Inessential Linux-Athena

The Student Information Processing Board

Emil Sit Salvatore Valente Greg Hudson

March 1, 1996

1 Introduction

Congratulations! You are now reading the Inessential Guide to using the Linux operating system^{1} to access all of your favorite Athena services over the MIT network and the Resnet extention. When your machine is properly configured to support the Athena environment, you will be able to read and write files to your Athena home directory, send and receive e-mail and zephyrs, access olc, olh, SIS, Moira, netnews and many popular lockers (and other services) without having to go to a cluster and without using the dialup machines.

You should read through this entire guide before proceeding with any modifications to your system. If you have any questions concerning any process described in this guide, you should try to have it clarified before doing anything which might render your system inoperable. If you are reading this via the World Wide Web, there may be links to relevant information. You should also subscribe to the linux-announce mailing list by running blanche linux-announce -a $USER. This will allow you to receive any upgrade announcements.

1.1 … But I’m Not Using Linux

If you are running a Unix clone other than Linux, some of the information in this paper will still be useful to you. You will have to figure out exactly which parts those are. If you are running MS-DOS, this paper is completely worthless to you; please drop it in the nearest recycling bin. If you are running a Microsoft Windows variant, please stop.

2 Assumptions

This paper assumes that you have already successfully installed Linux on your computer.^{2} You should be able to log in as root and run simple commands. For example, you should be able to use the passwd command to change the root password on your computer to be something that nobody else knows. You will NOT, of course, tell anyone.^{3}

This also paper assumes that you are familiar with the basic concepts of Unix. For example, you should know what a “dotfile” is, you should know how to change your “path”, and you should have some idea what a “pipe” is. It might also be helpful if you were familiar with standard Unix file permissions and ownership. If you are not familiar with these terms, then it’s a good idea for you to find a book on Unix for beginners.

Before you can use any Athena services, your Linux system must be configured correctly for MITnet. At the most basic level, this requires telling Linux your network parameters. These include your IP address, netmask, network address, broadcast address, and gateway address.^{4} Most Linux distributions come with a program that will ask you for these addresses, and then configure the proper files for you. For example, Slackware Linux comes with a script called “netconfig.”

Do not install Linux-Athena until your system has been configured for MITnet.

2.1 For more information…

There are many useful sources for information about Linux. Among these are:

• O’Reilly and Associates offers a number of useful books related to maintaining and running variants of Unix, and two books specifically on Linux. Some of these books are available at the Coop.

• For general information on configuring a host for use on the net, you should consult the “NET-2-HOWTO” in /mit/linux/docs/HOWTO. They may also be installed on your system in /usr/doc/faq/howto. Basic configuration for MITnet is covered in the SIPB Linux Net Installation (“Getting Started with Linux and Slackware on MITnet”) document. If you need help after reading these files, call or drop by SIPB (W20-557, x3-7788) and we will try to help.

1If you don’t know what Linux is, and you would like to find out, a very good source of documentation is the WWW page http://www.linux.org/.

2SIPB offers a brief paper called “Getting Started with Linux and Slackware on MITnet”. You can pick it up where you got this.

3Even if you are tortured.

4These parameters can be obtained from your RCC (for dormitory or ILG residents). ONLY if you are not in a dorm or ILG, try calling Computing Help Desk at 3-4101.

• The Usenet newsgroups in the comp.os.linux.* hierarchy discuss setting up, configuring and using the Linux operating system. You may want to read the newsgroups for a while to get a feel for what problems other users encounter.^{5}

• Man pages are invaluable in gaining an understanding of how commands work and how to use them properly. You can read man pages by using the man command. A typical usage would be man tar to get help on the usage for “tar”.

3 Preliminary requirements

Software Most of the Athena software can be installed over the network. However, certain basic items must be installed on your local hard drive before these packages can be accessed.^{6} You will first need to configure your nameserver (as mentioned above and discussed below). Once that is set up, you should configure the Andrew File System (AFS), a distributed file system which is used by Athena to store and share files. AFS is used to store basic Athena software (such as “inc” or “zwrite”) as well as all the lockers. Once AFS is configured and working, you will need to install Kerberos. Kerberos is the main security and authentication system which is used at MIT.

Binary Formats It was recently decided to attempt to standardize Linux to use the ELF (Executable and Linking Format) binary format. Linux originally used the older a.out format. Currently, new distributions of Linux will be distributed with ELF binaries, but older ones will still have a.out ones. Unfortunately, the two are not comptabile. If you have a newer installation, chances are, your system will support both formats. Linux-Athena software is available^{7} in both formats. However, some programs will require that you have a.out libraries on your system. For this reason, when you are installing Linux, you should agree to install any “oldlibs” (or similar package) and/or any backwards compatibility software.

Make note of which binary format your system uses. If you have a file on your Linux system which matches the wildcards /lib/libc.so.5.* or /lib/elf/libc.so.5.*, your system will support ELF binaries and you should use them. If you are using an a.out system, you should substitute “a.out” whenever this document mentions a path with “elf” in it.

Getting started Once your machine is configured to use the network, you will need to use ftp to get certain things which need to be installed locally. Login as root and run the following commands (your output will be similar):

   # cd /var/tmp
   # ftp 18.183.0.25

Connected to 18.183.0.25.

220 erebus.MIT.EDU FTP server (Version 4.177 Thu Oct 20 15:46:16 EDT 1994) ready.

   <Login as yourself here>
   ftp> quote atch linux
   ftp> cd /mit/linux/packages
   ftp> binary
   ftp> get Linux-AFS/afs-current-aout.tar.gz afs-current-aout.tar.gz
   ftp> get Linux-AFS/README README
   ftp> get common/mit-named.tgz
   ftp> get common/athena-rc.tgz
   ftp> get elf/attach.tgz

5SIPB has an Inessential NetNews document, if you want more information on reading news.

6Eventually, this same software which you have to install locally will be available on AFS.

7Well… for the most part anyway.

   ftp> quit

There may also be some inconsistencies between the two directories, so you may want to check both. It is likely that the a.out distribution is more out of date than the ELF distribution.

Note: When you do the above ftp, your transactions are not encrypted! This means that your Athena password is transmitted in clear text over the network for anyone to see. This may disturb you.

For reference, when we say “install package package” (or similar) you should use the command:

        tar -C / -zxvpf package.tgz

You will need to specify the path for the file. Once you have AFS installed and running, you can get the Linux-Athena packages from the linux locker in /mit/linux/packages/elf. They are in tarred-and-gzipped format and contain executables only. After you finish this section, you should be able to attach linux to access all of the Linux-Athena files. You can also access the locker by substituting /afs/sipb/project/linux

for /mit/linux.

Almost all files will unpack into the directory /usr/athena. A few files will be put in the directories

/bin/athena and /etc/athena.

3.1 Configuring named

One very important aspect of configuring your machine is to setup a “nameserver”. This is a piece of software which allows programs like telnet, ftp, and attach to work properly.

To get your nameserver working, first install the mit-named package. Then you should edit /etc/rc.d/rc.inet2, find the lines referring to named which are commented out and uncomment them.^{8} The lines should look something like:

# Start the NAMED/BIND name server.
if [ -f ${NET}/named ]; then
  echo -n " named"
  ${NET}/named
fi

Now modify your /etc/inetd.conf to read:

domain MIT.EDU
nameserver 127.0.0.1

You should be able to resolve names now, after you start the nameserver with the command /usr/sbin/named.

3.2 Athena Startup Files

Athena workstations need to execute certain commands upon startup. Install the athena-rc package (in common) to get the script files which run these commands. Then add the following to your /etc/rc.d/rc.local:

if [ -r /etc/athena/rc.athena ]; then
    . /etc/athena/rc.athena
fi

3.3 Configuring AFS

You will need to configure AFS in order to access any the of the Linux-Athena software. To begin, you need to read the README file downloaded above and follow the installation and start-up instructions. (If you don’t know how, try reading the README. Basically, you untar the file like any other package. To start it, you run

sh /etc/rc.d/rc.afs.) Now, install the attach package.

Note that attach will not work until you have configured your nameserver. It will probably also complain until you install Kerberos.

8Lines are commented if they begin with #.

Note: AFS is very dependent on what kernel version you have. Most distributions will give you kernel 1.2.13 which is the only version supported by the latest release.^{9} It will not work with the experimental 1.3.x kernels (yet). At the time of this writing, there is talk of a port to the 2.x kernels, which should be released “soon.”

Run the command uname -r to find out what version of the Linux kernel you’re running. If your kernel version does not match the Linux AFS kernel version, you will have to update your kernel. Building a new kernel is a fun and exciting task that most Linux users find themselves doing much more often than they would like. It is also a task which is a bit too complex to be documented here. However, here are a few tips. You can find the source code of the correct version of the Linux kernel in a tarred-and-gzipped file in the directory /mit/linux/afskern/. You will have to unpack this archive in the /usr/src directory of your system. Once it’s unpacked, you can start building it with the command:

cd /usr/src/linux; make config

When you rebuild your kernel, you must answer yes when asked if you want to “Set version information on all symbols for modules”.

If you need help building the kernel, read the Kernel-HOWTO file, which is in the

/mit/linux/docs/HOWTO directory.

4 Getting Kerberos Tickets

Kerberos tickets are magical little items that tell Athena servers who you are. You will need to install the Linux Kerberos software before you can access any Athena services.

First, you must install the package kerberos.tgz. Second, append the file

/mit/linux/packages/common/services.add to your /etc/services file with the following command:
cat /mit/linux/packages/common/services.add >> /etc/services
   Finally, append the file /mit/linux/packages/common/inetd.conf.add to your /etc/inetd.conf file.

The procedure for this is the same as above (with the correct substitution, of course).

Once you have completed the above steps, you can get tickets. Normally, your tickets will be gotten for you during login (i.e. xlogin). If you ever want to get tickets manually, (or you wish to test your installation) type kinit joeuser, where joeuser is your Athena username. Enter your Athena password when prompted. You can check to see that this was successful by running klist.^{10}

Your tickets will only last for about ten hours and will become useless after this time. If you install the ttylogin package, you can use the renew alias to get new tickets. (This command will work on any Athena workstation.)

If you manually get tickets, you should kdestroy them when you are done.

5 Using Zephyr

To use this popular Athena tool, install the zephyr package. Provided you installed the athena-rc package, your machine will start up the necessary software for Zephyr upon reboot. (In case you are curious, Zephyr depends on a program called zhm to facilitate communications between your machine and the Zephyr servers.)

To begin receiving messages (once you have Kerberos tickets), run the command zwgc. (When you log into a public Athena workstation, both “kinit” and “zwgc” are automatically run. So you may not recognize the command names, but you’ve always been running the commands.) If you are not running X windows, you may need to start zwgc with “zwgc -ttymode”. At this point, the commands “zwrite” and “zctl” work exactly as you’re used to them. To verify this, try to send a zephyrgram to yourself.

9This may be out of date. After you have untared the AFS package, look at the file /usr/vice/etc/dkload/VERSION to see what kernel version is required.

10If you are testing this and you get a “command not found” error, try specifying /usr/athena/bin/kinit. Athena commands like kinit will not be in your path unless you install the ttylogin package.

Note: “zwgc” assumes that you have the attach package installed. If you don’t have the attach package installed, you will have to put the following line in the file /etc/athena/zephyr.vars:

initprogs = /bin/true

6 Sending and Receiving E-mail

6.1 The Mail Transport Agent

A mail transport agent (“MTA”) is a program used for sending e-mail. There are two popular MTA’s for Linux: “smail” and “sendmail”. A default installation of Slackware should include the “sendmail” package. If you do not have sendmail installed, you should install the “sendmail” Linux-Athena package. If you have an MTA installed, you should either: (a) un-install it and install the “sendmail.tgz” package, or (b) customize it for the Athena environment. If you do not know what it means to “customize an MTA for the Athena environment”, you should simply use option (a).

6.2 Using MH

The standard MH commands are located in the mhmail package. You will also need to install the mhlib package. No special configuration of this package is needed, though you will need to have a happily configured MTA.

6.3 Other E-mail Interfaces

Once you have installed or configured “sendmail”, any program that can send mail should work properly. In order to read mail from your Athena mail server (i.e. you don’t use chpobox to redirect your mail to your Linux machine), the mail interface must support the “KPOP”^{11} protocol. Most mail-reading programs don’t support this by default. Therefore, you should use the MH package provided by Linux-Athena. Of course, if you use Emacs Rmail, xmh, or exmh, those will still work fine.^{12}

7 Getting an Athena Login Prompt

The most important part of all this work you are doing is, of course, the part which will allow you to login and actually use Athena.

7.1 User access control

User information for unix machines is stored in a file called /etc/passwd. By default, your system will allow any valid Athena user to login when physically at your machine, but only users in this file to login remotely (i.e. telnet or rlogin). In order to allow users the ability to login remotely, you need to put them in the

passwd file.

To do this, you need to have the misc package installed. When that is installed, become root and run

        /bin/athena/hesinfo user passwd >> /etc/passwd.

This will append the appropriate user information to the file.

If you wish to restrict access of users of the machine to just those in the password database, edit

the file /etc/athena/rc.conf and change the line NOCREATE=false to NOCREATE=true. Then run touch

/etc/nocreate. This will only allow users in /etc/passwd to access the machine.

If you like, you can store your files on your local hard drive instead of on Athena. The advantage of this is that you do not have to rely on AFS servers working or be limited by your Athena quota. On the other hand, you will have to copy all of your files from your locker to your hard drive. You will then have to telnet to your machine anytime you want to access those files. In general, it is probably easier to just use your Athena home directory.

11Kerberized Post Office Protocol. Don’t worry about it.

12This is because they are frontends to the (Linux-Athena) MH programs.

7.2 Terminal based logins

To enable dialup like behavior via your console, you should install the ttylogin package. Then as root, run the following commands:

cd /bin
mv login login.orig
ln -s athena/login ./login

Athena logins should now work as expected.

7.3 X based logins

To get the standard Athena Login window, you need to install the xlogin package. You must have X windows already properly working on your system, which is something we will leave to the XFree86-HOWTO to teach you how to do. (It can be sometimes tricky; getting X working is the hard part.)

To get a login prompt once, shut down the X server if you’re running it, become root in a virtual console, and run the following command:

/etc/athena/dm /etc/athena/login/config ttyp0 console

You should run this at least once manually to make sure it works. In order to have the login prompt come up automatically when your system boots and when users log out, you will need to modify the /etc/inittab file. You should be careful when modifying this file, since it can make it difficult to boot your system. You will be adding a line that looks something like the following:

x2:5:respawn:/etc/athena/dm /etc/athena/login/config ttyp0 console

The first field, “x2”, should be different from the first field of every other line in the file, and the number in the second field, “5”, should agree with your default runlevel. There should be a line in your inittab file beginning with “id” which will show you the default runlevel; for example:

# Default runlevel.
id:5:initdefault:

For more information about init and /etc/inittab, read the init(8), telinit(8) and inittab(5) man pages.

Note: You may observe that init complains about dm respawning too quickly, sleeping for five minutes and then working again. The solution to this problem is to change your inittab to run a shell script which runs:

sleep 5; /etc/athena/dm /etc/athena/login/config ttyp0 console

The problem is that after you logout and X exits, init tries to restart X before your system is ready to run it again. When you log out, X exits and dm exits. init then restarts dm which attempts to restart X before the terminal driver is ready to run X. The sleep causes it to wait a little while.

8 Security

By now, you probably have a Linux machine which is on MITnet (and hence the Internet). One thing every person running a Unix machine on some network should note is that Unix and the network are probably both insecure. In general, Unix machines that are newly bought or newly set up are notoriously insecure. They are probably vulnerable to any number of attacks.

If you are interested in securing your system (you should be!), you should at the very least do the following to secure your system:

1. Edit /etc/inetd.conf and add a ’#’ sign at the front of lines which begin: smtp, nntp, shell,

     login, exec, pop, uucp, systat, netstat, netbios. These are services which may potentially

compromise your system.

2. Change the class lines of /etc/ftpaccess to look like:

     class   local   real *.domain 0.0.0.0
     class   remote  real *

This prevents anonymous users from ftp’ing to your machine.

3. Create/modify /etc/ftpusers to have the following names (each on separate lines): root, uucp,

     news, bin, daemon, operator, mail, postmaster. This prevents certain users from being able

login via ftp on your machine.

4. If you are not planning on exporting directories under NFS,^{13} you should edit your /etc/rc.d/rc.inet2 file and put # before the following lines:

     if [ -f ${NET}/rpc.portmap ]; then
        echo -n " portmap"
        ${NET}/rpc.portmap
     fi
     # Start the various SUN RPC servers.
     ...
     fi  # Done starting various SUN RPC servers.
  5. Sign up to the netusers mailing list: blanche netusers-a $USER.

Don’t think that this makes your system secure. There are other known holes — to list all of them would take too much space. Just remember that it is important to keep your system secure; if unauthorized users gain access to your machine, they may be able to damage your data and the data of other users of your system (including data stored on Athena accounts). You should also follow the linux-security discuss meeting to keep abreast of security issues and problems. You can read this using through the Discuss program. It is meeting number 628; read the “Inessential Discuss” SIPB document to learn how to use Discuss.

One other very important issue is configuring your machine to support secure telnets. As it is currently set up, your machine will accept incoming telnets; however, they will not be encrypted! This means that if you login and type your password, you will be transmitting your password in clear text over the network! This means that anyone who is on the physical network(s) that your password is transmitted through will be able to obtain your password, if they are sufficiently motivated and knowledgable.^{14}

In order to support secure incoming telnets, you need what is called a srvtab. This file contains a secret key which allows your machine to authenticate incoming users to Kerberos and then encrypt the connection. In order to get this file, send mail to net-help asking for one. They should get back to you in under a week. When you get mail, it will tell you how to retrieve the file. You should install it in /etc/athena/srvtab and execute

13For example, if you don’t know what this means.

14Look at http://web.mit.edu/telnet/www/scenarios.html for more information.

chown root.root /etc/athena/srvtab
chmod 400 /etc/athena/srvtab
/usr/athena/etc/ksrvutil change

If you require more assistance, send additional mail to net-help.

9 Everything Else

There are several more packages in /mit/linux/packages. The contents of these are fairly self-explanatory. Here is a list:

• The dash package contains the standard Athena Dashboard, which by default is a blue menubar across the top of your screen. If you do not install this, you may get an error message in your Console when you login (which you may safely ignore).

• The delete package contains the delete command (and its related utilities) which give you some degree of unerase ability. Note that files that you delete on your local hard drive will not be automatically expunged.

• The discuss package contains the Discuss, which is where many Athena mailing lists are archived. It is kind of like Usenet but worse.

• The lpr package allows you to print to Athena printers. You will have to specify the printer on the command line though.

• The ktelnet package is necessary for getting secure (i.e. encrypted) logins to your machine from other Athena hosts. It also contains an Athena-ized telnet binary which allow your outgoing telnets to also be secure.

• The lib package contains various libraries which will be useful to you if you are developing programs for the Athena environment.

• The moira package installs mailmaint and blanche, among other things. You should install this package if you wish to use moira or its related programs.

• The mwm package contains files necessary to run the default mwm window manager. If you are using a non-default window manager, it may or may not work with xlogin. You must install this package for default X-windows logins to work properly.

• The neos package is used to turn in homeworks, for those classes which use it.

• The olc package allows you to use the OLC service to access helpful online consultants.

• The reactivate package contains programs which are necessary for public Athena workstations. It basically cleans up a workstation after someone has used it. You will probably not want nor need this package. Your xlogin program may complain of being unable to run reactivate which can safely be ignored.

The only problem you should run into when using these programs is that many of them have configuration files stored in your home directory. For example, discuss creates a dotfile called “.meetings” in your home directory, and updates it after each time you read discuss. If you keep your files in a local home directory (i.e. one stored on your local hard drive; you may wish to do this if you find your ten megabyte quota restricting), these files will not be in sync with the ones in your Athena home directory. Keeping these in sync can be annoying. One technique is to symbolically link the files from your local home directory to your Athena home directory.

10 Feedback

You will encounter some problems. The programs we are providing may have bugs, the packages may be incomplete, and this documentation may suck. Please tell us what problems you encounter in the process of Athena-izing your Linux box so we may improve the process. The address to send your comments to is the mailing list linux-dev@mit.edu. If you have questions, send them to linux-help@mit.edu.

This document is $Revision: 1.5 $. Last modified $Date: 1996/03/03 03:34:52 $