Subject: Re: Help for a newbie

From: Steve Freitas <[email-masked]>
Date: Wed, 20 Sep 2000 11:29:02 -0700

>I am not well acquainted with tcp wrappers, but doesn't tcp wrappers
>only apply if you are starting afpd from /etc/inetd.conf, and not the
>SysV-style /etc/rc.d/init.d/atalk script?  On the other hand, if you use
>ipchains to block the port, then it shouldn't matter how you start the
>server, because then the firewalling is done at a lower level in the
>kernel.

I bow to your grater knowledge. :-) Ipchains is it.

>   Beyond that, it seems to me that both the ipchains and tcp wrappers
>solutions would block *all* access, or none; neither could be used to
>limit it to guest access.  What Colin was asking for is access control
>based on both IP and user ID.

My impression was that he was asking to exclude a range of IPs 
completely. Colin, can you sort this out? :-)

Steve

---

From: BWS - Offwhite <[email-masked]>
Date: Wed, 20 Sep 2000 14:08:29 -0500 (CDT)

Yes, are their any access controls like this?  If it could work much like
the htaccess configs in apache.  That would be great.

Right now I do not like having Netatalk on various servers because I
cannot limit access very easy using Netatalk itself.

But with firewalls you should be able to allow access to specific IPs to
specific services/ports and then put a rule after those which block all
access.  I have yet to set this up, but it can be done.  I just wish I
know how to tell the firewall to allow or block an entire C block,
123.123.123.0/32.  That does not seem to work with FreeBSd/ipfw.  I may
just need to do some more reading.

If anyone can offer any pointers it would be appreciated.

Brennan Stehling - web developer and sys admin
projects: www.greasydaemon.com | www.onmilwaukee.com | www.sncalumni.com

---

From: Matthew Temple <[email-masked]>
Date: Wed, 20 Sep 2000 16:07:11 -0400

All,

	I believe that the tcp_wrapper support available through
inetd is specifically for services that don't know anything about
libwrap and so must call tcpd for this kind of handling.  Doesn't
netatalk use libwrap calls to call the library directly so that
the /etc/hosts.allow file is what's really used as a basis?

					mht

-- 
=============================================================
Matthew Temple                Tel:    617/632-2597
Director, Research Computing  Fax:    617/632-4012
Dana-Farber Cancer Institute     
44 Binney Street, Smith 345   [email-masked]
Boston, MA 02115              IMAP LIVES!
=============================================================

---

From: Matthew Geier <[email-masked]>
Date: Thu, 21 Sep 2000 08:53:58 +1100

Matthew Temple wrote:
> the /etc/hosts.allow file is what's really used as a basis.

 Yes, NetAtalk uses the library directly. I use, and have gotten some
one to test
for me, IP blocking. No one outside the campus can connect. It works.
The outsider
didn't get a response from the server on his mac.

> > >based on both IP and user ID.

 That is some what more difficult. But my problem was of course that
ANYONE could connect as guest, not just our people. Thus we had licenced
software available to the world. The NetAtalk server is protected by TCP
wrappers, and our ASIP server is protected by the MacOS equivalent of a
kernel firewall rules called TCP Filter.

 Being a University, by history we are not firewalled to the hilt like
most modern commercial organisations. Of course our greatest threat is
probably inside, not outside :-)

-- 
Matthew Geier			[email-masked]
Arts IT Unit			+61 2 9351 4713
Sydney University

---

From: Colin Murphy <[email-masked]>
Date: Thu, 21 Sep 2000 08:25:49 +0800

Hi all,
there is some confusion as to what I was trying to do in my last (first)
posting.  Even I am confused.  To make a short story long.

I have a RedHat 6.2 box running
Apache
Samba
Proftpd
Netatalk

The Box is a server for the transfering of files to and from this unit by
departments who want files processed.  Not all these departments are on the
university network.  It is a typical university setup.  The Box has (say)
two directories. One upload and one download.  With
read/write/create/delete set accordingly.  Apache is used for transferring
files through a web browser and is working.  ProFTPD is used for anonamous
upload/download to the corresponding directories and is working.  Samba is
configured so that ALL the PCs in the unit can upload/download to the
corresponding directories and is working.  Some PCs have the ability to
read/write/delete from both directories, using the 'admin users =' in
samba, and are working.  This is so the production computers can access the
files over the network.  I want ALL Macintosh computers on the campus
Appletalk network to have guest access to the Linux Box, BUT I want a
couple of (production) Macs in the unit to have read/write/delete
priveleges through netatalk.  However if this is setup with the Linux
priveleges than every Mac on the campus can read all the files on the Box.
(so could all the other computers, I suspect).  Not a good thing for
security.

I have had an old 486 with this working setup running without problem, but
also without the extra Mac priveleges.
So now ...... How do I set netatalk up so that some macs can have different
priveleges than the rest?  Is there something like the 'admin users ='
setting in Netatalk?  I do have flexibility with IP number as the unit has
its own IP subnet.

Thanks to all who have responded, in particular thanks to Steve Freitas for
pointing out the solution to my Mac Chooser problem.

Kind regards ......  Colin.

Colin Murphy
Manager.  Photographic Unit
The University of Western Australia
Nedlands. 6907 Ph +61 (08) 9380 3056.
http://cyclone.graphics.uwa.edu.au

---

From: Ryan McBeth <[email-masked]>
Date: Thu, 21 Sep 2000 06:55:49 -0400

Colin,

	Do you want some specific Macs to have these access 
privileges or some specific users to have these privileges?  The 
solution will be different for each case?

	Ryan

>http://cyclone.graphics.uwa.edu.au

__________________________________
Ryan McBeth
Systems Administrator, Mobius New Media
Voice: (302) 475-9880 x11
FAX: (302) 475-9894
www.mobiusnm.com
__________________________________
If you want to achieve excellence, you can get there today. As of 
this second, quit doing less-than-excellent work.
-Thomas Watson, founder of IBM