% % Inessential Linux-Athena. A SIPB Document % $Id: linux-athena.tex,v 1.6 1996/03/18 02:34:51 sit Exp $ % \documentstyle[fullpage]{report} \title{ \begin{center} \vspace{1.5in} \hspace*{1mm}\special{psfile=funky-owl.PS hoffset=-100}\hspace*{1mm} \vspace{2cm} \end{center} Inessential Linux-Athena} \author{The Student Information Processing Board \\Emil Sit \\Salvatore Valente \\Greg Hudson} \date{March 1, 1996} \def\thesection {\arabic{section}} \def\thesubsection {\thesection.\arabic{subsection}} \def\thesubsubsection {\thesubsection .\arabic{subsubsection}} % We could define some logical style to get out of \tt all the time. \begin{document} \maketitle %\sloppypar \section{Introduction} Congratulations! You are now reading the Inessential Guide to using the Linux operating system% \footnote{If you don't know what Linux is, and you would like to find out, a very good source of documentation is the WWW page {\tt http://www.linux.org/}.} to access all of your favorite Athena services over the MIT network and the Resnet extention. When your machine is properly configured to support the Athena environment, you will be able to read and write files to your Athena home directory, send and receive e-mail and zephyrs, access olc, olh, SIS, Moira, netnews and many popular lockers (and other services) without having to go to a cluster and {\em without\/} using the dialup machines. You should read through this entire guide before proceeding with any modifications to your system. If you have any questions concerning any process described in this guide, you should try to have it clarified before doing anything which might render your system inoperable. If you are reading this via the World Wide Web, there may be links to relevant information. You should also subscribe to the {\tt linux-announce} mailing list by running {\tt blanche linux-announce -a \$USER}. This will allow you to receive any upgrade announcements. \subsection{\dots But I'm Not Using Linux} If you are running a Unix clone other than Linux, some of the information in this paper will still be useful to you. You will have to figure out exactly which parts those are. If you are running MS-DOS, this paper is completely worthless to you; please drop it in the nearest recycling bin. If you are running a Microsoft Windows variant, please stop. \section{Assumptions} This paper assumes that you have already successfully installed Linux on your computer.% \footnote{SIPB offers a brief paper called ``Getting Started with Linux and Slackware on MITnet''. You can pick it up where you got this.} You should be able to log in as root and run simple commands. For example, you should be able to use the {\tt passwd} command to change the root password on your computer to be something that nobody else knows. You will {\bf NOT}, of course, tell {\bf anyone}.\footnote{Even if you are tortured.} This also paper assumes that you are familiar with the basic concepts of Unix. For example, you should know what a ``dotfile'' is, you should know how to change your ``path'', and you should have some idea what a ``pipe'' is. It might also be helpful if you were familiar with standard Unix file permissions and ownership. If you are not familiar with these terms, then it's a good idea for you to find a book on Unix for beginners. Before you can use any Athena services, your Linux system must be configured correctly for MITnet. At the most basic level, this requires telling Linux your network parameters. These include your IP address, netmask, network address, broadcast address, and gateway address.\footnote{These parameters can be obtained from your RCC (for dormitory or ILG residents). {\bf ONLY} if you are not in a dorm or ILG, try calling Computing Help Desk at 3-4101.} Most Linux distributions come with a program that will ask you for these addresses, and then configure the proper files for you. For example, Slackware Linux comes with a script called ``netconfig.'' Do not install Linux-Athena until your system has been configured for MITnet. \subsection{For more information\dots} There are many useful sources for information about Linux. Among these are: \begin{itemize} \item O'Reilly and Associates offers a number of useful books related to maintaining and running variants of Unix, and two books specifically on Linux. Some of these books are available at the Coop. \item For general information on configuring a host for use on the net, you should consult the ``{\tt NET-2-HOWTO}'' in {\tt /mit/linux/docs/HOWTO}. They may also be installed on your system in \break{\tt /usr/doc/faq/howto}. Basic configuration for MITnet is covered in the SIPB Linux Net Installation (``Getting Started with Linux and Slackware on MITnet'') document. If you need help after reading these files, call or drop by SIPB (W20-557, x3-7788) and we will try to help. \item The Usenet newsgroups in the {\tt comp.os.linux.*} hierarchy discuss setting up, configuring and using the Linux operating system. You may want to read the newsgroups for a while to get a feel for what problems other users encounter.\footnote{SIPB has an Inessential NetNews document, if you want more information on reading news.} \item Man pages are invaluable in gaining an understanding of how commands work and how to use them properly. You can read man pages by using the {\tt man} command. A typical usage would be {\tt man tar} to get help on the usage for ``{\tt tar}''. \end{itemize} \section{Preliminary requirements} \paragraph{Software} Most of the Athena software can be installed over the network. However, certain basic items must be installed on your local hard drive before these packages can be accessed.\footnote{Eventually, this same software which you have to install locally will be available on AFS.} You will first need to configure your nameserver (as mentioned above and discussed below). Once that is set up, you should configure the Andrew File System (AFS), a distributed file system which is used by Athena to store and share files. AFS is used to store basic Athena software (such as ``inc'' or ``zwrite'') as well as all the lockers. Once AFS is configured and working, you will need to install Kerberos. Kerberos is the main security and authentication system which is used at MIT. \paragraph{Binary Formats} It was recently decided to attempt to standardize Linux to use the ELF (Executable and Linking Format) binary format. Linux originally used the older a.out format. Currently, new distributions of Linux will be distributed with ELF binaries, but older ones will still have a.out ones. Unfortunately, the two are not comptabile. If you have a newer installation, chances are, your system will support both formats. Linux-Athena software is available\footnote{Well\dots for the most part anyway.} in both formats. However, some programs will require that you have a.out libraries on your system. For this reason, when you are installing Linux, you should agree to install any ``oldlibs'' (or similar package) and/or any backwards compatibility software. Make note of which binary format your system uses. If you have a file on your Linux system which matches the wildcards {\tt /lib/libc.so.5.*} or {\tt /lib/elf/libc.so.5.*}, your system will support ELF binaries and you should use them. If you are using an a.out system, you should substitute ``{\tt a.out}'' whenever this document mentions a path with ``{\tt elf}'' in it. \paragraph{Getting started} Once your machine is configured to use the network, you will need to use ftp to get certain things which need to be installed locally. Login as root and run the following commands (your output will be similar): {\em\obeylines \# {\tt cd /var/tmp} \# {\tt ftp 18.183.0.25} Connected to 18.183.0.25. 220 erebus.MIT.EDU FTP server (Version 4.177 Thu Oct 20 15:46:16 EDT 1994) ready. {\tt } %Name (18.183.0.25:sit): {\tt } %331 Password required for sit. %Password: {\tt } %230 User sit logged in with Kerberos tickets. ftp$>$ {\tt quote atch linux} ftp$>$ {\tt cd /mit/linux/packages} %250 CWD command successful. ftp$>$ {\tt binary} %200 Type set to I. ftp$>$ {\tt get Linux-AFS/afs-current-aout.tar.gz afs-current-aout.tar.gz} ftp$>$ {\tt get Linux-AFS/README README} ftp$>$ {\tt get common/mit-named.tgz} ftp$>$ {\tt get common/athena-rc.tgz} ftp$>$ {\tt get elf/attach.tgz} ftp$>$ {\tt quit} } % End tt There may also be some inconsistencies between the two directories, so you may want to check both. It is likely that the a.out distribution is more out of date than the ELF distribution. \paragraph{Note:} When you do the above {\tt ftp}, your transactions are {\bf not} encrypted! This means that your Athena password is transmitted in clear text over the network for anyone to see. This may disturb you. \medskip For reference, when we say ``install package {\it package}'' (or similar) you should use the command: \begin{quotation} {\tt tar -C / -zxvpf} {\it package.tgz} \end{quotation} You will need to specify the path for the file. Once you have AFS installed and running, you can get the Linux-Athena packages from the linux locker in {\tt /mit/linux/packages/elf}. They are in tarred-and-gzipped format and contain executables only. After you finish this section, you should be able to {\tt attach linux} to access all of the Linux-Athena files. You can also access the locker by substituting {\tt /afs/sipb/project/linux} for {\tt /mit/linux}. Almost all files will unpack into the directory {\tt /usr/athena}. A few files will be put in the directories {\tt /bin/athena} and {\tt /etc/athena}. \subsection{Configuring named} One very important aspect of configuring your machine is to setup a ``nameserver''. This is a piece of software which allows programs like {\tt telnet}, {\tt ftp}, and {\tt attach} to work properly. To get your nameserver working, first install the {\tt mit-named} package. Then you should edit\break{\tt /etc/rc.d/rc.inet2}, find the lines referring to named which are commented out and uncomment them.\footnote{Lines are commented if they begin with {\tt \#}.} The lines should look something like: \begin{verbatim} # Start the NAMED/BIND name server. if [ -f ${NET}/named ]; then echo -n " named" ${NET}/named fi \end{verbatim} Now modify your {\tt /etc/inetd.conf} to read: \begin{verbatim} domain MIT.EDU nameserver 127.0.0.1 \end{verbatim} You should be able to resolve names now, after you start the nameserver with the command {\tt /usr/sbin/named}. \subsection{Athena Startup Files} Athena workstations need to execute certain commands upon startup. Install the {\tt athena-rc} package (in {\tt common}) to get the script files which run these commands. Then add the following to your {\tt /etc/rc.d/rc.local}: \begin{verbatim} if [ -r /etc/athena/rc.athena ]; then . /etc/athena/rc.athena fi \end{verbatim} \subsection{Configuring AFS} You will need to configure AFS in order to access any the of the Linux-Athena software. To begin, you need to read the {\tt README} file downloaded above and follow the installation and start-up instructions. (If you don't know how, try reading the {\tt README}. Basically, you un{\tt tar} the file like any other package. To start it, you run {\tt sh /etc/rc.d/rc.afs}.) Now, install the {\tt attach} package. Note that {\tt attach} will not work until you have configured your nameserver. It will probably also complain until you install Kerberos. \paragraph{Note:} AFS is very dependent on what kernel version you have. Most distributions will give you kernel $1.2.13$ which is the only version supported by the latest release.\footnote{This may be out of date. After you have un{\tt tar}ed the AFS package, look at the file {\tt /usr/vice/etc/dkload/VERSION} to see what kernel version is required.} It will not work with the experimental $1.3.x$ kernels (yet). At the time of this writing, there is talk of a port to the $2.x$ kernels, which should be released ``soon.'' Run the command {\tt uname\ -r} to find out what version of the Linux kernel you're running. If your kernel version does not match the Linux AFS kernel version, you will have to update your kernel. Building a new kernel is a fun and exciting task that most Linux users find themselves doing much more often than they would like. It is also a task which is a bit too complex to be documented here. However, here are a few tips. You can find the source code of the correct version of the Linux kernel in a tarred-and-gzipped file in the directory {\tt /mit/linux/afskern/}. You will have to unpack this archive in the {\tt /usr/src} directory of your system. Once it's unpacked, you can start building it with the command: \begin{verbatim} cd /usr/src/linux; make config \end{verbatim} When you rebuild your kernel, you must answer yes when asked if you want to ``Set version information on all symbols for modules''. If you need help building the kernel, read the Kernel-HOWTO file, which is in the\break{\tt /mit/linux/docs/HOWTO} directory. \section{Getting Kerberos Tickets} Kerberos tickets are magical little items that tell Athena servers who you are. You will need to install the Linux Kerberos software before you can access any Athena services. First, you must install the package {\tt kerberos.tgz}. Second, append the file\break {\tt /mit/linux/packages/common/services.add} to your {\tt /etc/services} file with the following command: \begin{verbatim} cat /mit/linux/packages/common/services.add >> /etc/services \end{verbatim} Finally, append the file {\tt /mit/linux/packages/common/inetd.conf.add} to your {\tt /etc/inetd.conf} file. The procedure for this is the same as above (with the correct substitution, of course). Once you have completed the above steps, you can get tickets. Normally, your tickets will be gotten for you during login (i.e. xlogin). If you ever want to get tickets manually, (or you wish to test your installation) type {\tt kinit joeuser}, where {\tt joeuser} is your Athena username. Enter your Athena password when prompted. You can check to see that this was successful by running {\tt klist}.\footnote{If you are testing this and you get a ``command not found'' error, try specifying {\tt /usr/athena/bin/kinit}. Athena commands like {\tt kinit} will not be in your path unless you install the {\tt ttylogin} package.} Your tickets will only last for about ten hours and will become useless after this time. If you install the {\tt ttylogin} package, you can use the {\tt renew} alias to get new tickets. (This command will work on any Athena workstation.) If you manually get tickets, you should {\tt kdestroy} them when you are done. \section{Using Zephyr} To use this popular Athena tool, install the {\tt zephyr} package. Provided you installed the {\tt athena-rc} package, your machine will start up the necessary software for Zephyr upon reboot. (In case you are curious, Zephyr depends on a program called {\tt zhm} to facilitate communications between your machine and the Zephyr servers.) %The trick to running Zephyr is that there is a magical program always %running on all Athena workstations called ``zhm.'' To run this on %your home computer, just type ``{\tt /etc/athena/zhm}'' as root. That makes %your computer Zephyr-ready. You have to run this program once after %each time you reboot your system. To begin receiving messages (once you have Kerberos tickets), run the command {\tt zwgc}. (When you log into a public Athena workstation, both ``{\tt kinit}'' and ``{\tt zwgc}'' are automatically run. So you may not recognize the command names, but you've always been running the commands.) If you are not running X windows, you may need to start zwgc with ``{\tt zwgc -ttymode}''. At this point, the commands ``{\tt zwrite}'' and ``{\tt zctl}'' work exactly as you're used to them. To verify this, try to send a zephyrgram to yourself. Note: ``{\tt zwgc}'' assumes that you have the {\tt attach} package installed. If you don't have the attach package installed, you will have to put the following line in the file {\tt /etc/athena/zephyr.vars}: \begin{verbatim} initprogs = /bin/true \end{verbatim} \section{Sending and Receiving E-mail} \subsection{The Mail Transport Agent} A mail transport agent (``MTA'') is a pro used for sending e-mail. There are two popular MTA's for Linux: ``smail'' and ``sendmail''. A default installation of Slackware should include the ``{\tt sendmail}'' package. If you do not have sendmail installed, you should install the ``sendmail'' Linux-Athena package. If you have an MTA installed, you should either: (a) un-install it and install the ``sendmail'' package, or (b) customize it for the Athena environment. If you do not know what it means to ``customize an MTA for the Athena environment'', you should simply use option (a). \subsection{Using MH} The standard MH commands are located in the {\tt mhmail} package. You will also need to install the {\tt mhlib} package. No special configuration of this package is needed, though you will need to have a happily configured MTA. \subsection{Other E-mail Interfaces} Once you have installed or configured ``sendmail'', any program that can send mail should work properly. In order to read mail from your Athena mail server (i.e. you don't use {\tt chpobox} to redirect your mail to your Linux machine), the mail interface must support the ``KPOP''\footnote{Kerberized Post Office Protocol. Don't worry about it.} protocol. Most mail-reading programs don't support this by default. Therefore, you should use the MH package provided by Linux-Athena. Of course, if you use Emacs Rmail, xmh, or exmh, those will still work fine.\footnote{This is because they are frontends to the (Linux-Athena) MH programs.} \section{Getting an Athena Login Prompt} The most important part of all this work you are doing is, of course, the part which will allow you to login and actually use Athena. \subsection{User access control} User information for unix machines is stored in a file called {\tt /etc/passwd}. By default, your system will allow any valid Athena user to login when physically at your machine, but only users in this file to login remotely (i.e. telnet or rlogin). In order to allow users the ability to login remotely, you need to put them in the {\tt passwd} file. To do this, you need to have the {\tt misc} package installed. When that is installed, become root and run \begin{quotation} {\tt /bin/athena/hesinfo} {\it user} {\tt passwd >> /etc/passwd}. \end{quotation} This will append the appropriate user information to the file. If you wish to restrict access of users of the machine to just those in the password database, edit the file {\tt /etc/athena/rc.conf} and change the line {\tt NOCREATE=false} to {\tt NOCREATE=true}. Then run {\tt touch /etc/nocreate}. This will only allow users in {\tt /etc/passwd} to access the machine. \medskip If you like, you can store your files on your local hard drive instead of on Athena. The advantage of this is that you do not have to rely on AFS servers working or be limited by your Athena quota. On the other hand, you will have to copy all of your files from your locker to your hard drive. You will then have to telnet to your machine anytime you want to access those files. In general, it is probably easier to just use your Athena home directory. %You can copy your files to a local drive using %tar -cf - /mit/joeuser | tar -C /home -xf - \subsection{Terminal based logins} To enable dialup like behavior via your console, you should install the {\tt ttylogin} package. Then as root, run the following commands: \begin{verbatim} cd /bin mv login login.orig ln -s athena/login ./login \end{verbatim} Athena logins should now work as expected. \subsection{X based logins} To get the standard Athena Login window, you need to install the {\tt xlogin} package. You must have X windows already properly working on your system, which is something we will leave to the XFree86-HOWTO to teach you how to do. (It can be sometimes tricky; getting X working is the hard part.) To get a login prompt once, shut down the X server if you're running it, become root in a virtual console, and run the following command: \begin{verbatim} /etc/athena/dm /etc/athena/login/config ttyp0 console \end{verbatim} You should run this at least once manually to make sure it works. In order to have the login prompt come up automatically when your system boots and when users log out, you will need to modify the {\tt /etc/inittab} file. You should be careful when modifying this file, since it can make it difficult to boot your system. You will be adding a line that looks something like the following: \begin{verbatim} x2:5:respawn:/etc/athena/dm /etc/athena/login/config ttyp0 console \end{verbatim} The first field, ``x2'', should be different from the first field of every other line in the file, and the number in the second field, ``5'', should agree with your default runlevel. There should be a line in your inittab file beginning with ``id'' which will show you the default runlevel; for example: \begin{verbatim} # Default runlevel. id:5:initdefault: \end{verbatim} For more information about {\tt init} and {\tt /etc/inittab}, read the init(8), telinit(8) and inittab(5) man pages. \paragraph{Note:} You may observe that {\tt init} complains about dm respawning too quickly, sleeping for five minutes and then working again. The solution to this problem is to change your {\tt inittab} to run a shell script which runs: \begin{verbatim} sleep 5; /etc/athena/dm /etc/athena/login/config ttyp0 console \end{verbatim} The problem is that after you logout and X exits, init tries to restart X before your system is ready to run it again. When you log out, X exits and dm exits. init then restarts dm which attempts to restart X before the terminal driver is ready to run X. The {\tt sleep} causes it to wait a little while. \section{Security} By now, you probably have a Linux machine which is on MITnet (and hence the Internet). One thing every person running a Unix machine on some network should note is that Unix and the network are probably both insecure. In general, Unix machines that are newly bought or newly set up are notoriously insecure. They are probably vulnerable to any number of attacks. If you are interested in securing your system (you should be!), you should at the very least do the following to secure your system: \begin{enumerate} \item Edit {\tt /etc/inetd.conf} and add a '{\tt \#}' sign at the front of lines which begin: {\tt smtp, nntp, shell, login, exec, pop, uucp, systat, netstat, netbios.} These are services which may potentially compromise your system. \item Change the {\tt class} lines of {\tt /etc/ftpaccess} to look like:\begin{verbatim} class local real *.domain 0.0.0.0 class remote real * \end{verbatim} This prevents anonymous users from {\tt ftp}'ing to your machine. \item Create/modify {\tt /etc/ftpusers} to have the following names (each on separate lines): {\tt root, uucp, news, bin, daemon, operator, mail, postmaster}. This prevents certain users from being able login via ftp on your machine. \item If you are not planning on exporting directories under NFS,\footnote{For example, if you don't know what this means.} you should edit your {\tt /etc/rc.d/rc.inet2} file and put {\tt \#} before the following lines: \begin{verbatim} if [ -f ${NET}/rpc.portmap ]; then echo -n " portmap" ${NET}/rpc.portmap fi \end{verbatim} \begin{verbatim} # Start the various SUN RPC servers. ... fi # Done starting various SUN RPC servers. \end{verbatim} \item Sign up to the {\tt netusers} mailing list: {\tt blanche netusers-a \$USER}. \end{enumerate} Don't think that this makes your system secure. There are other known holes --- to list all of them would take too much space. Just remember that it is important to keep your system secure; if unauthorized users gain access to your machine, they may be able to damage your data and the data of other users of your system (including data stored on Athena accounts). You should also follow the linux-security discuss meeting to keep abreast of security issues and problems. You can read this using through the Discuss program. It is meeting number 628; read the ``Inessential Discuss'' SIPB document to learn how to use Discuss. One other very important issue is configuring your machine to support secure telnets. As it is currently set up, your machine will accept incoming telnets; however, they will {\bf not} be encrypted! This means that if you login and type your password, you will be transmitting your password {\bf in clear text} over the network! This means that anyone who is on the physical network(s) that your password is transmitted through will be able to obtain your password, if they are sufficiently motivated and knowledgable.\footnote{Look at {\tt http://web.mit.edu/telnet/www/scenarios.html} for more information.} In order to support secure incoming telnets, you need what is called a {\tt srvtab}. This file contains a secret key which allows your machine to authenticate incoming users to Kerberos and then encrypt the connection. In order to get this file, send mail to {\tt net-help} asking for one. They should get back to you in under a week. When you get mail, it will tell you how to retrieve the file. You should install it in {\tt /etc/athena/srvtab} and execute \begin{verbatim} chown root.root /etc/athena/srvtab chmod 400 /etc/athena/srvtab /usr/athena/etc/ksrvutil change \end{verbatim} If you require more assistance, send additional mail to {\tt net-help}. \section{Everything Else} There are several more packages in {\tt /mit/linux/packages}. The contents of these are fairly self-explanatory. Here is a list: \begin{itemize} \item The {\tt dash} package contains the standard Athena Dashboard, which by default is a blue menubar across the top of your screen. If you do not install this, you may get an error message in your Console when you login (which you may safely ignore). \item The {\tt delete} package contains the delete command (and its related utilities) which give you some degree of unerase ability. Note that files that you {\tt delete} on your local hard drive will not be automatically expunged. \item The {\tt discuss} package contains the Discuss, which is where many Athena mailing lists are archived. It is kind of like Usenet but worse. % Jered said it, not me. \item The {\tt lpr} package allows you to print to Athena printers. You will have to specify the printer on the command line though. \item The {\tt ktelnet} package is necessary for getting secure (i.e. encrypted) logins to your machine from other Athena hosts. It also contains an Athena-ized telnet binary which allow your outgoing telnets to also be secure. \item The {\tt lib} package contains various libraries which will be useful to you if you are developing programs for the Athena environment. \item The {\tt moira} package installs {\tt mailmaint} and {\tt blanche}, among other things. You should install this package if you wish to use {\tt moira} or its related programs. \item The {\tt mwm} package contains files necessary to run the default {\tt mwm} window manager. If you are using a non-default window manager, it may or may not work with {\tt xlogin}. You must install this package for default X-windows logins to work properly. \item The {\tt neos} package is used to turn in homeworks, for those classes which use it. \item The {\tt olc} package allows you to use the OLC service to access helpful online consultants. \item The {\tt reactivate} package contains programs which are necessary for public Athena workstations. It basically cleans up a workstation after someone has used it. You will probably not want nor need this package. Your {\tt xlogin} program may complain of being unable to run {\tt reactivate} which can safely be ignored. \end{itemize} The only problem you should run into when using these programs is that many of them have configuration files stored in your home directory. For example, discuss creates a dotfile called ``{\tt .meetings}'' in your home directory, and updates it after each time you read discuss. If you keep your files in a local home directory (i.e. one stored on your local hard drive; you may wish to do this if you find your ten megabyte quota restricting), these files will not be in sync with the ones in your Athena home directory. Keepiing these in sync can be annoying. One technique is to symbolically link the files from your local home directory to your Athena home directory. \section{Feedback} You will encounter some problems. The programs we are providing may have bugs, the packages may be incomplete, and this documentation may suck. Please tell us what problems you encounter in the process of Athena-izing your Linux box so we may improve the process. The address to send your comments to is the mailing list {\tt linux-dev@mit.edu}. If you have questions, send them to {\tt linux-help@mit.edu}. \vfill {\noindent\it This document is \verb!$Revision: 1.6 $!. Last modified \verb!$Date: 1996/03/18 02:34:51 $!} \end{document}