ASIP
Black Magic v1.0.3 Notes/Comments
(back to
top) Whenever
possible, update to the latest ASIP and latest AppleShare
clients. This will ensure that you will all the latest
bug fixes.
None
of this info in this document is guarantee to be correct!
A lot of this information has come from past postings
to the ASIP mailing list. It just seemed like a good idea
to put them into a common file.
ASIP
Server crashing at around 12 PM - 1 AM (back
to top)
Large File copies over 100 MB getting stuck (back to top) Seems
to be related to "OT Auto Push Support" extension
in your system folder. This extension is used
for the TCP Filtering, but note that TCP filtering
does not actually have to be in use, just the
presence of that extension is enough to cause
problems.
ASIP
File Server getting "hung/frozen/etc.", but
other services work... (back
to top)
AFP/TCP
freezing under heavy load, but AFP/ATalk still
works (back
to top)
Error
43 has occurred
(back
to top) Server
hitting the Internet every minute (back
to top) ASIP
6.3 not autostarting at startup (back
to top) Slow
startup (back
to top) At
startup, the Users & Groups file
is checked completely. Over time,
it seems to get filled with a lot
of junk and/or it may be corrupted.
Unexpected Disconnects (back to top)
Finding
the source of an
unexpected disconnect
is very difficult
since so many things
can cause it to
happen. DHCP time-outs,
bad cables, bad
routers, bugs in
the server, bugs
in the client, bad
network cards, corrupted
data, etc. So one
person's problem
with unexpected
disconnects may
be completely different
from another persons
problem. Also, there
is the sheer randomness
of the disconnects.
That is why you
do not see postings
from Apple with
a single magic answer.
That said, here
are some ideas to
try...
Retrospect and ASIP (back to top)
From
David
Sallak...
Since
your
freeze
is happening
during
times
of low
use,
but
after
a backup,
the
problem
is more
likely
to be
a memory
conflict
between
ASIP
and
Retrospect.
If your
lockups
happened
during
high
client
activity
usage,
then
I'd
be looking
at the
RAM,
cabling,
or hard
disk
driver
software.
Retrospect
will
expand
in
memory
usage
dynamically
over
time,
similar
to
how
the
ASIP
Cache
expands
over
time.
Because
your
crash
doesn't
happen
every
night,
you
are
likely
having
a
problem
with
Retrospect's
temp
memory
overlapping
ASIP's
temporary
Cache
memory
as
they
each
build
up
over
time. Solution?
I
have
Retrospect
running
on
four
different
ASIP
servers,
and
none
of
them
have
these
lockups.
What's
the
secret?
The goal is to get Retrospect loaded before ASIP, so the ever-expanding ASIP cache doesn't bump into Retrospect's memory space. By loading Retrospect before ASIP, and giving it extra RAM, you give Retrospect a nice clean space to do its work, and the ASIP cache will never expand into the temp memory space that Retrospect uses.
AppleShare
Client
hangs
on
logging
into
server
(back
to
top)
To make your server more stable (back to top)
Try
the
following...
Virtual Memory and Disk cache on an ASIP Server (back to top)
Turning
off
VM
and
reducing
the
Disk
caches
helps
in
many
ways:
This is all assuming that you have fast enough hardware (both CPU and network) to make it worthwhile. For example, if your server is dealing with LocalTalk, then no matter how fast your server is or how much RAM it has, the performance bottleneck will always be LocalTalk.
In
ASIP
6.1,
there
is
an
UNSUPPORTED
option
that
you
can
turn
on
that
will
disable
AFP
over
AppleTalk
access.
NBP
(in
the
Chooser)
will
still
show
the
server's
name
and
will
still
do
the
"magic"
switch
to
TCP/IP,
but
anyone
trying
to
log
in
over
AppleTalk
will
get
an
error
of
"The
attempted
connection
to
the
server
has
failed.
Try
again
later."
This
error
dialog
appears
after
the
enter
password
dialog
has
appeared.
Not
the
most
informative
dialog,
but
hey,
that
is
why
it
is
UNSUPPORTED!
UNSUPPORTED Wiping out fork data (back to top)
Only
for
ASIP
6.3.x
and
later...
If
someone
does
a
FPSetForkParm
past
the
EOF
of
a
fork,
ASIP
does
not
automatically
zero
out
that
data.
So,
someone
could
then
read
that
area
and
see
what
was
left
over
there.
Most,
if
not
all
the
time,
the
data
there
is
total
garbage,
but
for
those
of
you
who
are
totally
security
paranoid...
This will fill in the new data areas with 'E' and hopefully 0 in later releases. Note that this will slow down your server performance and only affects the File Server part of AISP.
UNSUPPORTED
Turning
on
DDP
Checksums
for
AppleTalk
(back
to
top)
The
default checksumming in AppleTalk is not that
great, it will occasionally let through an error.
Especially now when people are transferring giant
archives or disk images that have auto checks
for errors in the file, we are seeing more and
more errors due to AppleTalk. Turning on DDP Checksumming
will slow AppleTalk performance, but will eliminate
these file errors.
Doorstop
and AutoPush (back
to top) Question: Answer: The Mentat stack is designed so that you can easily push any module on top of any other, but the particular code for allowing a module to pushed on top of TCP was not included (and no, I dont remember why). So, we needed a workaround and that was the OT Auto Push extension. Doorstop works without the OT Auto Push extension because it "pushes" itself much lower down in the stack (on top of IP) and the Mentat code for doing that is still in Open Transport. This allows filtering of UDP packets too. Unistalling
ASIP (or how to revert back to slow FileShare)
(back
to top)
Single
Link, Multihoming Setup (back
to top) The second way of configuring the ASIP server for multi domain support is to set up secondary IP addresses at the server, and have the clients' domain names mapped to the secondary addresses. Open Transport 1.3 or later and a PCI-based server is required to support this capability, which is called 'single-link multihoming', 'IP multinode support', or 'IP aliasing.' This method is needed when clients are using older browsers (such as Mosaic) which may not support HTTP 1.1; in these cases, the domain name the client used in the URL is not passed to the server; only the IP address is. Thus, the ASIP Web Server must use the IP address to determine what home page to send to the client. When using this method, you should use IP addresses, rather than the domain name, in the Multi Domain Settings file.
Long
delays after mounting a sharepoint (back
to top)
For detailed explanation on emptying the "Network Trash Folder" folder manually, using AShare Helper, or AppleScript, click here. Network
Trash Explanation (back
to top) When a client throws a file on a remote volume away the Finder tries to get a lock on the first byte of the Trash Can Usage Map if that byte is locked, it tries to get a lock on the second byte and so on. When it gets the lock it "claims" the corresponding Trash Can folder. It then moves the file to be thrown away into its Trash Can folder. When the User selects Empty Trash, the Finder will empty its Trash Can Folder. If the client machine breaks the connection via crashing or being disconnected, the Trash Can folder will not be emptied. However when a client Finder claims a Trash Can folder, it will delete anything that was in the folder previously. For detailed explanation on emptying the "Network Trash Folder" folder manually, using AShare Helper, or AppleScript, click here. AppleShare
Password Authentication & Security
(back
to top) The algorithms for all of the AppleShare Authentication methods are public. I don't see this as a problem. The security of the method is in the math, not in some secret algorithm. The AppleShare password encryption method he mentions, is probably the method for storing the passwords in the Users & Groups data file on the Server, which is only a problem if you send your attacker that file (AppleShare won't share the System folder on the server). Or, if the attacker has physical access to your server, then he/she could copy the Users & Groups data file; of course your server should ALWAYS be in a secure location. The most widely used (at this time) auth method is 2 Way random (introduced in 1989) which sends two 8 byte DES encrypted random numbers over the network. From a computational standpoint the algorithm is exactly as strong as 56-bit DES. It is however vulnerable to an off-line password guessing attack (similar to running crack against a unix passwd file), and it has a password length limit of 8 characters. We have developed a new authentication method that addresses the weaknesses of 2 Way randnum, called DHX. DHX uses Diffie-Hellman key exchange to create a 128 bit session key and then sends a 64 character password to the server encrypted with CAST 128. It's strength is approximately equivalent to 128-bit SSL. (iDisk uses DHX) So I suppose the answer to the question is, we've been doing 56-bit encryption since 1989, and we're in the process of moving to 128 bit encryption. Both are reasonably safe on the Internet, and infinitely safer than protocols like FTP, POP or HTTP which send passwords in the clear over the network. Note
About Security (back
to top)
UNSUPPORTED
- AppleShare Client that does not support ClearText
(back
to top)
How
come I only see XXX GB free on my FileSharing
CPU (back
to top) Installing
AppleShare IP 6.3.1 on Mac OS 9.0.4 (back
to top)
Detailed
Walkthrough For Steps 4 - 6
100Mbit
Ethernet Notes (most if not all is unconfirmed)
(back
to top)
DHX
(note that iDisk use DHX) (back
to top) Get the latest client from www.apple.com/appleshareip/text/downloads.html. Another
way to access my iDisk (requires client 3.8.6
or later) (back
to top)
AShare
Helper (back
to top)
How
to operate it? You can use the Notifications are to setup where to send a copy of the Event Log for both the Actions and Warnings. All email errors are saved in the event log as are the email logs themselves. The Event Log can viewed at any time by selecting 'View Log' from the File menu (shortcut is Cmd-L). This allows you to scroll through the log and clear it if required. Where
to put AShare Helper? What
are the limitations?
Questions
/ Comments
|
