=head1 NAME

fs exportafs - Reports or sets whether the machine can export AFS to clients of other
file systems

=head1 SYNOPSIS

fs exportafs B<-type> I<exporter name>
[B<-start> I<start/stop translator (on | off)>]
[B<-convert> I<convert from afs to unix mode (on | off)>]
[B<-uidcheck> I<run on strict 'uid check' mode (on | off)>]
[B<-submounts> I<allow nfs mounts to subdirs of /afs/.. (on | off)>]
[B<-help>]

fs exp B<-t> I<exporter name>
[B<-st> I<start/stop translator (on | off)>]
[B<-c> I<convert from afs to unix mode (on | off)>]
[B<-u> I<run on strict 'uid check' mode (on | off)>]
[B<-su> I<allow nfs mounts to subdirs of /afs/.. (on | off)>]
[B<-help>]

=head1 DESCRIPTION

The C<fs exportafs> command sets (if the B<-start> argument is provided) or
reports (if it is omitted) whether the machine can reexport the AFS
filespace to clients of a non-AFS file system. To control certain
features of the translation protocol, use the following arguments:

=over

=item *

To control whether the UNIX B<group> and B<other> mode bits on an AFS
file or directory are set to match the B<owner> mode bits when it is
exported to the non-AFS file system, use the B<-convert> argument.

=item *

To control whether tokens can be placed in a credential structure
identified by a UID that differs from the local UID of the entity
that is placing the tokens in the structure, use the B<-uidcheck>
argument. The most common use is to control whether issuers of the
C<knfs> command can specify a value for its B<-id> argument that does
not match their local UID on the NFS/AFS translator machine.

=item *

To control whether users can create mounts in the non-AFS
filespace to an AFS directory other than B</afs>, use the B<-submounts>
argument.

=back

=head1 OPTIONS

=over 4

=item B<-type> I<exporter name>

Names the alternate file system to which to reexport the AFS
filespace. The only acceptable value is B<nfs>, in lowercase
letters only.

=item B<-start> I<start/stop translator (on | off)>

Enables the local machine to reexport the AFS filespace if the
value is B<on>, or disables it if the value is B<off>. Omit this
argument to report the current setting for all of the
configurable parameters.

=item B<-convert> I<convert from afs to unix mode (on | off)>

Controls the setting of the UNIX B<group> and B<other> mode bits on
AFS files and directories exported to the non-AFS file system.
If the value is B<on>, they are set to match the owner mode bits.
If the value is B<off>, the bits are not changed. If this argument
is omitted, the default value is B<on>.

=item B<-uidcheck> I<run on strict 'uid check' mode (on | off)>

Controls whether tokens can be placed in a credential structure
identified by a UID that differs from the local UID of the
entity that is placing the tokens in the structure.

=over

=item *

If the value is B<on>, the UID that identifies the credential
structure must match the local UID.

With respect to the C<knfs> command, this value means that the
value of B<-id> argument must match the issuer's local UID on
the translator machine. In practice, this setting makes it
pointless to include the B<-id> argument to the C<knfs> command,
because the only acceptable value (the issuer's local UID) is
already used when the B<-id> argument is omitted.

Enabling UID checking also makes it impossible to issue the
C<klog> and C<pagsh> commands on a client machine of the non-AFS
file system even though it is a system type supported by AFS.
For an explanation, see the reference page for the C<klog>
command.

=item *

If the value is B<off> (the default), tokens can be assigned to
a local UID in the non-AFS file system that does not match
the local UID of the entity assigning the tokens.

With respect to the C<knfs> command, it means that the issuer
can use the B<-id> argument to assign tokens to a local UID on
the NFS client machine that does not match his or her local
UID on the translator machine. (An example is assigning
tokens to the MFS client machine's local superuser B<root>.)
This setting allows more than one issuer of the C<knfs> command
to make tokens available to the same user on the NFS client
machine. Each time a different user issues the C<knfs> command
with the same value for the B<-id> argument, that user's tokens
overwrite the existing ones. This can result in unpredictable
access for the user on the NFS client machine.

=back

=item B<-submounts> I<allow nfs mounts to subdirs of /afs/.. (on | off)>

Controls whether a user of the non-AFS filesystem can mount any
directory in the AFS filespace other than the top-level B</afs>
directory. If the value is B<on>, such submounts are allowed. If
the value is off, only mounts of the B</afs> directory are
allowed. If this argument is omitted, the default value is B<off>.

=item B<-help>

Prints the online help for this command. All other valid
options are ignored.

=back

=head1 OUTPUT

If the machine is not even configured as a server of the non-AFS file
system, the following message appears:

Sorry, the I<file_system>-exporter type is currently not supported on this AFS client

If the machine is configured as a server of the non-AFS file system
but is not currently enabled to reexport AFS to it (because the B<-start>
argument to this command is not set to on), the message is as follows:

'I<file_system>' translator is disabled

If the machine is enabled to reexport AFS, the following message
precedes messages that report the settings of the other parameters.

'I<file_system>' translator is enabled with the following options:

The following messages indicate that the B<-convert> argument is set to
B<on> or B<off> respectively:

 Running in convert owner mode bits to world/other mode
 Running in strict unix mode

The following messages indicate that the B<-uidcheck> argument is set to
B<on> or B<off> respectively:

 Running in strict 'passwd sync' mode
 Running in no 'passwd sync' mode

The following messages indicate that the B<-submounts> argument is set to
B<on> or B<off> respectively:

 Allow mounts of /afs/.. subdirs
 Only mounts to /afs allowed

=head1 EXAMPLES

The following example shows that the local machine can export AFS to
NFS client machines.

    fs exportafs nfs
   'nfs' translator is enabled with the following options:
   Running in convert owner mode bits to world/other mode
   Running in no 'passwd sync' mode
   Only mounts to /afs allowed

The following example enables the machine as an NFS server and
converts the UNIX B<group> and B<other> mode bits on exported AFS
directories and files to match the UNIX B<owner> mode bits.

    fs exportafs -type nfs -start on -convert on

The following example disables the machine from reexporting AFS to NFS
client machines:

    fs exportafs -type nfs -start off

=head1 PRIVILEGE REQUIRED

The issuer must be logged in as the local superuser B<root>.

=head1 COPYRIGHT

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

Converted from html to pod by Alf Wachsmann <alfw@slac.stanford.edu>, 2003,
and Elizabeth Cassell <e_a_c@mailsnare.net>, 2004,
Stanford Linear Accelerator Center, a department of Stanford University.

=head1 SEE ALSO

L<klog(1)>,
L<knfs(1)>

=cut
