The libnss-afs library is an NSS plugin which answers these queries using the information stored in the AFS ptserver, avoiding the need to duplicate (and update) this information in /etc/passwd or LDAP. The library also synthesizes the name AfsPag-XXXX for the fake group ids that are used to represent AFS PAGs.
For an example of how to integrate this with Kerberos, PAM, SSH, nscd, and the OpenAFS client, please see HCoop's New Machine Setup page.
You can retrieve libnss-afs from its git repository or directly out of AFS:
Install the debian package and put these lines in /etc/nsswitch.conf:
passwd: afs compat
group: afs compat
Unlike libnss-ptdb, the new library requires no daemon process. Unlike nss_pts, the new library performs proper pthreads-locking around the thread-unsafe AFS libraries. Perhaps most importantly of all, libnss-afs is only 286 lines of code in a single file, making it easier to review for correctness and robustness.
libnss-afs also includes the functionality provided by nss_afspag. This functionality is integrated directly into libnss_afs.so rather than being in a separate library, and has been updated to the new Linux 2.6 PAG numbering scheme. It also includes a fix for a bug which would cause nscd to crash.
On 8-Dec-2009, libnss-afs 2.0 was released. The only change in this version is that it will return NSS_UNAVAIL if used without nscd (this is checked by examining /proc/self/cmdline). This avoids the risks of loading libnss_afs into a process which is already linked to the AFS libraries, and ensures that long delays are not incurred when the network is down (for example, during shutdown).
Starting with libnss-afs 2.0, you must use nscd. With prior versions it is strongly recommended that you run it.
There is a known bug in nscd which may cause it to crash. It seems that libnss-afs increases the probability of triggering this bug. To avoid this, you must put this line in /etc/nscd.conf:
enable-cache hosts no
Moreover, based on advice from here, it's probably a good idea to disable persistence:
persistent passwd no
persistent groups no
persistent hosts no
In the transition from libnss-ptdb to libnss-afs, all configuration options were removed. The majority of them are no longer necessary because there is no daemon, but I really need to add back in a way to choose the “homedir style” and “shell style”.
Currently these settings are hardwired, but can be changed with very simple edits to the source code:
The next version will allow you to set configuration options for these choices in your krb5.conf file, the same way that pam-afs-session does (see load_krb5_config() in options.c).