1 .\" Copyright (c) 1980, 1986, 1988, 1993 The Regents of the University of California.
2 .\" All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" @(#)5.t 8.1 (Berkeley) 7/27/93
32 .ds LH "Installing/Operating \*(4B
37 \*(4B provides support for the standard Internet
38 protocols IP, ICMP, TCP, and UDP. These protocols may be used
39 on top of a variety of hardware devices ranging from
40 serial lines to local area network controllers
41 for the Ethernet. Network services are split between the
42 kernel (communication protocols) and user programs (user
43 services such as TELNET and FTP). This section describes
44 how to configure your system to use the Internet networking support.
45 \*(4B also supports the Xerox Network Systems (NS) protocols.
46 IDP and SPP are implemented in the kernel,
47 and other protocols such as Courier run at the user level.
48 \*(4B provides some support for the ISO OSI protocols CLNP
49 TP4, and ESIS. User level process
50 complete the application protocols such as X.400 and X.500.
51 .Sh 2 "System configuration"
53 To configure the kernel to include the Internet communication
54 protocols, define the INET option.
55 Xerox NS support is enabled with the NS option.
56 ISO OSI support is enabled with the ISO option.
57 In either case, include the pseudo-devices
58 ``pty'', and ``loop'' in your machine's configuration
60 The ``pty'' pseudo-device forces the pseudo terminal device driver
61 to be configured into the system, see
63 while the ``loop'' pseudo-device forces inclusion of the software loopback
65 The loop driver is used in network testing
66 and also by the error logging system.
68 If you are planning to use the Internet network facilities on a 10Mb/s
69 Ethernet, the pseudo-device ``ether'' should also be included
70 in the configuration; this forces inclusion of the Address Resolution
71 Protocol module used in mapping between 48-bit Ethernet
72 and 32-bit Internet addresses.
74 Before configuring the appropriate networking hardware, you should
75 consult the manual pages in section 4 of the Programmer's Manual
76 selecting the appropriate interfaces for your architecture.
78 All network interface drivers including the loopback interface,
79 require that their host address(es) be defined at boot time.
82 commands included in the
85 Interfaces that are able to dynamically deduce the host
86 part of an address may check that the host part of the address is correct.
87 The manual page for each network interface
88 describes the method used to establish a host's address.
90 can also be used to set options for the interface at boot time.
91 Options are set independently for each interface, and
92 apply to all packets sent using that interface.
93 Alternatively, translations for such hosts may be set in advance
94 or ``published'' by a \*(4B host by use of the
97 Note that the use of trailer link-level is now negotiated between \*(4B hosts
99 and it is thus no longer necessary to disable the use of trailers
103 The OSI equivalent to ARP is ESIS (End System to Intermediate System Routing
104 Protocol); running this protocol is mandatory, however one can manually add
105 translations for machines that do not participate by use of the
108 Additional information is provided in the manual page describing
111 To use the pseudo terminals just configured, device
112 entries must be created in the
114 directory. To create 32
115 pseudo terminals (plenty, unless you have a heavy network load)
116 execute the following commands.
118 \fB#\fP \fIcd /dev\fP
119 \fB#\fP \fIMAKEDEV pty0 pty1\fP
121 More pseudo terminals may be made by specifying
124 etc. The kernel normally includes support for 32 pseudo terminals
125 unless the configuration file specifies a different number.
126 Each pseudo terminal really consists of two files in
128 a master and a slave. The master pseudo terminal file is named
130 while the slave side is
132 Pseudo terminals are also used by several programs not related to the network.
133 In addition to creating the pseudo terminals,
134 be sure to install them in the
136 file (with a `none' in the second column so no
139 .Sh 2 "Local subnets"
141 In \*(4B the Internet support
142 includes the notion of ``subnets''. This is a mechanism
143 by which multiple local networks may appears as a single Internet
144 network to off-site hosts. Subnetworks are useful because
145 they allow a site to hide their local topology, requiring only a single
146 route in external gateways;
147 it also means that local network numbers may be locally administered.
148 The standard describing this change in Internet addressing is RFC-950.
150 To set up local subnets one must first decide how the available
151 address space (the Internet ``host part'' of the 32-bit address)
152 is to be partitioned.
153 Sites with a class A network
154 number have a 24-bit host address space with which to work, sites with a
155 class B network number have a 16-bit host address space, while sites with
156 a class C network number have an 8-bit host address space\**.
158 If you are unfamiliar with the Internet addressing structure, consult
159 ``Address Mappings'', Internet RFC-796, J. Postel; available from
160 the Internet Network Information Center at SRI.
162 To define local subnets you must steal some bits
163 from the local host address space for use in extending the network
164 portion of the Internet address. This reinterpretation of Internet
165 addresses is done only for local networks; i.e. it is not visible
166 to hosts off-site. For example, if your site has a class B network
167 number, hosts on this network have an Internet address that contains
168 the network number, 16 bits, and the host number, another
169 16 bits. To define 254 local subnets, each
170 possessing at most 255 hosts, 8 bits may be taken from the local part.
171 (The use of subnets 0 and all-1's, 255 in this example, is discouraged
172 to avoid confusion about broadcast addresses.)
174 numbers are then constructed by concatenating the original 16-bit network
175 number with the extra 8 bits containing the local subnet number.
177 The existence of local subnets is communicated to the system at the time a
178 network interface is configured with the
182 program. A ``network mask'' is specified to define the
183 portion of the Internet address that is to be considered the network part
185 This mask normally contains the bits corresponding to the standard
186 network part as well as the portion of the local part
187 that has been assigned to subnets.
188 If no mask is specified when the address is set,
189 it will be set according to the class of the network.
190 For example, at Berkeley (class B network 128.32) 8 bits
191 of the local part have been reserved for defining subnets;
194 file contains lines of the form
197 /sbin/ifconfig le0 netmask 0xffffff00 128.32.1.7
199 This specifies that for interface ``le0'', the upper 24 bits of
200 the Internet address should be used in calculating network numbers
201 (netmask 0xffffff00), and the interface's Internet address is
202 ``128.32.1.7'' (host 7 on network 128.32.1). Hosts \fIm\fP on
203 sub-network \fIn\fP of this network would then have addresses of
204 the form ``128.32.\fIn\fP.\fIm\fP''; for example, host
205 99 on network 129 would have an address ``128.32.129.99''.
206 For hosts with multiple interfaces, the network mask should
207 be set for each interface,
208 although in practice only the mask of the first interface on each network
210 .Sh 2 "Internet broadcast addresses"
212 The address defined as the broadcast address for Internet networks
213 according to RFC-919 is the address with a host part of all 1's.
214 The address used by 4.2BSD was the address with a host part of 0.
215 \*(4B uses the standard broadcast address (all 1's) by default,
216 but allows the broadcast address to be set (with
219 This allows networks consisting of both 4.2BSD, \*(Ps and \*(4B hosts
220 to coexist while the upgrade process proceeds.
221 In the presence of subnets, the broadcast address uses the subnet field
222 as for normal host addresses, with the remaining host part set to 1's
223 (or 0's, on a network that has not yet been converted).
224 \*(4B hosts recognize and accept packets
225 sent to the logical-network broadcast address as well as those sent
226 to the subnet broadcast address, and when using an all-1's broadcast,
227 also recognize and receive packets sent to host 0 as a broadcast.
230 If your environment allows access to networks not directly
231 attached to your host you will need to set up routing information
232 to allow packets to be properly routed. Two schemes are
233 supported by the system. The first scheme
234 employs a routing table management daemon.
235 Optimally, you should use the routing daemon
237 available from Cornell university.
238 We use it on our systems and it works well,
239 especially for multi-homed hosts using Serial Line IP (SLIP).
240 Unfortunately, we were not able to obtain permission to
243 If you do not wish to or cannot obtain
245 the distribution does include
247 to maintain the system routing tables. The routing daemon
248 uses a variant of the Xerox Routing Information Protocol
249 to maintain up to date routing tables in a cluster of local
250 area networks. By using the
252 file, the routing daemon can also be used to initialize static routes
253 to distant networks (see the next section for further discussion).
254 When the routing daemon is started up
259 if it exists and installs those routes defined there,
260 then broadcasts on each local network
261 to which the host is attached to find other instances of the routing
262 daemon. If any responses are received, the routing daemons
263 cooperate in maintaining a globally consistent view of routing
264 in the local environment. This view can be extended to include
265 remote sites also running the routing daemon by setting up suitable
270 for a more thorough discussion.
272 The second approach is to define a default or wildcard
274 gateway and depend on the gateway to provide ICMP routing
275 redirect information to dynamically create a routing data
276 base. This is done by adding an entry of the form
279 /sbin/route add default \fIsmart-gateway\fP 1
285 for more information. The default route
286 will be used by the system as a ``last resort''
287 in routing packets to their destination. Assuming the gateway
288 to which packets are directed is able to generate the proper
289 routing redirect messages, the system will then add routing
290 table entries based on the information supplied. This approach
291 has certain advantages over the routing daemon, but is
292 unsuitable in an environment where there are only bridges (i.e.
293 pseudo gateways that, for instance, do not generate routing
294 redirect messages). Further, if the
295 smart gateway goes down there is no alternative, save manual
296 alteration of the routing table entry, to maintaining service.
298 The system always listens, and processes, routing redirect
299 information, so it is possible to combine both of the above
300 facilities. For example, the routing table management process
301 might be used to maintain up to date information about routes
302 to geographically local networks, while employing the wildcard
303 routing techniques for ``distant'' networks. The
305 program may be used to display routing table contents as well
306 as various routing oriented statistics. For example,
308 \fB#\fP \fInetstat \-r\fP
310 will display the contents of the routing tables, while
312 \fB#\fP \fInetstat \-r \-s\fP
314 will show the number of routing table entries dynamically
315 created as a result of routing redirect messages, etc.
316 .Sh 2 "Use of \*(4B machines as gateways"
318 Several changes have been made in \*(4B in the area of gateway support
319 (or packet forwarding, if one prefers).
320 A new configuration option, GATEWAY, is used when configuring
321 a machine to be used as a gateway.
322 This option increases the size of the routing hash tables in the kernel.
323 Unless configured with that option,
324 hosts with only a single non-loopback interface never attempt
325 to forward packets or to respond with ICMP error messages to misdirected
327 This change reduces the problems that may occur when different hosts
328 on a network disagree on the network number or broadcast address.
329 Another change is that \*(4B machines that forward packets back through
330 the same interface on which they arrived
331 will send ICMP redirects to the source host if it is on the same network.
332 This improves the interaction of \*(4B gateways with hosts that configure
333 their routes via default gateways and redirects.
334 The generation of redirects may be disabled with the configuration option
335 IPSENDREDIRECTS=0 or while the system is running by using the command:
338 sysctl -w net.inet.ip.redirect=0
340 in environments where it may cause difficulties.
341 .Sh 2 "Network databases"
343 Several data files are used by the network library routines
344 and server programs. Most of these files are host independent
345 and updated only rarely.
350 File Manual reference Use
352 /etc/hosts \fIhosts\fP\|(5) local host names
353 /etc/networks \fInetworks\fP\|(5) network names
354 /etc/services \fIservices\fP\|(5) list of known services
355 /etc/protocols \fIprotocols\fP\|(5) protocol names
356 /etc/hosts.equiv \fIrshd\fP\|(8) list of ``trusted'' hosts
357 /etc/netstart \fIrc\fP\|(8) command script for initializing network
358 /etc/rc \fIrc\fP\|(8) command script for starting standard servers
359 /etc/rc.local \fIrc\fP\|(8) command script for starting local servers
360 /etc/ftpusers \fIftpd\fP\|(8) list of ``unwelcome'' ftp users
361 /etc/hosts.lpd \fIlpd\fP\|(8) list of hosts allowed to access printers
362 /etc/inetd.conf \fIinetd\fP\|(8) list of servers started by \fIinetd\fP
364 The files distributed are set up for Internet hosts.
365 Local networks and hosts should be added to describe the local
366 configuration; the Berkeley entries may serve as examples
367 (see also the section on
369 Network numbers will have to be chosen for each Ethernet.
370 For sites connected to the Internet,
371 the normal channels should be used for allocation of network
372 numbers (contact hostmaster@SRI-NIC.ARPA).
374 these could be chosen more or less arbitrarily,
375 but it is generally better to request official numbers
376 to avoid conversion if a connection to the Internet (or others on the Internet)
378 .Sh 3 "Network servers"
380 Most network servers are automatically started up at boot time
383 or by the Internet daemon (see below).
384 These include the following:
387 Program Server Started by
389 /usr/sbin/syslogd error logging server \f(CW/etc/rc\fP
390 /usr/sbin/named Internet name server \f(CW/etc/rc\fP
391 /sbin/routed routing table management daemon \f(CW/etc/rc\fP
392 /usr/sbin/rwhod system status daemon \f(CW/etc/rc\fP
393 /usr/sbin/timed time synchronization daemon \f(CW/etc/rc\fP
394 /usr/sbin/sendmail SMTP server \f(CW/etc/rc\fP
395 /usr/libexec/rshd shell server inetd
396 /usr/libexec/rexecd exec server inetd
397 /usr/libexec/rlogind login server inetd
398 /usr/libexec/telnetd TELNET server inetd
399 /usr/libexec/ftpd FTP server inetd
400 /usr/libexec/fingerd Finger server inetd
401 /usr/libexec/tftpd TFTP server inetd
403 Consult the manual pages and accompanying documentation (particularly
404 for named and sendmail) for details about their operation.
410 is controlled by shell
417 is not; they are enabled by setting the variables \fIroutedflags\fP and
419 to strings other than ``NO.''
420 The value of \fIroutedflags\fP provides host-specific options to
433 To have other network servers started as well,
434 commands of the following sort should be placed in the site-dependent file
438 if [ -f /usr/sbin/timed ]; then
439 /usr/sbin/timed & echo -n ' timed' >/dev/console
442 .Sh 3 "Internet daemon"
444 In \*(4B most of the servers for user-visible services are started up by a
445 ``super server'', the Internet daemon. The Internet
447 .Pn /usr/sbin/inetd ,
448 acts as a master server for
449 programs specified in its configuration file,
450 .Pn /etc/inetd.conf ,
451 listening for service requests for these servers, and starting
452 up the appropriate program whenever a request is received.
453 The configuration file contains lines containing a service
456 the type of socket the
457 server expects (e.g. stream or dgram), the protocol to be
458 used with the socket (as found in
459 .Pn /etc/protocols ),
460 whether to wait for each server to complete before starting up another,
461 the user name by which the server should run, the server
462 program's name, and at most five arguments to pass to the
464 Some trivial services are implemented internally in
466 and their servers are listed as ``internal.''
467 For example, an entry for the file
468 transfer protocol server would appear as
471 ftp stream tcp nowait root /usr/libexec/ftpd ftpd
475 for more detail on the format of the configuration file
476 and the operation of the Internet daemon.
477 .Sh 3 "The \f(CW/etc/hosts.equiv\fP file"
479 The remote login and shell servers use an
480 authentication scheme based on trusted hosts. The
482 file contains a list of hosts that are considered trusted
483 and, under a single administrative control. When a user
484 contacts a remote login or shell server requesting service,
485 the client process passes the user's name and the official
486 name of the host on which the client is located. In the simple
487 case, if the host's name is located in
489 and the user has an account on the server's machine, then service
490 is rendered (i.e. the user is allowed to log in, or the command
491 is executed). Users may expand this ``equivalence'' of
492 machines by installing a
494 file in their login directory.
495 The root login is handled specially, bypassing the
497 file, and using only the
501 Thus, to create a class of equivalent machines, the
503 file should contain the \fIofficial\fP names for those machines.
504 If you are running the name server, you may omit the domain part
505 of the host name for machines in your local domain.
506 For example, four machines on our local
507 network are considered trusted, so the
512 vangogh.CS.Berkeley.EDU
513 picasso.CS.Berkeley.EDU
514 okeeffe.CS.Berkeley.EDU
516 .Sh 3 "The \f(CW/etc/ftpusers\fP file"
518 The FTP server included in the system provides support for an
519 anonymous FTP account. Because of the inherent security problems
520 with such a facility you should read this section carefully if
521 you consider providing such a service.
523 An anonymous account is enabled by creating a user
525 When a client uses the anonymous account a
527 system call is performed by the server to restrict the client
528 from moving outside that part of the filesystem where the
529 user ftp home directory is located. Because a
531 call is used, certain programs and files used by the server
532 process must be placed in the ftp home directory.
534 sure that all directories and executable images are unwritable.
535 The following directory setup is recommended. The
542 files are \fBSTRONGLY\fP recommended.
544 \fB#\fP \fIcd ~ftp\fP
545 \fB#\fP \fIchmod 555 .; chown ftp .; chgrp ftp .\fP
546 \fB#\fP \fImkdir bin etc pub\fP
547 \fB#\fP \fIchown root bin etc\fP
548 \fB#\fP \fIchmod 555 bin etc\fP
549 \fB#\fP \fIchown ftp pub\fP
550 \fB#\fP \fIchmod 777 pub\fP
552 \fB#\fP \fIcp /bin/sh /bin/ls .\fP
553 \fB#\fP \fIchmod 111 sh ls\fP
554 \fB#\fP \fIcd ../etc\fP
555 \fB#\fP \fIawk -F: '{$2="*";print$1":"$2":"$3":"$4":"$5":"$6":"}' < /etc/passwd > passwd\fP
556 \fB#\fP \fIawk -F: '{$2="*";print$1":"$2":"}' < /etc/group > group\fP
557 \fB#\fP \fIchmod 444 passwd group\fP
559 When local users wish to place files in the anonymous
560 area, they must be placed in a subdirectory. In the
561 setup here, the directory
565 Aside from the problems of directory modes and such,
566 the ftp server may provide a loophole for interlopers
567 if certain user accounts are allowed.
570 is checked on each connection.
571 If the requested user name is located in the file, the
572 request for service is denied. This file normally has
573 the following names on our systems.
578 Accounts without passwords need not be listed in this file as the ftp
579 server will refuse service to these users.
580 Accounts with nonstandard shells (any not listed in
582 will also be denied access via ftp.