AOH :: P55-13.TXT

The Black Book of AFS

-------[  Phrack Magazine --- Vol. 9 | Issue 55 --- 09.09.99 --- 13 of 19  ]

-------------------------[  Black Book of AFS  ]

--------[  nicnoc  ]

----[  Introduction

AFS is commonly deployed as a distributed filesystem solution in academic and
research environments.  This short article serves as an introductory guide to
publicly-accessible resources on AFS.  As always, misuse of this information
by the reader is taken at his or her own peril.

The current incarnation of AFS grew out of research conducted with the Andrew
FileSystem at Carnegie-Mellon University, also home of the CODA distributed fs
research (  AFS is now a commercial product,
supported and sold by the Transarc Corporation (

----[  Conventions

Resources on AFS listed in this document will take the form of '/afs/cell
name'.  As you will discover, certain hosts are only accessible from a gateway
immediately associated with the cell.  For example, the node
can only be reached from the outside (ie. using methods other than a local
fs mount) through the AFS gateway.  Where appropriate, these
access restrictions are noted.

----[  Basics

cell : Multiple hosts within the same domain sharing a single fs image.
 - local cell   : Describes a cell within the local domain.
 - foreign cell : All cells not within the local domain.
 - cell name    : Usually a derivation of the FQDN.
node : Generic term for any host on the network.
ACL  : Access Control List - who gets what, and how.

Access permissions of files and directories on an AFS cell are handled
independently of the underlying operating system permissions.  Traditional
Unix fs permission bits are divided into read, write, and execute.  The AFS
ACL groupings build on this concept and add extensions suitable for
distributed file-sharing.

Below is a basic introduction to concepts and commands used to manage AFS; by
no means a complete treatment of the subject.  See tutorials at and for
more information.

ACL bits
r : read        : view directory and file contents
l : lookup      : searching of a directory for filenames (recursive find)
i : insert      : create a new directory or file
d : delete      : remove a file or subdirectory
w : write       : modification of file contents
k : lock        : owner's processes allowed to flock() in this dir
a : administer  : user permitted to modify ACL for this resource

Commands for ACL listing and modification
fs: listacl <filename> (alias: la) : list access control list
setacl <directory> <username> <permissions> (alias: sa)
.... set access control list

ex. setacl secret.doc jsbach lidrw

Invoked as 'pts option' on the command-line.  Manages protection
groups, which permit a smaller group of users to access resources
owned by another user.
  adduser -user user1 user2... -group <owner>:<group name>
  	.... adds user(s) to an existing protection group
  removeuser -user user1 user2... -group <owner>:<group name>
  	.... removes user(s) from a protection group
  creategroup <owner>:<group name>
  	.... create a protection group
  examine <path>
  	....  volume name of specified resource at <path>
  membership -name <user>  (alternatively <group name>:<owner>)
  	.... list protection group membership for user
Protocol information
	AFS is implemented over wide-area TCP/IP networks, optionally
authenticating users with a modified Kerberos implementation.  Client nodes
utilize a cache manager, which stores frequently-accessed data on a local
disk for faster retrieval.

	Taken from an unknown cell's /etc/service, the ports and
protocols that make AFS work its magic:

afs3-fileserver 7000/udp       # file server itself
afs3-callback   7001/udp       # callbacks to cache managers
afs3-prserver   7002/udp       # users & groups database
afs3-vlserver   7003/udp       # volume location database
afs3-kaserver   7004/udp       # AFS/Kerberos authentication service
afs3-volser     7005/udp       # volume management server
afs3-errors     7006/udp       # error interpretation service
afs3-bos        7007/udp       # basic overseer process
afs3-update     7008/udp       # server-to-server updater
afs3-rmtsys     7009/udp       # remote cache manager service

	Legitimate access to AFS is quite easy to obtain.  Any alumnus of
an institution where AFS is widely deployed (MIT, CMU, Stanford, etc.)
usually has an account on a connected node.  Additionally, it is not
uncommon for admins to grant research accounts on university systems
to friends outside.
	For those without friends and we, the unwashed masses, there are
gateways which allow access to AFS through other services.  In the early
1990's, these were commonly found on institution FTP and Gopher sites.
Today, most gateways provide proxied access to AFS through the web.
Transarc provides the WebSecure product which is the most commonly used
gateway software.
	AFS->web gateway discovery is a matter of blind luck, although
with the assistance of a search engine, it is possible to select possible

Two commonly-used gateways are:

The MIT gateway is more controlled than the Transarc's.
Of the 74 active cells discovered, MIT permits only 12:

Some cells local to are accessible through the gateway with aliases,
namely: athena, dev, net, and sipb.  These aliases and restricted-access
nodes are not enumerated.

	This listing comes from an audit of active nodes accessible
through the AFS->web gateway.  From a dataset of 511 entries,
74 were found to be active.  The unofficial AFS FAQ (section 1.07)
assisted with identification of certain cells.
	Data were collected from a recent CellservDB
(/afs/ and the output of
'ls /afs' on an AFS node.  A simple script linking lynx, grep,
sort and awk produced the below listing.  All listed nodes were verified
to be accessible from an external network on 07.22.1999.

## Corporate (COM)
# Transarc Corporation	

## Education (EDU)
# Arizona State University		
# Boston University			
# Carnegie-Mellon University		
	!		# Top-level directory not browsable
# Cornell University
# Dartmouth College
# Indiana State University
# Indiana University
# Massachusetts Institute of Technology
# North Carolina Agricultural and Technical State University
# North Carolina State University
# Notre Dame
# Pennsylvania State University
# Pittsburgh Supercomputing Center
# Rose-Hulman Institute of Technology
# Stanford University
# University of California at Davis
# University of Chicago
# University of Illinois at Chicago (NCSA)
# University of Maryland at Baltimore
# University of Maryland
# University of Michigan
# University of Pittsburgh
# University of Utah
# University of Washington
# University of Wisconsin

## Government (GOV)
# Argonne National Labs
# Fermi National Accelerator Lab
# National Energy Research Supercomputer Center
# National Institutes of Health
# Princeton Plasma Physics Laboratory

## Military  (MIL)
# Naval Research Laboratory

## Network
# Energy Sciences Network

## Organization (ORG)
# Esprit Research Network of Excellence (European Communities)
# Open Software Foundation

## Europe and Asia
# European Laboratory for Particle Physics, Geneva
#Deutsches Elektronen-Synchrotron
#Univ. of Cologne Inst. for Geophysics & Meteorology
# DESY-IfH Zeuthen
# Leibniz-Rechenzentrum Muenchen
# Max-Planck-Institut fuer Astrophysik
# TH-Darmstadt
# Technische Universitaet Chemnitz-Zwickau
# Albert-Ludwigs-Universitat Freiburg
# University of Hohenheim
# Rechenzentrum University of Kaiserslautern
# University of Cologne
# University of Stuttgart
# IN2P3 production cell
# CASPUR Inter-University Computing Consortium
# INFN Sezione di Pisa
# Real World Computer Partnership
# Chalmers University of Technology - General users
# Royal Institute of Technology, NADA

Interesting areas
	Half of the challenge in network exploration is the act of
finding fun items to look at.  The list below is by no means complete,
and barely touches the surface of what the author and others have
collected over the years.  Enjoy, and good luck hunting.

	.... Left over from a time when Irix source resided there.
	.... Root directory of an Ultrix installation
	.... Not the daughter of the U.S. President, but a reasonable
 	     facsimile thereof which causes much excitement among readers.
	.... AFS follows the 'user-managed' philosophy of resource
             management, leaving it up to individual users to secure the
	     permissions on their own files.  This unfortunate admin
	     forgot to set the permissions on data collected during a
	     recent (08.08.1999) security compromise.  The world,
	     including the intruder, can now browse his work and see
	     what they have found.
	.... Corefiles from fileserver crashes at the University of
	     Maryland.  No further comment.
	.... Once in a blue moon, you come along a gem like this one.
	     Source code, project notes, and electronic messages from
	     the Multics project.  ./udd/multics/Rochlis contains the
	     mail, messages, and notes in case you can't find it.

	Shouts and thanks go out to route and the r00t crew, ParMaster,
cstone, aleph1, and the Slackworks crew.

-- nicnoc

AOH Site layout & design copyright © 2006 AOH