Check the configuration process to be sure it builds against the SSL
libraries. Those are essential for login from a IIGS (IIe workstation card can
do cleartext).

Glad to be of help.  Unfortunately, the netatalk maintainers have been
reticent to accept patches, so I stopped submitting them about 8-9 years ago.
There were a couple of problems that had to be fixed in the Ubuntu package,
for example: One was to build with libssl and the other fixed an issue where
it wasn't properly preserving file dates.

I'm not sure exactly what that's about, but I strongly suspect it's in
reference to Appletalk Server running on an older Mac.  As far as netatalk is
concerned, Mac OSX is "just another unix-like environment".  There shouldn't
be any serious technical hurdles at that low level.

Again, you can expect the same results from netatalk regardless of whether the
platform is Linux or OSX.  Some of the fiddling I did with netatalk had to do
with Type/Creator, but I do think those made it into the official sources.

Give a yell here if you run into problems.  In theory, getting it going should
be simple. In practice, it can be a pitched battle sometimes :-).

Steve

Thanks for offer to help.

I'm curious about:

Assuming I use a patched version of the GS/OS Appleshare CDEV (corrects the
case sensitivity on the Cleartext Password - Thanks to Marsha Jackson, BTW),
do I still need to be concerned about using SSL libraries provided I'm using
OS X Tiger (10.4), which still allows cleartext passwords by default?

Or, should I still build against it for some other reason?

Thanks.

Hugh Hood

I didn't realize that Marsha's fix permitted cleartext to work from a IIGS.
If that's the case, then you may not need libssl support.  I've never been
successful with any approach that relied on the platform authentication
mechanism (PAM on Linux), BTW.  Best to setup an afppasswd file.  It's been a
long time since I've gone through it, but I think you use a small utility and
cut-and-paste the hashed password into /etc/netatalk/afppasswd (may be located
somewhere else on Mac OSX).

http://www.zaphu.com/2008/04/29/ubuntu-guide-configure-a-netatalk-file-server-based-on-apple-filing-protocol-afp/

This one worked, now they have released 2.0.5, and I'm wondering if I
need to do this again this way vs. using the updater, and the answer
is probably do it this way again.

Between that and Avahi to broadcast the presence, the whole setup
works. though I am having some weird permissions issues with iTunes,
so I'm thinking 2.0.5 will fix that as there's some issues that it
addresses with 10.6.

> http://www.zaphu.com/2008/04/29/ubuntu-guide-configure-a-netatalk-file-server-based-on-apple-filing-protocol-afp/

For the archives:
Since 2.0.4 Netatalk has DHX2 which doesn't use OpenSSL but libgcrypt which
solved the Debian/Ubuntu licensing issue.

-Ralph

--
s/-nsp// for mail

Odd.  Did you create an afppasswd file as I had suggested?

Even odder.  I've never seen netatalk work with A2 clients using the platform
authentication - on a Linux box.  Are you actually hosting it under Mac OSX?
I know very little about OSX authentication.

Go figure.  That most definitely did not work for me.  I had to override the
Ubuntu defaults and build against openssl.  Again, I'm strictly referring to
use with A2 clients - Mac clients probably do work with the stock package.

Steve

I wonder if the Avahi config needs something in it.

FWIW: Although Netatalk is an AppleTalk router, both LocalTalk bridges*
I've used were sensitive to the startup order: the bridge had to be the
last thing up, presumably to see all the peers.

* AsanteTalk and LocalTalk Bridge
<http://en.wikipedia.org/wiki/LocalTalk-to-Ethernet_bridge>

--
John B. Matthews
trashgod at gmail dot com
<http://sites.google.com/site/drjohnbmatthews>

...the same Etherwave and Ethernet cards I have used a ton of times
except the server is a Mac.

By virtue of tuning on the IIgs that is powering the Etherwave, or the
Ethernet card being in a slot, they are infact powered up "last".

Geoff

-transall -uamlist uams_clrtxt.so,uams_dhx.so -nosavepassword

transall means both tcp and afp.

Geoff

Besides Steve Hirsch, who's helped me a ton with this thing, the
ubuntu box is visible to a Mac Portable using 6.0.8, and a 9600 that
has 7.6.1 with Open Transport, so that covers both AFP and TCP.

The Mac Portable can also see the 9600 shares.

The IIgs can only see the 9600 shares.

Since the Mac Portable/System 6/chooser means that we're using AFP
only - so AFP is broadcasting, and the Intel Mac is connected
properly ..

The IIgs sees itself, and the 9600, but not the Ubuntu box.

Who's doing what?

atalkd.conf has:
eth1 -phase 2 -net 0-65534 -addr 1.168
or
eth1 -seed -phase 2 -net 0-65534 -addr 1.168

Yeah, this has been very frustrating!  I've run a netatalk server here for
over ten years to support my Apple 2s.  Stuck my neck out and told Tony I
could talk him through it, but am busy eating crow...

To level-set things, I installed the exact same package version on an extra
box here. It worked from the word go.  My IIgs bridges to ethernet through a
Gatorbox and nbplkup on the Linux machine (essentially network broadcast ping)
turns up everything.  Network services to the IIgs are rock solid.

Tony's setup has been uncooperative.  It's almost as if something was
swallowing the DDP packets and not allowing any traffic between netatalk and
the IIgs.  Tried all the usual suspects:  Substituted different ethernet
switch, checked for firewall rules, etc, etc.  We are not dealing with
authentication issues, AFAIK, since things never get far enough to attempt a
connection!

So, I'll second the request:  Is anyone else on the list successfully using
netatalk to share files to a IIgs or IIe?

Steve

I've done this to a IIe many times, but only using Localtalk bridge on
an in between Mac. I have a hardware localtalk bridge (funny looking
star shaped green dongle thing) but I've found that to be flaky.

I remember at one point I had to mount a volume on the in-between Mac
before the AFP on my linux box was visible, but after that it worked
fine.

I stopped using this setup a few years back, but I can probably rig
something up if need be for verification.

Matt

Yes, I had suggested Localtalk bridge at one point.  Tony is very confident in
the Farallon Etherwave and is also fortunate enough to have the world's
largest private stash of gen-u-ine Apple-brand ethernet adapters!

Us mere mortals have to live with the Gatorbox :-)

Interesting data point.

Etherwave. That's the one. I had some difficulty with it. And yes,
I've had the privilege of seeing Tony's collection in the flesh, and
am still awestruck.

As to the Apple ethertalk card, I have no experience with that other
than looking at one at KFest '07 and getting extreme collection envy.

This *may* just be necessary to initialise the Localtalk bridge in the
event the IIe comes up last, but I can't be sure it's been a long
time.

Matt

I've never had much luck with anything carrying the name Farallon, but Tony
swears by it.

Something in the back of my mind is telling me that this is the net number
seeding problem from Hell (tm).  I'm not very well versed in Appletalk
technical details, though.

Steve

I've tried to setup netatalk under Kubuntu and have gone only as far
as Tony had.  My Mac sees the Linux box, the IIgs sees the Mac, but
the IIgs doesn't see the Linux box.  My LocalTalk-Ethernet bridge is a
Sonic Systems bridge (for the IIgs side).  Mac and Linux box use
standard RJ-45 Ethernet.

I've read somewhere that the Linux kernel (or some part) does not
support AppleTalk Phase 1 anymore, and doesn't the IIgs require Phase
1?

Welcome to the Twilight Zone, a dimension not of sight but of mind...

Seriously, this is going to drive me nuts!  I built the latest Ubuntu netatalk
revision from the deb sources with SSL authentication turned on, installed it
on a machine running 9.10 'Karmic' (latest kernel 2.6.31.x) and it "just
worked" - as has my main fileserver (running 8.04 'Hardy') since forever.

I don't see how that can be true, given my success here.  It's remotely
possible that my Gatorbox is doing... something.. to enable things, but I'm
not aware that it magically converts Phase I to Phase II or vice-versa.  Can
you direct me to where you found that bit of information?

Does your LT/Enet bridge allow the IIgs to be a client of a Mac-based Atalk
server?  Over the years I've only been successful with a Kinetics/Shiva
FastPath 4 (with the latest firmware at that) and Gatorbox.  Tried half dozen
assorted units by other vendors with absolutely no success.  Even the FastPath
5 manages to be broken - it will setup a session and _appear_ to work, but
cannot keep it alive for more than about five minutes.

Do we have any Appletalk gurus on the list?  I know enough about it to be
dangerous, but really am not well-versed on the technicalities.

Steve

I just recently upgraded a new Linux server with Debian testing.  My
old server was working fine with a much older version of Debian but
even still it took some time to get it working.  I have a GatorBox
router and don't boot the IIe or IIgs from the Linux box - I only
share files.  The biggest issue for me was getting the uams_* list
right.  Having my GatorBox already configured was a big help.

Note:  my server is also my internet gateway and firewall so I
explicitly enter my home net ethernet device and IP.

My afpd.conf looks like:

"Blade" -transall -ipaddr 192.168.123.1 -uamlist
uams_clrtxt.so,uams_randnum.so,uams_dhx.so  -nosavepassword -
passwdfile ~/.passwd

This way I keep the password in my local server directory and is much
easier to manage.  Note the .passwd *must* have only user
permissions.  I had to download the Debian package in order to build
the missing uams_randnum.so from source.  I didn't replace the whole
netatalk package, I just added the missing uams_* to /usr/lib/
netatalk.  It looks like Debian testing is built using PAM, so
uams_clrtxt.so softlinks to uams_pam.so.  I don't even remember why I
needed the uam_randnum, but I think it was for the IIgs.

My atalkd.conf files looks like:

eth1 -phase 2 -net 2 -addr 2.99 -zone "HomeEther"

My AppleVolumes.default looks like:

~/                        "NetHome"        options:prodos

Hope that helps,

Dave...

One of the reiterations was Ubuntu and then I loaded MythTV onto it
from the repository, but ultimately did it the other way around for
the last time.  I had  the same results all around though.

It may be the bridges performing the Phase 1 to Phase 2 translation.
The Sonic Systems bridge that I tried may not be doing that.   I'll
test with a Gatorbox or the other routers I have.

For IIe clients, that works just fine.

You went to more trouble than you needed to!  Here are the directions I worked
up when working with Tony:

----------------------------------

For Apple 2 compatibility, the deb package must be build with

DEB_BUILD_OPTIONS=ssl

set in the environment.  This will additionally require that
libssl-dev be installed on the system.  By doing so, netatalk will
support so-called 'RANDNUM' authentication.  At login, the
/etc/netatalk/afppasswd file is used for lookup, NOT the underlying
PAM or Unix systems.  Plaintext login does try to work through
pam_unix, but is not functional in the few attempts I've made to use
it.

Both the IIe workstation card and IIgs built-in Appletalk are capable
of authenticating over RANDNUM.  (NOTE:  Not sure if IIe actually does support
RandNum - need to verify)

In addition to the build pre-requisites listed in the .dsc file, the
following are needed:

cracklib2-dev (for libcrack)
libkrb53 (for libk5crypto)
libssl0.9.8 (for libcrypto)

The second and third item above AND libgssapi_krb5 require "unversioned"
symlinks to the versioned libraries, e.g. in /usr/lib:

$ ln -sf libk5crypto.so.3 libk5crypto.so
$ ln -sf libcrypto.so.4 libcrypto.so
$ ln -sf libgssapi_krb5.so.2 libgssapi_krb5.so

if any or all these links fail to exist on the system.

Procedure for build:

$ dpkg-source -x netatalk_2.0.3-4a2.dsc

$ cd netatalk_2.0.3

$ DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot -b

Use files in netatalk_config archive as guide for setup.  Do NOT overlook
creation of /etc/netatalk/afppasswd, using the /usr/bin/afppasswd utility.

This package has been verified to work on 64-bit Ubuntu Hardy.

Update 1/2/2010:  Verified build on Karmic

---------------------------------------------------------

Build procedure:

Place these in a common directory where you have write permissions:

netatalk_2.0.3-4a2.diff.gz
netatalk_2.0.3-4a2.dsc
netatalk_2.0.3.orig.tar.gz

Then, unpack:

$ dpkg-source -x netatalk_2.0.3-4a2.dsc

change into the newly-created directory and build:

$ DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot -b

(skip the -rfakeroot flag if you are already root at the time)

purge any existing netatalk package completely:

$ dpkg --purge netatalk

and install the new one:

$ dpkg -i netatalk_2.0.3-4a2.deb

Then, add the the appropriate 'ethN ..' line to /etc/netatalk/atalkd.conf.

Prevent a future apt-get upgrade from replacing this back-level version
(details to be added).

---------------------------------------------------------------------

Yes, required for the IIgs to log in.

After the above build and install occurs, you will have the normally-missing
afppasswd utility required to setup randnum authentication.  I keep hearing
suggestions that PAM can somehow be used for this, but I've never been able to
get that to work.  My suspicion is that applies strictly to cleartext login.

Steve

Testing with an AppleTalk "router" (an EtherRouteTCP/II) instead of a
"bridge" type of adapter allowed me to see the Kubuntu box from the
IIgs.

Searching the net for info, it looks like the IIgs uses AppleTalk
Phase 1.  A bridge would pass it through EtherTalk, but Phase 1 is not
recognized by Linux (at least as mentioned in some old docs at
http://www.anders.com/projects/netatalk/old/atalkd.conf.html and also
in Linux's ddp.c source).  Using a router that has Phase 1 on its
LocalTalk segment, and Phase 2 on its EtherTalk segment seems to
provide the necessary translation.

Out-of-the-box, the randnum UAMS is not enabled so I still wasn't able
to login to the Linux box.  I have to check if it can be enabled
through config or if a recompile of netatalk is needed.

The Farallon adapters (which I don't have) probably have the same
limitations as the Sonic Systems bridge that I tested with.

Great!  I think that answers the question.  I was unaware that the Gatorbox
was actually converting Phase 1 --> Phase 2!  I thought the only difference
was the range of addresses permitted.

That's correct.  It's very easy to rectify the situation, though.  Please see
my earlier posting for complete details.  Do not hesitate to contact me in
private e-mail if you need any help getting that going!

I believe that the Mac Localtalk / Ethertalk bridge application does a similar
conversion.  I had suggested to Tony that he give that a try.

Steve

Turned out that I really didn't need a secure authentication, so I
just used Marsha's patched AppleShare CDEV to use the cleartxt UAM
(cleartxt and DHX2 came as defaults in the netatalk package grabbed by
Kubuntu).  AFP shares were easily mountable into the IIgs Finder.

Since I was testing AppleTalk/AppleShare anyway, I fired up the old
Windows 2000 Server with the AppleTalk protocol add-in and the IIgs
can mount the shares there too.  This worked with either the
EtherRouteTCP/II router or the Sonic Systems bridge.  Apparently,
Windows' AppleTalk add-in can understand EtherTalk Phase 1.  I think
Windows 2003 Server was the last version that supported the AppleTalk
add-in (it isn't present on the Win7 install disc).

Sorry for chiming in so late, but I remembered a thread from a couple
of years ago in which a guy got an AsanteTalk working with Netatalk:
http://groups.google.com.au/group/comp.sys.apple2/browse_frm/thread/1c748fa1032249be

Do any of the suggestions there help out?

I would have thought that an AsanteTalk would be in the same class as
the Farallon and Sonic AppleTalk bridges?

I've not tried any of the suggestions within that thread, but I
thought I'd bring it to your attention on the off chance that it
provides a solution.

Cheers,
Mike

Geoff

Geoff,

You have delved into Appletalk internals a bit, haven't you?  Can you confirm
that the IIgs (and presumably the IIe Workstation card) only speak Phase 1
Appletalk?

I've now seen two different theories for Tony's problem:

1. IIgs speaks Phase 1 and Linux does not support it.

2. Bridge must advertise a zone (is this the same as supporting Phase 2?  In
other words, are zones something that were introduced with phase 2?).

Steve

Linux was not responding to these packets, so it would appear to be
discarding these packets as faulty.

The main change was that Phase 2 allowed a range of network addresses
instead of a single network address to be allocated to a network
allowing more than 253 to be on the network at once.
Phase 2 also saw the introduction of Tokentalk.

Zones existed prior to Phase 2.

I don't think bridges are required to have zones as they make the
device appear as if it is on the other side of the bridge. and there
might not be a router on the other side of the bridge to provide the
zone or network address information.
I haven't played with bridges and that is one of the reasons I was
asking if a network capture could be provided.
It may help me to modify Linux appletalk/netatalk to support these
types of devices.

Geoff

What's odd is that Tony tried the IIgs through a Farallon etherwave bridge and
had similar (bad) results.  I believe he mentioned trying a Gatorbox, too.

But, it seems you may be on to something.

That's what I thought.  The claim on an old usenet post about Linux DDP
lacking support for Phase 1 is, I believe, incorrect.

So, to be sure my terminology is correct:  My Gatorbox, and its predecessor
Kinetics FastPath 4, are routers rather than bridges?  Or, can they operate in
a bridged mode as well?

Steve

Geoff

After fooling around with routers, both instigated by NetATalk itself
and external devices (GatorBox), the IIgs now sees absolute squat.

Aside from the server being a linux box this time around, many many
years, many many networks, all this stuff has just worked.  Gatorbox
not required.

If I want files off a PowerMac, ShareWay worked just fine. EtherWave,
LocalTalk via an LC III that had LocalTalk Bridge on it, Marinetti
with same LC III and Vicom Sluceway serving up MacIP. Again, via
Ethernet card, EtherWave or "Telephone Talk" localtalk node jerk off
clone connector. Didn't matter a bit, or byte.

Pa-the-tic.

I've swapped wires, changed out switches, added hubs, isolated stuff.
The fact that the PowerMac sees it all, the Mac Portable sees it all -
through the same physical cabling, switch, router, etc - tells me it's
not a link issue.  Even the same transceiver on the IIgs, stuck to the
PowerMac - it's fine.

There was a specific point to setting all this up. it's causing quite
a backlog in progress.

Some folks have echoed similar issues where it just plain does not
work, others say it works just fine.

I don't have any of the "modified" AppleShare stuff on the IIgs. All
the years, I've never had to use any of that. Since I can't even get
Ubuntu to show up in the server window to choose from, there's no
point.

It's all behind a firewall, I don't care about plaintext, I don't have
the secrets to the Death Star here. I don't care.

3.5 HDD is your friend :-)

Stay calm. Breathe and relax,

antoine

Don't blame you for being frustrated.  Wish you lived closer!

Is it your feeling that Geoff's interpretation of the bad packets is incorrect
or irrelevant?

Thats it.

Do you have a IIe and workstation card available?

I take it that does not do any better?  Geoff is a whole lot more clued in
about networking than I am, and I have confidence he'll get to the bottom of
things.

I finally spent some 'spare time' over a couple of weekends installing
Netatalk (via Macports) on an external hard drive connected to one of my OS
X 10.4.11 / Tiger Macs, in the hope that it could become a file sharing
server solution for several Apple IIGS machines.

A little background..............

As most of you know, the Apple II machines (the IIGS and IIe with
Workstation Card) use the legacy 'AppleTalk' protocol, and more specifically
the AFP 2.1 specification. And, Netatalk, at least when running on _some_
platforms, will serve files to clients using this protocol and spec.

Added to that is that Mac OS X (up through OS X 10.5 / Leopard) still
supports the basal DDP protocol that is at the core of Appletalk, and that
makes it possible for pre Snow Leopard machines to speak to Appletalk-only
printers via PAP (printer access protocol), as well as broadcast / discover
via NBP (Appletalk name binding protocol) to Appletalk-speaking printers and
clients connected to an Appletalk-capable network.

In the case of my particular Apple IIGS connection, that Appletalk network
connection is via 'Ethertalk', using a Farallon iPrint adapter, which
appears to do its job of converting AppleTalk over LocalTalk (IIGS) into
AppleTalk over Ethernet (Mac) well.

In fact, using the 'atlookup' command from the OS X Terminal reports the
following for an iPrint-connected AppleIIGS:

     Some-Mugs-PowerMac-G3:~ somemug$ atlookup
     
     Found 3 entries in zone *
     ffaa.ac.80      Some Mug's Power Mac G3:Darwin
     ff00.52.80      Silentwriter 95:LaserWriter
     ff00.14.81      guest:Apple IIgs

Sadly, as most of you know, Apple's own 'AppleFileServer' provided as the
core of the Mac OS X 'Personal File Sharing' capability does a
unsatisfactory job of serving files to an Apple II. In OS X versions 10.1 -
10.5, the Apple IIGS AppleShare Control Panel will 'see' the Mac as a
'Server' thanks to NBP support, and in OS X versions 10.1 - 10.3, the IIGS
will actually connect to the Mac as a 'Client'. Unfortunately, even when a
successful 'Client' hookup is established, the file sharing is essentially
'read only', as any attempted 'write' operations from the Apple IIGS to the
Mac produce an error message, which I _suspect_ results from a small change
in the AFP specification between version 2.1 and 2.2 that affected ProDOS
writes.

And, of course, as of OS X 10.4 / Tiger, the Mac _only_ supports AFP over
TCP/IP, and AppleTalk only machines (e.g. Apple IIGS with AppleShare Control
Panel) need not apply.

Anyway, enough background .................

Boys, I'm afraid I've fallen on my face on getting something to work for us.

Yes, Netatalk does compile and run on a Mac running OS X.

The 'gotcha' is this:

Even if your flavor of Mac OS X supports DDP (all pre 10.6 / Snow Leopard
systems), the Netatalk afpd (Apple File Protocol Daemon), when running on
Mac OS X, will _not_ serve files using the AppleTalk protocol. It will only
serve files using TCP/IP.

And it doesn't seem to matter how you build Netatalk or how you later set
the parameters in the various configuration files either.

So, my conclusion is that if you expect Netatalk to serve files to an Apple
IIGS (or IIe with Workstation Card), you'll need to build it and run it on
something _other_ than OS X. (e.g. - a Linux box).

If any of you fellas has any pull or stroke with the smart boys who do the
Netatalk development work, maybe you can ring some bells and get them to
change this - specifically, to add AFP over _AppleTalk_ support to OS X
builds of Netatalk.

That would be swell, at least by me. Heck, I'd send a $100.00 Amazon gift
card to the clever guy who made it all work. Really.

Hugh Hood

in article C75116FC.EF...@earthlink.net, Hugh Hood at
hugh...@earthlink.net wrote on 12/18/09 11:24 AM:

> Fellas,
>
> I've been toying with installing Netatalk on an OS X 10.4.11 (Tiger) Machine
> to serve as a file server for several of my Apple IIGS machines.
>
> Netatalk (2.0.5) is available from Macports, so installation shouldn't be
> too bad.
>
> Netatalk  will handle the AFP 2.2 that the IIGS uses. Moreover, thanks to
> Steven Hirsch's efforts, Netatalk supports ProDOS and Apple II clients.
>
> I'll hook this up with a Farallon Localtalk to Ethertalk device and give it
> a go.
>
> I had done this same thing a couple of years ago on an OS X 10.3 (Panther)
> setup using OS X's built-in AppleTalk file sharing, but ran into the same
> issue as Roger Johnstone (and others) reported many years ago in this
> newsgroup, that being:
>
>
>> The bigger problem is that Apple 'repurposed' a flag originally used for
>> storing ProDOS files on a Mac volume. As a result while the IIGS can
>> read files fine from the Mac it can't write any files to it. [without
>>  receiving an error message, that is]
>
>
> My question:
>
> Has anyone here used Netatalk on an OS X machine and sucessfully written
> files from the IIGS to the Mac? Also, are file attributes (Type/Creator)
> preserved?
>
> Thanks.
>
> If no one has done this, I suppose I'll give it a try in the next month or
> so and report back.
>
> I know the Linux guys report Netatalk works great with the IIGS, but what
> obout you OS X guys?
>
> Hugh Hood
>

That makes sense, since kernel support was required for Linux to speak DDP.

Steve