Subject: [netatalk-admins] multiple interfaces

From: Simon Buchanan <[email-masked]>
Date: Wed, 09 Jun 1999 09:42:28 +1200

RH5.2/i386 with netatalk-1.4b2+asun2.1.3-4
I have two ethernet cards.. eht0 = inside firewall, eth1 = connected to
the internet. standard setup. having put eth0 in atalkd.conf, netatalk
has filled in the rest for me.. my question is..

Is it possible to have eth0 running with TCP and normal appletalk and
eth1 running only non-tcp appletalk?

And if so how? :)

Cheers

-- 
Simon Buchanan
Systems Administrator
New Media Communications
===================================================
[email-masked]           www.newmedia.net.nz

---

From: [email-masked]
Date: Wed, 9 Jun 1999 10:41:32 -0500 (CDT)

> eth1 running only non-tcp appletalk?

A better solution would be to make sure that your firewall blocks
appletalk over IP and call it a day.  Another solution, which I think is
better would be to keep appletalk off the "unsecure" segment altogether
and equip any mac necessitating a direct connection to the I-net with a
second ethernet interface to talk to the internal network.  Surely there
aren't too many of those Macs.

Tom

---

From: [email-masked]
Date: Wed, 9 Jun 1999 14:04:22 -0500 (CDT)

On Wed, 9 Jun 1999, Devin Reade wrote:

> Unfortunately, that kind of defeats the purpose of the firewall, 
> having one or more machines (other than the firewall) connected
> to both networks.

Yes, but appletalk without IP suggests that someone is willing to do it
anyway.  Besides, the border router can be a rudimentary if not a
complete firewall.  I don't necessarily disagree with you, I just provide
some options.  This one just happens to be just as bad as what was
suggested originally.

Tom

---

From: Devin Reade <[email-masked]>
Date: Wed, 9 Jun 1999 10:08:33 -0600 (MDT)

[email-masked] wrote:

> appletalk over IP and call it a day. 

I'll second this.

> Another solution, which I think is
> second ethernet interface to talk to the internal network.

Unfortunately, that kind of defeats the purpose of the firewall, 
having one or more machines (other than the firewall) connected
to both networks.  And if someone happens to configure one of
those macs to act as a router, then your problems are just beginning
(and not just because of potential crackers).

Devin
-- 
A competent and self-confident person is incapable of jealousy in anything.
Jealousy is invariably a symptom of neurotic insecurity.
							- Robert Heinlein

---

From: Patrik Schindler <[email-masked]>
Date: Wed, 9 Jun 1999 19:46:10 +0200

>eth1 running only non-tcp appletalk?

afpd binds to any IP interface, anyway, so currently you've got what you want.
You may restrict access in /etc/hosts.deny and /etc/hosts.allow for TCP sessions ONLY!

:wq! PoC

---

From: [email-masked]
Date: Wed, 09 Jun 1999 15:27:04 -0700

>(and not just because of potential crackers).

You can define more than one server to start from the afpd.conf file,
according to comments in the supplied afpd.conf in the RPM for
netatalk-1.4b2+asun2.1.3-2. I use this to bind 2 servers to 2 NICs on 2
separate IP addresses - works fine. Try the -ddp or -notcp flag on one of
the servers.

# Format of lines in this file:
#
#    server [ -tcp ] [ -ddp ] [ -guest ] [ -loginmesg message ] ...
#
# To specify a line with the default server name, use a "-" as the
# server name.
#
# There are a whole plethora of options available. Here they are for
# your edification:
#       toggles (-no<option> turns that option off; -<option> turns
#               it on):
#               transports: tcp, ddp, transall
#               debug: nodebug (can only turn off debug)
#               auth: cleartxt, afskrb, krbiv, guest, randnum, rand2num,
#                     authall (doesn't include randnum/rand2num)
#               passwd: savepassword, setpassword
#               user volumes: uservolfirst,
#                             nouservol (don't look for ~/.AppleVolumes)
#
#
#       options w/ arguments (-<option> <argument>):
#               defaultvol, systemvol, loginmesg, guestname
#               address (binds a server to a specific address)
#               port (has to be specified if more than one tcp server
#                    is to be served)
#               tickleval (sets the tickle interval in seconds)
#               uampath, nlspath
#
# Order of precedence:
#       options in afpd.conf > command-line options > built-in options
#
# Some examples:
#
#       The simplest case is to not have an afpd.conf.
#
#       4 servers w/ names server1-3 and one w/ the hostname. servers
#       1-3 get routed to different ports with server 3 being bound
#       specifically to address 192.168.1.3
#               -
#               server1 -port 12000
#               server2 -port 12001
#               server3 -port 12002 -address 192.168.1.3
#
#       a dedicated guest server, a user server, and a special
#       ddp-only server:
#               "Guest Volume" -nocleartxt -loginmesg "Welcome guest!"
#               "User Volume" -noguest -port 12000
#               "special" -notcp -defaultvol <path> -systemvol <path>

<------------------------------------------------------------->
| Erik Ohlin   mailto:[email-masked]   (760)438-8933 |
| Pacific Color http://www.pacificcolor.com fax:(760)438-8414 |
|    1916 Palomar Oaks Way, Suite 100, Carlsbad, CA  92008    |
<------------------------------------------------------------->
If quitters never win, and winners never quit, 
what fool came up with, "Quit while you're ahead?"

---

From: Simon Buchanan <[email-masked]>
Date: Thu, 10 Jun 1999 08:33:49 +1200

> You may restrict access in /etc/hosts.deny and /etc/hosts.allow for TCP sessions ONLY!

That would explain why i have appletalkip over both interfaces and
plain-appletalk over the internal network only yes?

The two ethernet card option has merits in other ways... Provided that
the mac is not set up as a router - which its not.. then you can allow
plain-appletalk direct access to this mac via the Mac OS file-sharing
for any admin type stuff. But then i suppose you could just walk over to
the mac :)

Is there any way of 'switching' netatalk off the 'external' network all
together?

---

From: [email-masked]
Date: Thu, 10 Jun 1999 09:46:17 -0500 (CDT)

On Thu, 10 Jun 1999, Simon Buchanan wrote:

> then you can allow
> for any admin type stuff.

Yes, but then you don't need to have it on the esxtermnal network at all.

> Is there any way of 'switching' netatalk off the 'external' network all

I think the following is at least what you want:

Internal Net   ----   External Net   ----   I-Net
Macs                  File Server
File Servers          (with TCP wrappers)

What you (?) have now is probably this:

Macs                 Macs
File Servers         File Servers
                     Gateway Router

Even TCP wrappers won't help much you against attacks on your Macs.

Tom

---

From: Patrik Schindler <[email-masked]>
Date: Thu, 10 Jun 1999 23:44:33 +0200

>plain-appletalk over the internal network only yes?

Right.

>the mac is not set up as a router - which its not..

You need special software.

>for any admin type stuff. But then i suppose you could just walk over to

Sorry, I cannot get what you mean?

>Is there any way of 'switching' netatalk off the 'external' network all

Perhaps look in the manpage to afpd.conf or restrict the usage via tcp_wrappers (/etc/hosts.*).

:wq! PoC