-------[  Phrack Magazine --- Vol. 9 | Issue 55 --- 09.09.99 --- 13 of 19  ]


-------------------------[  Black Book of AFS  ]


--------[  nicnoc  ]


----[  Introduction

AFS is commonly deployed as a distributed filesystem solution in academic and
research environments.  This short article serves as an introductory guide to
publicly-accessible resources on AFS.  As always, misuse of this information
by the reader is taken at his or her own peril.

The current incarnation of AFS grew out of research conducted with the Andrew
FileSystem at Carnegie-Mellon University, also home of the CODA distributed fs
research (http://www.coda.cs.cmu.edu/).  AFS is now a commercial product,
supported and sold by the Transarc Corporation (www.transarc.com).


----[  Conventions

Resources on AFS listed in this document will take the form of '/afs/cell
name'.  As you will discover, certain hosts are only accessible from a gateway
immediately associated with the cell.  For example, the node net.mit.edu
can only be reached from the outside (ie. using methods other than a local
fs mount) through the web.mit.edu AFS gateway.  Where appropriate, these
access restrictions are noted. 


----[  Basics

Terminology
-----------
cell : Multiple hosts within the same domain sharing a single fs image.
 - local cell   : Describes a cell within the local domain.
 - foreign cell : All cells not within the local domain.
 - cell name    : Usually a derivation of the FQDN.
node : Generic term for any host on the network.
ACL  : Access Control List - who gets what, and how.

Technical 
---------
Access permissions of files and directories on an AFS cell are handled
independently of the underlying operating system permissions.  Traditional
Unix fs permission bits are divided into read, write, and execute.  The AFS
ACL groupings build on this concept and add extensions suitable for
distributed file-sharing.  

Below is a basic introduction to concepts and commands used to manage AFS; by
no means a complete treatment of the subject.  See tutorials at
http://www.alw.nih.gov/Docs/AFS/AFS_toc.html and
http://www.slac.stanford.edu/comp/unix/afs/users-guide/afs-frames.htm for
more information. 

ACL bits
--------
r : read        : view directory and file contents
l : lookup      : searching of a directory for filenames (recursive find)
i : insert      : create a new directory or file
d : delete      : remove a file or subdirectory
w : write       : modification of file contents
k : lock        : owner's processes allowed to flock() in this dir
a : administer  : user permitted to modify ACL for this resource

Commands for ACL listing and modification 
-----------------------------------------
fs: listacl <filename> (alias: la) : list access control list
setacl <directory> <username> <permissions> (alias: sa)
.... set access control list

ex. setacl secret.doc jsbach lidrw

pts:
Invoked as 'pts option' on the command-line.  Manages protection
groups, which permit a smaller group of users to access resources
owned by another user.
 options:
  adduser -user user1 user2... -group <owner>:<group name>
  	.... adds user(s) to an existing protection group
  removeuser -user user1 user2... -group <owner>:<group name>
  	.... removes user(s) from a protection group 
  creategroup <owner>:<group name>
  	.... create a protection group
  examine <path>
  	....  volume name of specified resource at <path>
  membership -name <user>  (alternatively <group name>:<owner>)
  	.... list protection group membership for user
		
Protocol information
--------------------
	AFS is implemented over wide-area TCP/IP networks, optionally 
authenticating users with a modified Kerberos implementation.  Client nodes 
utilize a cache manager, which stores frequently-accessed data on a local 
disk for faster retrieval.  

	Taken from an unknown cell's /etc/service, the ports and 
protocols that make AFS work its magic: 

afs3-fileserver 7000/udp       # file server itself
afs3-callback   7001/udp       # callbacks to cache managers
afs3-prserver   7002/udp       # users & groups database
afs3-vlserver   7003/udp       # volume location database
afs3-kaserver   7004/udp       # AFS/Kerberos authentication service
afs3-volser     7005/udp       # volume management server
afs3-errors     7006/udp       # error interpretation service
afs3-bos        7007/udp       # basic overseer process
afs3-update     7008/udp       # server-to-server updater
afs3-rmtsys     7009/udp       # remote cache manager service

Gateways
========
	Legitimate access to AFS is quite easy to obtain.  Any alumnus of 
an institution where AFS is widely deployed (MIT, CMU, Stanford, etc.) 
usually has an account on a connected node.  Additionally, it is not 
uncommon for admins to grant research accounts on university systems 
to friends outside.  
	For those without friends and we, the unwashed masses, there are 
gateways which allow access to AFS through other services.  In the early 
1990's, these were commonly found on institution FTP and Gopher sites.  
Today, most gateways provide proxied access to AFS through the web.  
Transarc provides the WebSecure product which is the most commonly used
gateway software.
	AFS->web gateway discovery is a matter of blind luck, although
with the assistance of a search engine, it is possible to select possible
candidates. 

Two commonly-used gateways are: 
	web.mit.edu 
	www.transarc.com

The MIT gateway is more controlled than the Transarc's.  
Of the 74 active cells discovered, MIT permits only 12:
	andrew.cmu.edu 			athena.mit.edu
	cmu.edu 			cs.cmu.edu
	ece.cmu.edu 			iastate.edu
	ir.stanford.edu 		net.mit.edu
	northstar.dartmouth.edu 	sipb.mit.edu
	transarc.com 			umich.edu

Some cells local to mit.edu are accessible through the gateway with aliases, 
namely: athena, dev, net, and sipb.  These aliases and restricted-access
nodes are not enumerated. 

Directory
=========
	This listing comes from an audit of active nodes accessible 
through the transarc.com AFS->web gateway.  From a dataset of 511 entries, 
74 were found to be active.  The unofficial AFS FAQ (section 1.07)
(/afs/transarc.com/public/afs-contrib/doc/faq/afs-faq.html)
assisted with identification of certain cells. 
	Data were collected from a recent CellservDB 
(/afs/transarc.com/service/etc/CellServDB.export) and the output of 
'ls /afs' on an AFS node.  A simple script linking lynx, grep, 
sort and awk produced the below listing.  All listed nodes were verified 
to be accessible from an external network on 07.22.1999.  

## Corporate (COM)
|
# Transarc Corporation
	transarc.com	

## Education (EDU)
|
# Arizona State University
	asu.edu		
# Boston University
	bu.edu			
# Carnegie-Mellon University
	cmu.edu			
	andrew.cmu.edu
	ce.cmu.edu		
	! cs.cmu.edu		# Top-level directory not browsable	
	ece.cmu.edu	
	me.cmu.edu
# Cornell University 
	graphics.cornell.edu	
	msc.cornell.edu
	theory.cornell.edu
# Dartmouth College
	northstar.dartmouth.edu
# Indiana State University
	iastate.edu
# Indiana University
	ovpit.indiana.edu
# Massachusetts Institute of Technology
	athena.mit.edu
	sipb.mit.edu
# North Carolina Agricultural and Technical State University
	ncat.edu
# North Carolina State University
	eos.ncsu.edu
	unity.ncsu.edu
# Notre Dame
	nd.edu
# Pennsylvania State University
	psu.edu
# Pittsburgh Supercomputing Center
	psc.edu
# Rose-Hulman Institute of Technology
	rose-hulman.edu
# Stanford University
	ir.stanford.edu
	slac.stanford.edu
# University of California at Davis
	ece.ucdavis.edu
# University of Chicago
	spc.uchicago.edu
# University of Illinois at Chicago (NCSA)
	ncsa.uiuc.edu
# University of Maryland at Baltimore
	umbc.edu
# University of Maryland
	wam.umd.edu
# University of Michigan
	umich.edu
	citi.umich.edu
	engin.umich.edu
	lsa.umich.edu
	math.lsa.umich.edu
	dmsv.med.umich.edu
	sph.umich.edu
# University of Pittsburgh
	pitt.edu
# University of Utah
	utah.edu
	cs.utah.edu
# University of Washington
	cs.washington.edu
# University of Wisconsin
	cs.wisc.edu

## Government (GOV)
|
# Argonne National Labs
	anl.gov
# Fermi National Accelerator Lab
	fnal.gov
# National Energy Research Supercomputer Center
	nersc.gov
# National Institutes of Health
	alw.nih.gov
# Princeton Plasma Physics Laboratory
	pppl.gov

## Military  (MIL)
|
# Naval Research Laboratory
	cmf.nrl.navy.mil

## Network
|
# Energy Sciences Network
	es.net

## Organization (ORG)
|
# Esprit Research Network of Excellence (European Communities)
	research.ec.org
# Open Software Foundation
	ri.osf.org

## Europe and Asia
|
# European Laboratory for Particle Physics, Geneva
cern.ch
#Deutsches Elektronen-Synchrotron
	desy.de
#Univ. of Cologne Inst. for Geophysics & Meteorology
	geo.uni-koeln.de
# DESY-IfH Zeuthen
	ifh.de
# Leibniz-Rechenzentrum Muenchen
	lrz-muenchen.de
# Max-Planck-Institut fuer Astrophysik
	mpa-garching.mpg.de
# TH-Darmstadt
	hrzone.th-darmstadt.de
# Technische Universitaet Chemnitz-Zwickau
	tu-chemnitz.de
# Albert-Ludwigs-Universitat Freiburg
	uni-freiburg.de
# University of Hohenheim
	uni-hohenheim.de
# Rechenzentrum University of Kaiserslautern
	rhrk.uni-kl.de
# University of Cologne
	rrz.uni-koeln.de
# University of Stuttgart
	ihf.uni-stuttgart.de
	mathematik-cip.uni-stuttgart.de
	mathematik.uni-stuttgart.de
	rus.uni-stuttgart.de
# IN2P3 production cell
	in2p3.fr
# CASPUR Inter-University Computing Consortium
	caspur.it
# INFN Sezione di Pisa 
	pi.infn.it
# Real World Computer Partnership
	rwcp.or.jp
# Chalmers University of Technology - General users
        others.chalmers.se
# Royal Institute of Technology, NADA
	nada.kth.se

Interesting areas
=================
	Half of the challenge in network exploration is the act of 
finding fun items to look at.  The list below is by no means complete, 
and barely touches the surface of what the author and others have 
collected over the years.  Enjoy, and good luck hunting. 

/afs/andrew.cmu.edu/local/src/os/ 
	.... Left over from a time when Irix source resided there.
/afs/ncat.edu/common/
	.... Root directory of an Ultrix installation
/afs/ir.stanford.edu/users/c/l/clinton 
	.... Not the daughter of the U.S. President, but a reasonable 
 	     facsimile thereof which causes much excitement among readers. 
/afs/rose-hulman.edu/users/manager/agnello/compromised/
	.... AFS follows the 'user-managed' philosophy of resource
             management, leaving it up to individual users to secure the
	     permissions on their own files.  This unfortunate admin 
	     forgot to set the permissions on data collected during a 
	     recent (08.08.1999) security compromise.  The world, 
	     including the intruder, can now browse his work and see
	     what they have found.
/afs/umbc.edu/public/cores/
	.... Corefiles from fileserver crashes at the University of 
	     Maryland.  No further comment.
/afs/net.mit.edu/reference/multics/
	.... Once in a blue moon, you come along a gem like this one. 
	     Source code, project notes, and electronic messages from
	     the Multics project.  ./udd/multics/Rochlis contains the
	     mail, messages, and notes in case you can't find it. 

Greetings
=========
	Shouts and thanks go out to route and the r00t crew, ParMaster, 
cstone, aleph1, and the Slackworks crew.

-- nicnoc