Version: 0.2
Date: March 30, 1999
Author: Andrew Snell - asnell@store.unc.edu
Please report any inaccuracies, needed changes, suggestions, etc to the author at the address above.This document is designed to lead administrators through the process of building, installing, and configuring Netatalk in order to provide support for file sharing over TCP/IP, including encrypted passwords, and the ability to restrict access based on IP addresses using TCPWrappers. All instructions here were carried out on a Sparc Solaris 2.6 machine, although they should be readily adaptable to any Netatalk supported platform:
- SunOS and Solaris
- Linux
- FreeBSD
- Ultrix
This document is still applicable even if you do not desire to build encrypted passwords or TCP wrappers support. Just ignore the sections related to what you don't need. In a future revision, I will better separate the steps required.
Disclaimer - These instructions are intended to be a useful guide to installing this software package. I don't guarantee they're right, heck, I don't even guarantee they'll work. Its up to you to use these directions; neither I nor anyone else associated with Mac Support at UNC will take responsibility if these directions cause permanent difficulties to your system. You have been warned! Enough said, enjoy.
Required Software
Recommended Software
Preparation
libdes.a
into
/usr/local/lib
, and des.h
into
/usr/local/include
libwrap.a
into
/usr/local/lib
, and tcpd.h
into
/usr/local/include
Building Netatalk+Asun
Edit MakefileFirst, unpack the distribution, preferably in a 'playpen' or similar temporary area. Then, edit the Makefile in the distribution directory. By default, this package will install into/usr/local/atalk
tree. This seems to be a good place to put it, and lets you isolate the netatalk files from other packages. You can change this default location by editing theDESTDIR
variable. TheDESDIR
variable specifies the path to the DES library and header. Netatalk expects these files in$(DESDIR)/lib
and$(DESDIR)/include
, respectively. You shouldn't need to edit this variable. If you followed the directions above on TCPWrappers, you'll need to edit theTCPWRAPDIR
variable. Set this to/usr/local
. Next, comment (put a # in front of) out thePAMDIR
variable, as this howto doesn't cover PAM support.Note that the installation location can be tweaked easily by editing the appropriate Makefile variables if you have a particular installation scheme you'd like to follow. Mine is to use the
/usr/local
tree, so the defaults work here.Build Netatalk
You should be able to simply typemake
in the distribution directory. Netatalk should be able to find your architecture and system type, and build accordingly. You'll most certainly need a copy ofmake
in yourPATH
environment variable, as well asgcc
. If either of these are absent (or not properly located), the build will fail.Compiling netatalk takes around 5 minutes on our SparcStation 10 with 128 MB RAM. Go read SlashDot while you wait. We get a few compiler warnings relative to the redefinition of the 'int32_t' type, but nothing other than that. Again, this is with the egcs 1.1.2 compiler.
Installing Netatalk+Asun
Install PackageInstalling netatalk is as easy as typingmake install
in the distribution directory. Make should do the rest for you. Verify that the/usr/local/atalk
directory has been created and populated (or other customized install location). You should find/bin
,/etc
,/include
,/lib
, and/man
subdirectories.Next, copy the appropriate
rc.atalk.*
script to the appropriate location. Under Solaris 2.6, I use the/etc/init.d
directory, and link to this script from/etc/rc0.d/K79atalk
and/etc/rc2.d/S79atalk
. Your system may be different, depending on architecture and personal preference. I delete everything in this script except references toafpd
. Also, you'll need to adjust the paths used if you used an installation directory other than the default. Mine looks like this (with blank lines removed for sake of brevity):#! /bin/sh # # Start/stop the afpd daemon. # # Adapted from the netatalk rc.atalk.sysv script by ACS. # # kill the named process(es) # killproc() { pid=`/usr/bin/ps -e | /usr/bin/grep $1 | /usr/bin/sed -e 's/^ *//' -e 's/ .*//'` [ "$pid" != "" ] && kill $pid } case "$1" in # # Start the appletalk server processes. # 'start') echo 'starting appletalk daemons: \c' if [ -x /usr/local/atalk/etc/afpd ]; then /usr/local/atalk/etc/afpd; echo ' afpd\c' fi echo '.' ;; # # Stop the appletalk server processes. # 'stop') echo 'stopping appletalk daemons:\c' if [ -x /usr/local/atalk/etc/afpd ]; then killproc afpd; echo ' afpd\c' fi echo '.' ;; # # Usage statement. # *) echo "usage: $0 {start|stop}" exit 1 ;; esac
Configuring Netatalk+Asun
Copy and Edit Configuration FilesCopy from the/config
subdirectory of the distribution to/usr/local/atalk/etc
(or custom directory) the filesAppleVolumes.default
,AppleVolumes.system
, andafpd.conf
. TheAppleVolumes.system
file is where you setup the mapping of file extensions to Creator/Filetype pairs. For example, we change the line.html TEXT MOS!
to read.html TEXT R*ch
, since we like to edit HTML file using BBEdit. Adjust these mappings according to your taste (and that of your users). Theafpd.conf
file is where you setup shared volumes. There are a myriad of options available, all of which are listed in comments in that file. The configuration we use is:"Staging Server" -noguest -tcp -savepassword -setpassword -rand2num -address 152.2.XXX.XXXThe options here set the server name to Staging Server, disallow guest access, allow access only over TCP/IP, allow the user to set a new password and save the password, enable encrypted passwords, and listen to a particular address (this box multihomes several IP addresses). You most definitely should adjust this configuration to reflect your environment and preferences. Each line defines a virtual server, so it is possible to set up servers listening to different addresses, with different options, etc.
Edit TCPWrappers Configuration
In our setup of TCPWrappers, we have a line in/etc/hosts.deny
denying all connections across the board:ALL: ALL: (/usr/bin/echo "CLIENT: %h DAEMON: %d \ DATE: `/usr/bin/date`" | /usr/ucb/mail -s WARNING:hostname someaccount@somewhere.unc.edu)&This line mails notification of an unauthorized connect attempt to the sysadmin. The TCPWrappers manual pages document many options available here. Next, we explicitly specify that access is allowed to particular daemons from particular IP addresses in the
/etc/hosts.allow
file:afpd: 152.2.XXX.XXX 152.2.XXX.XXX localhostHere is where you should insert the IP addresses of your clients. Allowing based on subnets is done via
152.2.XXX.0/255.255.XXX.0
syntax. Ours is152.2.201.0/255.255.255.0
, thus allowing anyone in the 152.2.201 subnet to connect.Create AppleVolumes and .passwd files
We use one user, web, to allow access to the DocumentRoot directories of our webservers. In the home directory of the web user, there are two files,AppleVolumes
, and.passwd
. The format of the AppleVolumes file isFileSystem ExportName
. For example,/export/home/staging staging_WEB_FILESwill cause the
/export/home/staging
to be exported to Mac users as the shared diskstaging_WEB_FILES
. This file should be mode 644, owned by web (or whatever user you're using).
The
.passwd
file is necessary for encrypted passwords. This file should contain only the user's password, cleartext. It should be mode 600, and owned by the user. This does represent a small security hole, in that someone with root access could get this users password. Hopefully, the root account is under enough control that this should not be an issue.
Finally...
Fire that bad boy up! Start afpd using your RC script. Check to see that it is indeed running with aps -ef |grep afpd
or similar. Now, try to make a connection from a Mac. In the Chooser, select AppleShare, and then hit the button that reads 'Server IP Address...'. Type in the IP you specified in the configuration above, and try to make the connection. Note that under the password field, it should say 2-Way Encrypted Password. If you get a message saying 'No response from server. Please try again', you probably need to fix your TCPWrappers configuration. If it says your password is incorrect, you need to check your .passwd file. If everything is setup correctly, you should be able to mount whatever disks you defined inAppleVolumes
.
Where to Get Help
In the best of worlds, everything works right the first time. Right. Well, here are some resources to get help if things go awry:
- Netatalk Mailing List: send mail to netatalk-admins-request@umich.edu< /a> with the word subscribe in the body. This list has been most helpful in solving compilation, installation, and configuration problems, and is the place to learn of new builds (at least of the asun patches).
- TCPWrappers problems?
Original Author: Andrew Snell - asnell@store.unc.edu