is not being @@ -1501,10 +1519,11 @@ Microsoft Windows Internet Connection Firewall
The OpenAFS Client is compatible with the Internet Connection Firewall that debuted with Windows XP SP2 and Windows 2003 -SP1. The Internet Connection Firewall will be automatically adjusted to allow -the receipt of incoming callback messages from the AFS file server. In -addition, the appropriate Back Connection registry entries are added to -allow SMB authentication to be performed across the Microsoft Loopback Adapter.
+SP1. The Internet Connection Firewall will be automatically adjusted to +allow the receipt of incoming callback messages from the AFS file server. +In addition, the appropriate Back Connection registry entries are added +to allow SMB authentication to be performed across the Microsoft Loopback +Adapter.Many applications on Windows (e.g. Microsoft Office) require the use of byte range locks applied to a file either to protect against -simultaneous file access or as a signaling mechanism. OpenAFS for -Windows release 1.5 (or greater) implements byte range locking within the -CIFS-AFS gateway server. This support for byte range locking -obtains AFS advisory file server locks to simulate Microsoft Windows mandatory +simultaneous file access or as a signaling mechanism. OpenAFS for Windows +release 1.5 (or greater) implements byte range locking within the CIFS-AFS +gateway server. This support for byte range locking obtains AFS +advisory file server locks to simulate Microsoft Windows mandatory locks. When an application opens a file, a lock will be obtained from AFS indicating that the file is in use. If the lock is a write lock, access to the file will be restricted to other applications running on the same @@ -1547,13 +1566,13 @@ use.
lock semantics on top of AFS lock semantics it is important to understand how AFS file locks work. In Windows there are no special privileges associated with obtaining file locks. If you can read or execute a file, -then you can obtain shared and exclusive locks. In general, a Windows shared -lock equates to an AFS read lock and a Windows exclusive lock equates to an AFS -write lock. In AFS if you can write to a file, then you -can obtain a write lock. However, in AFS if you can read a file it does -not mean that you can obtain a read lock on it. The ability to -obtain read locks is granted only if you have the lock (or k) privilege. -This behavior is required in order to allow anonymous users to read files while +then you can obtain shared and exclusive locks. In general, a Windows +shared lock equates to an AFS read lock and a Windows exclusive lock equates to +an AFS write lock. In AFS if you can write to a file, then you can obtain +a write lock. However, in AFS if you can read a file it does not mean +that you can obtain a read lock on it. The ability to obtain read +locks is granted only if you have the lock (or k) privilege. This +behavior is required in order to allow anonymous users to read files while preventing them from being able to deny access to the files to other users. OpenAFS 1.4.0 and earlier as well as all IBM AFS file servers have an implementation bug that prevents users with write privileges from being @@ -1567,47 +1586,45 @@ CIFS-AFS gateway implements the following semantics in order to reduce the inconvenience on end users.OpenAFS for Windows implements an SMB server which is used
-as a gateway to the AFS filesystem. Because of limitations of the SMB implementation,
-Windows stores all files into AFS using OEM code pages such as CP437 (United
-States) or CP850 (Western Europe). These code pages are incompatible with
-the ISO Latin-1 character set typically used as the default on UNIX systems in
-both the
|
- [Ç] 128 - 08/00 200 80 C cedilla -[ü] 129 - 08/01 201 81 u diaeresis -[é] 130 - 08/02 202 82 e acute -[â] 131 - 08/03 203 83 a circumflex -[ä] 132 - 08/04 204 84 a diaeresis -[à] 133 - 08/05 205 85 a grave -[å] 134 - 08/06 206 86 a ring -[ç] 135 - 08/07 207 87 c cedilla -[ê] 136 08/08 - 210 88 e circumflex -[ë] 137 - 08/09 211 89 e diaeresis -[è] 138 - 08/10 212 8A e grave -[ï] 139 - 08/11 213 8B i diaeresis -[î] 140 - 08/12 214 8C i circumflex -[ì] 141 - 08/13 215 8D i grave -[Ä] 142 08/14 - 216 8E A diaeresis -[Å] 143 - 08/15 217 8F A ring -[É] 144 - 09/00 220 90 E acute -[æ] 145 - 09/01 221 91 ae diphthong -[Æ] 146 - 09/02 222 92 AE diphthong -[ô] 147 - 09/03 223 93 o circumflex -[ö] 148 - 09/04 224 94 o diaeresis -[ò] 149 - 09/05 225 95 o grave -[û] 150 - 09/06 226 96 u circumflex -[ù] 151 - 09/07 227 97 u grave -[ÿ] 152 - 09/08 230 98 y diaeresis -[Ö] 153 - 09/09 231 99 O diaeresis -[Ü] 154 - 09/10 232 9A U diaeresis -[ø] 155 - 09/11 233 9B o slash + [Ç] 128 08/00 200
+ 80 C cedilla
+ [ü] 129 08/01 201 81 u diaeresis
+ [é] 130 08/02 202 82 e acute
+ [â] 131 08/03 203 83 a circumflex
+ [ä] 132 08/04 204 84 a diaeresis
+ [à] 133 08/05 205 85 a grave
+ [å] 134 08/06 206 86 a ring
+ [ç] 135 08/07 207 87 c cedilla
+ [ê] 136 08/08 210 88 e circumflex
+ [ë] 137 08/09 211 89 e diaeresis
+ [è] 138 08/10 212 8A e grave
+ [ï] 139 08/11 213 8B i diaeresis
+ [î] 140 08/12 214 8C i circumflex
+ [ì] 141 08/13 215 8D i grave
+ [Ä] 142 08/14 216 8E A diaeresis
+ [Å] 143 08/15 217 8F A ring
+ [É] 144 09/00 220 90 E acute
+ [æ] 145 09/01 221 91 ae diphthong
+ [Æ] 146 09/02 222 92 AE diphthong
+ [ô] 147 09/03 223 93 o circumflex
+ [ö] 148 09/04 224 94 o diaeresis
+ [ò] 149 09/05 225 95 o grave
+ [û] 150 09/06 226 96 u circumflex
+ [ù] 151
+ 09/07 227 97 u grave
+ [ÿ] 152 09/08 230 98 y diaeresis
+ [Ö] 153
+ 09/09 231 99 O diaeresis
+ [Ü] 154 09/10 232 9A U diaeresis + [ø] 155 09/11 233 9B o slash [£] 156 09/12 234 9C Pound sterling sign -[Ø] 157 - 09/13 235 9D O slash -[×] 158 - 09/14 236 9E Multiplication sign - [] 159
- 09/15 237 9F [Ø] 157 09/13 235
+ 9D O slash
+ [×] 158 09/14 236 9E Multiplication sign
+ [] 159 09/15 237 9F |
The performance of the AFS Client Service is significantly affected by the access times associated with the AFSCache paging -file. When given the choice, the AFSCache file should be placed on -a fast disk, preferably NTFS, the file should not be compressed and should +file. When given the choice, the AFSCache file should be placed on a +fast disk, preferably NTFS, the file should not be compressed and should consist of as few fragments as possible. Significant performance gains can be achieved by defragmenting the AFSCache file with Sysinternal's Contig utility while the AFS Client Service is stopped.
@@ -2007,8 +2029,8 @@ are present and that they refer to the dll "rpcrt4.dll":HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" "ncadg_ip_udp"
-HKLM "SOFTWARE\Microsoft\RPC\ClientProtocols" -"ncacn_http"
+HKLM +"SOFTWARE\Microsoft\RPC\ClientProtocols" "ncacn_http"
Microsoft Office makes heavy use of asynchronous @@ -2082,9 +2104,9 @@ re-established until the machine is rebooted.
applications should be modified to use of \\AFS\<cellname>\<path> instead of drive letters. -Although 64-bit Windows platforms support both 64-bit and 32-bit applications, the OpenAFS Service installed on the machine must be @@ -2138,323 +2160,18 @@ the necessary privilege separation, until that time some functions such as the Start and Stop Service features of the AFS System Tray tool and the AFS Control Panel will not work unless they are Run as Administrator.
--The help files provided with OpenAFS are in .HLP format. -Windows Vista does not include a help engine for this format. 4. How to Debug Problems with OpenAFS for Windows: - -
OpenAFS for Windows provides a wide range of tools to assist -the developers in debugging problems. The techniques available are varied -because of the wide range of issues that have been discovered over the -years. When filing bug reports to the -OpenAFS developers, please collect as much information as possible and forward -it as part of the bug
- -pioctl (path-based ioctl) calls are used by various tools to -communicate with the AFS Client Service. Some of the operations performed -include:
- -· setting/querying -tokens (tokens.exe, aklog.exe, afscreds.exe)
- -· setting/querying -ACLs
- -· setting/querying -cache parameters
- -· flushing -files or volumes
- -· setting/querying -server preferences
- -· querying -path location
- -· checking -the status of servers and volumes
- -· setting/querying -the sysname list
- -pioctl calls are implemented by writing to a special UNC -path that is processed by the AFS Client Service. If there is a -failure to communicate with the AFS Client Service via SMB/CIFS, it will be -impossible to perform any of the above operations.
- -To assist in debugging these problems, the registry value:
- -[HKLM\SOFTWARE\OpenAFS\Client]
- -REG_DWORD: IoctlDebug = 0x01
- -should be set. Then any of the commands that perform -pioctl calls should be executed from the command prompt. With this key -set the pioctl library will generate debugging output to stderr. The -output will contain the Win32 API calls executed along with their most -important parameters and their return code. The MSDN Library and -the Microsoft KnowledgeBase can be used as a reference to help you determine -the configuration probem with your system.
- -Every time the AFS Client Service starts it appends data -about its progress and configuration to a file. This file provides -information crucial to determining why the service cannot start when there are -problems. When the process terminates due to a panic condition it will -write to this file the source code file and line number of the error. In -many cases the panic condition is due to a misconfiguration of the -machine. In other cases it might be due to a programming error in the -software. A quick review of the location in the source code will quickly -reveal the reason for the termination.
- -The MaxLogSize -registry value determines the maximum size of the %WINDIR%\TEMP\afsd_init.log -file. If the file is larger than this value when OpenAFS Client Service -starts, the file will be reset to 0 bytes. If value is set to 0, the file -will be allowed to grow indefinitely.
- -When attempting to debug the behavior of the SMB/CIFS Server -and the Cache Manager it is often useful to examine a log of the operations -being performed. While running the AFS Client Service keeps an in memory -log of many of its actions. The default number of actions preserved -at any one time is 5000. This can be adjusted with the registry value:
- --[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]
- -REG_DWORD TraceBufferSize
- -A restart of the service is necessary when adjusting this -value. Execute "fs trace -on" to clear to the log and -"fs trace -dump" to output the contents of the log to the file.
- -An alternatve option to the use of "fs trace --dump" to capture internal OpenAFS Client Service events is to use a tool -such as Sysinternal's DbgView to capture real-time debugging output. When -the OpenAFS Client Service starts and Bit 2 of the TraceOption value in the registry is set, all -trace log events are output using the Windows Debug Monitor interface -(OutputDebugString).
- --[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]
- -REG_DWORD -TraceOption = 0x04
- -Use fs trace on and fs trace off to toggle the generation -of log messages.
- -Sysinternals -FileMon utility can be use to monitor the file operations requested by -applications and their success or failure. Use the Volumes menu to -restrict FileMon monitor to Network volumes only in order to reduce the -output to just the CIFS requests. Turn on the Advanced Output -option in order to log with finer granularity.
- -Turn on the Clock Time and Show Milliseconds -options in both tools to make it easier to synchronize the application requests -and the resulting OpenAFS Client Service operations. The captured -data can be stored to files for inclusion in bug reports.
- -If the AFS Client Service become unresponsive to any form of -communication there may be a serious error that can only be debugged by someone -with access to the source code and a debugger. The "fs -minidump" command can be used to force the generation of a MiniDump file -containing the state of all of the threads in the AFS Client Service process.
- -If you are having trouble with the Integrated Logon -operations it is often useful to be able to obtain a log of what it is -attempting to do. Setting Bit 0 of the TraceOption registry value:
- --[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]
- -REG_DWORD TraceOption = 0x01
- -will instruct the Integrated Logon Network Provider and -Event Handlers to log information to the Windows Event Log: Application under -the name AFS Logon".
- -The rxdebug.exe tool can be used to query a variety of -information about the AFS services installed on a given machine. The port -for the AFS Cache Manager is 7001.
- -Usage: rxdebug -servers <server machine> [-port -<IP port>] [-nodally]
- --[-allconnections] [-rxstats] [-onlyserver] [-onlyclient]
- -[-onlyport -<show only <port>>]
- -[-onlyhost -<show only <host>>]
- -[-onlyauth -<show only <auth level>>] [-version]
- -[-noconns] -[-peers] [-help]
- -Where: --nodally don't show dallying -conns
- ---allconnections don't filter out uninteresting connections
- ---rxstats show Rx statistics
- ---onlyserver only show server conns
- ---onlyclient only show client conns
- ---version show AFS version id
- ---noconns show no connections
- ---peers show peers
- -The cmdebug.exe tool can be used to query the state of the -AFS Cache Manager on a given machine.
- -Usage: cmdebug -servers <server machine> [-port -<IP port>] [-long]
- -[-refcounts] -[-callbacks] [-addrs] [-cache] [-help]
- -Where: -long -print all info
- --refcounts -print only cache entries with positive reference counts
- --callbacks -print only cache entries with callbacks
- ---addrs print only host interfaces
- ---cache print only cache configuration
- -The persistent cache is stored in a Hidden System file at -%WinDir%\TEMP\AFSCache. If there is a problem with the persistent cache -that prevent the AFS Client Service from being able to start a validation check -on the file can be performed.
- -afsd_service.exe --validate-cache -<cache-path>
- -Bug reports should be sent to openafs-bugs@openafs.org. +
The help files provided with OpenAFS are in .HLP format. Windows Vista does not include a +help engine for this format. openafs-bugs@openafs.org. Please include as much information as possible about the issue. If you are reporting a crash, please install the debugging symbols by re-running the installer. If a dump file is available for the problem, %WINDIR%\TEMP\afsd.dmp, include it along with the AFS Client Trace file -%WINDIR%\TEMP\afsd.log. The AFS Client startup log is -%WINDIR%\TEMP\afsd_init.log. Send the last continuous block of log -information from this file.
+%WINDIR%\TEMP\afsd.log. The AFS Client startup log is %WINDIR%\TEMP\afsd_init.log. +Send the last continuous block of log information from this file.Configuring DrWatson to generate dump files for crashes:
@@ -2582,11 +2299,11 @@ style='mso-bookmark:_Toc115417094'>6.2. Secure Endpoints Inc.Secure Endpoints Inc. provides development and support services for OpenAFS for Windows and MIT Kerberos for Windows. - Donations provided to Secure Endpoints Inc. for the development of -OpenAFS are used to cover the OpenAFS gatekeeper responsibilities; providing -support to the OpenAFS community via the OpenAFS mailing lists; and furthering -development of desired features that are either too small to be financed by -development contracts. + Donations provided to Secure Endpoints Inc. for the development of OpenAFS +are used to cover the OpenAFS gatekeeper responsibilities; providing support to +the OpenAFS community via the OpenAFS mailing lists; and furthering development +of desired features that are either too small to be financed by development +contracts.Secure Endpoints Inc. accepts software development agreements from organizations who wish to fund a well-defined set of bug fixes @@ -2635,11 +2352,11 @@ name="_Toc115417098">
7. MSI Deployment Guide -and then checking the resulting openafs-test.msi to see if -all changes you have made above to openafs-modified.msi is present in openafs-test.msi. -'msitran' will complain if some modification in the transform can not be -successfully applied.
+all changes you have made above to openafs-modified.msi is present in +openafs-test.msi. 'msitran' will complain if some modification in the +transform can not be successfully applied.As mentioned above, you can use a tool like ORCA.EXE to edit the MSI databases directly when editing openafs-modified.msi. More @@ -2777,11 +2494,12 @@ You will need to add properties as needed to the MSI.
When one of the configurable properties is set, the installer will use the property value to set the corresponding setting in the -HKEY_LOCAL_MACHINE registry hive. The HKEY_CURRENT_USER hive is not -touched by the installer.
+HKEY_LOCAL_MACHINE registry hive. The HKEY_CURRENT_USER hive is not touched +by the installer. -For each property, the associated registry setting is referenced -by the same text used in Appendix A.
+For each property, the associated registry setting is +referenced by the same text used in Appendix +A.
Strings are quoted using single quotes (e.g. 'a string'). An empty string is denoted as ''. Note that you can't author null values @@ -2828,33 +2546,27 @@ style='mso-bookmark:_Toc115416165'>7.2.1.2 OpenAFS for Windows Properties
[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\Parameters]
[HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider]
[HKLM\SOFTWARE\OpenAFS\Client]
These properties are used to set the values of registry -entries associated with OpenAFS for Windows.
+These properties are used to set the values of registry entries +associated with OpenAFS for Windows.
AFSCACHEPATH
+ style='mso-bookmark:_Toc115416170'>AFSCACHEPATH
Registry key : (Service parameters) Registry value : CachePath @@ -2886,10 +2597,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
AFSCACHESIZE
+ style='mso-bookmark:_Toc115416171'>AFSCACHESIZE
Registry key : (Service parameters) Registry value : CacheSize @@ -2899,10 +2609,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
AFSCELLNAME
+ style='mso-bookmark:_Toc115416172'>AFSCELLNAME
Registry key : (Service parameters) Registry value : Cell @@ -2912,10 +2621,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
FREELANCEMODE
+ style='mso-bookmark:_Toc115416173'>FREELANCEMODE
Registry key : (Service parameters) Registry value : FreelanceClient @@ -2925,10 +2633,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
HIDEDOTFILES
+ style='mso-bookmark:_Toc115416174'>HIDEDOTFILES
Registry key : (Service parameters) Registry value : HideDotFiles @@ -2938,10 +2645,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
LOGONOPTIONS
+ style='mso-bookmark:_Toc115416175'>LOGONOPTIONS
Registry key : (Network provider) Registry value : LogonOptions @@ -2954,10 +2660,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
MOUNTROOT
+ style='mso-bookmark:_Toc115416176'>MOUNTROOT
Registry key : (Service parameters) Registry value : Mountroot @@ -2967,10 +2672,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
NETBIOSNAME
+ style='mso-bookmark:_Toc115416177'>NETBIOSNAME
Registry key : (Service parameters) Registry value : NetbiosName @@ -2981,10 +2685,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
NOFINDLANABYNAME
+ style='mso-bookmark:_Toc115416178'>NOFINDLANABYNAME
Registry key : (Service parameters) Registry value : NoFindLanaByName @@ -2994,10 +2697,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
RXMAXMTU
+ style='mso-bookmark:_Toc115416179'>RXMAXMTU
Registry key : (Service parameters) Registry value : RxMaxMTU @@ -3007,10 +2709,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
SECURITYLEVEL
+ style='mso-bookmark:_Toc115416180'>SECURITYLEVEL
Registry key : (Service parameters) Registry value : SecurityLevel @@ -3020,10 +2721,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
SMBAUTHTYPE
+ style='mso-bookmark:_Toc115416181'>SMBAUTHTYPE
Registry key : (Service parameters) Registry value : SMBAuthType @@ -3033,10 +2733,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
STOREANSIFILENAMES
+ style='mso-bookmark:_Toc115416182'>STOREANSIFILENAMES
Registry key : (OpenAFS Client) Registry value : StoreAnsiFilenames @@ -3046,10 +2745,9 @@ entries associated with OpenAFS for Windows. | |||||||||||||||||||||||
USEDNS
+ style='mso-bookmark:_Toc115416183'>USEDNS
Registry key : (Service parameters) Registry value : UseDNS @@ -3064,36 +2762,34 @@ name="_7.2.1.2.2_AFSCreds.exe_Properties">7.2.1.2.2 AFSCreds.exe PropertiesThese properties are combined to add a command line option -to the shortcut that will be created in the Start:Programs:OpenAFS and -Start:Programs:Startup folders (see CREDSSTARTUP). The method of -specifying the option was chosen for easy integration with the Windows -Installer user interface. Although other methods can be used to specify -options to AFSCREDS.EXE, it is advised that they be avoided as transforms -including such options may not apply to future releases of OpenAFS. +to the shortcut that will be created in the Start:Programs:OpenAFS and Start:Programs:Startup +folders (see CREDSSTARTUP). The method of specifying the option was +chosen for easy integration with the Windows Installer user interface. +Although other methods can be used to specify options to AFSCREDS.EXE, it is +advised that they be avoided as transforms including such options may not apply +to future releases of OpenAFS.It is important to create the -new feature under the 'feaClient' feature, which will ensure that the -configuration file will be installed when the client binaries are installed. +It is important to create the new +feature under the 'feaClient' feature, which will ensure that the configuration +file will be installed when the client binaries are installed. Setting 'Display' to 0 will hide -this feature from the feature selection dialog during an interactive -installation. A value of 30 for 'Level' allows this feature to be -installed by default (on a 'Typical' installation). +this feature from the feature selection dialog during an interactive installation. +A value of 30 for 'Level' allows this feature to be installed by default (on a +'Typical' installation).The 'Attributes' value is msidbFeatureAttributesDisallowAdvertise (8), which is set on all features in @@ -3547,8 +3240,8 @@ new row with the following values: The 'Attributes' value is msidbFileAttributesNonCompressed (8192). This is because we will be placing this file in the same directory as the MSI instead of embedding the -file in it. Transforms do not support updating compressed sources or adding -new cabinet streams. +file in it. Transforms do not support updating compressed sources or +adding new cabinet streams.Finally, the 'Sequence' value of 1000 will be used later to distinguish the file as being in a separate source @@ -3594,8 +3287,8 @@ row with the following values : (leave other fields blank) -The sequence number of 1000 -designates this as the media source for the newly added file. +The sequence number of 1000 designates +this as the media source for the newly added file.
|
|
(new row) - - Name + Name : 'LogonOptions' Value @@ -3829,8 +3521,7 @@ hold the new registry keys. : 2 Key - : - 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST' + : 'SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon\NetworkProvider\Domain\LOCALHOST' Name : 'FailLoginsSilently' @@ -3874,8 +3565,8 @@ hold the new registry keys. | |
|
-
- (new row)
+ (new row) |
(new row) - Component - : 'rcm_FreelanceKeys' + + Component : 'rcm_FreelanceKeys' |
The example adds a read-only mountpoint to the -athena.mit.edu cell's root.afs volume as well as a read-write mountpoint. -Aliases are also provided using symlinks.
+The example adds a read-only mountpoint to the athena.mit.edu +cell's root.afs volume as well as a read-write mountpoint. Aliases are +also provided using symlinks.
Note that versions of the OpenAFS NSIS package prior to 1.3.65 had a bug where it couldn't be uninstalled properly in unattended mode. Therefore the MSI package will not try to uninstall an OpenAFS NSIS -package if running unattended. This means that group policy based deployments -will fail on machines that have the OpenAFS NSIS package installed.
+package if running unattended. This means that group policy based +deployments will fail on machines that have the OpenAFS NSIS package installed.If you have used a different MSI package to install OpenAFS
and wish to upgrade it you can author rows into the 'Upgrade' table as
@@ -4182,11 +3874,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD
Default: -1
Variable: LANadapter
Type: DWORD
Default: 98304 (CM_CONFIGDEFAULT_CACHESIZE)
Variable: cm_initParams.cacheSize
Type: DWORD
Default: 17 (CM_CONFIGDEFAULT_CHUNKSIZE)
Variable: cm_logChunkSize (cm_chunkSize = 1 << cm_logChunkSize)
Type: DWORD
Default: 2 (CM_CONFIGDEFAULT_DAEMONS)
Variable: numBkgD
Type: DWORD
Default: 25 (CM_CONFIGDEFAULT_SVTHREADS)
Variable: numSvThreads
Type: DWORD
Default: 10000 (CM_CONFIGDEFAULT_STATS)
Variable: cm_initParams.nStatCaches
Type: DWORD {1,0}
Default : 0
If enabled (set to 1), the Logoff Event handler will not
@@ -4296,11 +3976,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: REG_SZ
Default: "root.afs"
Variable: cm_rootVolumeName
Type: REG_SZ
Default: "/afs"
Variable: cm_mountRoot
Type: REG_SZ or REG_EXPAND_SZ
Default: "%TEMP%\AFSCache"
Variable: cm_CachePath
Type: DWORD [0..1]
Default: 0
Variable: buf_CacheType
Type: DWORD [0..2]
Default: 1
Variable: buf_CacheType
Type: DWORD {1,0}
Default: 0
Variable: traceOnPanic
Type: REG_EXPAND_SZ
Default: "AFS"
Variable: cm_NetbiosName
Type: DWORD {1,0}
Default: 0
Variable: isGateway
Type: DWORD {1,0}
Default: 0
Variable: reportSessionStartups
Type: DWORD
Default: 5000 (CM_CONFIGDEFAULT_TRACEBUFSIZE)
Variable: traceBufSize
Type: REG_SZ
Default: "x86_win32 i386_w2k i386_nt40" (X86)
amd64_win64 x86_win32 i386_w2k (AMD64)
@@ -4493,11 +4151,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD {1,0}
Default: 0
Variable: cryptall
Type: DWORD {1,0}
Default: 1
Variable: cm_dnsEnabled
Enables resolving volservers using AFSDB DNS queries.
As of 1.3.60, this value is ignored as the DNS query - support utilizes the Win32 DNSQuery API which is available on Win2000 and - above.
+ support utilizes the Win32 DNSQuery API which is available on Win2000 and above.Type: DWORD {1,0}
Default: 0
Variable: cm_freelanceEnabled
Type: DWORD {1,0}
Default: 1
Variable: smb_hideDotFiles
Type: DWORD
Default: 50
Variable: smb_maxMpxRequests
Type: DWORD
Default: 100
Variable: smb_maxVCPerServer
Type: REG_SZ
Default: <none>
Variable: rootCellName
Type: DWORD {0,1}
Default: 0
Variable: rx_nojumbo
Type: DWORD
Default: -1
Variable: rx_mtu
Type: DWORD
Default: 60 (seconds)
Variable: ConnDeadtimeout
Type: DWORD
Default: 120 (seconds)
Variable: HardDeadtimeout
Type: DWORD {0-15}
Default: 0
Enables logging of debug output to the Windows Event
@@ -4697,11 +4333,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD {0, 1}
Default: 1
Variable: allSubmount (smb.c)
@@ -4714,27 +4348,23 @@ style='mso-bookmark:_Toc115416200'>Regkey:Type: DWORD {0, 1}
Default: 0
Disables the attempt to identity the network adapter to use - by looking for an adapter with a display name of "AFS".
+Disables the attempt to identity the network adapter to + use by looking for an adapter with a display name of "AFS".
Type: DWORD {1..32} or {1..64} depending on the
- architecture
+ style='mso-bookmark:_Toc115416233'>Value: MaxCPUs
+
Type: DWORD {1..32} or {1..64} depending on the architecture
Default: <no default>
If this value is specified, afsd_service.exe will
restrict itself to executing on the specified number of CPUs if there are a
@@ -4745,11 +4375,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD {0..2}
Default: 2
If this value is specified, it defines the type of SMB
@@ -4765,11 +4393,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD {0 .. MAXDWORD}
Default: 100K
This entry determines the maximum size of the
@@ -4782,11 +4408,9 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD {0,1}
Default: 1
If set, flushes all volumes before the machine goes on
@@ -4797,9 +4421,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD (seconds)
Default: 180
This
@@ -4811,9 +4433,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD (seconds)
Default: 600
This value controls how frequently the AFS cache manager
@@ -4824,9 +4444,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD (seconds)
Default: 3600
This
@@ -4838,23 +4456,18 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD (seconds)
Default: 60
This
- value controls how frequently the AFS cache manager checks for callback
- invalidation.
Type: DWORD (seconds)
Default: 60
This
@@ -4866,9 +4479,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD (seconds)
Default: 180
This
@@ -4880,8 +4491,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
Type: DWORD
Default: 7001
This value specifies which port number should be used
@@ -4897,9 +4507,7 @@ style='mso-bookmark:_Toc115416200'>Regkey:
height:65.75pt'>
Type: DWORD {0, 1, 2}
Default: 1
Determines whether or not the AFS file server is
@@ -4927,11 +4535,10 @@ style='mso-bookmark:_Toc115416237'>Regkey:
Type: REG_SZ
Specifies the submount name to be mapped by afsd_service.exe at startup to the provided drive letter.
@@ -4953,11 +4560,9 @@ style='mso-bookmark:_Toc115416239'>Regkey:Type: REG_SZ
Default: <not defined>
Specifies the directory containing the CellServDB
@@ -4969,12 +4574,9 @@ style='mso-bookmark:_Toc115416239'>Regkey:
Type: REG_DWORD
Default: 0x1
This value can be used to disable the runtime
@@ -4992,11 +4594,9 @@ style='mso-bookmark:_Toc115416239'>Regkey:
Type: REG_DWORD
Default: 0x0
This value can be used to debug the cause of pioctl()
@@ -5010,11 +4610,9 @@ style='mso-bookmark:_Toc115416239'>Regkey:
Type: REG_DWORD
Default: 0x0 (MiniDumpNormal)
This value is used to specify the type of minidump
@@ -5045,16 +4643,14 @@ style='mso-bookmark:_Toc115416239'>Regkey:
Type: REG_DWORD
Default: 0x0
This value can be used to force the AFS Client Service - to store filenames using the Windows system's ANSI character set instead of - the OEM Code Page character set which has traditionally been used by SMB file +
This value can be used to force the AFS Client Service to + store filenames using the Windows system's ANSI character set instead of the + OEM Code Page character set which has traditionally been used by SMB file systems.
Note: The use of ANSI characters will render access to
files with 8-bit OEM file names unaccessible from Windows. This option
@@ -5077,11 +4673,9 @@ style='mso-bookmark:_Toc115416245'>Regkey:
Type: REG_SZ
Default: <none>
This key is used to map SMB/CIFS shares to Client Side
@@ -5106,16 +4700,14 @@ style='mso-bookmark:_Toc152605197'>Regkey:
Type: REG_SZ
Default: <none>
This key is used to store dot terminated mount point - strings for use in constructing the fake root.afs volume when Freelance - (dynamic roots) mode is activated.
+ strings for use in constructing the fake root.afs volume when Freelance (dynamic + roots) mode is activated."athena.mit.edu#athena.mit.edu:root.cell."
".athena.mit.edu%athena.mit.edu:root.cell."
These values used to be stored in afs_freelance.ini
@@ -5136,11 +4728,9 @@ _Toc154229520'>Regkey:Type: REG_SZ
Default: <none>
This key is used to store a dot terminated symlink
@@ -5167,18 +4757,16 @@ style='mso-bookmark:_Toc115416251'>Regkey:
Type: REG_EXPAND_SZ
Default: <none>
This key is used to store mappings of UNIX style AFS - paths to submount names which can be referenced as UNC paths. For - example the submount string /athena.mit.edu/user/j/a/jaltman" can be - associated with the submount name "jaltman.home". This can - then be referenced as the UNC path \\AFS\jaltman.home.
+This key is used to store mappings of UNIX style AFS paths + to submount names which can be referenced as UNC paths. For example the + submount string /athena.mit.edu/user/j/a/jaltman" can be associated + with the submount name "jaltman.home". This can then be + referenced as the UNC path \\AFS\jaltman.home.
These values used to be stored in afsdsbmt.ini
NOTE: Submounts should no longer be used with OpenAFS.
Use the Windows Explorer to create drive mappings to AFS UNC paths instead of
@@ -5200,11 +4788,9 @@ _Toc154229524'>Regkey:
Type: REG_DWORD
Default: <none>
This key is used to specify a default set of VLDB server
@@ -5229,11 +4815,9 @@ style='mso-bookmark:_Toc115416255'>Regkey:
Type: REG_DWORD
Default: <none>
This key is used to specify a default set of File server @@ -5266,11 +4850,9 @@ style='mso-bookmark:_Toc115416258'>Regkey:
Type: DWORD
Default: 0
Do not display message boxes if the login fails.
@@ -5290,11 +4872,9 @@ style='mso-bookmark:_Toc115416260'>Regkey:Type: DWORD
Default: 0
Disables visible warnings during logon.
@@ -5304,11 +4884,9 @@ style='mso-bookmark:_Toc115416260'>Regkey:Type: REG_SZ
NSIS: %WINDIR%\SYSTEM32\afslogon.dll
Specifies the install location of the authentication
@@ -5319,10 +4897,9 @@ style='mso-bookmark:_Toc115416260'>Regkey:
Type: DWORD
NSIS: 0x02
Specifies the class of network provider
@@ -5332,11 +4909,9 @@ style='mso-bookmark:_Toc115416260'>Regkey:Type: REG_MULTI_SZ
NSIS: PNP_TDI
Specifies the service groups upon which the AFS Client
@@ -5349,26 +4924,23 @@ style='mso-bookmark:_Toc115416260'>Regkey:
Type: REG_MULTI_SZ
NSIS: Tcpip NETBIOS RpcSs
Specifies a list of services upon which the AFS Client - Service depends. Windows should not attempt to start the AFS Client - Service until all of the specified services have successfully started.
+ Service depends. Windows should not attempt to start the AFS Client Service + until all of the specified services have successfully started.Type: REG_SZ
NSIS: "OpenAFSDaemon"
Specifies the display name of the AFS Client Service
@@ -5378,11 +4950,9 @@ style='mso-bookmark:_Toc115416260'>Regkey:Type: REG_SZ
NSIS: %WINDIR%\SYSTEM32\afslogon.dll
Specifies the DLL to use for the network provider
@@ -5397,12 +4967,12 @@ style='mso-bookmark:_Toc154229539'>A.2. Domain specific configuration keys for the Network ProviderThe network provider can be configured to have different -behavior depending on the domain that the user logs into. These settings -are only relevant when using integrated login. A domain refers to an -Active Directory (AD) domain, a trusted Kerberos (non-AD) realm or the local -machine (i.e. local account logins). The domain name that is used for -selecting the domain would be the domain that is passed into the NPLogonNotify -function of the network provider.
+behavior depending on the domain that the user logs into. These settings are +only relevant when using integrated login. A domain refers to an Active +Directory (AD) domain, a trusted Kerberos (non-AD) realm or the local machine +(i.e. local account logins). The domain name that is used for selecting +the domain would be the domain that is passed into the NPLogonNotify function +of the network provider.Domain specific registry keys are:
@@ -5476,11 +5046,9 @@ name"]Type: DWORD
Default: 0x01
NSIS/WiX: depends on user configuration
@@ -5500,11 +5068,9 @@ name"]Type: DWORD (1|0)
Default: 0
NSIS/WiX: (not set)
Type: REG_SZ or REG_EXPAND_SZ
Default: (null)
NSIS/WiX: (only value under NP key) <install path>\afscreds.exe -:%s -x
@@ -5537,11 +5101,9 @@ name"]
Type: DWORD
Default: 30
NSIS/WiX: (not set)
Type: DWORD
Default: 5
NSIS/WiX: (not set)
Type: REG_MULTI_SZ
NSIS: <not set>
When Kerberos 5 is being used, TheseCells provides a +
When Kerberos v5 is being used, TheseCells provides a list of additional cells for which tokens should be obtained with the default - Kerberos 5 principal.
+ Kerberos v5 principal.Type: REG_SZ
Default: ""
Function: GetGatewayName()
If the AFS client is utilizing a gateway to obtain AFS - access, the name of the gateway is specified by this value.
+If the AFS client is utilizing a gateway to obtain AFS access, + the name of the gateway is specified by this value.
Type: REG_SZ
Default: <none>
Variable: IsServiceConfigured()
Type: DWORD {0, 1}
Default: 1
Function: InitApp(), Main_OnCheckTerminate()
Type: DWORD {0, 1}
Default: 1
Function: KFW_is_available()
When MIT Kerberos for Windows can be loaded, Kerberos 5 +
When MIT Kerberos for Windows can be loaded, Kerberos v5 will be used to obtain AFS credentials. By setting this value to 0, the - internal Kerberos 4 implementation will be used instead. The current + internal Kerberos v4 implementation will be used instead. The current user value is checked first; if it does not exist the local machine value is checked.
Type: DWORD {0, 1}
Default: 0
Function: KFW_use_krb524()
When MIT Kerberos for Windows can be loaded, Kerberos 5 +
When MIT Kerberos for Windows can be loaded, Kerberos v5 will be used to obtain AFS credentials. By setting this value to 1, the - Kerberos 5 tickets will be converted to Kerberos 4 tokens via a call to the + Kerberos v5 tickets will be converted to Kerberos v4 tokens via a call to the krb524 daemon. The current user value is checked first; if it does not exist the local machine value is checked.
Type: REG_SZ
Default: "-A -M -N -Q"
Function: Shortcut_FixStartup
Type: REG_SZ
Default: <none>
Function: Afscreds.exe GetDefaultCell()
Type: DWORD {0, 1}
Default: <none>
Function: LoadRemind(), SaveRemind()
Type: DWORD {0, 1}
Default: <none>
These values are used to store the persistence state of
@@ -5896,11 +5438,9 @@ style='mso-bookmark:_Toc115416301'>Regkey:
Type: REG_SZ
Default: <none>
These values are used to store the AFS path in UNIX
@@ -5913,19 +5453,19 @@ style='mso-bookmark:_Toc115416301'>Regkey: