Re: [9fans] Localhost/127.1

Re: [9fans] Localhost/127.1

[andrey mirtchovski]

> What /lib/ndb entry should one include for localhost/127.0.0.1?
> 
> I note that netstat gets held up when looking up the address, which is
> a small nuisance.
> 
> ++L

not sure if this isn't backwards to what you want, but I hope it helps:

	home% ip/ping localhost
	ip/ping: couldn't dial: cs: can't translate address: dns: resource does not exist
	home% echo 'sys=localhost ip=127.0.0.1 dom=localhost' > /net/ndb
	home% ip/ping localhost
	sending 32 64 byte messages 1000 ms apart
	0: rtt 615 µs, avg rtt 615 µs, ttl = 128
	1: rtt 539 µs, avg rtt 577 µs, ttl = 128
	2: rtt 635 µs, avg rtt 596 µs, ttl = 128
	home% 

andrey

[9fans] Localhost/127.1

[Lucio De Re]

What /lib/ndb entry should one include for localhost/127.0.0.1?

I note that netstat gets held up when looking up the address, which is
a small nuisance.

++L

Re: [9fans] Localhost/127.1

[Lucio De Re]

On Tue, Feb 24, 2004 at 09:29:12PM -0700, andrey mirtchovski wrote:
> 
> not sure if this isn't backwards to what you want, but I hope it helps:
> 
> 	home% ip/ping localhost
> 	ip/ping: couldn't dial: cs: can't translate address: dns: resource does not exist
> 	home% echo 'sys=localhost ip=127.0.0.1 dom=localhost' > /net/ndb
> 	home% ip/ping localhost
> 	sending 32 64 byte messages 1000 ms apart
> 	0: rtt 615 µs, avg rtt 615 µs, ttl = 128
> 	1: rtt 539 µs, avg rtt 577 µs, ttl = 128
> 	2: rtt 635 µs, avg rtt 596 µs, ttl = 128
> 	home% 
> 
In Plan 9 terms, the above ought to be exactly right, let me try
it...

Nopes, I guess the nameserver needs to be authoritative for
1.0.0.127.in-addr.arpa.  I wonder if Bell Labs would be willing to
add an option to ndb/dns to enforce this.

++L

Re: [9fans] server configuration

[andrey mirtchovski]

a "protocol botch" message usually means your client and auth server
can't agree on what the authdom is..  see "telnet problem" from
11-Feb-2003.

plenty of other mentionings in the archive, the last one seems to be
from the 9th of this month -- just search comp.os.plan9 for "protocol
botch"

andrey

Re: [9fans] Localhost/127.1

[dbailey27]

Try the following in rc:

cat > foo << !
	ipnet=local-net
		ip=127.0.0.0
		ipmask=255.0.0.0

	sys=localhost
		ip=127.0.0.1
		proto=il
	!

cat foo >> /lib/ndb/local
echo refresh >/net/cs
echo refresh >/net/dns
ip/ping localhost

Note that the above asumes you've got a loopback interface
up and running.

Don (north_)

Re: [9fans] Localhost/127.1

[Geoff Collyer]

If you want to convince your machines that they are authoritative,
just add "soa=" (*not* "soa=delegated") to the forward and reverse
domain definitions:

dom=localhost soa=
	sys=localhost
	ip=127.0.0.1
#	ip=::1
	refresh=36000 ttl=36000
	ns=my-big-nameserver
	mbox=postmaster@my-domain
dom=127.in-addr.arpa soa=
	refresh=36000 ttl=36000
	ns=my-big-nameserver
	mbox=postmaster@my-domain
# I have omitted the ipv6 reverse map

Re: [9fans] Localhost/127.1

[Geoff Collyer]

...  and those definitions are intended for the appropriate ndb files,
not /net*/ndb.

Re: [9fans] Localhost/127.1

[Lucio De Re]

On Tue, Feb 24, 2004 at 10:20:43PM -0800, Geoff Collyer wrote:
>
> ...  and those definitions are intended for the appropriate ndb files,
> not /net*/ndb.

Thank you for remininding me of the SOA bit.  The question then
becomes: is there any reason for the stuff you suggested not to be
distributed in the default /lib/ndb/local?

If nothing else, it makes a neat extra example and it seems to me
to be globally valid.  Of course, as Don points out, without a
loopback interface it may interfere, but I think the risk is
minimal.

++L

Re: [9fans] Localhost/127.1

[dbailey27]

> If nothing else, it makes a neat extra example and it seems to me
> to be globally valid.  Of course, as Don points out, without a
> loopback interface it may interfere, but I think the risk is
> minimal.

Without a loopback interface the sends will probably go through your
ipgw, but will obviously be blackholed very soon. So, the use itself is
really limited to the sensible use of a loopback interface.

I think it wasn't distributed with the default ndb/local simply because
it wasn't/isn't being used at the Labs. I agree that there is little, if any,
reason against including it.

Don (north_)

Re: [9fans] Localhost/127.1

[dbailey27]

> Please forgive the occasional,
> extremely unimportant posting, I don't have the self-confidence to
> be sure that a trivial issue is not me overlooking something crucial.

I wouldn't worry about it. Everyone here seems to enjoy helping out,
at least every once in a while. I know I've gotten more than my fair
share out of this bunch :-)

Don (north_)

Re: [9fans] Localhost/127.1

[Lucio De Re]

On Wed, Feb 25, 2004 at 01:28:32AM -0500, dbailey27@ameritech.net wrote:
>
> I think it wasn't distributed with the default ndb/local simply because
> it wasn't/isn't being used at the Labs. I agree that there is little, if any,
> reason against including it.
>
Geoff's suggestion worked a treat, as was to be expected.

I'm tidying up my network after a file server crash and I'd like
to pluck a whole lot of legacy lint that would otherwise just
accumulate in the air passages.  Please forgive the occasional,
extremely unimportant posting, I don't have the self-confidence to
be sure that a trivial issue is not me overlooking something crucial.

++L

[9fans] server configuration

[vdharani]

hi,

i am struggling to bring up some services in my auth/cpu/fs server.

i have booted my machine with 9pcauth kernel.

now here are my problems:

- i tried telnet. it gets username and then comes back
saying 'authentication failure:auth server protocol botch'

- i tried ftp. it gets username and comes back saying
'421 auth server protocol botch' and fails.

- i tried ssh from a windows machine. it asks for password and after
sometime it again asks for password (looks like it fails to do ssh). i
tried ssh from the server machine to itself ('ssh vdharani@192.168.1.50'
from 192.168.1.50 itself). it comes back saying 'ssh: client
authentication failed'.

i tried various combinations from auth/ssh_genkey to auth/rsagen. somehow
i am missing something.

in the meanwhile, in /rc/bin/cpurc, I added ip addresses for fs and auth
in ipconfig line. when i did 'cat /net/ndb' i saw only fs entry taken
(auth didnt showup). i manually added it (using 'cat > /net/ndb').

the wiki pages gives some description on ssh configuration but the top
line says something like 'the commands are not valid anymore'. i am not
able to get the proper sequence for ssh configuration. in particular, if i
need to do ssh to the same machine, what should i do? can someone briefly
explain what all i should do? also, do i have to start auth/sshserve
manually? (btw, i noticed that if i enter just 'sshserve' it displays the
usage line continuously)

given that ftp server and telnet also dont work, i am also wondering if
something else is wrong. since i dont see any useful messages thrown, i
have no clue at this time.

any help appreciated.

thanks
dharani

Re: [9fans] server configuration

[David Presotto]

[-- Attachment #1: Type: text/plain, Size: 203 bytes --]

open a window. in it 'echo debug > /mnt/factotum/ctl;cat /dev/kprint'.
open another window. do something that fails.

if the problem doesn't become obvious, mail me what you get in the kprint
window.

[-- Attachment #2: Type: message/rfc822, Size: 4053 bytes --]

From: <vdharani@infernopark.com>
To: <9fans@cse.psu.edu>
Subject: [9fans] server configuration
Date: Wed, 25 Feb 2004 04:15:56 -0500 (EST)
Message-ID: <32853.67.85.61.176.1077700556.squirrel@www.infernopark.com>

hi,

i am struggling to bring up some services in my auth/cpu/fs server.

i have booted my machine with 9pcauth kernel.

now here are my problems:

- i tried telnet. it gets username and then comes back
saying 'authentication failure:auth server protocol botch'

- i tried ftp. it gets username and comes back saying
'421 auth server protocol botch' and fails.

- i tried ssh from a windows machine. it asks for password and after
sometime it again asks for password (looks like it fails to do ssh). i
tried ssh from the server machine to itself ('ssh vdharani@192.168.1.50'
from 192.168.1.50 itself). it comes back saying 'ssh: client
authentication failed'.

i tried various combinations from auth/ssh_genkey to auth/rsagen. somehow
i am missing something.

in the meanwhile, in /rc/bin/cpurc, I added ip addresses for fs and auth
in ipconfig line. when i did 'cat /net/ndb' i saw only fs entry taken
(auth didnt showup). i manually added it (using 'cat > /net/ndb').

the wiki pages gives some description on ssh configuration but the top
line says something like 'the commands are not valid anymore'. i am not
able to get the proper sequence for ssh configuration. in particular, if i
need to do ssh to the same machine, what should i do? can someone briefly
explain what all i should do? also, do i have to start auth/sshserve
manually? (btw, i noticed that if i enter just 'sshserve' it displays the
usage line continuously)

given that ftp server and telnet also dont work, i am also wondering if
something else is wrong. since i dont see any useful messages thrown, i
have no clue at this time.

any help appreciated.

thanks
dharani

Re: [9fans] Localhost/127.1

[boyd, rounin]

> Nopes, I guess the nameserver needs to be authoritative for
> 1.0.0.127.in-addr.arpa.  I wonder if Bell Labs would be willing to
> add an option to ndb/dns to enforce this.

god no.  those bind dns zone files are just awful.

This is not LINUX!  This is Plan 9.  There are rules.  -boyd/walter

Re: [9fans] Localhost/127.1

[boyd, rounin]

> I added 'ip=127.0.0.1 sys=localhost' to the default /lib/ndb/local.
>
> I DO NOT want any DNS server serving it, nor does anyone else I believe.

correct

Re: [9fans] Localhost/127.1

[David Presotto]

[-- Attachment #1: Type: text/plain, Size: 221 bytes --]

I added 'ip=127.0.0.1 sys=localhost' to the default /lib/ndb/local.

I DO NOT want any DNS server serving it, nor does anyone else I believe.
Don't put in SOA's for it.  Its a convenient local hack, not a part
of DNS.

[-- Attachment #2: Type: message/rfc822, Size: 2399 bytes --]

From: "boyd, rounin" <boyd@insultant.net>
To: <9fans@cse.psu.edu>
Subject: Re: [9fans] Localhost/127.1
Date: Thu, 26 Feb 2004 06:34:47 +0100
Message-ID: <007a01c3fc2a$85acb4a0$0b00a8c0@SOMA>

> Nopes, I guess the nameserver needs to be authoritative for
> 1.0.0.127.in-addr.arpa.  I wonder if Bell Labs would be willing to
> add an option to ndb/dns to enforce this.

god no.  those bind dns zone files are just awful.

This is not LINUX!  This is Plan 9.  There are rules.  -boyd/walter

Re: [9fans] Localhost/127.1

[Lucio De Re]

On Thu, Feb 26, 2004 at 08:52:43AM -0500, David Presotto wrote:
>
> I added 'ip=127.0.0.1 sys=localhost' to the default /lib/ndb/local.
>
> I DO NOT want any DNS server serving it, nor does anyone else I believe.
> Don't put in SOA's for it.  Its a convenient local hack, not a part
> of DNS.

I'm going to disagree: the reverse lookup is a very firm convention.
127.0.0.1 reverse resolves to localhost. (note the trailing dot,
I think the jury is still out on that one ;-)

Nobody is meant to request recursive lookup for 127.0.0.1, although
many configurations do, of course.  They deserve what they get,
don't they?

Lastly, the idea was to get rid of the delay and failure in the
revcerse l.ookup, which I believe is not achieved by the suggested
/lib/ndb/local (why not /lib/ndb/common?) entry.

++L

Re: [9fans] Localhost/127.1

[David Presotto]

[-- Attachment #1: Type: text/plain, Size: 143 bytes --]

So you want a reverse lookup that doesn't match the forward lookup?

Where exactly are you getting slowed down by this reverse lookup, smtpd?

[-- Attachment #2: Type: message/rfc822, Size: 3190 bytes --]

From: Lucio De Re <lucio@proxima.alt.za>
To: 9fans@cse.psu.edu
Subject: Re: [9fans] Localhost/127.1
Date: Thu, 26 Feb 2004 16:45:55 +0200
Message-ID: <20040226164554.A22848@cackle.proxima.alt.za>

On Thu, Feb 26, 2004 at 08:52:43AM -0500, David Presotto wrote:
>
> I added 'ip=127.0.0.1 sys=localhost' to the default /lib/ndb/local.
>
> I DO NOT want any DNS server serving it, nor does anyone else I believe.
> Don't put in SOA's for it.  Its a convenient local hack, not a part
> of DNS.

I'm going to disagree: the reverse lookup is a very firm convention.
127.0.0.1 reverse resolves to localhost. (note the trailing dot,
I think the jury is still out on that one ;-)

Nobody is meant to request recursive lookup for 127.0.0.1, although
many configurations do, of course.  They deserve what they get,
don't they?

Lastly, the idea was to get rid of the delay and failure in the
revcerse l.ookup, which I believe is not achieved by the suggested
/lib/ndb/local (why not /lib/ndb/common?) entry.

++L

Re: [9fans] server configuration

[vdharani]

hi,

> open a window. in it 'echo debug > /mnt/factotum/ctl;cat /dev/kprint'.
> open another window. do something that fails.
>
> if the problem doesn't become obvious, mail me what you get in the
> kprint window.

wow! atlast i have cofigured my machine properly. now, all the things (ssh,
telnet, ftp) work very well. the words 'auth/debug' and 'authdom' were
clues enough for me to cross the hurdles. i figured that i had given some
near-junk domain name during reboot (after the blahblahblah nvram
initialization). auth/debug pointed me the mistakes. after i corrected
those things, everything seems to be fine now.

the wordings "The authdom is a non-empty domain (e.g. moscvax.edu) of your
choosing (for debugging), ..." in Wiki standalone CPU server config page in
really confused me. i thought i can give any name for the domain and it
wont be needed.

apart from this, wiki page on ssh configuration also confused me. it seems
to be neither useful nor correct. why cant we change it, if it is not valid
anymore?

next, i see that there is really no information on auth setup really in the
wiki pages. just a few lines describing auth/debug, and anything else to
check would have been enough.

i can do some of these things and of course, you can feel free to modify
it. are wiki pages editable now? can i go ahead and do it?

though i have been using plan 9 for many years, only recently i am doing
things like CPU/AUTH server setup etc. things are a bit difficult
initially, but i can see that i am gaining knowledge on plan 9 day by day.
i feel happy to play with and use plan 9. and i am wondering why i didnt
jump into it early enough.

thanks dave, andrey and lucio for your responses.

regards
dharani

Re: [9fans] Localhost/127.1

[Lucio De Re]

On Thu, Feb 26, 2004 at 10:10:06AM -0500, David Presotto wrote:
>
> So you want a reverse lookup that doesn't match the forward lookup?
>
It's conventional enough for 127.0.0.1 to be reverse resolve to
localhost (does anybody actually resolve it to anything else?) that it
doesn't matter if it is "wrong".  And if something else is wanted, it
can be changed easily enough.  I really think the local DNS can serve
an authoritative zone for it.  Serving it outside the network _is_
absurd, that I will grant.

But Geoff's /lib/ndb entries seem perfectly reasonable to me in term
of such a convention.

> Where exactly are you getting slowed down by this reverse lookup, smtpd?

Netstat.  On every line that points to the loopback port.  Smtpd might
be transparent, being store-and-forward, netstat I have to wait for.
It's my fault, of course, for running it on the console without the
option to stop it, but it's only an alert, I believe the underlying
convention can be cast in stone, or at least come highly recommended
(have a /lib/local/localhost that can be included by the user in
/lib/ndb/local would probably be OK for everyone).

++L

Re: [9fans] server configuration

[ron minnich]

well I just fixed my problem with server configuration. I was unable to 
drawterm from my linux laptop to my plan 9 laptop. 

Error was the obscure '?AS: protocol botch: file does not exist'

which is not so obvious when you can't find any files that don't exist :-)

Turns out the file 
/rc/bin/service.auth/tcp567 was a directory, more or less, except it was a 
file and was full of junk -- kind of looked like it had the contents of 
/rc/bin/service.auth in the file tcp567. Clearly not what was intended.

Of course it has to have 
#!/bin/rc
/bin/auth/authsrv $3

Don't know how this one got smashed. Happy now, can cpu again to my T21.

ron