Ubuntu 18.04 LTS, 20.04 LTS

On Ubuntu (and derivatives) Kerberos 5 and OpenAFS packets are available in the standard repositories, so the installation of the OpenAFS and Kerberos 5 is straightforward. Sme configuration data must be provided by the user during the installation procedure.
Here is the procedure from a root session (or using sudo):

1. Download krb5.conf for the selected site and copy it in root home
2. apt install krb5-user
• Default kerberos version 5 realm:  > ENEA.IT  <ok>   
• Kerberos servers for your realm: aixfs.frascati.enea.it <ok>
• Administrative server for your Kerberos real: afskdc.frascati.enea.it <ok>
3. mv /etc/krb5.conf /etc/krb5.conf_dist
4. mv  ~/krb5.conf /etc/krb5.conf
5. apt install openafs-client openafs-krb5
• AFS cell this workstation belongs to: enea.it <ok>
• Size of AFS cache in kB: 500000 <ok>
6. systemctl start openafs-client ; systemctl enable openafs-client
7. df            [to verify the existence of /afs/... directory]

The service configuration files are:  /etc/openafs/afs.conf.client /etc/openafs/afs.conf

Important node for Ubuntu 20.04: the bug in 1.8.x versions has been solved by the patch provided by
https://launchpad.net/~openafs/+archive/ubuntu/stable  by the following commands
    add-apt-repository ppa:openafs/stable
    apt upgrade

CentOS 7.x

On CentOS 7.x  the OpenAFS rpms are not available on the CentOS repository so they must be rebuilt for the specific kernel version with the following procedure from a root session. The example is show both for OpenAFS 1.6.24 and 1.8.8
If also the src.rpm is not available for the selected version, it can be easily rebuilt with instructions from https://wiki.openafs.org/devel/HowToBuildOpenAfsRpmPackages/.

1. Download compile_install_OpenAFS1624_Centos7_v1.sh or compile_install_OpenAFS189_Centos7_v1.sh.
   
2. Configure the AFS cell editing /usr/vice/etc/ThisCell:
   echo "enea.it" >/usr/vice/etc/ThisCell
3. Start the service: systemctl start openafs-client
4. Download krb5.conf for the selected site and copy it in root ho
5. yum install krb5-workstation
6. mv /etc/krb5.conf /etc/krb5.conf_dist
7. mv  ~/krb5.conf /etc/krb5.con

The service configuration file is: /etc/sysconfig/openafs

When the OpenAFS client must be updated a new version of the rpms can be prepared with the script: compile_only_OpenAFS189_Centos7_v1.sh.
The new rpms are produced in the directory  rpmbuild/RPMS/x86_64

Some rpms of the recent OpenAFS versions for CentOS6 and CentOS7 are available in a local repository.
If the kernel module is not available it can be rebuilt by installing the dkms-openafs-xx package.
At the AFS location  /afs/inf.ed.ac.uk/group/afsbuild/ collections of rpms for many OpenAFS versions can be found.

CentOS 8.x , Rocky Linux 8.x

Also for CentOS 8.x / Rocky Linux 8.x  the OpenAFS rpms are not available on repositories so they must be rebuilt for the specific kernel version with the following procedure from a root session.
A script has been prepared for the OpenAFS client installation for version 1.8.7. The script is based on the instructions from https://wiki.openafs.org/devel/HowToBuildOpenAfsRpmPackages/.

1. Download compile_install_OpenAFS188_Centos8_v1.sh
   
2. Configure the AFS cell editing /usr/vice/etc/ThisCell:
   echo "enea.it" >/usr/vice/etc/ThisCell
3. Start the service: systemctl start openafs-client
4. Download krb5.conf for the selected site and copy it in root home
5. dnf install krb5-workstation
6. mv /etc/krb5.conf /etc/krb5.conf_dist
7. mv  ~/krb5.conf /etc/krb5.conf

RH9.x, Almalinux 9.x , Rocky Linux 9.x

Also for RH9.x / Almalinux 9.x / Rocky Linux 9.x  the OpenAFS rpms are not available on repositories so they must be rebuilt for the specific kernel version.
It must be noted that OpenAFS 1.8.10 is required for RH 9.x and its derivatives so a script has been prepared for the OpenAFS client installation for version 1.8.10. The script is based on the instructions from https://wiki.openafs.org/devel/HowToBuildOpenAfsRpmPackages/.

1. Download and run  compile_install_OpenAFS1810_RH9_v1.sh
   
2. Configure the AFS cell editing /usr/vice/etc/ThisCell:
   echo "enea.it" >/usr/vice/etc/ThisCell
3. Start the service: systemctl start openafs-client
4. Download krb5.conf for the selected site and copy it in root home
5. dnf install krb5-workstation
6. mv /etc/krb5.conf /etc/krb5.conf_dist
7. mv  ~/krb5.conf /etc/krb5.conf

Getting Ticket and token for enea.it AFS cell

To get a Kerberos 5 ticket and an AFS tokens for an ENEAGRID user:

1. kinit <my_userid>@ENEA.IT  [@ENEA.IT can be omitted, as the defaut realm defined in the krb5.conf file].
   
2. aklog
3. klist; tokens  [to verify the obtained ticket & token]
   

With the switch -d the comamnd  aklog -d provides more information and it is useful to debug problems.

Getting Ticket and token for fusione.it AFS cell

With the provided   it is also possible to obatain a ticket and a tokens on AFS cell fusione.it, for users defined in the FUSIONE.IT realm:

1. kinit <my_userid_in-cell-fusione.it>@FUSIONE.IT
   
2. aklog -c fusione.it -k FUSIONE.IT

Passwordless ssh connection to an ENEAGRID node

When kerberos 5 has been properly configured it is possibile too acquire a Kerberos 5 ticket in the local system and use it to open a remote ssh session to an ENEAGRID node without having to provide the password. The local ssh client configuration file /etc/ssh/ssh_config must be configured as following:  

1. GSSAPIAuthentication yes
2. GSSAPIDelegateCredentials yes

How to verify the type of AFS token: user based or PAG based?

If a Kerberos 5 ticket is available the command aklog creates an AFS token based on the information in the ticket by contacting the AFS DB servers.
Then there are two possibilities:

1. user based AFS token : the token is available to all the user processes on the node
2. PAG based AFS token : the token are available only in the current process and in its childrens. If aklog is called in the main ssh shell process the token is avalable to all the session processes but not to other ssh session of the same user [ PAG - Process Authentication Group ].
   

It is clear that on a multisession node a user based token can result in unexpected results as the command "unlog" deletes the token to all the user processes independently from how they were generated.
The command keyctl show permits to verify if the current shell has a user or a PAG based token.

For a user based token, root id=0 in this case::
# keyctl show
Session Keyring
 107061358 --alswrv      0     0  keyring: _ses
 556891430 --alswrv      0 65534   \_ keyring: _uid.0

For a PAG based token:
# keyctl show
Session Keyring
       -3 --alswrv      0     0  keyring: _ses.3347
647522168 ----s--v      0     0   \_ afs_pag: _pag

Note for  CentOS 7.x

Additional information about client installation can be obtained from
https://wiki.openafs.org/admin/InstallingOpenAFSonCentOS7/#index5h2