Netatalk+Asun under Solaris howto

Version: 0.2

Date: March 30, 1999

Author: Andrew Snell - asnell@store.unc.edu

Please report any inaccuracies, needed changes, suggestions, etc to the author at the address above.

This document is designed to lead administrators through the process of building, installing, and configuring Netatalk in order to provide support for file sharing over TCP/IP, including encrypted passwords, and the ability to restrict access based on IP addresses using TCPWrappers. All instructions here were carried out on a Sparc Solaris 2.6 machine, although they should be readily adaptable to any Netatalk supported platform:

This document is still applicable even if you do not desire to build encrypted passwords or TCP wrappers support. Just ignore the sections related to what you don't need. In a future revision, I will better separate the steps required.

Disclaimer - These instructions are intended to be a useful guide to installing this software package. I don't guarantee they're right, heck, I don't even guarantee they'll work. Its up to you to use these directions; neither I nor anyone else associated with Mac Support at UNC will take responsibility if these directions cause permanent difficulties to your system. You have been warned! Enough said, enjoy.

Required Software

Recommended Software

Preparation

Building Netatalk+Asun

Edit Makefile
First, unpack the distribution, preferably in a 'playpen' or similar temporary area. Then, edit the Makefile in the distribution directory. By default, this package will install into /usr/local/atalk tree. This seems to be a good place to put it, and lets you isolate the netatalk files from other packages. You can change this default location by editing the DESTDIR variable. The DESDIR variable specifies the path to the DES library and header. Netatalk expects these files in $(DESDIR)/lib and $(DESDIR)/include, respectively. You shouldn't need to edit this variable. If you followed the directions above on TCPWrappers, you'll need to edit the TCPWRAPDIR variable. Set this to /usr/local. Next, comment (put a # in front of) out the PAMDIR variable, as this howto doesn't cover PAM support.

Note that the installation location can be tweaked easily by editing the appropriate Makefile variables if you have a particular installation scheme you'd like to follow. Mine is to use the /usr/local tree, so the defaults work here.

Build Netatalk

You should be able to simply type make in the distribution directory. Netatalk should be able to find your architecture and system type, and build accordingly. You'll most certainly need a copy of make in your PATH environment variable, as well as gcc. If either of these are absent (or not properly located), the build will fail.

Compiling netatalk takes around 5 minutes on our SparcStation 10 with 128 MB RAM. Go read SlashDot while you wait. We get a few compiler warnings relative to the redefinition of the 'int32_t' type, but nothing other than that. Again, this is with the egcs 1.1.2 compiler.

Installing Netatalk+Asun

Install Package
Installing netatalk is as easy as typing make install in the distribution directory. Make should do the rest for you. Verify that the /usr/local/atalk directory has been created and populated (or other customized install location). You should find /bin, /etc, /include, /lib, and /man subdirectories.

Next, copy the appropriate rc.atalk.* script to the appropriate location. Under Solaris 2.6, I use the /etc/init.d directory, and link to this script from /etc/rc0.d/K79atalk and /etc/rc2.d/S79atalk. Your system may be different, depending on architecture and personal preference. I delete everything in this script except references to afpd. Also, you'll need to adjust the paths used if you used an installation directory other than the default. Mine looks like this (with blank lines removed for sake of brevity):

#! /bin/sh
#
# Start/stop the afpd daemon.
#
# Adapted from the netatalk rc.atalk.sysv script by ACS.
#
# kill the named process(es)
#
killproc() {
        pid=`/usr/bin/ps -e |
             /usr/bin/grep $1 |
             /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
        [ "$pid" != "" ] && kill $pid
}
case "$1" in
#
# Start the appletalk server processes.
#
'start')
        echo 'starting appletalk daemons: \c'
        if [ -x /usr/local/atalk/etc/afpd ]; then
                /usr/local/atalk/etc/afpd;                      echo ' afpd\c'
        fi
        echo '.'
        ;;
#
# Stop the appletalk server processes.
#
'stop')
        echo 'stopping appletalk daemons:\c'
        if [ -x /usr/local/atalk/etc/afpd ]; then
                killproc afpd;                  echo ' afpd\c'
        fi
        echo '.'
        ;;
#
# Usage statement.
#
*)
        echo "usage: $0 {start|stop}"
        exit 1
        ;;
esac
       

Configuring Netatalk+Asun

Copy and Edit Configuration Files
Copy from the /config subdirectory of the distribution to /usr/local/atalk/etc (or custom directory) the files AppleVolumes.default, AppleVolumes.system, and afpd.conf. The AppleVolumes.system file is where you setup the mapping of file extensions to Creator/Filetype pairs. For example, we change the line .html TEXT MOS! to read .html TEXT R*ch, since we like to edit HTML file using BBEdit. Adjust these mappings according to your taste (and that of your users). The afpd.conf file is where you setup shared volumes. There are a myriad of options available, all of which are listed in comments in that file. The configuration we use is:
"Staging Server" -noguest -tcp -savepassword -setpassword -rand2num
-address 152.2.XXX.XXX
 

The options here set the server name to Staging Server, disallow guest access, allow access only over TCP/IP, allow the user to set a new password and save the password, enable encrypted passwords, and listen to a particular address (this box multihomes several IP addresses). You most definitely should adjust this configuration to reflect your environment and preferences. Each line defines a virtual server, so it is possible to set up servers listening to different addresses, with different options, etc.

Edit TCPWrappers Configuration

In our setup of TCPWrappers, we have a line in /etc/hosts.deny denying all connections across the board:
ALL: ALL: (/usr/bin/echo "CLIENT: %h DAEMON: %d \
DATE: `/usr/bin/date`" | /usr/ucb/mail -s WARNING:hostname
someaccount@somewhere.unc.edu)&
 

This line mails notification of an unauthorized connect attempt to the sysadmin. The TCPWrappers manual pages document many options available here. Next, we explicitly specify that access is allowed to particular daemons from particular IP addresses in the /etc/hosts.allow file:

afpd: 152.2.XXX.XXX 152.2.XXX.XXX localhost
 

Here is where you should insert the IP addresses of your clients. Allowing based on subnets is done via 152.2.XXX.0/255.255.XXX.0 syntax. Ours is 152.2.201.0/255.255.255.0, thus allowing anyone in the 152.2.201 subnet to connect.

Create AppleVolumes and .passwd files

We use one user, web, to allow access to the DocumentRoot directories of our webservers. In the home directory of the web user, there are two files, AppleVolumes, and .passwd. The format of the AppleVolumes file is FileSystem ExportName. For example,
/export/home/staging
staging_WEB_FILES

will cause the /export/home/staging to be exported to Mac users as the shared disk staging_WEB_FILES. This file should be mode 644, owned by web (or whatever user you're using).

 

The .passwd file is necessary for encrypted passwords. This file should contain only the user's password, cleartext. It should be mode 600, and owned by the user. This does represent a small security hole, in that someone with root access could get this users password. Hopefully, the root account is under enough control that this should not be an issue.

Finally...

Fire that bad boy up! Start afpd using your RC script. Check to see that it is indeed running with a ps -ef |grep afpd or similar. Now, try to make a connection from a Mac. In the Chooser, select AppleShare, and then hit the button that reads 'Server IP Address...'. Type in the IP you specified in the configuration above, and try to make the connection. Note that under the password field, it should say 2-Way Encrypted Password. If you get a message saying 'No response from server. Please try again', you probably need to fix your TCPWrappers configuration. If it says your password is incorrect, you need to check your .passwd file. If everything is setup correctly, you should be able to mount whatever disks you defined in AppleVolumes.

Where to Get Help

In the best of worlds, everything works right the first time. Right. Well, here are some resources to get help if things go awry:

Copyright © 1999 University of North Carolina
Student Stores

 

 

Original Author: Andrew Snell - asnell@store.unc.edu