Subject: Re: Macs in chooser using TCP

From: Chip Mefford<[email-masked]>
Date: Fri, 25 Aug 2000 19:47:44 -0400

------- Original Copy -------
>Subject: Macs in chooser using TCP
>Date: 08/25/2000 3:29 PM
>From: Aaron Levitt <[email-masked]>
>To: [email-masked]

>Ok.. before you start pointing me to Harry's .sig file, 
read the whole mail.  I have a box set up and I want to 
force TCP over appletalk.  So I added the -noddp flag.  Will 
this also force it not be browseable in the chooser??  If 
so, is there a way to have the box show in the chooser but 
default to afp-over-tcp??

Hi Aaron;

My netatalk boxes are set up with the 
-noddp flag, they appear in the
chooser and always mount via tcp. 

Guess that's what ya want?

---

From: Aaron Levitt <[email-masked]>
Date: Fri, 25 Aug 2000 18:49:37 -0700 (PDT)

Yep.. That is what I wanted to hear.  I hadn't added the alias to
/etc/conf.modules until today and the machine won't get a reboot until
this weekend (I assume that is what it takes to get the box to re-read the
conf.modules file).  I will know tomorrow after the reboot if I am all
set.  Thanx for the good word!

-Aaron

---

From: andrew morgan <[email-masked]>
Date: Fri, 25 Aug 2000 19:21:29 -0700 (PDT)

> set.  Thanx for the good word!

It should work without rebooting.  Try restarting netatalk before
you go through the hassle.

	Andy

---

From: Aaron Levitt <[email-masked]>
Date: Fri, 25 Aug 2000 23:09:10 -0700 (PDT)

already tried restarting atalk.  Nothing happened.  Which is why I am
going to reboot over the weekend. =(

-Aaron

---

From: "Kirk W. Charles" <[email-masked]>
Date: Mon, 28 Aug 2000 09:49:49 -0400

> > chooser and always mount via tcp.

How do you tell if the mount is TCP or not?
--
Kirk W. Charles phone: 404-351-2042
Sundberg-Ferar  FAX: 404-352-9370
1850 Alma St.   E-mail: [email-masked]
Atlanta, GA 30318       www.sundbergf.com

---

From: Rick Zeman <[email-masked]>
Date: Mon, 28 Aug 2000 10:33:26 -0400 (EDT)

>From the Mac, select the mounted volume and get info on it.  That'll tell
ya.

---

From: Aaron Levitt <[email-masked]>
Date: Mon, 28 Aug 2000 08:00:48 -0700

Well.. after mucking around with netatalk, I couldn't get the box to show in the chooser with the -noddp flag, so I just removed the flag from my afpd.conf.  I am still using the pre39 version on a 2.2.14 kernel and it appears to be fine aside from that.  As far as I can tell, it still defaults to afp-over-tcp.  I tested it on various macs with various OS's and they all pick tcp.  

One side notes I noticed I thought I would point out, is when I compiled the source, I enabled all the various password authentication I could (with the exception of kerberos).  With OS9 (I guess from the new changes in the security code) it automatically uses "Encrypted Password Transport" which seems pretty secure.  I sniffed the network and was unable to see the passwords, though I am not sure which method it uses on the unix side (looking at /var/log/messages, I would guess PAM).  So with OS9, you don't need to use the .passwd file in the home dir and you don't end up with cleartext passwords floating around your network.

Also, I received a couple messages asking how you can tell whether the mount used TCP or not.  There are two ways.  The first, which may not work in all cases, if there is a small globe in the lower right hand side of the icon of the mounted server, that means it used TCP.  If that isn't the case, on the mac you mounted the share, if you "get info"(cmd + I) on the share, it will say in the dialog. In the "Where" information it will say either "$mount,$box,via TCP" or "$mount,$box,via appleshare".

Hope this information helps someone along the way.

-Aaron
>>>>====--------====<<<<>>>>====--------====<<<<
Aaron Levitt		1616 Franklin Street
Systems Administrator	Oakland, CA  94612
Navis LLC		Tel:  510-763-5715
http://www.navis.com	Fax:  510-763-2516
>>>>====--------====<<<<>>>>====--------====<<<<

---

From: andrew morgan <[email-masked]>
Date: Mon, 28 Aug 2000 09:00:38 -0700 (PDT)

On Mon, 28 Aug 2000, Aaron Levitt wrote:

> Well.. after mucking around with netatalk, I couldn't get the box to
> show in the chooser with the -noddp flag, so I just removed the flag
> from my afpd.conf.  I am still using the pre39 version on a 2.2.14
> kernel and it appears to be fine aside from that.  As far as I can
> tell, it still defaults to afp-over-tcp.  I tested it on various macs
> with various OS's and they all pick tcp.

Advertising in the chooser *requires* using DDP (AppleTalk).  However,
when the mac connects to the server over DDP, the server can tell the mac,
"hey, I'm also available over TCP/IP at this address: xxx".  Then the mac
will reconnect to the server with that IP address.  Bottom line: if you
want to browse for servers, you need AppleTalk, as you discovered.

> One side notes I noticed I thought I would point out, is when I
> compiled the source, I enabled all the various password authentication
> I could (with the exception of kerberos).  With OS9 (I guess from the
> new changes in the security code) it automatically uses "Encrypted
> Password Transport" which seems pretty secure.  I sniffed the network
> and was unable to see the passwords, though I am not sure which method
> it uses on the unix side (looking at /var/log/messages, I would guess
> PAM).  So with OS9, you don't need to use the .passwd file in the home
> dir and you don't end up with cleartext passwords floating around your
> network.

You are using DHX encrypted passwords, which you get by setting the
CRYPTODIR variable in the top-level Makefile.  Basically, DHX encrypts
your password using SSL routines before sending it across the network.  I
don't know why anybody would use rand2num passwords instead.  I don't want
my cleartext password sitting in a file on the network!  DHX support is
already included in OS9 and all the versions of OS8 I have tried.

	Andy

---

From: Aaron Levitt <[email-masked]>
Date: Mon, 28 Aug 2000 09:31:08 -0700

How do you get OS8+ to use DHX??  The macs I have tried here, it only seems to work with OS9.  I have tried OS8.1, OS8.5 and OS8.6 and they only seem to get clear text password authentication.  Is there something that needs to be added to the macs??

-Aaron

---

From: Steven Karel <[email-masked]>
Date: Mon, 28 Aug 2000 14:01:15 -0400 (EDT)

All you should need to do is upgrade to AppleShare Client 3.8.6

http://asu.info.apple.com/swupdates.nsf/artnum/n11544

steven

 On Mon, 28

---

From: Harry Zink/Netatalk List <[email-masked]>
Date: Mon, 28 Aug 2000 22:33:12 -0700

> All you should need to do is upgrade to AppleShare Client 3.8.6

Well, I'm running the RPM from Jeff B, and I made sure that AppleShare 3.8.6
is installed (which is suppopsed to have DHX integrated). When I try to
connect, I get an error that let's me know that the appropriate UAM is not
installed in the 'AppleShare Folder' in the 'Extensions' folder.

Yes, I made sure the DHX uam is specified in the afpd.conf file, but I still
can't get anything else to work but clear-text passwords.

Could it be that Jeff didn't compile the needed settings into his pre-39
RPM? If so, Jeff, is there any chance to release a new RPM that does handle
all of this - otherwise, what might I be overlooking?

Harry

-- 
CAN'T SEE MAC IN CHOOSER UNDER RedHat 6.2: If you get errors starting
AppleTalk under RedHat 6.2 and Mandrake 7.1, you need to manually add "alias
net-pf-5 appletalk" to your /etc/conf.modules file.

---

From: Aaron Levitt <[email-masked]>
Date: Tue, 29 Aug 2000 08:07:06 -0700

Adding Appleshare client 3.8.6 to the non-OS9 machines did the trick for me.

Thanx for all the input folks!

-Aaron