HDTenEightyP/NetNews huggingface dataset:
From: N.R.Ellis@newcastle.ac.uk (Nigel R Ellis)
Newsgroups: comp.protocols.appletalk
Subject: How to setup CAP's bridge_desc file -- Help!
Date: 9 Sep 92 08:42:29 GMT
Organization: AI Systems Group, Durham University, England.


Hi,

We recently installed CAP using the Unix Appletalk bridge option and 
are having problems configuring the 'bridge_desc' file.

This is the network:

                          | (lots of Macs) 55.0 DurCampusEther
      ------------------------------------------------------------
                   |
                   | 129.234.200.100 (ie:0)
    gateway-->  bylands 
                   | 129.234.203.1   (ie:1)
                   |
      -----------------------------
                          | (some more Macs) 44.0 AIEther

I thought that something along the lines of:

>  bylands.dur.ac.uk [elap,ie:0]    mkip    [55.0,DurCampusEther]
>  bylands.dur.ac.uk [elap,ie:1]    mkip    [44.0,AIEther]


would be ok.  This should pass phase 1 ethertalk packets through bylands and
allow the AI macs to talk to the Campus Macs.

Have I got this right?

Thanks for any response.

Nigel R. Ellis.
From: dax@ulysse.enst.fr (Philippe Dax)
Newsgroups: comp.protocols.appletalk
Subject: AUFS overwriting folder - Bug ?
Keywords: cap, aufs
Date: 11 Sep 92 16:24:23 GMT
Distribution: comp
Organization: Telecom-Paris, France


Hi caplanders,

We apologize if our problem is a FAQ.

We have got problems with aufs under SunOS4.1.2 running cap60pl126.
The problem occurs when we overwrite a folder on the Unix side
with the same name and same contents, the transfert is aborted,
and we got the following error message on Mac :

	"Impossible to write element of type file "<filename here>"; 
	 this element is not found; ... "  (Fr -> English translation :-))

Moreover the contents of the folder is filled with zeroed size files :-(.

The same problem occurred when we ran cap60pl100.
This problem is still there with patch 100075-08 (rpc.lockd)
and 100173-08 (NFS Jumbo patch)

Does anyone know this problem ?
Did we get something wrong ?

Please help !

Philippe Dax	dax@inf.enst.fr
Gille Dauphin	dauphin@sig.enst.fr
Newsgroups: comp.protocols.appletalk
From: ken@cujo.curtin.edu.au (Ken Taylor)
Subject: Re: MAC Integration
Organization: Curtin University of Technology
X-Newsreader: Tin 1.1 PL5
Date: Thu, 10 Sep 1992 00:36:39 GMT

Jim Reece (reece@PANTHER.WARM.INMET.COM) wrote:
: 
: 	How do I hook up a MAC SE on a Novell Ethernet network?  The network 
: 	is mainly IBM's and at work they told me it could not be done.  
: 	We are using Wordperfect Office---Does's WordPerfect make this 
: 	for the MAC as well?  I would greatly appreciate any help anyone 
: 	could give me.  Thanks...

Novell distribute Netware for Macinotsh with Netware 2.2 (and 2.15A-C if you
were quick), but not with 3.11.. Netware for Macintosh 3.0 is still a separate
product if you're running version 3.11...

Basically, NW4Mac gives you file service, and some printing services available
to other Netware users, but you'd either have to put a Localtalk card in the
server or get an Ethernet card for your SE (The latter would be preferable
IMHO)....

WordPerfect's Word Processor is available for the Mac, but I don't think they
ever released the "Office" suite for the Mac...

Hope this gives you a start

Ken
-- 
 Ken Taylor              |  "I have a friend who's seen inside my tiny brain
 ken@cujo.curtin.edu.au  |   He's seen the aging and the mildew from the rain
 Curtin University       |   And he does what he can to keep on top of every
 Perth, W. Australia     |     one of them"     - Happy Rhodes
Newsgroups: comp.protocols.appletalk
From: zagar@chester.cms.udel.edu (Randy Zagar)
Subject: Need cure for stupidity: Cap-60 (pl100)
Keywords: aarpd, CAP
Reply-To: zagar@chester.cms.udel.edu
Organization: Marine Studies, University of Delaware
Date: Mon, 14 Sep 1992 15:07:06 GMT

Okay, I'm running a Sun SPARCstation-1 (sunos 4.1.2) and I've
successfully installed the stanford enet filter as "/dev/enet-le0".
[Not real sure, kinda hard to test that w/o a functioning CAP...]

I'm just trying to do a simple test-install of cap60 with
Native EtherTalk (Phase-2).

Right off the bat, when I try to run aarpd with the command-line

	aarpd le0 "TheZone"

I get the following error message

	open: /dev/enetXX: No such file or directory
	10:48:48 09/14/92  pi_open: aarp_init: No such file or directory
	init_enet: network initialization failed

So, I seem to have some problems... :-)

Needless to say, I wouldn't mind corresponding with someone who's had
experience setting up cap60 in this way.

Any information would be helpful,

-Randy

---
 _____________________________________________________________________________
/                                                                             \
| Randy Zagar                            Get your priorities straight.        |
| Internet: zagar@Chester.CMS.UDel.Edu   No one on their death bed ever said  |
| Bell-net: 302/831-1139                 "Gee, if I'd only spent more time    |
|                                        at the office..."                    |
\_____________________________________________________________________________/
From: reece@PANTHER.WARM.INMET.COM (Jim Reece)
Newsgroups: comp.protocols.appletalk
Subject: Re: Hooking a PC into an AppleTalk Network
Date: 9 Sep 92 18:27:14 GMT
Distribution: world
Organization: The Internet

In the version of PhoneNet Talk we have, it only supports the 3Com
ethernet card. They say they'll support Western Digital in the next
release

reece@panther.warm.inmet.com
From: sob@hsdndev.UUCP (Scott Bradner)
Newsgroups: comp.protocols.appletalk
Subject: LocalTalk <-> Ethertalk router performance testing
Date: 13 Sep 92 13:27:47 GMT
Organization: Harvard University

In response to requests from some vendors, the fall '92 round of Harvard router
performance tests will include LocalTalk/EtherTalk devices.  The test setup
to be used is:


                --------------                    -------------
===Ethernet=====|  router 1  |------LocalTalk-----|  router 2 |====Ethernet===
                --------------                    -------------

The tester measures the throughput between the Ethernets.

The tests start this week and continue until just before Interop.  The
results will be reported in my tutorial at Interop, a special session on
Wed during Interop and placed in the on-line archives.

If your company has a AppleTalk router that you would like to have included
please let me know.   (Currently, I've talked to three vendors.)


Scott Bradner
Harvard Network Device Test Lab
Harvard University
10 Ware St.
Cambridge MA 02138
617-495-3864
fax 617-495-0914
Newsgroups: comp.protocols.appletalk
From: hard@rock.concert.net (Kevin  Hardman -- Personal Account)
Subject: Re: SNAps APPC Programming
Organization: CONCERT-CONNECT -- Public Access UNIX
Date: Thu, 10 Sep 1992 04:13:03 GMT

In article <01GOH8TQ0FJK0003IP@urvax.urich.edu> MARTINHER@URVAX.URICH.EDU (HERB MARTIN) writes:
>I see that Apple sells a SNAps developer's kit and documentation as
>well as a SNAps Gateway that should run on our token ring MACs.  This
>seems to be the kit for doing APPC programming to an SNA host.
>
>Any issue or advice  will be appreciated.

I developed a product "AM:PM for the Macintosh" for the company Tangram Systems
Corporation which used SNA*ps to communicate with a VTAM application on an IBM
mainframe using LU 6.2 (APPC) protocols.  The gateway works well; however, the
software only supports Apple tokenring and serial cards and at least with the
tokenring we the memory supplied on the card was insufficient to really do 
anything (we also use TokenTalk and it comsumes some of the memory).  The
administrative tools are some of the best I've seen (compared to Novell and 
IBM OS/2 CM).  There is no support for APPN style network management (yet).
The developer's kit include the documentation kit and is a must.  The
documentation is good, but weak when it comes to explaining the IBM Way (as 
would be expected).

If you have additional questions feel free to send me mail.

--Kevin

+=====================================+=====================================+
| B. Kevin Hardman                    | Internet: hard@rock.concert.net     |
+-------------------------------------+-------------------------------------+
| No Affiliations, No Disclaimers, No Apologies                             |
Newsgroups: comp.protocols.appletalk
From: perl@pbseps.sf180.PacBell.COM (Richard Perlman)
Subject: ARA CCL wanted for NEC N9635E
Originator: perl@pbseps.sf180.PacBell.COM
Organization: Pacific Bell - Financial Management
Date: Thu, 10 Sep 1992 21:37:22 GMT

I am looking for a CCL for the NEC N9635E _with_ a handshaking
cable.  I was using the codex 1133 CCL with a non-handshaking
cable and it mostly worked.  Since I switched cables it dies.  I
need the cable for other things (SLIP) so giving it up is not an
option.

Thanks,

-- 
"There are very few accomplishments of any value that can be gained without 
 practice, and that which takes the least time to learn is usually the least 
 valuable when learned." -The Eagle Bicycle Co. Catalog, 1890
Richard Perlman   |*|  perl@pbseps.sf180.pacbell.com  |*|  (415) 545-0233
Newsgroups: comp.protocols.kerberos
From: sdawson@ENGIN.UMICH.EDU (Scott Dawson)
Subject: Re: Kerberos' rlogin
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 10 Sep 1992 12:20:22 GMT


>  I have the following problem about the Kerberos rlogin: 
>  
>  After installing the testing Kerberos IV, on a SUN sparc station with 
>  SunOS 4.1. I tried to enable the application rlogin and rsh, but I got
>  the error message as follows when executing the command "rlogin host" 
>  
>          rcmd: socket: Permission denied
>          rlogin: Kerberos rcmd failed: rcmd protocol failure.
>          trying normal rlogin (/usr/ucb/rlogin.ucb)
>          exec: No such file or directory
>  
>  Do any of the netters encounter this problem before? Any hint on how 
>  to fix this problem? 
>  
>  Any help is appreciated!

It looks like rlogin is running without the suid bit turned on.
That's why it can't get the socket.  When it fails to grab the socket,
it tries to exec /usr/ucb/rlogin.ucb (this assumes that you install
kerberos right into your system tree and call the kerberos rlogin
/usr/ucb/rlogin and offname the vendor rlogin to rlogin.ucb).  Since
/usr/ucb/rlogin.ucb doesn't exist on your system (maybe you installed
differently), the exec fails.  You can change the path of the vendor
rlogin in the file rlogin.c.  The define is UCB_RLOGIN.

Good luck,
-Scott
Newsgroups: comp.protocols.kerberos
From: flur@asia.eecom.gatech.edu (Peter W. Flur)
Subject: Setting up a slave server under Kerb V4
Organization: School of Electrical Engineering, Georgia Institute of Technology
Date: Wed, 16 Sep 1992 01:51:00 GMT

Can someone give me pointers as to what needs to be done in order to do
the following things:
1
1) Translate an existing passwor database (straight Unix passwd file) into
a kerberos principal so that we can put the passwords straight into the
kdc without having to distribute new passwords.

2) Set up a slave server.  I figured out how to make kprop talk to kpropd,
but I'm a little confused as to what principals need to be created in
order for the master server to be able to talk with the slave servers.  I
get kpropd started on the slave, then run kprop on the master, but it
gives me a "kerberos: unknown principal" message.  What principal is
needed for this?

3)  How does one handle something like the operator account which does
incremental backups across the network in the middle of the night in
unattended mode?  There is no one to respond to a password prompt.

4)  What is the "standard mode" for installing krb4 with respect to the
rlogin.ucb, rsh.ucb, etc.?  By this, I mean to most people  remove the ucb
versions and require a kerberized session?  Do you turn off the rlogind,
rshd, etc. ports?  Do you modify the krb logins not to even run the ucb
versions upon failure?

Suggestions and/or pointers to more papers would be greatly appreciated.

Peter

-- 
-----------------------------------------------------------------------
     Peter Flur, Research Engineer - School of EE, Georgia Tech
       E-MAIL: peter.flur@ee.gatech.edu PHONE: (404) 853-9355
     DUKE UNIVERSITY -- 1991 & 1992 NCAA BASKETBALL CHAMPIONS!!!
Newsgroups: comp.protocols.kerberos
From: eichin@CYGNUS.COM ("Mark W. Eichin")
Subject: Re: my previous question refined
Organization: Internet-USENET Gateway at Stanford University
Date: Sat, 5 Sep 1992 00:13:02 GMT

Mr. Nesset makes several comments...
> the remote machine. To protect it, you probably want to logon originally
> by executing "rlogin -x". Of course, this means either knowing ahead of
> time you want to change to root, or (more likely) always executing "rlogin -x".
	I do work cross-country (via AlterNET and NEARnet); the 56Kbps
link at the other end is far more of a bottleneck than DES encryption
will ever be. I always use encrypted rlogin. 
	Note that the 91.03.25 version of telnet does support toggling
encryption on and off, inbound and outbound, if you do notice the
performance. 

> Jon Rochlis suggests either using ksu or "rlogin -l root". The latter option
> doesn't work for Telnet.
	Actually, when the aforementioned telnet is invoked as rlogin,
it *does* work. (It seems not to work for root, but there is no
problem switching to other users based on the .klogin file; failing as
root in particular appears to be simply a bug.)

> access tickets) and then logon to the remote machine. I'm not sure, but
> I think this means that a user with root privilege has those privileges
> on all machines.
	The only machines that a user with a root instance has root
access to (via rlogin or ksu) are those with their root instance
listed in the /.klogin file. This could easily be no machines at all;
root access has nothing to with the name of the instance, all that
matters is that the name of the principal given is on the access
control list.

> Barry Jaspan points out that support of ksu could provide a security hole
> if the machine doesn't have a rcmd.<hostname> srvtab. That's another concern,
	If the machine is "tightly kerberized" as you describe, then
without such a srvtab, you won't be able to get in at all, other than
from a directly wired terminal, so ksu won't be a threat. It is still
important to be careful about making ksu available on "client only"
machines that don't have such a srvtab.

> do root work, you logoff the remote machine, su to root (which gets root
> access tickets) and then logon to the remote machine. I'm not sure, but
	I don't think Jeff implied that it was necessary to log off;
most of us use window systems of some sort, so popping up an
additional connection isn't a hassle.
					_Mark_ <eichin@cygnus.com>
					Cygnus Support --
					"Cygnus Network Security"
From: Joseph_Jackson@transarc.com
Newsgroups: comp.protocols.kerberos
Subject: Re: (none)
Date: 15 Sep 92 20:42:38 GMT
Organization: Carnegie Mellon, Pittsburgh, PA

boche@VNET.IBM.COM (Ulrich K. Boche) writes:
> In RELEASED: Kerberos FAQ Version 0.0 (Trailer), references are
> given:
> >...
> >[6] S.M. Bellovin and M. Merritt, "Limitations of the Kerberos
> >Authentication System," Computer Communications Review 20(5), pp.
> >119-132 (October 1990).  [research.att.com:dist/kerblimit.usenix.ps]
> >...
> >
> I understand the network information to be file "kerblimit.usenix.ps"
> in directory "dist" at node "research.att.com".  When I tried to get
> the file via anonymous FTP, I was told the file didn't exist.  Am I
> off base with my interpretation or is there a typo in the FAQ trailer?

Try research.att.com:dist/internet_security
250 CWD command successful
Newsgroups: comp.protocols.kerberos
From: yuan@syl.dl.nec.com (Ruixi Yuan)
Subject: Re: Kerberos' rlogin, and Thanks.
Keywords: rlogin, setuid
Organization: NEC Systems Lab.
Date: Thu, 10 Sep 1992 16:04:02 GMT

Thanks for those responded to my question. The problem is caused by not 
setting the SUID of the rlogin program. The kerberos' rlogin program is 
running now.

However, there is a warning message: 

	Warning: No Kerberos tickets obtained.

displayed after the rlogin. Does this mean the rlogin session is not 
authenticated? 

Another problem is that the terminal display and key definition is 
somewhat altered. For example, the "del" key can delete charactor 
in command mode, but the display doesn't show the charactor being 
deleted (I am using Xwindow). 

Thanks again for those responded my previous question and I appreciate
any suggestions on the above mentioned problems. 


--- Ruixi

Newsgroups: comp.protocols.kerberos
From: backman@vaxeline.ftp.com  (Larry Backman)
Subject: Re: Kerberos for DOS and OS/2
Nntp-Software: PC/TCP NNTP
Organization: FTP Software, Inc., Wakefield, MA
Date: Fri, 11 Sep 1992 11:07:33

In article <9209012341.AA22373@endor.harvard.edu> ddl@DAS.HARVARD.EDU (Dan Lanciani) writes:

 >> |Is your krb for OS/2 process or thread reentrant?
 >> 
 >>         It is, by definition, process-reentrant.  I have no idea how
 >> it would react to multi-threading as there many potential critical
 >> sections.  Tracking them down will have to wait until I have an
 >> application that can make real use of multi-threading (beyond being able
 >> to call itself a multi-threaded application in PR releases :).
 >> 
 >> |i.e., is it in a
 >> |DLL that can be shared by processes and threads?
 >> 
 >>         I never bothered building a DLL; however, FTP Software packages
 >> the code as a DLL so it can certainly be done.
 >> 
As Dan says we ship the kerberos code as a Kerberos DLL.  It most certainly
is multi-process reentrant and most probably would break if you wrote a
mutl-threaded app that used kerberos services concurrently.

Our experience so far over the 1.5 years we have been shipping the DLL
is limited; there are few users of OS/2 and fewer even of OS/2 & Kerberos.

L.

Newsgroups: comp.protocols.kerberos
From: tytso@ATHENA.MIT.EDU (Theodore Ts'o)
Newsgroups: comp.protocols.kerberos
Subject: Re: Existing authentication mechanisms have a deficiency
Date: 9 Sep 92 04:26:09 GMT
Organization: Internet-USENET Gateway at Stanford University


   Date: Tue, 8 Sep 92 16:03:34 PDT
   From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)

   It seems to me, after the discussion about su, ksu, etc., that
   something is missing from existing distributed authentication
   mechanisms.....

   If an organization wants to keep its authentication data in exactly
   one place, existing authentication mechanisms are insufficient. 

Yup.... what's missing is "an authorization mechanism".  Both Kerberos
and SPX purport to offer an "authentication", and completely punt on the
"authorization" issue, leaving that as an exercise for the application
writer to deal with.

While this may seem to be an amazing cop out, since every nearly every
application which uses the authentication services provided by Kerberos
or SPX will require some sort of authorization policy, even if it is as
simple as checking an ACL, file, there is a good reason for this design
choice.  And the reason is this:  

	While authentication systems are relatively well-understood at
	this point, authorization policies are not.  

Specifically, there is no good, general model which shows what sort of
functionality an system would need in order to provide a completely
general authorization policy which would work for all possible
applications.  There have been attempts to do so --- ECMA has issued one
or two technical reports which try to do so --- but they tend to be
fairly confusing, and it is not clear at least to me whether they
generate more light than heat.  So it seems fairly clear to me that a
workable authorization framework is at least partially still an area for
research.  

What we use at MIT Project Athena is a system called "Moira" to handle
our authorization policies.  Specifically, it is a database system which
automtically distributes configuration files to most of the Project
Athena servers every night.  This allows most of the authorizatrion
information to bee kept in exactly one place, as your requirement
specifies.  Since connections to Moira require a Kerberos-authenticated
connection, reasonable access list control can be placed on the Moira
database, and it is even possible to figure out who made what
modifications to a particular database entry.

Moira is big and hard to set up (it runs on top of Ingres), so it may
not be appropriate for all sites.  But it is one solution which keeps a
large part of the authorization information in one centralized place.

							- Ted
From: dyer@spdcc.com (Steve Dyer)
Newsgroups: comp.protocols.kerberos
Subject: Re: Kerberos' rlogin, and Thanks.
Keywords: rlogin, setuid
Date: 10 Sep 92 17:38:49 GMT
Organization: S.P. Dyer Computer Consulting, Cambridge MA

In article <1992Sep10.160402.16410@syl.dl.nec.com> yuan@syl.dl.nec.com (Ruixi Yuan) writes:
>The kerberos' rlogin program is running now.
>
>However, there is a warning message: 
>
>	Warning: No Kerberos tickets obtained.
>
>displayed after the rlogin. Does this mean the rlogin session is not 
>authenticated? 

It means you don't have a Kerberos TGT which you can use on the host you
logged into.  You'd have to get a new one using "kinit" (unfortunately
exposing your password over the net).  In version 4, the ticket contains
the single IP address from which it may be used, and therefore, tickets
can't be forwarded to other hosts to be used there.  In version 5, there
is the capability to allow a list of addresses from which a ticket may be
used or (if my memory serves me) an indication that the ticket may be used
without regard to the host from which it's used.

-- 
Steve Dyer
dyer@ursa-major.spdcc.com aka {ima,harvard,rayssd,linus,m2c}!spdcc!dyer
From: trier@slc6.ins.cwru.edu (Stephen C. Trier)
Newsgroups: comp.protocols.kerberos
Subject: Re:  Existing authentication mechanisms have a deficiency
Date: 14 Sep 92 17:29:57 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
NNTP-Posting-Host: slc6.ins.cwru.edu

In article <9209091614.AA15084@ocfmail.ocf.llnl.gov> nessett@OCFMAIL.OCF.LLNL.GOV (Danny Nessett) writes:
>One could imagine a system configured so that all on-machine authentication
>requests contacted the appropriate server, say the Kerberos server or
>SPX LEAF server, rather than looking in /etc/passwd for the user's
>encrypted password. Actually, I think SUN already does something like this
>by looking in the NIS...

If one is willing to look beyond Unix, this is more or less what is being
done in the MS-DOS and Macintosh worlds when Kerberos is installed.  In
those environments, there exist no local user access controls, nor is it
clear that any such controls would be effective.

Kerberos can be integrated into the network software on such machines,
moving, as you suggest, all authentication information to a centralized
server.  (I should say this is still a theoretical idea here because we
haven't gotten our DOS Kerberos working yet.)

NIS and similar systems are inappropriate for this sort of environment,
which is, I think, why so many people are interested in any news about
Kerberos or SPX for MS-DOS, MacOS, and Windows.

>My suggestion about modifying su to contact the appropriate server to
>perform authentication was along these lines.

I was recently attempting to figure out whether there was any use for
ksu on MS-DOS.  :-)  I still haven't decided -- I need to figure out
exactly what ksu does with TGTs before I decide whether we should port
it.

-- 
"Beware of programmers who     Stephen Trier
 carry screwdrivers."          Network Services Engineering, IRIS/INS/Telecom
       Leonard Brandwein       Case Western Reserve University
                               trier@ins.cwru.edu