Subject: Still having a problem with Linux 2.2.16-3 and netatalk

From: Margaret Doll <[email-masked]>
Date: Mon, 2 Oct 2000 16:46:29 -0400

Dear netatalk group,

	I have three linux computers running RedHat linux; one at
2.2.12-20, one at 2.2.14-6, and one at 2.2.16-3.  All are supposedly
running netatalk, but one can only see the first two of them on a Mac
Chooser.

	The third one is set up in the same way as the others.  All are
running
netatalk-1.4b2_asun2.1.3-6 installed from an rpm file.  atalk is in
/etc/atalk on all.
I changed the last lines on the AppleVolumes.* files to fit the system
names.  "lsmod" on all of them
lists appletalk; the appletalk module is smaller on the 2.2.12-20 system.
papd is running on all of them.  afpd is running as "afpd -c 5 -n
nameofcomputer" on all of them.  The "nameofcomputer" is the name
without the domain information.  "hostname" on all computers is the fully
qualified hostname with the domain information.  "atalkd" is running on all
of them.

	Any idea what is happening?  I have ordered RedHat 7.0, but I need
to understand what is going wrong with the 2.2.16-3 system.

	Thanks.   This is a very useful product when it is working.

					Margaret Doll  (x3-1982)
					[email-masked]
					(401) 745-7306 (beeper)

---

From: Marc Miller <[email-masked]>
Date: Mon, 2 Oct 2000 14:22:13 -0700 (PDT)

What happens if you change the order that they're listed in
AppleVolumes?  Is it always the first two listed in the file that show
up?  Also, the default location that netatalk looks for its files changes
from version to version.  Make sure that if you modify the name of the
volume in AppleVolumes.* and restart afpd that the name *does*
change.  If not, it's reading a different copy of
AppleVolumes.default.

> 	Thanks.   This is a very useful product when it is working.

============================================================
	/\/\arc ._|. /\/\iller ([email-masked])
	Computer Room Consultant
	Information Technology/Lab Management
============================================================
I can be contacted through the Communication Center link from
http://www.mother.com/~mjmiller/

---

From: Harry Zink/Netatalk List <[email-masked]>
Date: Tue, 03 Oct 2000 00:14:56 +0000

Just to chime in, but I have the similar problem with only seeing a 1.99gb
window on my server's true size - this is with 1.499 from SourceForge.

Harry

---

From: "Basil Hussain" <[email-masked]>
Date: Tue, 3 Oct 2000 12:04:46 +0100

Hi,

> window on my server's true size - this is with 1.499 from SourceForge.

Yes, this indeed appears to be a bug or misconfiguration. I have just
installed netatalk-1.4.99-0.20000927mdk on RedHat 6.0 from the RPM on
SourceForge and I'm getting the same thing.

Whilst I'm on the subject of 1.4.99, I have a few suggestions for the
default config supplied with it.

In afpd.conf it indicates that the default config for file sharing is:

- -transall -uamlist
uams_guest.so,uams_clrtxt.so,uams_dhx.so -nosavepassword

which seems a bit strange, as I believe that you have to set something
special up on the Mac side to use DHX. Providing a default of:

- -transall -uamlist uams_guest.so,uams_randnum.so -nosavepassword

would be better, so long as you have OpenSSL installed (the RPM's
dependencies seem to take care of that anyway). 2-way encrypted passwords
just work out of the box.

Also (and this is very strange), ATALK_BGROUND in netatalk.conf is set to
'no' by default! I can't imagine any situation (apart from debugging) where
you would want to run a daemon service in the foreground. Maybe this is
intentional (as it is beta), but it confused the hell out of me for a while.

Regards,

------------------------------------------------
Basil Hussain ([email-masked])

---

From: David R Bosso <[email-masked]>
Date: Tue, 03 Oct 2000 09:30:47 -0700

> special up on the Mac side to use DHX. Providing a default of:

DHX just requires MacOS 9, or 8.1-8.6 with Appleshare Client 3.8.5(?) or 
later.

> just work out of the box.

Not really out of the box, randnum requires plain text passwords on the 
server.  It's basically a server side vs. client side configuration issue. 
I personally would rather not have plain text passwords on the server.

-David

---

From: jeff b <[email-masked]>
Date: Tue, 03 Oct 2000 12:07:05 -0400

Basil Hussain wrote:
> > Just to chime in, but I have the similar problem with only seeing a 
> > 1.99gb window on my server's true size - this is with 1.499 from 
> > SourceForge.
> 

It was my understanding that the 1.9 GB display problem was related to
the version of Appleshare Client that you are using -- the older ones
seem to have that problem.
 
> dependencies seem to take care of that anyway). 2-way encrypted
> passwords just work out of the box.

If everyone else is good with the change, we can make it -- I'm just not
sure what people have had success with.
 
> Also (and this is very strange), ATALK_BGROUND in netatalk.conf is set
> to 'no' by default! I can't imagine any situation (apart from debugging)
> where you would want to run a daemon service in the foreground. Maybe
> this is intentional (as it is beta), but it confused the hell out of me
> for a while.

That setting does not run netatalk in the foreground... it merely causes
the init scripts to run in the foreground. This is important for seeing
whether it starts or fails in Redhat type initscripts.

jeff

---

From: "Basil Hussain" <[email-masked]>
Date: Tue, 3 Oct 2000 18:12:08 +0100

Hi,

> I personally would rather not have plain text passwords on the server.

Well, it doesn't seem that they're stored on the server as plain text
anymore with 1.4.99, as you now use the supplied afppasswd utility to set
passwords - which it does by creating a file that is similar in style and
operation to /etc/passwd.

This is what my file shows (usernames obfuscated for security purposes):

# cat /etc/atalk/afppasswd
user1:6F6D656761000000:****************:********
user2:6661737463617200:****************:********
user3:7570776972650000:****************:********
user4:77696E646F770000:****************:********
user5:6F76657274696D65:****************:********

Not exactly plain text, is it?

While on the subject, maybe someone can explain what other authentication
methods afppasswd can set passwords for? The man page for it doesn't name
any, simply saying that it "allows the maintenance of afppasswd files
created by netatalk for use by some User Authentication Modules (UAMs)". I
gather this is what the other fields in the password file are for.

Regards,

---

From: "Marc J. Miller" <[email-masked]>
Date: Tue, 3 Oct 2000 10:26:24 -0700

There's an option in AppleVolumes.default that is normally used to restrict
the visible size to 2G (for older versions of MacOS that don't understand
large hard drives).  I think it's supposed to be disabled by default.  Has
anyone tried fooling with that?

DHX only requires an updated version of AppleShare.  Nothing is required to
activate it on the client side; it simply uses that method if it's
available.

ATALK_BGROUND="no" doesn't really affect operation.  It's foregrounded while
atalkd, afpd, and papd are *loading*.  After they're loaded, they go to the
background like any other daemon.  Since it takes 10-20 seconds for the
Appletalk services to load, some people prefer that they load in the
background.  Myself, I prefer to know when it's done loading so that as soon
as it's done loading, I can have a Mac log in to the server (and I don't
have to make a guess as to whether it's done loading yet).

----- Original Message -----
From: "Basil Hussain" <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, October 03, 2000 4:04 AM
Subject: Re: 1.99gb window limit

> > Just to chime in, but I have the similar problem with only seeing a
1.99gb

---

From: David R Bosso <[email-masked]>
Date: Tue, 03 Oct 2000 10:29:45 -0700

> Not exactly plain text, is it?

Interesting... it was my understanding that the randnum uam needed plain 
text.  Have they acually been re-written to take advantage of the afppasswd 
database?

That still leaves you with having to maintain a separate password database 
for randnum, which is not required for DHX.  I personally could go either 
way on the default behavior, I'm just trying to point out some of the 
differences.

-David

---

From: "Basil Hussain" <[email-masked]>
Date: Tue, 3 Oct 2000 18:43:29 +0100

Hi,

> seem to have that problem.

Well, I'm experiencing the problem using an iMac with MacOS 9.0.4 and
AppleShare Client 3.8.6 - not very old, I think you'll agree - but, just in
case, I had a look for software updates on Apple's web site and didn't find
a newer version.

> whether it starts or fails in Redhat type initscripts.

Ah, right. Thanks! BTW, are the netatalk.conf options described in a man
page somewhere?

Regards,

---

From: Sean Phelan <[email-masked]>
Date: Tue, 03 Oct 2000 13:39:50 -0500

Okay, here is the situation.  We are trying to replace an old novell server
with a linux box running netatalk/samba.  We are a newspaper that relies
heavily on Quark 3.32 - 4.11 running on both Macs and PCs.  Generally,
editorial uses windows machines (95,98,NT) and Quark to create the
content/listings.  When finished, they tell the production people to make
it look pretty using Quark on Macs (8.1 - 9.04).

So, I set up a new dell (PIII 700 256RAM 3COM 905c) running Redhat 6.0 with
the 2.2.16 kernel.  I am using samba 2.0.7 and netatalk pre-asun2.1.4-37b
with FLOCKS.

Here are the problems that we are having:
1.  Macs cannot open any quark file that is created on a pc.  They are told
that the file is locked.  They are able to open a copy of the file once I
make a copy of it via the linux command line.  NOTE: Sometimes when they
try to open the file and it tells them it is locked, the file is somehow
deleted.  I thought is was something with samba so I looked into how they
lock files.  I have turned oplocks off.

2.  Lastly,  macs 8.6 and above still are unable to keep a connection.
They are constantly getting disconnected.  

Any direction is much appreciated.  Unforunately if I cant get this to work
ASAP,  we might have to look elsewhere for solutions(windows 2000).  

Thanks in advance
Sean Phelan
Chicago Reader

---

From: "Marc J. Miller" <[email-masked]>
Date: Tue, 3 Oct 2000 11:36:35 -0700

If we do change the default, our configure scripts should make sure that the
original defaults are preserved if upgrading from a previous version.  So if
the file exists and there are no uncommented lines, a script should tack on
the original set of defaults.  That will prevent an upgrade from changing
the configuration of the box.

---

From: Cliff Crawford <[email-masked]>
Date: Tue, 3 Oct 2000 14:57:34 -0400

> user1:6F6D656761000000:****************:********
        o m e g a
> user2:6661737463617200:****************:********
        f a s t c a r
> user3:7570776972650000:****************:********
        u p w i r e
> user4:77696E646F770000:****************:********
        w i n d o w
> user5:6F76657274696D65:****************:********
        o v e r t i m e
> Not exactly plain text, is it?

No, but it can still easily be decoded, each two characters is an ASCII
code in hexadecimal.  Now that you've posted your users' passwords to a
public mailing list, you might want to have them change them..and you
might want to discuss basic password security as well, for example not
using dictionary words :)

-- 
cliff crawford       http://www.people.cornell.edu/pages/cjc26/
                     "Man, the Internet is so cool." -Robert

---

From: Matthew Keller <[email-masked]>
Date: Tue, 03 Oct 2000 15:45:44 -0400

> it look pretty using Quark on Macs (8.1 - 9.04).

	Word of warning, Quark + Netatalk = Bad Things (tm) in general.

> lock files.  I have turned oplocks off.

	Does the Mac user have rights to "write" to these folders? If Netatalk
can't create a .AppleDouble folder and files in it, it tends to give
this error.
	
> They are constantly getting disconnected.

	I have 4500 or so users, accessing a central storage server running
Samba and Netatalk for home directories and file sharing without a hitch
(for the most part).

-- 

 Matthew Keller
 WebMaster & Lead Programmer/Analyst
 Distributed Computing/Telemedia
 Information Services Division
 State University of New York at Potsdam
 
 Website: http://mattwork.potsdam.edu/
 PGP: http://mattwork.potsdam.edu/crypto/
 Webcam:  http://webcam.mattwork.potsdam.edu:85/

---

From: "Basil Hussain" <[email-masked]>
Date: Wed, 4 Oct 2000 11:39:57 +0100

Hi,

> using dictionary words :)

Hmm, so it is still basically 'plain text', but just in another form. Don't
worry about those passwords, they were changed afterwards. Besides, what
good's a password without a username and knowing which host they're from?

Anyway, you've made me remember something else to-do with afppasswd. Now, I
know it's A Good Thing to use long, alpha-numeric passwords, but the trouble
is, users just can't remember them! One thing I found using the afppasswd
utility is that by default it doesn't allow you to set dictionary-based
passwords (it uses cracklib to check, IIRC) unless you use the '-n' flag.
This is sensible, but I think the default should be more like the passwd
utility, where it warns you sternly about setting a bad password, but still
lets you do it.

Regards,

---

From: jeff b <[email-masked]>
Date: Wed, 04 Oct 2000 08:49:59 -0400

Basil Hussain wrote:
> 
> Hi,
> 
> > No, but it can still easily be decoded, each two characters is an
> > ASCII code in hexadecimal.  Now that you've posted your users'
> > passwords to a public mailing list, you might want to have them change
> > them..and you might want to discuss basic password security as well,
> > for example not using dictionary words :)
> 
> Hmm, so it is still basically 'plain text', but just in another form.
> Don't worry about those passwords, they were changed afterwards.
> Besides, what good's a password without a username and knowing which
> host they're from?
> 
> Anyway, you've made me remember something else to-do with afppasswd.
> Now, I know it's A Good Thing to use long, alpha-numeric passwords, but
> the trouble is, users just can't remember them! One thing I found using
> the afppasswd utility is that by default it doesn't allow you to set
> dictionary-based passwords (it uses cracklib to check, IIRC) unless you
> use the '-n' flag. This is sensible, but I think the default should be 
> more like the passwd utility, where it warns you sternly about setting a
> bad password, but still lets you do it.

I think I'm the guilty party responsible for the -n flag. I will modify
the behavior if there are no objections, but this comes down to a basic
sysadmin PEBKAC problem (Problem Exists Between Keyboard And Chair) that
users want the power of using networked computers, but don't want the
added responsibility of security. Kind of like driving a car, but
refusing to use your headlights at night because they are an extra
hassle to remember to turn on.

jeff

(with apologies for the cross-post. developers might want to comment on
the afppasswd change)

---

From: "Russell Kerrison" <[email-masked]>
Date: Fri, 27 Oct 2000 14:21:36 +1000

Howdy,

We're running 1.4b2+asun2.1.4 and just encountered the following error. The
user had copied a folder of images to a folder on the mounted volume, and
after the copy had finished had not seen the folder appear in  the
destination. They then tried to copy the same folder again whereupon the
Macintosh crashed.

As per the log below, the folder they had dragged was "Historical Web Shots
2"

The result was that the while the folder they tried to copy did appear, it
had no files in it, and worse, every other folder had been deleted,
accounting for about 30 images in 6 folders and 500Mb of data.

Poking about the filesystem, I could find no trace of the deleted files.

Is this a bug? Is it likely to happen again? This server has been running
for about a month under light loads, though moving about a fair bit of data,
on average 10Gb a day.

Oct 27 12:03:19 bearmedia1 afpd[3125]: WARNING: DID conflict for 'Temporary
Items' and 'Historical Web Shots 2'. Are these the same file?
Oct 27 12:03:50 bearmedia1 last message repeated 5 times
Oct 27 12:04:52 bearmedia1 last message repeated 20 times
Oct 27 12:05:54 bearmedia1 last message repeated 75 times
Oct 27 12:06:35 bearmedia1 last message repeated 6 times
Oct 27 12:09:02 bearmedia1 afpd[3195]: ASIP session:548(1) from
203.37.106.72:2048(2)
Oct 27 12:09:02 bearmedia1 afpd[863]: server_child[1] 3195 done
Oct 27 12:09:02 bearmedia1 afpd[3125]: dsi_stream_read(-1): Connection reset
by peer
Oct 27 12:09:02 bearmedia1 afpd[3125]: dsi_stream_write: Broken pipe
Oct 27 12:09:02 bearmedia1 PAM_pwdb[3125]: (netatalk) session closed for
user russell
Oct 27 12:09:02 bearmedia1 afpd[3125]: dsi_stream_write: Broken pipe
Oct 27 12:09:02 bearmedia1 afpd[3125]: 3952.60KB read, 6551.71KB written

---

From: "Jonathan Newman" <[email-masked]>
Date: Thu, 26 Oct 2000 20:39:39 -0700

> We're running 1.4b2+asun2.1.4 and just encountered the

... Chop ...

> Items' and 'Historical Web Shots 2'. Are these the same file?

This is a result of the DID kludge added to netatalk a while back.  If
you are building from the sourceforge source, you can
specify --enable-lastdid as an argument to ./configure.

e.g.

./configure --enable-lastdid

This will rectify the problem, but you won't have "persistent
directory id" support.

Jon Newman