mirror of
https://git.openafs.org/openafs.git
synced 2025-01-19 07:20:11 +00:00
bdf6192509
override system resource limits so we get corefiles Change-Id: I50f228d709090c8275bed2fc2958653c43a0a026 Change-Id: I5b5e8c6a5e02ed0b28610949eb81f6345357969e Reviewed-on: http://gerrit.openafs.org/1959 Tested-by: Derrick Brashear <shadow@dementia.org> Reviewed-by: Derrick Brashear <shadow@dementia.org>
216 lines
7.3 KiB
Plaintext
216 lines
7.3 KiB
Plaintext
=head1 NAME
|
|
|
|
bosserver - Initializes the BOS Server
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
=for html
|
|
<div class="synopsis">
|
|
|
|
B<bosserver> [B<-noauth>] [B<-log>] [B<-enable_peer_stats>]
|
|
S<<< [B<-auditlog> <I<log path>>] >>> [B<-audit-interface> (file | sysvmq)]
|
|
[B<-enable_process_stats>] [B<-allow-dotted-principals>]
|
|
[B<-cores=>(none|<I<path>>)]
|
|
[B<-restricted>] [B<-help>]
|
|
|
|
=for html
|
|
</div>
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The bosserver command initializes the Basic OverSeer (BOS) Server
|
|
(B<bosserver> process). In the conventional configuration, the binary file
|
|
is located in the F</usr/afs/bin> directory on a file server machine.
|
|
|
|
The BOS Server must run on every file server machine and helps to automate
|
|
file server administration by performing the following tasks:
|
|
|
|
=over 4
|
|
|
|
=item *
|
|
|
|
Monitors the other AFS server processes on the local machine, to make sure
|
|
they are running correctly.
|
|
|
|
=item *
|
|
|
|
Automatically restarts failed processes, without contacting a human
|
|
operator. When restarting multiple server processes simultaneously, the
|
|
BOS Server takes interdependencies into account and initiates restarts in
|
|
the correct order.
|
|
|
|
=item *
|
|
|
|
Processes commands from the bos suite that administrators issue to verify
|
|
the status of server processes, install and start new processes, stop
|
|
processes either temporarily or permanently, and restart halted processes.
|
|
|
|
=item *
|
|
|
|
Manages system configuration information: the files that list the cell's
|
|
server encryption keys, database server machines, and users privileged to
|
|
issue commands from the B<bos> and B<vos> suites.
|
|
|
|
=back
|
|
|
|
The BOS Server is configured via the F<BosConfig> configuration file.
|
|
Normally, this file is managed via the B<bos> command suite rather than
|
|
edited directly. See the L<BosConfig(5)> man page for the syntax of this
|
|
file.
|
|
|
|
The BOS Server will rewrite B<BosConfig> when shutting down, so changes
|
|
made manually to it will be discarded. Instead, to change the BOS Server
|
|
configuration only for the next restart of B<bosserver>, create a file
|
|
named F</usr/afs/local/BosConfig.new>. If B<BosConfig.new> exists when
|
|
B<bosserver> starts, it is renamed to F</usr/afs/local/BosConfig>,
|
|
removing any existing file by that name, before B<bosserver> reads its
|
|
configuration.
|
|
|
|
The BOS Server logs a default set of important events in the file
|
|
F</usr/afs/logs/BosLog>. To record the name of any user who performs a
|
|
privileged B<bos> command (one that requires being listed in the
|
|
F</usr/afs/etc/UserList> file), add the B<-log> flag. To display the
|
|
contents of the B<BosLog> file, use the B<bos getlog> command.
|
|
|
|
The first time that the BOS Server initializes on a server machine, it
|
|
creates several files and subdirectories in the local F</usr/afs>
|
|
directory, and sets their mode bits to protect them from unauthorized
|
|
access. Each time it restarts, it checks that the mode bits still comply
|
|
with the settings listed in the following chart. A question mark indicates
|
|
that the BOS Server initially turns off the bit (sets it to the hyphen),
|
|
but does not check it at restart.
|
|
|
|
/usr/afs drwxr?xr-x
|
|
/usr/afs/backup drwx???---
|
|
/usr/afs/bin drwxr?xr-x
|
|
/usr/afs/db drwx???---
|
|
/usr/afs/etc drwxr?xr-x
|
|
/usr/afs/etc/KeyFile -rw????---
|
|
/usr/afs/etc/UserList -rw?????--
|
|
/usr/afs/local drwx???---
|
|
/usr/afs/logs drwxr?xr-x
|
|
|
|
If the mode bits do not comply, the BOS Server writes the following
|
|
warning to the F<BosLog> file:
|
|
|
|
Bosserver reports inappropriate access on server directories
|
|
|
|
However, the BOS Server does not reset the mode bits, so the administrator
|
|
can set them to alternate values if desired (with the understanding that
|
|
the warning message then appears at startup).
|
|
|
|
This command does not use the syntax conventions of the AFS command
|
|
suites. Provide the command name and all option names in full.
|
|
|
|
=head1 OPTIONS
|
|
|
|
=over 4
|
|
|
|
=item B<-noauth>
|
|
|
|
Assigns the unprivileged identity C<anonymous> to the issuer, which is
|
|
useful only when authorization checking is disabled on the server machine
|
|
(for instance, during the installation of a file server machine.)
|
|
|
|
=item B<-log>
|
|
|
|
Records in the F</usr/afs/logs/BosLog> file the names of all users who
|
|
successfully issue a privileged B<bos> command (one that requires being
|
|
listed in the F</usr/afs/etc/UserList> file).
|
|
|
|
=item B<-cores=>none|<I<path>>
|
|
|
|
The argument none turns off core file generation. Otherwise, the
|
|
argument is a path where core files will be stored.
|
|
|
|
=item B<-auditlog> <I<log path>>
|
|
|
|
Turns on audit logging, and sets the path for the audit log. The audit
|
|
log records information about RPC calls, including the name of the RPC
|
|
call, the host that submitted the call, the authenticated entity (user)
|
|
that issued the call, the parameters for the call, and if the call
|
|
succeeded or failed.
|
|
|
|
=item B<-audit-interface> (file | sysvmq)
|
|
|
|
Specifies what audit interface to use. Defaults to C<file>. See
|
|
L<fileserver(8)> for an explanation of each interface.
|
|
|
|
=item B<-enable_peer_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. For each connection with a specific UDP port on another machine,
|
|
a separate record is kept for each type of RPC (FetchFile, GetStatus, and
|
|
so on) sent or received. To display or otherwise access the records, use
|
|
the Rx Monitoring API.
|
|
|
|
=item B<-enable_process_stats>
|
|
|
|
Activates the collection of Rx statistics and allocates memory for their
|
|
storage. A separate record is kept for each type of RPC (FetchFile,
|
|
GetStatus, and so on) sent or received, aggregated over all connections to
|
|
other machines. To display or otherwise access the records, use the Rx
|
|
Monitoring API.
|
|
|
|
=item B<-allow-dotted-principals>
|
|
|
|
By default, the RXKAD security layer will disallow access by Kerberos
|
|
principals with a dot in the first component of their name. This is to avoid
|
|
the confusion where principals user/admin and user.admin are both mapped to the
|
|
user.admin PTS entry. Sites whose Kerberos realms don't have these collisions
|
|
between principal names may disable this check by starting the server
|
|
with this option.
|
|
|
|
=item B<-restricted>
|
|
|
|
In normal operation, the bos server allows a super user to run any command.
|
|
When the bos server is running in restricted mode (either due to this
|
|
command line flag, or when configured by L<bos_setrestricted(8)>) a number
|
|
of commands are unavailable. Note that this flag persists across reboots.
|
|
Once a server has been placed in restricted mode, it can only be opened up
|
|
by sending the SIGFPE signal.
|
|
|
|
=item B<-help>
|
|
|
|
Prints the online help for this command. All other valid options are
|
|
ignored.
|
|
|
|
=back
|
|
|
|
=head1 EXAMPLES
|
|
|
|
The following command initializes the BOS Server and logs the names of
|
|
users who issue privileged B<bos> commands.
|
|
|
|
% bosserver -log &
|
|
|
|
=head1 PRIVILEGE REQUIRED
|
|
|
|
The issuer most be logged onto a file server machine as the local
|
|
superuser C<root>.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<BosConfig(5)>,
|
|
L<BosLog(5)>,
|
|
L<bos(8)>,
|
|
L<bos_create(8)>,
|
|
L<bos_exec(8)>,
|
|
L<bos_getlog(8)>,
|
|
L<bos_getrestart(8)>,
|
|
L<bos_restart(8)>,
|
|
L<bos_setrestricted(8)>,
|
|
L<bos_shutdown(8)>,
|
|
L<bos_start(8)>,
|
|
L<bos_startup(8)>,
|
|
L<bos_status(8)>,
|
|
L<bos_stop(8)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.
|
|
|
|
This documentation is covered by the IBM Public License Version 1.0. It was
|
|
converted from HTML to POD by software written by Chas Williams and Russ
|
|
Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.
|