Subject: [netatalk-admins] AppleTalk routing

From: [email-masked] (Amitai Schlair)
Date: Sat, 17 Jan 1998 16:39:07 -0500

I'm running Netatalk 1.4b2 (with Arthur Sun's patches) on NetBSD 1.3,
and I'm trying to get AppleTalk routing, as described in atalkd(8),
working. I've got AppleShare IP on ae2 (accessible to the LAN), and I'd
like my Mac (connected to ae1) to be able to access AppleShare resources
on the outside network, as well as those on the NetBSD box. Is this
possible? If so, how do I configure ae1 in atalkd.conf? (Letting atalkd
auto-configure the interfaces on startup didn't work well at all.)

Thanks for any help.

-- 
A critic is a man who knows the way but can't drive the car.
     -- Kenneth Tynan

---

From: [email-masked] (Amitai Schlair)
Date: Sat, 17 Jan 1998 21:06:09 -0500

> auto-configure the interfaces on startup didn't work well at all.)

Despite my total lack of experience with and understanding of AppleTalk
internals, I managed to hack my way partly there. From my Mac (connected
to ae1), I can now see all the zones on the LAN (connected to ae2).
However, the only AppleShare volume I can see in the Chooser (or any
AppleTalk service for that matter) is the one on my NetBSD box. I'd like
to be able to see all the AppleShare volumes out there on the LAN, if
possible.

My atalkd.conf:

ae2 -phase 2 -net 25-50 -addr 25.33 -zone "CWRUnet" -zone "Chemistry"
-zone "Housing" -zone "Statistics" -zone "neurosciences" -zone "WSOM"
-zone "Smith Lab" -zone "Physics" -zone "Neutral" -zone "Net Services"
-zone "Music" -zone "MSASS" -zone "Medicine" -zone "Math" -zone
"Libraries" -zone "Health Sci" -zone "ESS" -zone "Engr" -zone "EEAP"
-zone "CIT" -zone "CP&P" -zone "CNS Internal" -zone "CIM" -zone "CES"
-zone "BRB" -zone "BIOMED" -zone "Arts & Sci" -zone "Archives" -zone
"AIS" -zone "Administration" -zone "South Residences" -zone "North
Residences" -zone "Medlab" -zone "Meds" -zone "Asian Studies" -zone "INS
Internal"
ae1 -phase 2 -net 51-75 -addr 51.33

The AppleTalk Phase II network range for the LAN, as described in the
network docs, is 25-50. "CWRUnet" is the default zone; I have my AFP
service running in "North Residences". (My connection to the LAN on ae2
works great.) The bit of hackery I did to get on the AppleTalk network,
sort of, was to set the netrange on ae1 in atalkd.conf to 51-75
(wrong?), and manually set the network and node in the Mac's AppleTalk
control panel to some reasonable numbers.

Despite my inexperience, I'm pretty sure my ae1 netrange setting is why
I can't see the machines on the LAN... but I can't get anything at all
when I set it properly (25-50).

I'm also getting a lot of messages on the console:

Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CIT exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CIT exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast CWRUnet exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists
Jan 17 20:27:08 b60735 atalkd[224]: zone_bcast EEAPo exists

and so on. I hope I'm not making an AppleStorm on the LAN! How can I fix
all this to work properly?

-- 
God is dead, but fifty thousand social workers have risen to take his
place.
     -- J.D. McCoughey

---

From: Julian Elischer <[email-masked]>
Date: Sat, 17 Jan 1998 21:04:24 -0800 (PST)

I'm not convinced that atalk on FreeBSD routes.
NetBSD was based off the freeBSD port I did.
so I'm not sure it  works..
I also made some changes in FreeBSD that were not copied (to my knowledge)
to NetBSD.

the best bet is to read teh source :)

---

From: Bill Studenmund <[email-masked]>
Date: Wed, 28 Jan 1998 12:42:29 -0800 (PST)

> control panel to some reasonable numbers.

Are ALL of these zones available on the same wire?? If you go to the
Network (not OpenTransport) or the AppleTalk (OpenTransport) Control
panel, do you see all of these zones?

> when I set it properly (25-50).

25-50 is NOT right! Each wire, like your internal net, should have its own
netowrk number, or net range. Node numbers (net.node) are address like IP
addresses (except they are randomly choosable and don't scale to world
sizes). So your internal wire will have to have its own number, so the
other computers can have a chance of talking to you.

I'd suggest a netrange of just one number (say 51). You can get upwards of
250 nodes per net, so you don't really need 25 of them. :-)

> all this to work properly?

As Stefan said, talk to your admins. For this to work, the other routers
on campus have to know about your net number.

---

From: Bill Studenmund <[email-masked]>
Date: Wed, 28 Jan 1998 13:15:54 -0800 (PST)

> the best bet is to read teh source :)

Julian,

What are these changes? Could you send them to me?

I bet you're right that the forwarding might not work right. It's one of
the things I want to look at next time I go mucking in the netatalk code.

I think you have all the changes we've made. The only outstanding things,
which come from OpenBSD, are adding an extra test in at_aarpinput to make
sure we ignore aarp responses from a broadcast address and a pullup on the
packet in ddp_output (for aligning packets forwarded from a phase 1 net to
a phase 2 net).

I'm running the broadcast catch, and I've not seen the message. When I
asked Jason Thorpe about the pullup, he didn't seem to think we needed it.

The things I want to add are: use of NetBSD's new macros for getting the
head and next item of TAILQ's, and LocalTalk support. FreeBSD and OpenBSD
will certainly be welcome to all of these changes.

Does FreeBSD have macros for getting at items in TAILQ's? I know it's not
too hard to do, but stuff like aa->aa_ifa.ifa_list.tqe_next is bulky. 

Take care,

Bill

---

From: Carl Beaudry <[email-masked]>
Date: Wed, 28 Jan 1998 20:25:23 +0000

Has anyone here successfully compiled poppassd under either of the last
two Redhat releases (either with or without shadow passwords.)

I'm still getting the following error:

    poppassd.c: In function `chkPass':
    poppassd.c:803: warning: passing arg 1 of `strcmp' makes
                    pointer from integer without a cast
    cc -o poppassd  poppassd.o 
    poppassd.o: In function `chkPass':
    poppassd.o(.text+0xa1b): undefined reference to `crypt'
    make: *** [poppassd] Error 1

which seems to be coming from the following function:

    int chkPass (char *user, char *pass, struct passwd *pw)
    {
         /*  Compare the supplied password with the password file entry
*/
         if (strcmp (crypt (pass, pw->pw_passwd), pw->pw_passwd) != 0)
              return (FAILURE);
         else 
              return (SUCCESS);
    }

Now it looks to me like strcmp is retuning an integer, which is as it
should be.  Am I missing something obvious here?

--Carl

---

From: Bill Studenmund <[email-masked]>
Date: Wed, 28 Jan 1998 13:32:00 -0800 (PST)

On Wed, 28 Jan 1998, Bill Studenmund wrote:

Sorry for the noise. That response was supposed to be private.

Take care,

Bill

---

From: Bill Studenmund <[email-masked]>
Date: Wed, 28 Jan 1998 13:57:22 -0800 (PST)

>                     pointer from integer without a cast

This says that the first parameter _to_ strcmp has a problem. I.e. crypt's
not defined right.

>     poppassd.o(.text+0xa1b): undefined reference to `crypt'

This error also says crypt's not working right.

> should be.  Am I missing something obvious here?

Is there a correct prototype to crypt?

I'm not sure how to fix this under Linux.. Sorry.

Take care,

Bill

---

From: Mike Holling <[email-masked]>
Date: Wed, 28 Jan 1998 14:06:53 -0800 (PST)

What does poppassd have to do with netatalk?

- Mike

---

From: Carl Beaudry <[email-masked]>
Date: Wed, 28 Jan 1998 21:27:47 +0000

> What does poppassd have to do with netatalk?

Nothing directly--except that it can be used to provide a graphical
interface for changing passwords, which is of no small importance to
sites using netatalk to support Macs without allowing telnet logins.  

And though it's possible to change people's shells to /bin/passwd (or
somesuch), for a lot of sites, the ability to shut off telnet altogether
is a useful security measure and I, for one, would love to see the
Chooser's password changing command supported in some future iteration
of netatalk and poppassd might be one way to accomplishing that since it
already has some cgi support (wwwpass, etc.) and a reasonably well-known
interface.

So I'm sorry if this offends listdotpurists, but the C interface to
password decryption is directly relevant to netatalk and so this seemed
to be a reasonable use of bandwidth.

--Carl

---

From: Bill Studenmund <[email-masked]>
Date: Wed, 28 Jan 1998 16:26:35 -0800 (PST)

> already has some cgi support (wwwpass, etc.) and a reasonably well-known

The deal w/ the Chooser password changing is, AFAIK it only works w/
two-way scrambled authentication. The latter requires the server (afpd)
know the plaintext password for the user. Stock unix authentication only
knows the one-way encrypted password, making password determination
require brute-force algorythms (encrypt a dictionary and see if the output
matches the encrypted password).

I think what the two-way scrambled authenticator that I've heard of does
is keep an afpd password in the user's home directory, clear text,
readable only by the user and root.

Take care,

Bill

---

From: Wes Brown <[email-masked]>
Date: Thu, 29 Jan 1998 08:21:33 -0500 (EST)

> 250 nodes per net, so you don't really need 25 of them. :-)

Please note: The network range 25-50 is correct for this network.  CWRUnet
Appletalk connections are to be coordinated through the Router Coordinator
and the Zone coordinator (both are [email-masked])

[clip]
> on campus have to know about your net number.

Wes
--- 
Wes Brown
[email-masked]		[email-masked]
http://prozac.cwru.edu/wes/About.me.html
KB8TGR

---

From: Bill Studenmund <[email-masked]>
Date: Thu, 29 Jan 1998 11:23:42 -0800 (PST)

> and the Zone coordinator (both are [email-masked])

Uhm, I though ae1 was the internal net, the one hidden from the main net. 
25-50 certainly would be right for the main net, but not for the internal
one, as those are the numbers you have on the main net. Here's an excert
from the message I was replying to:

Take care,

Bill