PTS(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

💖 PTS(1) — the AFS pts command suite 💖

okay bestie, pull up a chair, we're doing pts — one of the AFS Command Reference pages, and honestly? she's a whole vibe. she's the front door to the Protection Server and she has opinions about who gets to touch what. let's go. ✨

👑 NAME 👑

pts — your lil intro to the entire pts command suite. think of it as the group chat invite for every single pts command. 🫶

🌸 DESCRIPTION 🌸

so. the commands in the pts command suite are the administrative interface to the Protection Server. that server runs on every database server machine in a cell (yes, every one, she's popular 💅) and it maintains the Protection Database. and that database stores all the info AFS uses to augment and refine the standard UNIX scheme for controlling access to files and directories.

here's the tea 🍓: instead of relying only on the mode bits that define access rights for individual files, AFS associates an access control list (ACL) with each directory. the ACL lists users and groups and specifies which of seven possible access permissions they have for the directory and the files it contains. (you can still set a directory or file's mode bits, but AFS interprets them in its own way — see the chapter on protection in the OpenAFS Administration Guide for the deets, iykyk.)

AFS also lets users define groups in the Protection Database and plop them onto ACLs, which extends a set of rights to multiple users simultaneously. iconic. groups simplify administration by making it possible to add someone to many ACLs by adding them to a group that already exists on those ACLs. Machines can be members of a group too — so users logged into that machine automatically inherit the permissions granted to the group. no cap.

There are several categories of commands in the pts command suite:

  • Commands to create and remove Protection Database entries: pts creategroup, pts createuser, and pts delete.
  • Commands to administer and display group membership: pts adduser, pts listowned, pts membership, and pts removeuser.
  • Commands to administer and display properties of user and group entries other than membership: pts chown, pts examine, pts listentries, pts rename, and pts setfields.
  • Commands to set and examine the counters used when assigning IDs to users and groups: pts listmax and pts setmax.
  • Commands to run commands interactively: pts interactive, pts sleep, and pts quit.
  • A command to run commands from a file: pts source.
  • Commands to obtain help: pts apropos and pts help.
  • A command to display the OpenAFS command suite version: pts version.

✨ OPTIONS ✨

these arguments and flags show up on many commands in the pts suite. every command's own reference page lists them too, but we're describing them here in greater detail because they deserve their moment. 🌈

  • -cell <cell name> — names the cell in which to run the command. it's totally fine to abbreviate the cell name to the shortest form that distinguishes it from the other entries in the /etc/openafs/CellServDB file on the local machine. if the -cell argument is omitted, the command interpreter determines the name of the local cell by reading the following in order:
    • The value of the AFSCELL environment variable.
    • The local /etc/openafs/ThisCell file.
    • The local /etc/openafs/server/ThisCell file.
⚠️ do not combine the -cell and -localauth options, bestie. a command on which the -localauth flag is included always runs in the local cell (as defined in the server machine's local /etc/openafs/server/ThisCell file), whereas a command on which the -cell argument is included runs in the specified foreign cell. two different worlds, don't mix 'em. 💀
  • -config <config directory> — the location of the directory to use to obtain configuration information, including the CellServDB. this is primarily provided for testing purposes. if the -config and -localauth arguments are omitted, the command interpreter searches for the configuration information in the following order:
    • The /etc/openafs directory.
    • The /etc/openafs/server directory.
  • -force — enables the command to continue executing as far as possible when errors or other problems occur, rather than halting execution immediately. without it, the command halts as soon as the first error is encountered. in either case, the pts command interpreter reports errors at the command shell. this flag is especially useful if the issuer provides many values for a command line argument — if one of them is invalid, the command interpreter continues on to process the remaining arguments. she keeps going, she's resilient. 💪
  • -help — prints a command's online help message on the standard output stream. do not combine this flag with any of the command's other options; when it is provided, the command interpreter ignores all other options, and only prints the help message. she said no distractions. 🎀
  • -noauth — establishes an unauthenticated connection to the Protection Server, in which the server treats the issuer as the unprivileged user anonymous. it is useful only when authorization checking is disabled on the server machine (during the installation of a file server machine or when the bos setauth command has been used during other unusual circumstances). in normal circumstances, the Protection Server allows only privileged users to issue commands that change the Protection Database, and refuses to perform such an action even if the -noauth flag is provided. so like… don't get cute with it. 🙈
  • -encrypt — establishes an authenticated, encrypted connection to the Protection Server. it is useful when it is desired to obscure network traffic related to the transactions being done. privacy era, we love to see it. 🔒
  • -localauth — constructs a server ticket using the server encryption key with the highest key version number in the local /etc/openafs/server/KeyFile file. the pts command interpreter presents the ticket, which never expires, to the BOS Server during mutual authentication. 👑

use this flag only when issuing a command on a server machine; client machines do not usually have a /etc/openafs/server/KeyFile file. the issuer of a command that includes this flag must be logged on to the server machine as the local superuser root. the flag is useful for commands invoked by an unattended application program, such as a process controlled by the UNIX cron utility. it is also useful if an administrator is unable to authenticate to AFS but is logged in as the local superuser root.

⚠️ do not combine the -cell and -localauth options. a command on which the -localauth flag is included always runs in the local cell (as defined in the server machine's local /etc/openafs/server/ThisCell file), whereas a command on which the -cell argument is included runs in the specified foreign cell. Also, do not combine the -localauth and -noauth flags. pick a lane, bestie. 💅
  • -auth — use the calling user's tokens from the kernel to communicate with the ptserver (that is, the same tokens displayed by tokens(1)). this is the default if neither -localauth nor -noauth is given.

since this option is the default, it is usually not useful for running single command line operations. however, it can be useful when running commands via pts_interactive(1), since otherwise it would be impossible to switch from, for example, -localauth back to using regular tokens during a bulk operation. see pts_interactive(1) for more details. periodt. 🦋

🔐 PRIVILEGE REQUIRED 🔐

members of the system:administrators group can issue all pts commands on any entry in the Protection Database. main character energy only. 👑

users who do not belong to the system:administrators group can list information about their own entry and any group entries they own. the privacy flags set with the pts setfields command control access to entries owned by other users.

🌟 SEE ALSO 🌟

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

this documentation is covered by the IBM Public License Version 1.0. it was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell. absolute legends, we stan. 🫶

okay that's the whole page, bestie!! this OpenAFS pts page is dated 2026-07-27 and that's a wrap — go forth and protect that database, you're doing amazing sweetie 💖✨🌷

📦 where this page comes from