This is the official version of am-utils.

See the file NEWS for news on this and previous releases.

*** General Notes to alpha/beta testers:

[A] as alpha/beta testers, I expect you to be able to find certain things on
your own (especially look at the sources to figure out how things work).

[B] if you intend to modify any files, first find out if the file you want
to modify gets autogenerated from some other place.  If so, modify it at the
source.

You can adjust some of the configuration of am-utils after it has been
auto-configured by putting whatever definitions you wish in a file called
localconfig.h, located in the top build directory (the same one where
config.h is created for you).

[C] there are several ways you can build am-utils:

(1) run the buildall script as follows:

	./buildall

This would build all the applications inside a special directory relative to
the root of the source tree, called A.<cpu-company-system>, where the <>
part is filled in by GNU's config.guess script.  This is the preferred
method, for it will separate the build from the sources, and allow you to
run buildall for multiple architectures concurrently.

You can run "buildall -h" to see what options it takes.

(2) run the configure script such as:

	./configure

and then run

	make

This would configure amd in the directory you've run the configure script
in, and the built it there.  Run "make install" to install all the necessary
files.

Note that this is good for building only one version of amd on one
architecture!  Don't try this for multiple architectures.  If you must, then
after doing one such build, run "make distclean" and then reconfigure for
another architecture.

(3) run the configure script for build in a different location.  Let's say
that /src/am-utils-6.0 is where you unpacked the sources.  So you could

	mkdir /src/build/sunos5
	cd /src/build/sunos5
	/src/am-utils-6.0/configure --srcdir=/src/am-utils-6.0
	make

This is a manual method that will let you build in any directory outside the
am-utils source tree.  It requires that your "make" program understand
VPATH.  This can be used multiple times to build am-utils concurrently in
multiple (but different) directories.  In fact, the buildall script
described above does precisely that, using the A.* subdirectories.

(4) If you need to configure am-utils with extra libraries and/or headers,
for example to add hesiod support, do so as follows:

	configure --enable-libs="-lhesiod -lresolv" \
		--enable-ldflags="-L/usr/local/hesiod/lib" \
		--enable-cppflags="-I/usr/local/hesiod/include"

[D] If you modify any of the *.[chyl] sources in the directories amd, amq,
hlfsd, lib, etc, all you need to do to get a new version of am-utils is run
make.

If you modify any of the files in the m4/ or conf/ directories, or any *.in
or *.am file, then you must rebuild the configure script, Makefile.in files,
aclocal.m4, etc.  The best way to do so is to run

	./bootstrap
or
	./buildall -K

To be a developer and be able to run "bootstrap", you must have
autoconf-2.68, automake-1.11.1, and libtool 2.2.6b installed on your system (or
later versions thereof).  You no longer need to get my special version of
automake.  Contact me if you'd like to be a maintainer and get access to the
CVS server.

After you've remade the basic configuration files you must rerun the
buildall script to rerun configure and then remake the binaries.

Modifying M4 macros may not be very intuitive to anyone that has not done so
before.  Let me know if you are having any problems with them.  I fully
expect, at least initially, to have to be the sole developers of the M4
macros and let others concentrate on C sources.

[E] Report all bugs via Bugzilla or the am-utils list (see
www.am-utils.org).  Avoid reporting to my personal email address.  It is
important to involve the whole list in bug fixes etc.

Good luck.

Erez Zadok,
Maintainer, am-utils.

		 NFS Attribute Caching OS Problems and Amd
		      Last updated September 18, 2005

* Summary:

Some OSs don't seem to have a way to turn off the NFS attribute cache, which
breaks the Amd automounter so badly that it is not recommend using Amd on
such OS for heavy use, not until this is fixed.


* Details:

Amd is a user-level NFSv2 server that manages automounts of all other file
systems.  The kernel contacts Amd via RPCs, and Amd in turn performs the
actual mounts, and then responds back to the kernel's RPCs.  Every kernel
caches attributes of files, in a cache called the Directory Name Lookup
Cache (DNLC), or a Directory Cache (dcache).

Amd manages its namespace in the user level, but the kernel caches names
itself.  So the two must coordinate to ensure that both namespaces are in
sync.  If the kernel uses a cached entry from the DNLC, without consulting
Amd, users may see corruption of the automounter namespace (symlinks
pointing to the wrong places, ESTALE errors, and more).  For example,
suppose Amd timed out an entry and removed the entry from Amd's namespace.
Amd has to tell the kernel to purge its corresponding DNLC entry too.  The
way Amd often does that is by incrementing the last modification time
(mtime) of the parent directory.  This is the most common method for kernels
to check if their DNLC entries are stale: if the parent directory mtime is
newer, the kernel will discard all cached entries for that directory, and
will re-issue lookup methods.  Those lookups will result in
NFS_GETATTR/NFS_LOOKUP calls sent from the kernel down to Amd, and Amd can
then properly inform the kernel of the new state of automounted entries.

In order to ensure that Amd is "in charge" of its namespace without
interference from the kernel, Amd will try to turn off the NFS attribute
cache.  It does so by using the NFSMNT_NOAC flag, if it exists, or by
setting various "cache timeout" fields in struct nfs_args to 0 (acregmin,
acregmax, acdirmin, or acdirmax).

We have released a major new version of am-utils, version 6.1, in June 2005.
Since then, a lot of people have experimented with Amd, in anticipation of
migrating from the very old am-utils 6.0 to the new 6.1.  For a couple of
months since the release of 6.1, we have received reports of problems with
Amd, especially under heavy use.  Users reported getting ESTALE errors from
time to time, or seeing automounted entries whose symlinks don't point to
where it should be.  After much debugging, we traced it to a few places in
Amd where it wasn't updating the parent directory mtime as it should have;
in some places where Amd was indeed updating the mtime, it was using a
resolution of only 1 second, which was not fine enough under heavy load.  We
fixed this problem and switched to using a microsecond resolution mtime.

After fixing this in Amd, we went on to verify that things work for other
OSs.  When we got to test certain BSDs, we found out that they always cache
directory entries, and there is no way to turn it off completely.
Specifically, if we set the ac{reg,dir}{min,max} fields in struct nfs_args
all to zero, the kernel seems to cache the entries for a default number of
seconds (something like 5-30 seconds).  On some OSs, setting these four
fields to 0 turns off the attribute cache, but not on some BSDs.  We were
able to verify this using Amd and a script that exercises the interaction of
the kernel's attrcache and Amd.  (If you're interested, the script can be
made available.)

We then experimented by setting the ac{reg,dir}{min,max} fields in struct
nfs_args all to 1, the smallest non-zero value we could.  When we ran the
Amd exercising script, we found that the value of 1 reduced the race between
the DNLC and Amd, and the script took a little longer to run before it
detected an incoherency.  That makes sense: the smaller the DNLC cache
interval is, the shorter the window of vulnerability is.  (BTW, the man
pages on some OSs say that the ac{reg,dir}{min,max} fields use a 1 second
resolution, but experimentation indicated it was in 0.1 second units.)

Clearly, setting the ac{reg,dir}{min,max} fields to 0 is worse than setting
it to 1 on those OSs that don't have a way to turn off the attribute cache.
So the current workaround I've implemented in am-utils is to create a
configuration parameter called "broken_attrcache" which, if turned on, will
set these nfs_args fields to 1 instead of 0.  I wish I didn't have to create
such ugly workaround features in Amd, but I've got no choice.

The near term solution is for every OS to support a true 'noac' flag, which
can be added fairly easily.  This'd make Amd work reliably.

The long term solution is to implement Autofs support for all OSs and to
support it in Amd.  Currently, Amd supports autofs on Solaris and Linux;
FreeBSD is next.  Still, we found that even with autofs support, many
sysadmins still prefer to use the good 'ol non-autofs mode.


* Confirmed Status

This is the confirmed status of various OSs' vulnerability to this attribute
cache bug.  We are slowly checking the status of other OSs.  The status of
any OS not listed is unknown as of the date at the top of this file.

** Not Vulnerable (support a proper "noac" flag):

Sun Solaris 8 and 9 (10 probably works fine)
Linux: 2.6.11 kernel (2.4.latest probably works fine)
FreeBSD 5.4 and 6.0-SNAP001 (older versions probably work fine)
OpenBSD 3.7 (older versions probably work fine)

** Vulnerable (don't support a proper "noac" flag natively):

NetBSD 2.0.2 (older versions are also probably affected)

Note: NetBSD has promised to support a noac flag hopefully after 2.1.0 is
released (maybe in 3.0 or 2.2).  In the mean time, you can apply one of
these two kernel patchs to support a 'noac' flag in NetBSD 2.x or 3.x:
	ftp://ftp.netbsd.org/pub/NetBSD/misc/christos/2x.nfs.noac.diff
	ftp://ftp.netbsd.org/pub/NetBSD/misc/christos/3x.nfs.noac.diff
After applying this patch and rebuilding your kernel, reboot with the new
kernel.  Then copy the new nfs.h and nfsmount.h from /sys/nfs/ to
/usr/include/nfs/, and finally rebuild am-utils from scratch.

** Testing

When you build am-utils, a script named scripts/test-attrcache is built,
which can be used to test the NFS attribute cache behavior of the current
OS.  You can run this script as root as follows:

# make install
# cd scripts
# sh test-attrcache

If you run this script on an OS whose status is known (and not listed
above), please report it to us via Bugzilla or the am-utils mailing list
(see www.am-utils.org), so we can record it in this file.

Sincerely,
Erez.

LDAP support for am-utils was originally done by Leif Johansson
<leifj AT it.su.se>.  He no longer maintains it.

The current LDAP support for am-utils is for LDAPv2 only.  Reportedly,
LDAPv3 mostly works.  Volunteers and patches are welcome.

The IANA has assigned the following Private Enterprise Number to:

	10180  Am-utils Organization   Erez Zadok	ezk AT am-utils.org

There are three files in this directory that relate to LDAP:

ldap.schema:

	This is the most current schema.

ldap-id.txt:

	This is an experimental schema for amd mount maps in LDAP.  Since
	LDAP isn't maintained now, this code may not match with either the
	current ldap_info.c code or with Amd mount maps in general.

	The schema is written in the form of an internet-draft but it has
	not been published as such.  We need volunteers who know and use
	LDAP to clean it up and further its process of submission.

ldap-id.ms:

	This is the NROFF source of the draft.  To generate the text from
	it, run "nroff -ms ldap-id.ms > ldap-id.txt"

Erez.

------- Forwarded Message

From: "IANA Private Enterprise Number" <iana-pen AT icann.org>
To: "Erez Zadok" <ezk AT cs.columbia.edu>
Subject: RE: Application for Enterprise-number (10180)
Date: Sun, 15 Jul 2001 14:43:45 -0700

Dear Erez,

The IANA has assigned the following Private Enterprise
Number to:

10180  Am-utils Organization   Erez Zadok                 ezk AT am-utils.org

Please notify the IANA if there is a change in your contact
or company information.

Thank you,

Bill Huang
IANA - Private Enterprise Numbers

------- End of Forwarded Message

		       AM-UTILS YEAR-2000 COMPLIANCE

Most likely am-utils is y2k compliant.

I do not know for sure because I have not certified am-utils myself, nor do
I have the time for it.  I do not think that amd will be affected by y2k at
all, because it does not do anything with dates other than print the date on
the log file, in whatever format is provided by your os/libc --- especially
the ctime(3) call.

However, on Friday, September 18th 1998, Matthew Crosby <mcrosby AT ms.com>
reported that they evaluated 6.0a16 and found it to be compliant.

On March 26, 1999, Paul Balyoz <pbalyoz AT sedona.ch.intel.com> submitted a
patch to lostaltmail which makes it print Y2K compliant dates.  He used a
code scanner and manually "eyeballed" the code and could not find any more
problems.  Paul's patch is included in am-utils-6.0.1s7 and newer versions.
Paul also said that other 2-digit years used in am-utils are "harmless."

NOTE: NONE OF THE PERSONS MENTIONED HERE, AUTHOR INCLUDED, ARE WILLING TO
CERTIFY AM-UTILS AS Y2K COMPLIANT.  USE AT YOUR OWN RISK.

---
Erez Zadok.
Maintainer, am-utils package and am-utils list.
WWW:   http://www.am-utils.org

Indexes created Sun Apr 21 02:25:19 MDT 2024