Subject: [netatalk-admins] Compiling netatalk-1.4b2+asun

From: Jochen Haeberle <[email-masked]>
Date: Thu, 12 Mar 1998 11:28:30 +0000

Hi,

after the kind help from the list yesterday, I got netatalk 1.4b2 with the
patches from asun. But I got problems compiling it. in the Main Makefile I
commented out the PAMDIR line which got rid of one error. But now I am missing
the file sys/quota.h

I installed the quota source for my Linux 2.0.32 and found the missing file as
/usr/src/linux-2.0.32/include/linux/quota.h I guess I only need a symlink from
this file but I don't know where to point it to.

Could anyone please help me again?

Jochen

---

From: Jonathan Peterson <[email-masked]>
Date: Thu, 12 Mar 1998 10:36:36 +0000

>Could anyone please help me again?

Re-read the README.LINUX file. At the end it says:

6.  Quota support should work under linux now. If you're using a
    version of glibc > 970627 snapshot or libc > 5.4.34, you can
    comment out the -DNEED_QUOTACTL_WRAPPER in sys/linux/Makefile

This might help solve your problem. Let me know!

--------
Jon Peterson	[email-masked]	+44 (0)171 613 5300
Internet Developer

When she told me I was average, she was just being mean.

---

From: Jonathan Peterson <[email-masked]>
Date: Thu, 12 Mar 1998 10:43:06 +0000

Sorry to be ignorant, but what are TCPwrappers, and why does Netatalk
highly recommend them? Are they a security thing or a speed thing (or
both?) and where can I get them.

Thanks,

--------

---

From: William LeFebvre <[email-masked]>
Date: Thu, 12 Mar 1998 07:00:16 -0500

You wrote:
> Date: Thu, 12 Mar 1998 10:43:06 GMT
> From: Jonathan Peterson <[email-masked]>
> To: <[email-masked]>
> Subject: [netatalk-admins] tcpwrapper
>
> 

It's a security thing.  It originally started as a program that
"wrapped" itself around inetd applications.  Inetd is reconfigured
(through inetd.conf) to invoke the wrapper first, which then execs the
service program.  But before running the service program the wrapper
checks the peer address against a list of rules found in
/etc/hosts.allow and /etc/hosts.deny to see if that host is allowed
for this service.  The access is also logged, and the connection is
checked for any use of IP source routing.

The routines that parse the files and perform the actual checking
were pulled out and placed in a separate library---libwrap---so
that they could be easily embedded in other daemon applications
which were not controlled by inetd.  The library is what netatalk
wants to use.

You can get tcpwrappers from the COAST archive at purdue:
ftp to coast.cs.purdue.edu and look in /pub/tools/unix/tcp_wrappers.

				William LeFebvre
				Group sys Consulting
				<[email-masked]>
				+1 770 813 3224

---

From: Jochen Haeberle <[email-masked]>
Date: Thu, 12 Mar 1998 14:29:14 +0000

Hi,

thanks for your fast reply, but it did not help. -DNEED_QUOTACTL_WRAPPER in
sys/linux/Makefile is already commented out in the release of netatalk I got.

Jochen

---

From: Jochen Haeberle <[email-masked]>
Date: Thu, 12 Mar 1998 14:42:48 +0000

Hi,

perhaps the line in README.LINUX means I should unncomment
-DNEED_QUOTACTL_WRAPPER? But if I do so I get a compiler error very fast saying

make[1]: Entering directory `/usr/src/netatalk-1.4b2+asun2.0a18.2/sys/linux'
Makefile:2: *** missing separator.  Stop.
make[1]: Leaving directory `/usr/src/netatalk-1.4b2+asun2.0a18.2/sys/linux'
make: *** [all] Error 2

So that is probably not the way to go.

Jochen

---

From: Brian Bergstrand <[email-masked]>
Date: Thu, 12 Mar 1998 08:40:06 -0600

>So that is probably not the way to go.
[snip]
No, you should uncomment it, but the def has to be on it's own line. Here
are the top 4 lines of my <netatalk-dir>/sys/linux/Makefile file:

# Linux specific defines, passed to subdirectories.
DEFS=-DNEED_QUOTACTL_WRAPPER
OPTOPTS=        -O5 -fomit-frame-pointer -fsigned-char -Wunused -Wuninitialized
#OPTOPTS=       -g -fsigned-char

Brian

Brian Bergstrand
Network Specialist - ACS
Northern Illinois University
815-753-8547
[email-masked]

---

From: Wes Brown <[email-masked]>
Date: Thu, 12 Mar 1998 08:30:00 -0500 (EST)

> which were not controlled by inetd.  The library is what netatalk

Something that I have been wondering, but have not taken the time to read
the source to find out is what is the prefix for the /etc/hosts.deny
/etc/hosts.allow file that can wrap out just netatalk?

I would guess it is one of the following:
netatalk:ALL
atalkd:ALL
afpd:ALL

Does it only work for AppleShareIP?

Wes
--- 
Wes Brown
[email-masked]		[email-masked]
http://prozac.cwru.edu/wes/About.me.html
KB8TGR

---

From: Michael M Han <[email-masked]>
Date: Thu, 12 Mar 1998 08:42:17 -0800

Previously...
>/etc/hosts.allow file that can wrap out just netatalk?

It's not necessary to read the source. Just the man pages. You should
be able to find tcpd(8) and its see-also hosts_access(5). "wrap out"?
If you mean deny all netatalk,
afpd: ALL
in /etc/hosts.deny would do the trick.

>Does it only work for AppleShareIP?

I doubt that TCP wrappers could cover ddp requests, but don't know for
certain.
_________
mike ([email-masked])
I will not instigate revolution
 - The collected wisdom of Bart Simpson

---

From: William LeFebvre <[email-masked]>
Date: Thu, 12 Mar 1998 12:07:02 -0500

> I doubt that TCP wrappers could cover ddp requests, but don't know for

libwrap doesn't know what appletalk IS.  Yes, this will only check
IP-based connections.  Might be an interesting project to extend
libwrap to accomodate Appletalk, however......  :-)

		Bill

---

From: Oliver Wrede <[email-masked]>
Date: Thu, 12 Mar 1998 17:34:14 +0100

>I would guess it is one of the following:

The last one ist it! You got to put the actual program name there.

>Does it only work for AppleShareIP?

Because you control a _TCP_wrapper with hosts.deny/hosts.allow, you
will notice, that it wraps the TCP services. The original AppleTalk
istself is running on top of DDP (instead of TCP), so it won't be
affected. You can verify that in /etc/services

But Internet-Routers usually do not route DDP, so you'll be stick
to your subnet anyway!

Oliver

. causa formalis  . . . Bruesseler Platz 15 . . [email-masked] .
. informationsdesign  . 50674 Koeln, Germany  .
<http://www.causa-formalis.de/>www.causa-formalis.de  . .
. . . . . . . . . . . . tel +49 221 9522 600  . fax: 605 . . . . . . . . .

---

From: Bill Studenmund <[email-masked]>
Date: Thu, 12 Mar 1998 12:53:26 -0800 (PST)

> libwrap to accomodate Appletalk, however......  :-)

Why?

ddp internets don't interconnect the way IP ones do (they aren't on the
whole-planet scale). So all the ddp packets you'll get are from your
neighboors, be they within your university or workplace. If you're having
breakins from THEM, you've got REAL problems. :-)

Take care,

Bill

---

From: William LeFebvre <[email-masked]>
Date: Thu, 12 Mar 1998 15:58:07 -0500

> breakins from THEM, you've got REAL problems. :-)

Oh, so you trust all the undergrads with their in-dorm connections to
not try afp/ddp spoofing to break in to your Appletalk servers?

Most security experts (this includes physical security as well) agree
that the greatest threat usually lies within an organization.

I'm not saying that the threat really justifies extending libwrap, I
just thought it would be an interesting exercise.

		Bill

---

From: KHOO Guan Chen <[email-masked]>
Date: Sat, 14 Mar 1998 17:11:09 +0800 (SGT)

This is probably silly, but why can't I download a mac file off the
internet, put in into the share folder, copy it out to the mac and expand
it with say stuffIt? I have tried a few times and everytime, I get file is
corrupted message.

Thanks

Richard KHOO Guan Chen
e-mail: [email-masked]
snail-mail: 38-A, Lorong 23, Geylang, Singapore 388372

---

From: William LeFebvre <[email-masked]>
Date: Sat, 14 Mar 1998 15:14:07 -0500

You wrote:
> Date: Sat, 14 Mar 1998 17:11:09 +0800
> From: KHOO Guan Chen <[email-masked]>
> To: [email-masked]
> Subject: [netatalk-admins] corrupted downloads
>
> 

If you are downloading it with FTP, then are you doing a binary
transfer?  If the transfer is not binary, then the file will almost
certainly become corrupt.

				William LeFebvre
				Group sys Consulting
				<[email-masked]>
				+1 770 813 3224

---

From: KHOO Guan Chen <[email-masked]>
Date: Sun, 15 Mar 1998 14:26:12 +0800 (SGT)

Thanks to all who replied. I think I must, in future, remember to give
more details, at least, that I did use binary to download. Anyway, Andras
Kedinger mentioned that it has to do with CR-LF translation and that is
the direction I will be persuing. 

Great! guys!!!

Richard KHOO Guan Chen

---

From: Jonathan Peterson <[email-masked]>
Date: Mon, 16 Mar 1998 10:07:17 +0000

>certainly become corrupt.

Also, make sure that CR/LF translation is turned off in netatalk. By
default this is done automatically, and you have to turn it off my
uncommenting the line in the Makefile, and re-compiling.

I have to say that I think this is a very silly default. How many users are
there that use netatalk _only_ for ASCII files??

--------

---

From: Vivek <[email-masked]>
Date: Mon, 16 Mar 1998 10:36:11 +0000 (GMT)

> there that use netatalk _only_ for ASCII files??

It's only the default translation when it can't determine the file type,
although I agree it seems silly to have TEXT/UNIX be the default: I have
BINA/ttxt as the default translation, and explicitly set TEXT/whatever
only when I've tested that format and extracted it's type/creator from a
resource fork. [After being burnt by the TEXT/UNIX thing a few times... ]

--
fsck -f -b 8193 /dev/cortex