From: fhl@milton.u.washington.edu (Dean Pentcheff)
Newsgroups: comp.os.os2.networking
Subject: Re: BASIC NETWORKING QUESTIONS/HELP!!! [Verbose, explicit answers]
Date: 23 Nov 92 09:15:47 GMT
Article-I.D.: u.1992Nov23.091547.12557
Reply-To: dean2@tbone.biol.scarolina.edu (Dean Pentcheff)
Followup-To: comp.os.os2.networking
Organization: Department of Biology, University of South Carolina, Columbia

v085khdn@ubvmsb.cc.buffalo.edu (Geo @UB) writes:
>I have some very basic networking questions that I desperately need help
>with. I would like to hook up to the Ethernet network at U.B. here, and
>display Xwindows using either Desqview/X, or OS/2, both of which I have
>running. I have a 3Com503 card & have got the setup to accomplish
>telnet & ftp (though shakily, works best only to a Sun workstation in
>the same office), this using a public domain 3C503 packet driver, some
>file (small) NETDEV.SYS in my CONFIG.SYS ( DOS only, can't get this
>to work in a OS/2 DOS session, or in a Desqview/X DOS window, packet driver
>driver crashes OS/2, Desqview/X mekes it to login, then locks up ), &
>the public domain (I guess) FTP & TELNET programs. I took the card out
>of a 286 we had here, put it in my computer, copied the software over,
>& accomplished what the 286 did (TELNET,FTP). I did the switch to get
>Xwindows, what else do I need ? I know for Desqview/X I need the network
>manager for PC/TCP, will this do it. Am I a fully functioning node on
>the network if I can FTP & TELNET? I am totally confused as to the difference
>between TCP/IP & PC/TCP, one is the protocal right? ,which is it, what
>do I need to fully implement it? , am I already? Do I need this
>IBM's TCP/IP package (or whoevers)? , what do I need for PC/TCP ?, 
>finally how can I do Xwindows on OS/2. I would really appreciate it if
>one of you knowledgeable people would take the time to post a little
>begginers course on this stuff, deciphering some of these acronyms.
>
>                                   Thanks in advance,
>                                       George Sabini


OK, I'll take a crack at it.  I'm no networking pro, but I've managed
to start a working network system using OS/2 and IBM's TCP/IP
offerings.  Maybe this could serve as the beginning of a FAQ list on
how to set up networking under OS/2 using IBM's offerings...  It took
me long enough to sort it all out.  I hope I can save someone else the
trouble.

I make no guarantees that the following is entirely correct!  It's
based on my experiences.  PLEASE correct me (with [edited] followup
posts) if there's anything misleading or wrong.

-Dean

P.S. Why in hell did I write all this?  I've benefitted hugely from
some analogous missives on the Net in the past.  Time to return the
favor.  And I clearly have a lot of other work to do...
--
Dean Pentcheff  (Internet: dean2@tbone.biol.scarolina.edu) (803) 777-8998
Department of Biology, University of South Carolina, Columbia SC 29205
(NOTE: my email address is different than the address from which I post news)

=============================================================================

---------------------------
  Some Terminology
---------------------------

TCP/IP is a protocol name - it defines a way for computers to chat with
each other.

PC/TCP is a particular product (?) that uses TCP/IP on a PC.

FTP is a "file transfer protocol" that runs on top of TCP/IP (there are
implementations of FTP for pretty much any computer that can talk
TCP/IP, making it a lingua franca for file exchange - it's not pretty
but it works).

Telnet is a defined way for TCP/IP-speaking computers to set up
terminal sessions between each other so that you can actually log onto
a remote computer and interact with your account there.

A 3Com 3C503 card is a (very cheap and popular, if not screamingly
fast) Ethernet board for PCs.  Using it (and appropriate software) you
can connect a PC to a TCP/IP network.  Note that you can also connect
it to a Novell network - same hardware, just different protocols.

CSD is IBM's word for a publicly distributed bug fix package.  Note
that CSDs obsolete prior CSDs.  That is, application of any later CSD
will take care of everything that was done by earlier CSDs.  You don't
have to apply the whole chronological string of CSDs, just the most
recent one.  God help you if you install an earlier CSD over a later
one (IBM sure won't help).

---------------------------
  Selecting parts of the IBM TCP/IP packages
---------------------------

IBM sells a bunch of pieces, many of which are optional, for TCP/IP
networking.  Following is a brief summary of them.  Note that all of
the following come with both 1.2 Mb 5-1/4" and 1.44 Mb 5-1/2" disks in
the same package (you don't need to specify medium).

TCP/IP Base Program (Part #02G6968).  You need this in order to use any
of the other following parts.  It gives you the software to connect
with your 3Com (or other Ethernet or Token Ring card), plus a few
character-oriented programs (Telnet, FTP, ping, etc.).  It's sort of
equivalent to the NCSA Telnet package for DOS.

NFS Kit (Part #02G6970).  This gives your OS/2 system the ability to
serve as both a client and a server on for sharing disk space using
Sun's NFS (Network File System) protocol.  In other words, you can
mount disks over the network that are physically attached to other
minicomputers or OS/2 systems as though they were attached to your
computer.  Conversely, you can make parts of your OS/2 computer's disks
available for sharing by others.  With this package (along with the
Base Program), you've got the makings of a small local area network
that can share disk space and printers.

X-Windows System (Part #02G6980).  This gives your OS/2 system the
ability to display output (and relay input) to X programs running on
other computers.  X-Windows is a standardized way for programs (mostly
on Unix-based systems) to put graphics on the screen and interact with
the user.  X terminology is a bit peculiar:  the program doing the work
is called the "client"; the program doing the display is called the
"server".  This package allows your OS/2 system to be an "X server",
but not an "X client": you can display and interact with X programs
running elsewhere, but you can't run an X program on your OS/2 system
and display its results elsewhere.

X.25 Networking (Part #?).  Enables X.25 communications from your OS/2
system.  I have no exposure to this product, so I won't comment.  I
assume you'll know if you need it.

Source code and programming packages.  If you're ordering these you
sure as hell don't need me giving you hints on what to do.

Oh yes, prices.  The following prices are the educational discount
prices for the items about which I know:
        TCP/IP Base Program     $130.00
        NFS                     $ 98.00
        X-Window System         $ 98.00

---------------------------
  Preparing to hook up to a TCP/IP network
---------------------------

Once you have the TCP/IP base package, you can be a full-blown node on
the Internet.  To do that, you _must_ contact a local system
adminstrator on the network to which you will physically connect your
OS/2 machine.  He or she has to give you an Internet number.  Choosing
one at random is unlikely to work and is exceedingly antisocial (since
it may well disrupt others' use of the network).

You can probably select your own cute name for your machine, unless
there is an iron-fisted net administrator who enforces a naming
convention.  As examples, our lab works on crab behavior, so our PCs
are called "fiddler" and "cancer".  The last place I worked had a lot
of people working on marine larvae, so they had "cypris", "zoea",
"actinula", etc.

When you decide on a name and send it to your Local Network Guru, also
ask the following questions:

What's will my machine's full Internet name be (e.g.
fiddler.biol.scarolina.edu for the machine at which I'm sitting)?

What is my IP address (e.g. 123.234.321.112 for a totally fictitios
example)?

Is this network subnetted?  If so, what's the subnet mask (e.g.
255.255.0.0)?

Is there a non-default broadcast address?  If so, what is it?

What are the IP addresses of three domain nameservers?

And, before you start the software installation, do yourself a favor.
Open up your machine and take a good look at the network adapter.
Write down any strap or switch options that are set.  You'll probably
need them later when you do the software configuration of the driver
for TCP/IP.

---------------------------
  Installing IBM's TCP/IP Package
---------------------------

All the documentation comes with the Base Program.  The other packages
just consist of a folder with disks.

It is not initially clear how to proceed, so here's enough to get you
started:

Begin with the manual "TCP/IP Version 1.2.1 for OS/2 (Refresh):
Installation and Maintenance".  You install the TCP/IP software first,
then the specific driver software for your Ethernet/Token Ring board.

There's a nice little configuration program called ICAT (Installation
and Configuration Automation Tool).  As per instructions, stick in disk
1 and run ICAT from an OS/2 command line.

Push the "Install" button first.  It will give you the opportunity to
install any/all of the options you've ordered (base package, NFS,
X-Windows, and X.25).  Check off whatever boxes you want and feed disks
as requested.  Go ahead and install everything you've got.

Once everything has been copied to disk, push the "Configure" button of
ICAT.  Now comes the fun stuff.  I'm assuming you have the
documentation, I'll just give you some hints based on what I did.
There's a numbered list of 6 configuration things to do.  We'll run
down the list.

1.  Configure Network Interface Parameters.  You probably only have one
Ethernet/Token Ring board in your computer, so you only have to fill in
half this screen (the other half is for another board - and up to two
more on a "Next Screen").  Your IP address is whatever was issued to
you by your Friendly Local Network Adminstrator.  If he/she told you
anything about a "Subnet Mask", enter it appropriately.  Leave
"Broadast" and "Destination Address" blank (unless you've been
explicitly instructed otherwise).  For that matter, leave the rest of
the screen untouched unless told otherwise.  Don't forget to check the
little "Enabled" box in the top left corner.  When done, press the
"Menu" button to return to the main Configure menu.

2.  X.25 Parameters.  You're on your own here (I haven't done this),
but it looks straightforward - stick in your IP address.

3.  SLIP Parameters.  This is if you're going to use a serial port for
access, instead of a network adapter (SLIP = Serial Line Internet
Protocol).  Fill in the IP address, and the rest is like setting up the
dialer in a communications program.

4.  Automatic Starting of Services.  Again, the following are
reasonable defaults if (a) you haven't been told otherwise; and (b) you
have the software involved.

        DO enable the inetd super server - this is one program which
        runs all the time and spawns off some of the other network
        service programs on an as-needed basis.  This way they don't
        all have to be started at once.

        If you want yourself or others to be able to Telnet into this
        machine, enable the Telnet server (BUT SEE NOTES BELOW - THIS
        CAN BE A REAL SECURITY RISK).

        If you want to be able to access files on this machine from
        other machines using the FTP protocol, enable the FTP server.
        This does not influence your ability to use FTP on your machine
        to access other machines.  (SEE NOTES BELOW - THIS IS A
        POTENTIAL SECURITY RISK).

        Unless you know otherwise, DO NOT enable TFTP.

        I lean towards not enabling rexec and rsh unless there's a
        compelling reason to do so.  THESE ARE A REAL SECURITY RISK.

        If you are going to use your machine's printer as a print
        server for other machines, enable the lpd server.

        If you've got the X-Windows stuff, enable it (leave the
        "Parameters" as it is).

        If you're into online typing to people, enable Talk, but
        honestly, why not just use the phone?

        Enable the NFS Server if you want other people to access your
        hard disk (SEE SECURITY NOTES BELOW).

        Enable NFSCTL if you want to be able to mount other machines'
        disks (but note that they must allow you to do so).

        Go ahead and enable the automatic routing server routed.

        FINALLY, if you're going to receive mail directly onto your
        machine, enable sendmail.  If you're already receiving mail on
        another machine, this is FAR more trouble than it's worth (in
        my opinion).  With the other software you've got, you'll easily
        be able to read your mail on another machine, so why bother
        with all the sendmail setup stuff (which is relatively
        fierce)?

5.  Configure Services.  I'm going to give hints based on my slightly
net.paranoid approach.  See the security notes below for some details.

        Put one and only one entry in the FTP Access Protection:
        anonymous.

        If you're doing X-Windows, X Host Authorization gets the name
        of the machine(s) on which your X "clients" (e.g. main
        programs) will run.

        In the X Client Display Variable, enter your OS/2 machine's IP
        address (or Internet name, whichever).  Not the name of the
        host to which you will be connecting, but this very OS/2
        machine's address.  Follow the IP address or machine name with
        ":0" (without the quotes of course).  For example, I've
        entered:  fiddler.biol.scarolina.edu:0

        Fill in the timezone in standard Unixoid format.  See page 95
        of the manual for some of the more popular timezones.

        If you will use another machine's printer, enter that machine's
        name and it's printer's name.

        If you took my advice on rexec, enter nothing in the rexec
        username and password.

        Enter nothing in the password field for telnet (BUT SEE THE
        SECURITY NOTES BELOW).

        Enter your machine's name in the Hostname field (just the very
        first part of the name: "fiddler" in the case of
        "fiddler.biol.scaroline.edu").  Enter the rest of the name in
        the Domain Name field ("biol.scarolina.edu").

        Type in (correctly!) the IP numbers of the (up to) three local
        nameserver machines your Always Cheerful Network Adminstrator
        gave you.

6.  Routing Information.  If you're lucky, you won't have to enter
anything in the routing information screen.  You're local network will
happily figure everything out for itself.  If you _do_ need to enter
something here, see the local Net Guru (whose cheerfulness may be
wearing a bit thin by now).  I'm lucky - I haven't had to deal with
this.

When this is done, go ahead and "Exit" all the way out of the ICAT
program, reassuring it that you really do want it to write this stuff
to disk as it quits.

---------------------------
  Installing the driver for the network adapter.
---------------------------

Once you finish with all that nonsense, you will realize that you
haven't told the software anything about the network adapter you've
got.  Time to turn to the "LAN Adapter and Protocol Support
Introduction and Configuration Guide".  Cram in the LAPS disk, and,
from an OS/2 command prompt, start up the LAPS program from the
floppy.

What you do is simple: pick one from column A and one from column B.
In fact, IBM has made it simpler still - there's only one choice in
column B (but you still have to explicitly pick it).  Choose your
network adapter from the Network Adapters list (select and "Add" it).
Then choose the only choice (IBM TCP/IP) from column B.  You've now
declared that your network adapter number 0 (the first one) is of a
particular type, and it will run TCP/IP.  Punch OK and the proper
software is copied in.

Now highlight the adapter name in the Current Configuration window and
press "Edit".  Now's your chance to make sure that the hardware options
on your adapter match up with the software's idea of them.  Change
anything that needs changing.  When in doubt, leave it as it was.

---------------------------
  Initial tryout.
---------------------------

Are ya feelin' lucky?  Hope so.  Quit out of LAPS.  Do the standard
OS/2 Shutdown.  Make sure your network adapter is actually plugged into
a network.  Cross fingers and toes.  Start up OS/2.

It will take much longer to boot as five zillion networking programs
crank up.  Lots of them will put screens up as they come on.  Once
things are up, you can minimize these screens.  Meanwhile, they will
tell you of your progress.

If things really choke and you don't get a boot, well, you knew the job
was dangerous when you took it.  Get an OS/2 guru to boot from a floppy
for your and REM out the line in "startup.cmd" that says "CALL
C:\TCPIP\BIN\TCPSTART.CMD".

Assuming things more-or-less come up, try things out.  First, from an
OS/2 command line, try a ping to yourself.  In my case, that's "ping
fiddler.biol.scarolina.edu".  You should get a series of one-liners
once a second informing you that you've sent 64 bytes to yourself and
received it.  Press ^C to quit that.  If, after you enter your ping
command, you get nothing (the command just hangs there), you've got a
problem: you're unable to find yourself.  Check your machine name and
internet number using ICAT, and make sure your network adapter board is
properly set up, and the correct parameters are set using LAPS.

Try telnetting to your local host.  Try an FTP file transfer.  Once FTP
file transfers work, I advise you do take the following step next,
before doing a lot more playing.

One thing you'll want to try, which I did, is to double-click on the
cute little INETD icon.  Don't do it.  You'll get a textmode screen
with Inetd's potential clients listed.  That's it.  No menus.  No
nothing.  It makes you feel like DOS is back.  Press Alt-Tab or Alt-Esc
to get the hell out of there fast.  Memorize this, because you'll do it
accidentally one day anyway.  [Hey, does anyone know how to stop this
rather rude behavior?]

---------------------------
  Downloading CSDs (bug fixes)
---------------------------

My system almost-kinda-sorta worked (flakey is the word that comes to
mind).  Following application of the bug fixes, it works very
smoothly.  So, to avoid wasting time, apply the bug fixes early.
Here's the scoop.

1.  For neatness' sake, make a subdirectory called "csd" (well, don't
listen to me about it, call it "rosebud" if you want).  Do a "cd" to
that directory (all this is done from the OS/2 command line).

2.  Give the command:  ftp ftp-os2.nmsu.edu

3.  If that doesn't work ("host unknown") you've got a problem with
domain name resolution.  Ignore that for now.  Try giving the command:
ftp 128.123.35.151

4.  Log in as user anonymous, with your full login (joe@ace.b.c.edu) as
password.  Yeah, you don't really have a user name ("joe") since you're
on a single-user machine.  Make one up.

5.  Give the following FTP commands [things in square brackets are my
comments, not parts of the commands]:

        binary 
        cd pub/os2/2.0/patches 
        get tcp2274.zip                 [base TCP/IP package patches] 
        get nfscsd.zip                  [if you've got NFS] 
        get pmx02205.zip                [if you've got X-Windows] 
        get progcsd.zip                 [if you've got programming toolkit]
        get x25csd.zip                  [if you've got X.25] cd
        /pub/os2/2.0/archivers 
        get unz50x32.zip                [Info-ZIP unzipper for unpacking] 
        bye

Of course, this will be out of date soon.  Just look for the most
recent CSD packages in the directory and snarf them.  Likewise for the
Info-Zip unzipper.

6.  Unpack the suckers.  First just run unz50x32.  It will unpack
itself into the unzip program.  Then start unzipping whichever other
packages came your way.  The TCP Base package is a big sucker.  You'll
need three high density 3-1/2" floppies for it (no, its parts don't fit
onto 1.2 Mb 5-1/4" floppies, I tried).  The NFS and X-Windows CSD's
will happily go into a subdirectory each on one single floppy (either
3-1/2" HD or 1.2 Mb 5-1/4").  The others, I'm not sure.

To unpack the TCP Base package, you first unzip the zip file, leading
to three "programs".  Unpack each of those onto its own floppy disk.
Do so by making the floppy disk your current directory, then running
the program from there.  For example:

        b:  
        c:\csd\basecsd1

will unpack the first of the three floppies-worth.  Switch disks and
continue for each of the other two.

For the NFS and PMX ones, just unzip onto a floppy.  I did:

        a:  
        mkdir nfs
        cd nfs
        c:\csd\unzip
        c:\csd\nfscsd
        cd ..
        mkdir pmx
        cd pmx
        c:\csd\unzip c:\csd\pmx02205

7.  Now you've got your CSDs (bug fixes) on disk.  You have to first
REM out a couple of lines in your startup scripts, then reboot.
Otherwise OS/2 will refuse to let you update programs that are actually
running.  Using your favorite editor, edit your c:\config.sys.  Find
the line that runs CNTRL.EXE.  Insert REM (followd by a space) before
it.  Save the file (as Plain Text, if you're asked).  I found that I
also had to edit the file c:\startup.cmd and similarly REM out the line
that reads "CALL C:\TCPIP\BIN\TCPSTART.CMD".

Now reboot.

Why not do all this before even rebooting once?  Because applying the
CSD depends on a lot of networking environment that is set up in the
main config.sys file, so you've got to have booted with the networking
stuff installed but REMed out for the CSD to apply properly.

8.  Each CSD has its own handy install script.  Stick in the floppy and
run the whatever.CMD file.  For the Base Package it's basecsd.cmd; for
NFS it's nfscsd.cmd; for X-Windows it's installx.cmd (thanks for the
consistency, guys).  Basically all that these do is copy over a bunch
of new versions of programs on top of the old ones.  As far as I can
tell, they don't meddle with initialization setups.

9.  With your trusty editor, remove the REMs from config.sys and
startup.cmd.

10.  Reboot OS/2 to a far less bugfull networking setup.

---------------------------
  A Few Reminders
---------------------------

If you are running the X-Windows server, you need to let the host
computer know that you're legitimate.  That probably means putting your
OS/2 machine's Internet name into /etc/X0.hosts or ~/.Xauthority on
your Unix box.

If you want to mount part of a Unix box's disk, the Unix machine will
need an entry in its /etc/exports file describing what you're allowd to
mount.  Similarly, your OS/2 system's \tcpip\etc\exports file will have
to list systems you allow to mount your disks (SEE SECURITY NOTES
BELOW).

---------------------------
  Security Concerns
---------------------------

You are now a node on the Internet (assuming you've hooked up to an
Internet-worked network).  That means you have to be security
conscious.  You don't have to be an international bank to be chosen as
a victim.  There really are people out there trying to break into
whatever computers they can.  You don't want to leave yourself open to
that.

Furthermore, if your computer is ever broken into, you stand a far
better chance of getting sympathetic help if you didn't leave it wide
open in the first place.  If I leave my house unlocked and someone
walks in and takes things, they are still doing wrong, but I'd be more
likely to get sympathetic help had I locked the door.

I will outline the approach I've taken to setting up our OS/2 systems.
I AM NOT A UNIX OR NETWORK SECURITY EXPERT.  Just for good measure,
I'll say that again:  I AM NOT A UNIX OR NETWORK SECURITY EXPERT.  I've
done enough reading to know that (a) it matters; and (b) security holes
can be very subtle.  So don't necessarily believe what I'm
recommending.  I welcome comments (but I will not open a debate on the
morality of computer breakins).

1.  Enable Telnet but only with the real password option.  The default
password option offered is very weak.  It requires a single password,
that is readable by anyone who has access to the system.  VERY WEAK.
But, buried deep is a better solution.  On page 72-3 of the
Installation and Maintenance Manual is the description of how to set up
telnet to require a Unix-style password file.  Now, Unix-style
passwords are far from hyper-secure, but they're better than a
clear-text "password"!  You'll need to copy an /etc/passwd file from a
Unix host.  Perversely, IBM doesn't provide you with a program to make
the passwd file.  But you've probably got a login on a Unix machine -
you can use it's password file.

Follow the directions to install the passwd file and shuffle in a
different version of the login.exe program on OS/2.

In general, don't depend on any of the so-called "passwords" that
appear in environmental varibles.  World-visible passwords are a (bad)
joke.

2.  Disable incoming FTP except for the very restricted "anonymous"
account.  Your TRUSERS file should look like this:

        user:  anonymous
        rd:    c:\anonymous
        wr:    c:\anonymous

Make sure to create the directory c:\anonymous.  Someone can stuff your
system by filling your disk, but that's relatively benign.  If it's a
problem, remove "c:\anonymous" from the "wr:" field.  How can anyone
FTP a file into your machine if you don't even let them have ftp write
access to "\anonymous"?  With this setup, a really trusted user can
have an entry in the Unix-style passwd file.  Then she or he can telnet
into your machine and run FTP on your machine to suck the file in.

Don't have anything else in the TRUSERS file.  The idea of unencoded
passwords is ludicrous.

3.  Don't enable the rexecd server.  It depends on clear-text passwords
in the environment or in the NETRC file.  People can Telnet in through
the passwd-protected telnet, then execute the command.  Same goes for
the rshd server.

Come on.  Do you really want Joe Unwashed-behind-the-ears to be able to
do "rexec yourmachine del c:\*"?  And then giggle a bit.  Yup, that
could happen.

4.  Don't enable the TFTP daemon tftpd unless you really need it for
some obscure reason.  FTP does the job.

5.  Vanilla NFS is well known to be full of security holes.  You'll
notice the tight security demanded by the Unix host: give it a UID and
GID number and that's who you are.  Cute.  I'd be very wary about
giving write permission to my disk.

REMEMBER: THERE ARE NO ACCESS CONTROLS ONCE SOMEONE HAS ACCESS TO YOUR
OS/2 SYSTEM.  No files are protected from reading or deletion.  Once
someone is into your system, they can happily read any of your setup
files in \tcpip\etc (which could [if you're naive] contain real live
readable passwords.  They can also read your \config.sys and
tcpstart.cmd files, in case they missed a password or two.

The only people I want to have write access to my system are people
who've passed the (really minimal!) test of having logged in past the
Telnet-with-Unix-style-passwords.

------------
That's about it for now, folks.  Read the IBM manuals - they're actually
not too bad.  Not hold-your-handish, but most of what you need is
(somewhere) in there.  

Best of luck with networking.  Maybe we'll ping each other one day...