DNS discovery for OpenAFS

Just as with Kerberos client administration, when faced with a sigificant number of AFS clients, one possible way to streamline administration is to maintain a predetermined set of DNS hostname aliases (CNAME records) to refer to the OpenAFS database servers on a network. However, the flexibility of this approach is limited for the same reason it is when doing this with Kerberos, so it is fortunate that AFS also supports DNS discovery, but not with the relatively new SRV DNS resource record.

The AFSDB DNS resource record was defined in RFC-1183 in 1990 − a full decade before the definition of the SRV DNS resource record. With a format similar to that of MX records, it allows AFS clients to locate AFS database servers. For instance, if two such servers, klas1 and klas2, are available on the network, only two extra entries need to the zone file. For instance, here they are for the domain example.com in BIND9 format:

example.com.		IN	AFSDB	1 klas1.example.com.
example.com.		IN	AFSDB	1 klas2.example.com.

These records are composed as follows:

1. The owner is the name of the AFS cell, followed by a trailing dot.
2. The IN (Internet) data class indicator.
3. The AFSDB (AFS DataBase Location; RFC-1183) resource record type indicator.
4. A subtype, the value of which is a 16 bit integer. A subtype equal to '1' indicates a host with an AFS v3.0 Volume Location Server.
5. The target is the FQDN (not an alias!) of the host providing the service, followed by a trailing dot.

Since omission of the trailing dots will cause BIND9 to complete the names in each entry with the zone's domain name, it is possible to achieve exactly the same results as above with the following, assuming these records are located near the top of the zone file following the initial entry representing the domain, and also that the zone file is only used for example.com:

			IN	AFSDB	1 kas1
			IN	AFSDB	1 kas2

NB: With BIND9, if the owner field is left blank, as it is here, the same owner is used as in the last entry above it to have an owner. Many BIND9 zone files start with an entry that represents the domain name, in this case example.com.

Once the correct AFSDB entries have been implemented, check that they are available:

~$ host -t AFSDB example.com
example.com has AFSDB record 1 klas2.example.com.
example.com has AFSDB record 1 klas1.example.com.
~$ _

• Kerberos-OpenAFS client
• Integrated Kerberos-OpenLDAP-OpenAFS client
• DNS discovery for MIT Kerberos V
• DNS discovery for OpenLDAP

• Eastlake D, Panitz A. 1999. RFC2606 − Reserved Top Level DNS Names. The Internet Society. HTML at the Internet FAQ Archives.
• Everhart C, Mamakos L, Ullmann R, Mockapetris P. 1990. RFC1183 − New DNS RR Definitions. The Internet Society. HTML at the Internet FAQ Archives.

• OpenAFS. 2000-2009. Documentation. HTML at OpenAFS.