mirror of
https://git.openafs.org/openafs.git
synced 2025-01-19 07:20:11 +00:00
98a68f9b02
LICENSE IPL10 FIXES 75101 give an option to not enforce the dotted principal check. document it.
162 lines
5.1 KiB
Plaintext
162 lines
5.1 KiB
Plaintext
=head1 NAME
|
|
|
|
bosserver - Initializes the BOS Server
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
=for html
|
|
<div class="synopsis">
|
|
|
|
B<bosserver> [B<-noauth>] [B<-log>] [B<-enable_peer_stats>]
|
|
[B<-enable_process_stats>] [B<-allow-dotted-principal>] [B<-help>]
|
|
|
|
=for html
|
|
</div>
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The bosserver command initializes the Basic OverSeer (BOS) Server
|
|
(B<bosserver> process). In the conventional configuration, the binary file
|
|
is located in the F</usr/afs/bin> directory on a file server machine.
|
|
|
|
The BOS Server must run on every file server machine and helps to automate
|
|
file server administration by performing the following tasks:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
Monitors the other AFS server processes on the local machine, to make sure
|
|
they are running correctly.
|
|
|
|
=item *
|
|
|
|
Automatically restarts failed processes, without contacting a human
|
|
operator. When restarting multiple server processes simultaneously, the
|
|
BOS Server takes interdependencies into account and initiates restarts in
|
|
the correct order.
|
|
|
|
=item *
|
|
|
|
Processes commands from the bos suite that administrators issue to verify
|
|
the status of server processes, install and start new processes, stop
|
|
processes either temporarily or permanently, and restart halted processes.
|
|
|
|
=item *
|
|
|
|
Manages system configuration information: the files that list the cell's
|
|
server encryption keys, database server machines, and users privileged to
|
|
issue commands from the B<bos> and B<vos> suites.
|
|
|
|
=back
|
|
|
|
The BOS Server logs a default set of important events in the file
|
|
F</usr/afs/logs/BosLog>. To record the name of any user who performs a
|
|
privileged B<bos> command (one that requires being listed in the
|
|
F</usr/afs/etc/UserList> file), add the B<-log> flag. To display the
|
|
contents of the B<BosLog> file, use the B<bos getlog> command.
|
|
|
|
The first time that the BOS Server initializes on a server machine, it
|
|
creates several files and subdirectories in the local F</usr/afs>
|
|
directory, and sets their mode bits to protect them from unauthorized
|
|
access. Each time it restarts, it checks that the mode bits still comply
|
|
with the settings listed in the following chart. A question mark indicates
|
|
that the BOS Server initially turns off the bit (sets it to the hyphen),
|
|
but does not check it at restart.
|
|
|
|
If the mode bits do not comply, the BOS Server writes the following
|
|
warning to the F<BosLog> file:
|
|
|
|
Bosserver reports inappropriate access on server directories
|
|
|
|
However, the BOS Server does not reset the mode bits, so the administrator
|
|
can set them to alternate values if desired (with the understanding that
|
|
the warning message then appears at startup).
|
|
|
|
This command does not use the syntax conventions of the AFS command
|
|
suites. Provide the command name and all option names in full.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item B<-noauth>
|
|
|
|
Assigns the unprivileged identity C<anonymous> to the issuer, which is
|
|
useful only when authorization checking is disabled on the server machine
|
|
(for instance, during the installation of a file server machine.)
|
|
|
|
=item B<-log>
|
|
|
|
Records in the F</usr/afs/logs/BosLog> file the names of all users who
|
|
successfully issue a privileged B<bos> command (one that requires being
|
|
listed in the F</usr/afs/etc/UserList> file).
|
|
|
|
=item B<-enable_peer_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. For each connection with a specific UDP port on another machine,
|
|
a separate record is kept for each type of RPC (FetchFile, GetStatus, and
|
|
so on) sent or received. To display or otherwise access the records, use
|
|
the Rx Monitoring API.
|
|
|
|
=item B<-enable_process_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. A separate record is kept for each type of RPC (FetchFile,
|
|
GetStatus, and so on) sent or received, aggregated over all connections to
|
|
other machines. To display or otherwise access the records, use the Rx
|
|
Monitoring API.
|
|
|
|
=item B<-allow-dotted-principal>
|
|
|
|
By default, the RXKAD security layer will disallow access by Kerberos
|
|
principals with a dot in the first component of their name. This is to avoid
|
|
the confusion where principals user/admin and user.admin are both mapped to the
|
|
user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
|
|
between principal names may disable this check by starting the server
|
|
with this option.
|
|
|
|
=item B<-help>
|
|
|
|
Prints the online help for this command. All other valid options are
|
|
ignored.
|
|
|
|
=back
|
|
|
|
=head1 EXAMPLES
|
|
|
|
The following command initializes the BOS Server and logs the names of
|
|
users who issue privileged B<bos> commands.
|
|
|
|
% bosserver -log &
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
The issuer most be logged onto a file server machine as the local
|
|
superuser C<root>.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<BosConfig(5)>,
|
|
L<BosLog(5)>,
|
|
L<bos(8)>,
|
|
L<bos_create(8)>,
|
|
L<bos_exec(8)>,
|
|
L<bos_getlog(8)>,
|
|
L<bos_getrestart(8)>,
|
|
L<bos_restart(8)>,
|
|
L<bos_shutdown(8)>,
|
|
L<bos_start(8)>,
|
|
L<bos_startup(8)>,
|
|
L<bos_status(8)>,
|
|
L<bos_stop(8)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|