iksd.txt

C-Kermit源码。是使用串口/Modem和网络通讯的程序

		  IKSD - The Internet Kermit Service Daemon

		      UNIX SYSTEM ADMINISTRATOR'S GUIDE

			      The Kermit Project
			     Columbia University
		       http://www.columbia.edu/kermit/

			      D R A F T  #  1 5

			  Sun Nov 14 17:55:09 1999


The Internet Kermit Service Deamon (IKSD) is C-Kermit 7.0 or later, started
in a special way.  At this writing, only the UNIX version of C-Kermit
contains IKSD functions, but these can be (easily?) added to the VMS, VOS,
AOS/VS, and other versions too.  

This is a draft.  Everything here is subject to change.


CONTENTS

  1.   Why IKSD?
  2.   System Configuration
  3.   Compile-Time Configuration Options
  4.   Runtime Configuration Options
  4.1.   Command-Line Options
  4.2.   System Logging
  4.3.   The IKSD Log File
  4.4.   IKSD Configuration File
  4.5.   Initialization File
  5.   Access to Services
  5.1.   Automatic Settings
  5.2.   Authentication
  5.3.   The DISABLE Command
  5.4.   Shell Access
  5.5.   Anonymous Users
  5.6.   Management Information
  6.   Open Issues
  6.1.   Connection Establishment
  6.2.   Shell Access
  6.3.   External and/or non-Kermit Protocols
  6.4.   Additional Administrative Controls
  6.5.   Known Bugs
  7.   Monitoring
  7.1.   Database Record Format
  7.2    The Display Module
  7.3.   Database Management
  8.   Testing


1. Why IKSD?

Why run an Internet Kermit Service Daemon when you are already running
an FTP server?

 . Like FTP, Kermit provides a service that can be accessed from many
   different platforms with a consistent set of commands, but unlike FTP,
   these commands include programming constructions such as variables,
   arrays, looping and selection mechanisms, and local and remote procedure
   calls, thus allowing file transfer and management operations of arbitrary
   complexity to be easily automated.

 . Like FTP, Kermit provides both text- and binary-mode data transfer, as
   well as file management capabilities.  But Kermit also offers numerous
   features lacking from FTP, such as character-set translation, flexible
   file selection mechanisms, preservation of timestamps and permissions,
   automatic per-file text/binary mode switching (important in cross-platform
   transfers), cross-platform directory-tree transfer, and a selection of file
   collision options including "make backup copy of existing file and accept
   incoming file", "reject incoming file", "accept incoming file only if newer
   than existing file", etc.

 . Unlike FTP, Kermit supports atomic file movement, in which the source
   file can be deleted (or renamed, or moved) when and only when it has been
   transferred successfully, as part of the transfer operation itself.

 . Unlike most FTP implementations, Kermit supports recovery of interrupted
   transfers from the point of failure.  You can even use it to recover
   interrupted FTP transfers when FTP itself does not offer this option.

 . Unlike standard FTP, Kermit can transfer data through firewalls or
   proxies or NATs on a single well-known port (unless the TCP port for the
   connection has been explicitly filtered).

 . Unlike FTP, Kermit can transfer data across a combination of transports
   (e.g. dial-up to a terminal server and thence to an Internet host).

 . Authentication and data transfer can take place over secure connections
   (mutually authenticated and encrypted) using established Telnet
   authentication and encryption options.

 . Unlike traditional Kermit use over Telnet, anonymous access is possible,
   and the considerable overhead of the intervening Telnet server and
   pseudoterminal service is eliminated.

 . Unlike the FTP daemon (ftpd), the IKSD can be monitored in real time
   by the system administrator (see Section 7).

A prototype IKSD is available for public access at:

  kermit.columbia.edu, port 1649

This service is based in part on a new Telnet Kermit Option described in an
Internet Draft:

  ftp://ftp.ietf.org/internet-drafts/draft-altman-telnet-kermit-server-01.txt

The Internet Kermit Service itself is discussed in a separate Internet Draft:

  ftp://ftp.ietf.org/internet-drafts/draft-columbia-kermit-service-01.txt


2. System Configuration

WARNING: Do NOT attempt to install a pre-7.0 version of C-Kermit as an IKSD.
Earlier versions do not perform the necessary authentication and security
functions, and therefore will leave your system wide open to anonymous root
access.  (Don't worry, the installation procedure described here, if you
follow it, and the interface to IKSD, prevent you from starting an earlier
version of C-Kermit as an IKSD, since it lacks the needed command-line
options and will halt with a usage message if you try to use them.)

Directory organization, file system, naming conventions, and other
administrative details vary from system to system and site to site, so
specific instructions can not be given here.  In general, however, the steps
are:

 a. The C-Kermit executable should be copied to the directory that is 
    normally used for launching Internet services, and renamed to "iksd".
    Normally the owner and group should be root and the permission 0750.

 b. The following entry should be added to the Internet services file,
    normally /etc/services:

      kermit   1649/tcp

 c. An entry must be made in the inetd configuration file, normally
    /etc/inetd.conf.  See your system-specific documentation for the
    name, location, and format of this file, e.g. "man inetd" and
    "man inetd.conf".  A typical example might be:

      kermit  stream  tcp  nowait  root  iksd -A <other-iksd-options>

    Or, with TCP wrappers:

      kermit  stream  tcp  nowait  root  tcpd iksd -A <other-iksd-options>

    Include full pathnames for tcpd and iksd if required.  See Section 4
    for <iksd-options>.

    NOTE: Different platforms might require different syntax, e.g.:

      kermit stream tcp nowait root /usr/sbin/iksd iksd -A <other-iksd-options>

 d. When using TCP wrappers, make the appropriate entries in its
    configuration file(s), such as /etc/hosts.allow and /etc/hosts.deny.
    See the TCP wrappers documentation for further info.

 e. Make any required hard or soft links to the iksd executable.

 f. If desired, create an IKSD configuration file (/etc/iksd.conf by default).

This setup allows multiple simultaneous IKSD sessions.  A fresh IKSD process
is started for each session, and disappears when IKSD exits, automatically
closing the session and the connection.

To kill a particular instance of IKSD, find its pid with "ps ax | grep iksd",
and then kill -9 <pid> (as root).

To update the IKSD program, simply replace the executable in the "launch"
directory ((a) above).

To discontinue IKSD service quickly, delete the iksd executable, or (to avoid
unwanted console logging) replace it with (say) /bin/false.


3. Compile-Time Configuration Options

You can use any C-Kermit configuration as an IKSD, ranging from a fully
configured version, to a special IKSD-Only version, to any of the various
"stripped-down" versions, as described in the C-Kermit Configuration Guide
(ckccfg.txt) and/or Installation Instructions (ckuins.txt).

The following compile-time options are specific to or of special relevance
to the IKSD:

TNCODE - Required for IKS.
  Include Telnet protocol code, even if networking code is not included.
  Defined by default if TCPSOCKET defined, otherwise must be defined
  explicitly. 

IKS_OPTION - Required for IKS.
  Include code for the new Internet Kermit Service Option.
  Currently defined automatically if TNCODE is defined.

CK_LOGIN - Required for IKS.
  Include user authentication code.  Defined automatically for UNIX unless
  NOLOGIN defined.

CK_PAM 
  The IKS is to be compiled to use PAM (Pluggable Authentication Modules)
  to authenticate the user for interactive logins instead of Unix password
  files.  The default PAM service type for IKSD is "kermit".

PAM_SERVICE_TYPE 
  If CK_PAM is defined and you wish to use a service type other than
  "kermit" you can define PAM_SERVICE_TYPE to equal the string you
  wish to use.

CK_SHADOW
  If your host utilizes the shadow password system for storing user
  passwords the IKS must be compiled with support for shadow passwords.
  This might also require some additional libraries added the LIBS
  clause, such as -lgen, for loading the getspnam() routine.

CKSYSLOG
  Include code for making syslog entries.  This symbol is defined
  automatically if (a) CK_LOGIN is defined; (b) UNIX is defined; and (c)
  NOSYSLOG is not defined.

CKWTMP
  Include code for making wtmp log entries.  This symbol is defined
  automatically if (a) CK_LOGIN is defined; (b) UNIX is defined; and (c)
  NOWTMP is not defined.

WTMPFILE
  String containing pathname of the default wtmp logfile.  If not specified,
  a default is supplied, currently /var/log/wtmp on Linux and /usr/adm/wtmp
  elsewhere.  The wtmp file can also be specified at runtime; see next
  section.

CK_CURSES
  Need not be defined in an IKSD-only build, since curses is used only
  in local mode, and the IKSD is always in remote mode, plus the fact that
  curses initialization can cause spurious error messages in IKSD since it
  might not have a terminal type (TERM variable) in its environment.

NOLOCAL
  This may be defined to exclude all code relating to the making of
  both serial and network connections from the C-Kermit/IKSD executable.
  This code is presently not needed, and is never used, in the IKSD.
  Compiling it out reduces the size of the executable and eliminates any
  possibility that a loophole could be exploited to use the IKSD as a
  relay.

NOPUSH
  This symbol may be defined to exclude all code that is used to access
  local shell or system functions, such as the RUN (!) command, the server
  end of the REMOTE HOST command, file-transfer pipes and filters, etc.
  Note that such code is disabled at runtime in the IKS anyway; compiling
  it out completely reduces the size of the executable and the risk of
  loopholes.

NOICP
  Disables the interactive command parser as well as long-form command-line
  options (Section 4.1).  In this configuration, the IKS runs only in Kermit
  Server mode, and the size of the executable is reduced dramatically.
  WARNING: NOICP also inhibits extended command-line options (the ones that
  start with "--"), since these share the same parsing routines as the
  interactive parser.

NOSPL
  Disables the script programming language (INPUT, OUTPUT, FOR, WHILE,
  IF, SWITCH, macros, variables, etc) without disabling the interactive
  command parser. 

NOGETUSERSHELL
  Add this if the link steps fails because it can't resolve getusershell()
  and/or endusershell().  Normally, IKSD will refuse a login if the user's
  login shell is not one of those returned by getusershell() (normally,
  getusershell() simply lists the shells listed in /etc/shells, but we
  can't depend on this).  Thus if your site "invalidates" user IDs by
  setting their login shell to something that is not really a shell (like
  /etc/nologin), but does not have a getusershell() function, IKSD will
  still let such users log in unless (a) you put them in the forbidden
  users file (see Section 4.1), or (b) add some code to ckufio.c to check
  for whatever invalid or valid shells might apply at your site.

NOIKSD
  This defines the symbols NOLOGIN, NOSYSLOG, NOWTMP, NOPRINTFSUBST, which
  in turn prevent the definition of symbols (CK_LOGIN, CKSYSLOG, etc) that
  cause IKSD-specific code to be included.

CK_SYSINI
CK_DSYSINI
  System-wide initialization file; see Section 4.4.

IKSD
  Is defined automatically if NOIKSD is not defined.

IKSDCONF
  The name of the IKSD configuration file.  In UNIX this is
  "/etc/iksd.conf" by default; elsewhere "iksd.cfg".

In an IKSD-only build, you should omit the termcap/termlib and (n)curses
libraries, and set up the link step to make sure the IKSD is linked with
the same user authorization libraries used by your local login program.
Here is a sample for SunOS 4.1.3 at a particular site:

sunos41giks:
	@echo Making C-Kermit $(CKVER) for SunOS 4.1 with gcc for IKS...
	$(MAKE) wermit "CC= gcc" "CC2= gcc" \
	"CFLAGS= -O -DSUNOS41 -DNDGPWNAM \
	-DTNCODE -DNOLOCAL -DNOPUSH $(KFLAGS)" \
	"LIBS= -L/usr/local/lib -lpwent -lcrypt"

-DNOLOCAL: excludes all code that is used to make connections.   
-DNOPUSH:  excludes all code that accesses local system shells and commands.
-DTNCODE:  includes Telnet protocol code even though -DNOLOCAL is included.

At sites that use shadow passwords, you'll need to add -DCK_SHADOW to CFLAGS
and perhaps -lgen to LIBS.

Also note that the crypt() function, which is used for verifying passwords,
is normally found in libc, but on some platforms it has been broken out into
a separate library, such as -lcrypt, and in that case must be included in
the LIBS clause.

For PAM installations, here's an example /etc/pam.d/kermit file that uses
EPS password files for user authentication and the standard unix modules for
account and session management:

  auth      required       /lib/security/pam_eps_auth.so
  password  required       /lib/security/pam_eps_passwd.so
  account   required       /lib/security/pam_unix_acct.so
  session   required       /lib/security/pam_unix_session.so

Kerberos IV, Kerberos V, and/or SRP, or any other authentication / security
mechanism may be also selected at build time if you have the appropriate
libraries and header files installed on your system.  See security.txt
for further details.

For a build that excludes all IKSD functions, it is normally sufficient
to add NOIKSD to the CFLAGS, e.g.:

  make aix41 KFLAGS=-DNOIKSD


4. Runtime Configuration Options

The IKSD can be configured at runtime with command-line options or by an
initialization file or other auxilliary file(s), in any combination.

4.1. Command-Line Options

To start C-Kermit as an Internet Kermit Service Daemon, include the '-A'
command-line option.  This option not only configures C-Kermit as an IKSD, but
it also ensures that you are running a version of C-Kermit that can do this,
i.e. C-Kermit 7.0 or later built with all the necessary compile-time options
(Section 3).  If either of these conditions does not apply, the '-A' option
will be invalid and the Kermit program will halt immediately.

In addition to -A and the command-line options described in "Using C-Kermit"
(2nd Edition), plus any other new ones described in the ckermit2.txt file, a
selection of new long-form options apply specifically to the IKSD.  Long-form
options work as follows:

 a. All long-form options must begin with "--" (two hyphens) or "-+".  If the
    option begins with "--" it is executed before or after the C-Kermit