HDTenEightyP/NetNews huggingface dataset:
From: cl7841s@ACAD.DRAKE.EDU
Newsgroups: comp.protocols.appletalk
Subject: Hayes InterBridge problems
Date: 12 Nov 92 08:27:22 GMT
Organization: The Internet


I just got an InterBridge back from Hayes after having it upgraded for
phase II operation.  When we tried to configure it, though, it will not
show up.  We have attached a "good" interbridge to the appletalk port of
the mac and it shows up.  As soon as we swap in the unit we just got back, 
it shows up for a second or two, then permanently disappears.

Has anyone else seen this before?  I guess that we will just have to send
it back to Hayes again.  But it seems to me that they test the units they
upgrade to make sure they are performing to the same specs as new units.  I
shouldn't be having problems at all if that is the case.  Or maybe, my unit
just slipped through!

Colin Lamb - MacMeister 8-)>  -  Drake University  -  Des Moines

Newsgroups: comp.protocols.appletalk
From: bill@cognet.ucla.edu (William M. Eldridge)
Subject: Software routing atalk->enet?
Organization: UCLA Cognitive Science Research Program
Date: Fri, 6 Nov 1992 21:49:11 GMT

Hello,
  Someone mentioned that Apple has a software router
to move from appletalk to ethernet protocol, which
would seem to save the expense of SCSI boxes on all
these blasted old MacIIpluses etc.

   Does anyone have info on the Apple product or
anyone else's for that matter?

Thanks,
Bill   bill@cognet.ucla.edu
-- 
{{{{ bill eldridge                                       x                }}}}
{{{{ bill@cognet.ucla.edu    310-206-3960               xxx              }}}}
{{{{ ~more, ~better, ~faster [80's motto]                x              }}}}
{{{{ ~hot, ~toxic, and ~shallow [90's motto]                              }}}}
From: marks@bldr.nist.gov (Roger Marks)
Newsgroups: comp.protocols.appletalk
Subject: CAP FAQ?
Date: 9 Nov 92 15:26:58 GMT
Organization: The Internet


I'm a network-ignorant Mac user who's trying to convince a Mac-ignorant Unix 
administrator to install CAP. Unfortunately, I can't tell him _exactly_ what it 
is or does, since I don't know. I also can't tell him how long it takes to 
install (on SunOS). Without this information, he's hesitant to help me out. Is 
there a written record somewhere that will answer his questions and provide him 
with some encouragement? We haven't found the README file that comes with CAP 
to be very comprehensive.

Thanks


Roger
Marks@bldr.nist.gov    NIST/Boulder,CO

Newsgroups: comp.protocols.appletalk
From: mmccann@eng.clemson.edu (Michael McCann)
Subject: CAP location
Reply-To: mmccann@eng.clemson.edu
Organization: Clemson University College of Engineering
Distribution: usa
Date: Wed, 11 Nov 1992 15:09:14 GMT

I know this is a "newbie" question but...  I have looked in archie and 
several of the more popular archives and I can't find CAP6.0.

Where can I FTP it from?

Thanks,
---
Mike McCann       (803) 656-1228   Internet = mmccann@eng.clemson.edu 
Engineering Computer Operations      Bitnet = mmccann@clemson.bitnet
113 Riggs Hall
Box 340904
Clemson, S.C. 29634-0904         DISCLAIMER = I speak only for myself.

Newsgroups: comp.protocols.appletalk
From: "Bill Wang" <wcwang@moose.cs.indiana.edu>
Subject: CAP 6.0 on NeXT
Organization: Indiana University, Bloomington
Date: Tue, 10 Nov 1992 16:27:09 -0500


Does anyone have any experience of getting CAP 6.0 up and running
on native ethertalk under NeXT Step 3.0?  Any help would be
appreciated!



-- 
Bill Wang
US Mail = Psychology Department, Indiana University, Bloomington, IN 47405
Internet = wcwang@cs.indiana.edu
From: ferch@ucs.ubc.ca (Les Ferch)
Newsgroups: comp.protocols.appletalk
Subject: Re: Laser Writer Serial port Printer Drivers in an ethernet enviornment
Date: 11 Nov 92 05:08:29 GMT
Organization: The University of British Columbia
NNTP-Posting-Host: swiss.ucs.ubc.ca

> I am looking for an Apple Laser Writer Driver for Mac System 7
> Currently I am connected to an ethernet network and the printer
> driver I have redirects itself to printers on the network. I would like
> to connect a local Laser Writer printer - this means the the printer
> driver can not use Apple Talk/Local Talk as this is disabled when
> the Ethernet is operating.

You can have EtherTalk active and access LocalTalk devices if you install
either a software router (Apple Internet Router or Liasson) or a software
bridge (EtherBridge from Sonic Systems). The bridge approach requires less
overhead, so it will not slow your Mac down as much as a router.

> Does any one know of a serial port driver or something like that.

That is a reasonable way of dealing with the problem if you are the only
user of the printer. You need the following files, available from
sumex.stanford.edu: 

    info-mac/util/dmm-lw-56-stuff-131.hqx
    info-mac/util/dmm-lw-7-stuff-131.hqx

Here is the EtherBridge info:

I saw the following software-only solutions, for bridging Ethernet and    
LocalTalk, at the Mactivity conference in July. LaserBridge should do what
you want. In the following, "Show" refers to the Mactivity show price.    

              EtherBridge Series from Sonic Systems

Product       Description                                Retail   Show

LaserBridge   Allows up to 5 LocalTalk printers to be     $199    $100
              shared on Ethernet

PowerBridge   Allows any Mac to be connected to Ethernet   149      75

SuperBridge   Allows up to 5 Macs and/or LocalTalk         249     125
              printers to be connected to Ethernet

Sonic Systems
333 W. El Camino Real #280
Sunnyvale, CA 94087
Tel: 408-736-1900
Fax: 408-736-7228
From: holder@hobbes.chem.uh.edu (Michael Holder)
Newsgroups: comp.protocols.appletalk
Subject: UAB under IRIX 4.0.5 (SGI)
Date: 13 Nov 92 07:37:23 GMT
Article-I.D.: hobbes.HOLDER.92Nov13013723
Distribution: comp
Organization: University of Houston, Chemistry Department

I have attempted to build UAB under IRIX 4.0.5 and I see some complaints when
aarp.c is compiled.  They come back as warnings that & is not allowed before
an array.  I am simply posting this I don't seem to make UAB work and
what I can find in the docs suggest it should.  I am at PL 126.

More but different - The Configure script seems to miss the quota and statfs
stuff which is on the SGI.  Is there some reason for this or was it an 
oversight?

Any assistance would be greatly appreciated.

Michael E. Holder
--
U   U H   H    Michael E. Holder        THEnet   : NA::HOLDER
U   U H   H    c/o B. M. Pettitt        Internet : HOLDER@NA.CHEM.UH.EDU
U   U HHHHH    Dept. of Chemistry       
U   U H   H    University of Houston
UUUUU H   H    Houston  TX  77204       Phone    : (713) 743-3262
 Chemistry
Newsgroups: comp.protocols.kerberos
From: jon@MIT.EDU (Jon A. Rochlis)
Subject: Re: kerberos for the mac OS (not AUX) in orig athena release...
Organization: Internet-USENET Gateway at Stanford University
Date: Mon, 9 Nov 1992 17:10:22 GMT

Retrieve /pub/kerberos/README.mac from athena-dist.mit.edu via anonymous 
FTP and it will tell you how to get the MIT MacOS kerberos port.

                -- Jon
Newsgroups: comp.protocols.kerberos
From: nessett@OCFMAIL.OCF.LLNL.GOV (Danny Nessett)
Subject: GSSAPI documentation for Kerberos
Organization: Internet-USENET Gateway at Stanford University
Date: Tue, 10 Nov 1992 22:26:50 GMT


Ted,

Cliff Neuman suggested that I contact you about documentation on the GSSAPI
interface for Kerberos. We are interested in using this interface in an
application we are working on. In particular we would like to know the
subset of GSSAPI that is implemented for Kerberos V5 and what the C language
bindings are. We are hoping there is more documentation than the source code.
Are our hopes in vain?

Regards,

Dan Nessett
Newsgroups: comp.protocols.kerberos
From: bf4grjc@SOCRATES.MIT.EDU (Ravi Ganesan (301) 595-8439)
Subject: Re: Local password validation (was: kerberizing xlock)
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 5 Nov 1992 19:00:50 GMT


Barry,

> We have now come full circle.  Notice that the subject line in this
> message contains "was: kerberizing xlock."  This entire conversation
> began because people were discussing using Kerberos for local password
> authentication, when it was not designed for that purpose.  
> 
> With public workstations (like those you described, and those at MIT's
> Athena) the spoofability of public workstations is irrelevant.
> However, when people start talking about using Kerberos for xlock, it
> is clear that they *do* care about an imposter gaining access to a
> workstation (particularly given that another user's credentials are
> already available there).  In that case, the spoofing issue becomes
> highly relevant.
> 
> So now, I think, the point has been made and everyone understands the
> issues better.  That is, after all, part of the purpose of this
> mailing list. :-)
> 
As per my earlier note (perhaps sent only to you), I just want to re-emphasize 
the ground realities of maintaining multiple 'systems' for network 
authentication and host authentication - kerberos WILL end up being used for 
both, and subtelities about which environment it was designed for (anonymous
workstations - MIT Athena) is nice to know, but is of little pracitcal 
consequence. 

I feel that getting a ticket and then getting a service ticket and using that 
service - under the condition the service is on the same machine, is a 
theoretically messy, but practically convenient solution. (To recap a 
hyper-kludgy hyper-quick and hyper-dirty way of doing this would be to 
replace login with a combination of a kinit, a chown on the ticket, and then 
a quick rlogin into the same machine. Naturally in practice you would set 
up a dummy server that does something trivial like retun a YES/No 
repsonse to your login program.

Ravi
-- 


*******************************************************************************

Ravi Ganesan                            e-mail: ravi@socrates.bell-atl.com
IS SAS Corporate Network Planning       v-mail: (301) 595-8439
Bell Atlantic                           Fax:    (301) 595-1341

Note: If your e-mail reply to me bounces, try sending it explicitly to 
ravi@socrates.bell-atl.com instead of using the 'reply' feature.
******************************************************************************
Newsgroups: comp.protocols.kerberos
From: louie@NI.UMD.EDU ("Louis A. Mamakos")
Subject: Re: NTP mailing list?
Organization: Internet-USENET Gateway at Stanford University
Date: Mon, 9 Nov 1992 16:09:39 GMT


Yes, there is an NTP mailing list <ntp@NI.UMD.EDU>.  There is also a
bit more activity in the comp.protocols.time.ntp USENET newgroup.
There currently exists a one-way gateway from the mailing list into
the newsgroup.  Send mail to ntp-request@NI.UMD.EDU to get on the
mailing list, though I *strongly* encourage you to just read the
newsgroup if you are able to.

louie
A.K.A. ntp-request@NI.UMD.EDU
Newsgroups: comp.protocols.kerberos
From: yuan@syl.dl.nec.com (Ruixi Yuan)
Subject: Question regarding BSD r commands and kadmin in KB5-BETA2
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 11 Nov 1992 23:37:30 GMT


Hi, Everybody: 

I am having difficulty getting the BSD r commands and "kadmin" working 
under krb5-beta2. The error messages are as follows: 

1. Kadmin:

Command (add, cpw, del, inq, mod, addrnd, cpwrnd, addv4, cpwv4, q): add

Name of Principal to be Added: newprincipal
Principal Already Exists!



Command (add, cpw, del, inq, mod, addrnd, cpwrnd, addv4, cpwv4, q): del

Name of Principal to be Deleted: oldprincipal
Principal Does NOT Exist!

This error persists regardless of whether the newprincipal and 
old principal actually exist or not. I have krb5kdc and kadmind both 
running. 

2. BSD RCMDS: 

I added a principal "host/<host>" to the Krb5 database and extracted a
srvtab by using "ext <host> host" in kdb5_edit. and placed it in 
/etc/srvtab. Now, when I use the command "rlogin <host>", I got the 
following error message.

rlogin: kcmd to host <host> failed - Not enough memory
trying normal rlogin (/usr/ucb/rlogin)

After some code hacking, It looks like the krb5_read and krb5_write
is not functioning properly. I suspect this has something to do with 
the srvtab file: its proper extraction and location. But cannot find
any clue to it yet. Another possibility is that I am missing some 
steps in setting up the applications.

Could some of our knowledgeable netters providing some comments on the 
above mentioned problems? Thanks in advance!

--- Ruixi
Newsgroups: comp.protocols.kerberos
From: tytso@ATHENA.MIT.EDU (Theodore Ts'o)
Subject: Re: The incredible missing Principle trick
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 13 Nov 1992 03:36:24 GMT

   Date: Thu, 12 Nov 1992 20:51:40 GMT
   From: Mike Hojnowski <mqh@theory.tc.cornell.edu>

   We're running Kerberos V4 here with about 6000 principles.  The server is 
   running on an RS/6000 (AIX 3.2.0).  Somehow, for reasons unknown, 8 of our
   principles disappeared over the weekend.  They appear in a "kdb_util dump"
   on Sunday, and are gone on Tuesday.  The server was not interrupted at all
   during that interval.

   Anyone seen anything like this before?

One possible reason is that you got unlucky with a hash collision which
caused the DBM file to grow bigger than the max. allowable filesize on
your system, and you have a badly implemented DBM library that doesn't
deal well with that situation (i.e., fails silently) --- but that's only
a guess.  At MIT, we haven't had that problem happen with our Kerberos
database, which has almost 20,000 entries in it.  However, we have had
this sort of problem with our /usr/lib/aliases file on our mailhub,
when the length of the /usr/lib/aliases.pag gets bigger than 2
gigabytes.

I'm not sure I believe this is what's really happening, though, since
6,000 principals isn't all that many.  We haven't seen your problem at
MIT, although we're not running our server on a RS/6000.

							- Ted

Newsgroups: comp.protocols.kerberos
From: yuan@syl.dl.nec.com (Ruixi Yuan)
Subject: problem with kpasswd
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 6 Nov 1992 21:11:33 GMT


I am in the process of getting KRB5-BETA2 version working. At first, 
there appears to be some problems with kdb5_mkdums and kpasswd.
After some code hacking, the memery problems seems to have been 
resolved by initializing alt_key in kdb5_mkdums and applying
the a simple patched that fix the simple error in kpasswd. However, 
I still cannot get the kpasswd running correctly, the following is 
the error message I got. 

Unable to Get Initial Credentials : Server not found in Kerberos database -1765328377


Protocol Failure - Password NOT Changed!

It looks like there is some procedure I haven't done before invoking kpasswd.
Since the documentation is limited and I cannot figure what step did I miss
( I had krb5kdc, kadmind both running ).  Is there any knowledgeable netter
can provide some hint on why this is happening? 

Ruixi Yuan, MTS
NEC Systems Lab.
yuan@syl.dl.nec.com

Newsgroups: comp.protocols.kerberos
From: Everette Gray Allen <everette_allen@ncsu.edu>
Subject: Re: kerberos for the mac OS (not AUX) in orig athena release...
X-Xxmessage-Id: <A71E90B926010B13@ccmc6.cc.ncsu.edu>
X-Xxdate: Thu, 5 Nov 92 16:50:01 GMT
Organization: NCSU Computing Center
X-Useragent: Nuntius v1.1.1d11
Date: Thu, 5 Nov 1992 13:50:14 GMT

In article <1992Nov4.163700.3327@ncsu.edu> Everette Gray Allen,
everette_allen@ncsu.edu writes:
>in the v 4.x origs from MIT.  Could some one point me to it??  Thanks
Thanks to all those who sent responses I found the stuff quickly.  Only
one
problem...I do not have MPW.  Has anyone actually compiled this ?  Is it 
being used anywhere?  I would like to hear the success/failure from some
people.  I see that brownvm.brown.edu has a kerboros init for the mac.
Does
anyone know how I can use this?? Thanks.
Newsgroups: comp.protocols.kerberos
From: jik@athena.mit.edu (Jonathan I. Kamens)
Newsgroups: comp.protocols.kerberos
Subject: Re: Some patches to V5 B2
Date: 10 Nov 1992 19:01:54 GMT
Organization: Massachusetts Institute of Technology
NNTP-Posting-Host: pit-manager.mit.edu
In-reply-to: lunt@CTT.BELLCORE.COM's message of 6 Nov 92 21:02:48 GMT

In article <9211062102.AA01776@shadow.secure.bellcore.com> lunt@CTT.BELLCORE.COM (Steve Lunt) writes:

   config/sun.cf:
	   Sun has setenv

Say what?

> head -1 /etc/motd
SunOS Release 4.1.3 (AKTIS-SERVER) #1: Thu Oct 22 12:58:12 EDT 1992
> nm /lib/libc.a | grep setenv
> cat > /tmp/test.c
main()
{
setenv("FOO", "BAR", 1);
}
> cc /tmp/test.c
ld: Undefined symbol 
   _setenv 
> 

Have you been frobbing your C library, Steve? :-)

-- 
Jonathan Kamens                                         jik@MIT.Edu
MIT Information Systems/Athena              Moderator, news.answers
From: trier@odin.ins.cwru.edu (Stephen C. Trier)
Newsgroups: comp.protocols.kerberos
Subject: Re: telnet encryption option vs. Clarkson TCP
Date: 10 Nov 1992 03:11:51 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
NNTP-Posting-Host: odin.ins.cwru.edu

In article <CMM.0.90.0.721344901.alan@curta.cc.columbia.edu> alan@CURTA.CC.COLUMBIA.EDU (Alan Crosswell) writes:
>The problem I have is the telnet session "freezes" right around the
>TELOPT_ENCRYPTION (option 38) negotiation.

This is *probably* an old bug that I fixed here a few years ago.

The problem is that CUTCP/CUTE thinks there are never more than 34 or 37
options (I don't remember the exact limit) and if it sees an option above
the limit, it rounds it down to make it fit.  It replies with the rounded-
down option rather than the correct one, and telnetd ends up waiting for
an option response that will never arrive.

My solution to the problem was to change the maximum number of options to
a more reasonable 255.  This required changes in only two or three lines
of code, since the option limit is neatly #defined in a header file.

Warning: I base this on the old "Clarkson NCSA Telnet 2.2D", which was
released before Clarkson renamed their package to CUTE and stopped releasing
source.  It is therefore quite possible that the bug you are experiencing
is different.

If you are really desperate, I might be able to dig up my patched Clarkson 
NCSA 2.2D source.  Let me warn you that there are a few other local hacks
in it that you may have to undo in order to make it useful.

-- 
Stephen Trier                                     
Network Services Engineering, IRIS/INS/Telecom    
Case Western Reserve University                   
trier@ins.cwru.edu
Newsgroups: comp.protocols.kerberos
From: pato@APOLLO.HP.COM (Joe Pato)
Subject: Re: Local password validation (was: kerberizing xlock)
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 6 Nov 1992 17:30:55 GMT

    Also, there is no need to actually contact the local verification
    service out of band.  The verification can be done entirely by the
    login program.  
    
    What you would do is initially request a ticket for the verification
    service, use that ticket to construct an authenticator, then
    immediately verify the ticket and authenticator from within the login
    program using the "local verification" services key which is
    presumably available to the login program since it runs as root.
    
    You could simplify this even further if you were willing to write your
    own code to do the verification, instead of using the code in the
    Kerberos library.  To do this, you would:
    
The OSF DCE Security library, leveraging Kerberos V5) provides this capability.
The sec_login_validate_and_cert_ident will both validate the user's password
(and obtain the user's TGT) and certify that the KDC is legitimate.   It
obtains a ticket to the local machine principal and verifies that the KDC
shares a key with the machine.  This call must be made by a privileged process
that has access to the machine principal's key (the system login code
qualifies)  Unprivileged processes may make a simillar call that communicates
with a local privileged service that has access to the local machine
principal's key.

An unprivileged call sec_login_validate_identity exists for applications that
do not care to certify the KDC.

This approach for local authentication validation is not weaker[1] than
conventional local authentication.  In any case the mechanism requires the
local machine to be resistent to attack.  In this model, the local machine
principal's key must be protected, in the conventional unix case the
/etc/passwd file must be protected from modification.  In either case breaking
local protections will compromise the authentication path.

[1] Using the network KDC for user authentication is weaker than a purely local
authentication path in the sense that the machine is now subject to attacks
both locally and at the KDC machine.  It also subjects the local machine to
attacks on the network authentication protocol.  Assuming that the protocol is
strong and that the KDC is appropriately protected, then the problem reduces to
the issue of protection of local data.

                    -- Joe Pato
                       Distributed Computing Program / East
                       Hewlett-Packard Company
                       pato@apollo.hp.com


-------
From: greg@DUKE.CS.UNLV.EDU (Greg Wohletz)
Newsgroups: comp.protocols.kerberos
Subject: Re: Local password validation (was: kerberizing xlock)
Date: 5 Nov 92 06:44:07 GMT
Organization: Internet-USENET Gateway at Stanford University

>In summary, here is a timeline showing the attack:
>
>1.  login sends tgt request {U,TGS} to KDC
>2.  attacker responds with {U,TGS}_fake
>3.  KDC responds with error, login is no longer listening
>4.  attacker enters correct fake password for {U,TGS}_fake
>
>5.  login sends service ticket {U,V} reques to KDC
>6.  attacker responds with {U,V}_fake using session key from {U,TGS}_fake
>7.  KDC responds with error, login is no longer listening
>8.  login's decryption succeeds
>
>9.  login sends mutual auth request to V
>10. attacker responds to mutual auth request 
>11. V responds with error, login is no longer listening
>12. login is tricked

OK,  now  I  see what  your  getting  at,  and  I  agree  that  it  is
theoretically possible  to accomlish  this.   I think that V  could be
designed  and  located on the  network in such  a way as to  make this
attact extremely difficult, if not impossible, I'll have to think more
on that.  Anyway, In our environment I still feel  OK about using this
scheme to  accomplish  login  authentication as I'm  not  particularly
concerned  if  an imposter gains access to a workstation cpu since all
he would not actually be able to  do anything usefull (nfs, pop,  etc.
all require kerberos authentication), and its annoying to have to have
multiple passwords floating around.  I  don't think anyone will  go to
that  much trouble just to gain access to a workstation with no usable
disk space, far easier to gain  root access  through the rom monitor I
should think...

>KERBEROS IS A NETWORK AUTHENTICATION SYSTEM, NOT A PASSWORD VALIDATION
SYSTEM.  If you use it as the latter, you must exercise extreme
>caution.  In particular, using Kerberos for screensaver/keyboard lock
>programs is a tricky business.

So it would appear.

					--Greg
Newsgroups: comp.protocols.kerberos