Subject: Re: Help for a newbie

From: Steve Freitas <[email-masked]>
Date: Tue, 19 Sep 2000 12:19:24 -0700

>Problem ONE
>
>All the Macs can see the RH6.0 box from the Chooser and can
>log on as guest.  But they cannot see the new boxes but can
>log on as guest when the IP number is entered from the Chooser.
>When I check the startup logs of them (the 6.2 boxes) I see:

Add this line to your /etc/conf.modules file on your 6.2 boxen and reboot:

alias net-pf-5 appletalk

The problem is that Redhat decided to take Appletalk support out of the 
kernel in 6.2. This line loads the appropriate kernel module, fixing that 
inconvenient configuration change.

>Problem TWO
>I wish to restrict access to one of the machines based on IP Numbers.
>This is no problem for me with samba but how do I set the config
>(which config) file to do this for netatalk?  I want the
>(restricted) Macs to have guest access, but no access for any other Macs

I'm not sure Netatalk has this functionality. However, unless someone 
else suggests something better, you might consider configuring TCP 
Wrappers (the Redhat-included "firewall" software) to block access to 
port 548 to all but a few IPs. This would give you what you want.

>I may as well make a pig of myself while I'm here.
>How do I set up a config file so that a Mac can log in with a password
>but be restricted to read or write priveleges?

I'm not sure what you mean by this. Typically, access permissions (e.g. 
read and write access) are controlled within the Linux filesystem, and 
Netatalk merely obeys them. So if you want a group of users to only have 
a certain type of access, you set up a directory in Linux to give that 
type of access to that group. Does this answer your question?

Steve

---

From: Bob Rogers <[email-masked]>
Date: Wed, 20 Sep 2000 12:16:06 -0400 (EDT)

From: Steve Freitas <[email-masked]>
   Date: Tue, 19 Sep 2000 12:19:24 -0700

   >(restricted) Macs to have guest access, but no access for any other Macs

Did you mean "no access for any other user accounts"?

I am not well acquainted with tcp wrappers, but doesn't tcp wrappers
only apply if you are starting afpd from /etc/inetd.conf, and not the
SysV-style /etc/rc.d/init.d/atalk script?  On the other hand, if you use
ipchains to block the port, then it shouldn't matter how you start the
server, because then the firewalling is done at a lower level in the
kernel.

   Beyond that, it seems to me that both the ipchains and tcp wrappers
solutions would block *all* access, or none; neither could be used to
limit it to guest access.  What Colin was asking for is access control
based on both IP and user ID.  It seems to me that IP-based access is
usually done at the firewall level (where it is more secure), and
user-based access is done at the server login level (where it is more
versatile); I know of no technology for mixing the two levels, but if
done anywhere, it would have to be in the server, where login is
handled.  Does Samba really do this?  Because I have a hard time
imagining a situation where I would trust a given host (or IP range) for
some users, but not for others.

					-- Bob Rogers