Daniel Lange's blog

If you need afppasswd and the depreciated, insecure uams (User Authentication Modules) that go with it, please check the update from 02.06.15 below.

Ok, whichever version of the debs you built or chose to download, now for installation:

Fortunately the netatalk devs decided to simplify the netatalk configuration as that was a mess in v2.
Unfortunately that means you need to adjust your configuration now.

Basically the whole configuration now happens in afp.conf and extmap.conf (which you can safely ignore usually). So afpd.conf and AppleVolumes.default and AppleVolumes.system are all depreciated and you should move them out of /etc/netatalk to a safe place.

For a timemachine share you need something like:

which you can construct from your old AppleVolumes.default and the helpful equivalence table from the netatalk upgrade documentation.

The files /etc/netatalk/afp_signature.conf and /etc/netatalk/afp_voluuid.conf now live in /var/**lib**/netatalk/ (for Debian). The netatalk docs say /var/netatalk but that violates Debian's file system layout and has hence been fixed in the debianization mentioned above. So move them to /var/lib/netatalk/.

With netatalk 3 the default way to store Apple's resource forks and assorted cruft has also changed from using .AppleDB subdirectories to storing them in extended attributs (EAs) of the underlying filesystem. The conversion will be done on the fly or - if you feel like speeding things - up removing the .AppleDB directories in your Apple vaults and then running:

NB: (adjust your path...)

We can enable the systemd units (that's what the init.d file equivalents are called now ) and run the daemons again:

Update

08.08.2015: systemd and perl in Jessie

I originally wrote "I'll cover more issues around perl and systemd in later blog posts." but I won't. For perl the reason is simple, we fixed the {useless|annoying|undocumented} perl 5.16+ depreciation (use of the defined function on aggregates) in all code very quickly. I was a major bummer for Jessie upgrade documentation to not warn of the incompatible perl version in the release notes, but that was it. See the glastree github for the simple sed -e "s/defined @/ @/"-type fix. Not worth writing a full blog post about it.

Now for systemd the reason is just the opposite. It is so broken in the Jessie incarnation that after battling with it for a few weeks, I decided to postpone using it on Debian systems for another release cycle. It needs to mature much more. Without systemd has good information on how to tame the beast in Jessie and Sid. Read from my friends at suckless what's conceptually wrong with systemd. Christoph Egger, one of the Debian maintainers, has written a piece and the bug list is so frightening and yet incomplete that I see no use in investing more time there right now. That said: check your watchdog. Yup, not running anymore if you upgraded from wheezy. If you want to use systemd I can recommend Fedora 22. It has its quirks there as well but they are nowhere near what you need to suffer through on Debian servers.

05.07.2015: logrotate script

Erik pointed out in the comments that the default afp.conf writes to /var/log/netatalk.log but netatalk does not install a logrotate configuration file for that.

So I'd drop the following into /etc/logrotate.d/netatalk :

The important thing is the copytruncate as netatalk would continue writing to the old log file otherwise as a SIGHUP only causes a re-read of the configuration, not including a log file close and re-open as it should be.

02.06.2015: OpenSSL builds for backward compatibility with uams_dhx.so, uams_randnum.so and afppasswd

Niek's comment below made me aware of an issue for people that upgrade from Netatalk2 and have not used uams_pam.so before.
The old "Randnum exchange" and "2-Way Randnum exchange" uams (User Authentication Modules) have long been depreciated because they only encrypt passwords on the wire with 56 bit DES, so that's unsafe by any standards these days. So you should use the builds from the table above and authenticate your users against PAM (eg. via /etc/passwd, /etc/shadow or LDAP if you have that set up).

Please see the excellent Netatalk documentation on authentication options for an explanation of the options and how to enable safe password storage and usage.

That said, if you have a migration scenario and are sure to need the old uams and afppasswd to go with them, here you go:

These have been built with openssl support (replacing the default libgcrypt). Thus they have uams_dhx.so, uams_randnum.so and afppasswd available after install.