3 ms·

My school used AFS. It was great being able to use ACLs to give a specific student and no one else access to a directory in my account. Then we could make gro

My school used AFS. It was great being able to use ACLs to give a specific student and no one else access to a directory in my account. Then we could make groups of students for group projects. Then I got a job in 1997 and it was back to traditional Unix groups where you need root or NIS admin access to create and modify groups. It's 2024 and I work at a company with 8,000 people and it still takes a few days to get multiple Unix group access for everything on a new project.

yjftsjthsd-h 2y ago
I've thought about trying out AFS; there are apparently open source server and clients available, and it seems to have some different design choices to let it work nicely over WAN compared to NFS. Less clear that the FOSS versions do the user/permission management stuff (though maybe they do), but that wouldn't matter as much for personal use.
- eichin 2y ago
  Debian has the packages and some decent README's for setting up a server. OpenAFS is a later version than the IBM AFS you might have seen in the 90s and it has all of the user-management and ACL-related features - which are quite useful for personal use (sharing files with specific friends, instead of the entire internet; insert-only directories are also useful for that kind of thing.) It's definitely not for most people - it's a lot of sysadmin work for a homelab (though it does get you volume-level replication and shuffling, but you don't really get much out of that unless you have at least two machines as servers.) You're also going to need a personal kerberos realm (which isn't much work, it's just One More Thing.)
_joel 2y ago
Err, LDAP? SSSD etc :) or just beurocracy (I guess!)
- lizknope 2y ago
  I'm not actually sure. We have a web page where we request group access and then I think it emails another project lead and they have to approve it but I don't know how it all works. Then we have another internal command that we run in every new shell where we include the groups we want access to. It runs and if we run the "groups" command before and after we see the new groups. But there is a limit to the number of groups so it is a pain if you need to access multiple projects at the same time because libraries and stuff are in different project areas.

yjftsjthsd-h 2y ago

I've thought about trying out AFS; there are apparently open source server and clients available, and it seems to have some different design choices to let it work nicely over WAN compared to NFS. Less clear that the FOSS versions do the user/permission management stuff (though maybe they do), but that wouldn't matter as much for personal use.

eichin 2y ago
Debian has the packages and some decent README's for setting up a server. OpenAFS is a later version than the IBM AFS you might have seen in the 90s and it has all of the user-management and ACL-related features - which are quite useful for personal use (sharing files with specific friends, instead of the entire internet; insert-only directories are also useful for that kind of thing.) It's definitely not for most people - it's a lot of sysadmin work for a homelab (though it does get you volume-level replication and shuffling, but you don't really get much out of that unless you have at least two machines as servers.) You're also going to need a personal kerberos realm (which isn't much work, it's just One More Thing.)

_joel 2y ago

Err, LDAP? SSSD etc :) or just beurocracy (I guess!)

lizknope 2y ago
I'm not actually sure. We have a web page where we request group access and then I think it emails another project lead and they have to approve it but I don't know how it all works. Then we have another internal command that we run in every new shell where we include the groups we want access to. It runs and if we run the "groups" command before and after we see the new groups. But there is a limit to the number of groups so it is a pain if you need to access multiple projects at the same time because libraries and stuff are in different project areas.