Attaching your SGI to the unizh.ch Network

Last modified: Dec 23 1999 13:55 / go

Attaching your SGI to the unizh.ch Network

This is a step by step instruction on how to attach your SGI to the network of the University of Zürich. Altough some configurations can be done in graphics windows this instructions will be restricted to the editing of the respective configuration files. You can use the editor of your choice. If you don't know about vi or emacs try typing > jot in a Unix-Shell followed by the file name eg. > jot resolv.conf.

Please read the security part of these instructions very carefully. Please also note that if your sendmail is activated but not the proper version or not configured absolutely correct, your SGI can be used as relay host by anybody on the Internet (just about 100'000'000 people). You might get nasty mails from people on the Internet asking you why you sent them junk mail. Please go to the sendmail chapter to see how you can turn off sendmail.

Attaching your SGI to the Network of the University of Zürich

Make shure you have the correct IP-Address and Gateway-Address for your machine.
(You should have received it from your EDV-Koordinator)
They should look somewhat like this:

IP-Address: 130.60.XX.XX
GW-Address: 130.60.XX.1

You have to substitute the XXes in the examples with the corresponding numbers given to you by the EDV-Koordinator.

Think of a reasonable and easy to remember name for your machine. Names containing the three letters sgi make it easyer for our network people. Here are some good examples using the Institutes abbreviation, sgi and an internal code, but don't use them, somebody else thought of them first:

rzusgigo
ocisgi8
biociris2

This example is only useful if you are a Marine Biologist:

Chaetopterus-variopedatus

Make sure you know the root password of your machine. New machines do not have a root password so you have to invent one. Try an 8 letter word with some numbers or special characters like & ( ) , . nobody but you can guess.

Start up your machine and log in as root. If it is the first time you start the machine you can now set the root password. In a Unix-Shell window type the command > passwd and enter your root password. Press return and you will be asked to verify the password given.
CAUTION! DON'T ever forget this password until you change it the next time!

Now you can start configuring your machine. (Remember, everything that follows now is happening on the command line of a Unix-Shell window on your machine except if you work with the graphical editor jot).
Let's start with the simple things:
Type > cd /etc and edit the file sys_id. Put in the name of your machine.

Type > cd /etc and edit the file hosts. Go to the last line and type your IP-Address followed by a space and the name of your machine. Click > here < for an example.
Type > cd /etc and edit the new file resolv.conf. It should look like this:
Please do not put this line into resolv.conf anymore: hostresorder local bind /etc/resolv.conf for Irix 5.3, 6.2-5 domain unizh.ch nameserver 130.60.128.3 nameserver 130.60.64.51

Now, to make your machine compatible with older software you have to type the following two mysterious commands:

> rm /usr/etc/resolv.conf
> ln -s /etc/resolv.conf /usr/etc/resolv.conf

Type > cd /etc/config and edit the new file ifconfig-1.options. Put in the line:

up arp netmask 255.255.255.0

Now comes a difficult step. Have your Gateway Address handy:
130.60.XX.1 1 is your Gateway address followed by a space and then 1.
For Irix 5.3
Edit the file /etc/rc2.d/S30network.
Go to line 355 and put in the following line after the else:
$ROUTE add default 130.60.XX.1 1
The region around line 355 should look like this:

348 if test "$if1name" != ""; then 349 $IFCONFIG $if1name inet $if1addr 2>/dev/null 350 $IFCONFIG $if1name down 2>/dev/null 351 fi 352 $IFCONFIG lo0 $localhost 353 $ROUTE -q delete net $if1addr $if1addr >/dev/null 2>&1 354 $ROUTE -q add 224.0.0.0 $localhost 0 >/dev/null 2>&1 355 else 356 $ROUTE add default 130.60.XX.1 1
357 358 # Initialize other boards if this host is a gateway (no harm if 359 # they are missing). Systems with more than 2 interfaces must 360 # update /etc/config/netif.options (see comments in the file). 361
old 6.2 Versions (if unsure check here)
Edit the file /etc/rc2.d/S30network.
Go to line 388 and put in the following line after the else:
route add -net default 130.60.XX.1 -hopcount 1
The region around line 388 should look like this:

379 $IFCONFIG lo0 $localhost 380 if1net=`$IFCONFIG $if1name \ 381 | sed -n 's/^[ ]*inet *$[^ ]*$.*/\1/p' 2>/dev/null` 382 if test -n "$if1net"; then 383 $ROUTE delete $if1net -net >/dev/null 384 fi 385 $ROUTE add 224.0.0.0 $localhost -interface >/dev/null 386 else 387 388 route add -net default 130.60.XX.1 -hopcount 1
389 390 # Initialize other boards if this host is a gateway or multi-homed 391 # (no harm if they are missing). Systems with more than 2 interfaces 392 # must update /etc/config/netif.options (see comments in the file). 393
For Irix 6.2-6.5
Depending on the patch-level of Irix 6.2 check if the file
/etc/config/static-route.options
exist (it should exist for Irix 6.3, 6.4. and 6.5.). If it does not exist, goto old Irix 6.2.
Enter the following line at the end of /etc/config/static-route.options:
$ROUTE $QUIET add -net default 130.60.XX.1

New in 6.5 is nsd
If nsd is set to on in chkconfig (default) and if you do not have NIS (Yellow Pages), you have to edit the file:
/etc/nsswitch.conf to look like this (this is the nsswitch.conf file of the zisgi):

12 #automount(dynamic): files 13 #bootparams: files 14 capability: files 15 clearance: files 16 ethers: files dns 17 group: files 18 hosts: files dns 19 mac: files dns 20 mail(null_extend_key): ndbm(file=/etc/aliases) 21 netgroup: nis 22 #netid.byname: nis 23 networks: files dns 24 passwd: files(compat) [notfound=return] 25 protocols: files 26 rpc: files 27 services: files 28 shadow(mode=0700): files 29 #ypservers: nis

The rest is easy:

Type > chkconfig routed off
Type > chkconfig timed off

Now everything is set up correctly. Before rebooting you should check every file you edited to controll the entries once again.
If everything is in correct you can reboot your machine now.

Security!
You have to be aware that now your machine is open to all of the 500'000'000 users on the internet. To be shure nobody can break into you computer you have to do the following as root:

By default SGIs come with some accounts without password. You should change that as fast as possible. Go to the /etc directory and type > chmod 644 passwd. Then edit the file passwd. A passwd entry is one line each and looks like this:
rzugo:byXrBxNz1l71g:541:500:Dr.A.Godknecht,ZI:/rzu/rzugo:/bin/tcsh
First comes the name then a colon then the password then a colon then the user-ID etc.
You will notice that some accounts have no passwords. Those accounts look like this:
guest::498:20:Guest Account:/home/rzusgi/sgi/guest:/bin/csh
To give these accounts a password or better to lock them you have to put a star (*) as password between the 2 colons.It should then look like this:
guest:*:498:20:Guest Account:/home/rzusgi/sgi/guest:/bin/csh

To prevent anybody from cracking your passwords you should make the passwords invisible for everyboby except root. There is a tool that does just that. It is called pwconv and produces a "shadow" password file that is only readable by root and replaces the passwords in the /etc/passwd file by x es. Before producing this shadow file you should check the corrected password file with the utility called pwck.
Type > pwck
You can ignore messages like the following:

sysadm:x:0:0:System V Administration:/usr/admin:/bin/sh Login directory not found diag:x:0:996:Hardware Diagnostics:/usr/diags:/bin/csh Login directory not found
If no complaints about passwords are reported you can transfer passwords to the shadow file by typing:

> pwconv

To prevent that just anybody can use your SGI as a relay host for his mail and that you don't get complaints from all over the world that some junk-mail was sent from your machine to theirs, you have to turn off sendmail:
> chkconfig sendmail off
If you turn off sendmail, you will not be able to receive e-mail but you will still be able to send e-mail. If you want to receive e-mail and want to keep sendmail on, make very, very sure that your sendmail is the right version ant that it is configured absolutely correct.
SGIs Window manager is based on X-Windows. Normally anybody can send a X-Windows to any X-Windows workstation or get information on what a user is doing at the moment on his machine. This is a very risky configuration and you should close this hole in your machines security especially for the Superuser or root. This does not make life easyer for you but it is necessary. As always there are different ways to do this:
- If you want to go the easy way edit the file .sgisession in the home directory of every user who does not like to be observed by nosy strangers. You really MUST do it at least in the roots home directory.
  Put the line:
  in the .sgisession file. This prevents any access to your terminal by strangers. It also prevents you getting any windows from a remote machine you might be logged into during your session. The normal error message you will receive looks like this:
```
   godknech@biox 1 > xterm
   Xlib:  connection to "rzusgigo.unizh.ch:0.0" refused by server
   Xlib:  Client is not authorized to connect to Server
   Error: Can't Open display
```
  If this happens you can type the following line on YOUR machine, replacing machinename by the name of the remote machine:
- The other way would be to close the whole machine via the xdm configuration files. This is rather complicated as you have to be aquainted with the MIT-MAGIC-COOKIE and Xauthority mechanism. This is beyond the scope of this installation instructions. You can read about it in the xdm, Xsgi, xauth and related manual pages. But PLEASE don't ask us about it.
Sometimes there are security problems detected. Have a look at the security advisories on the SGI security page of the Center for Computing Services (ZI/RZU). Most of the security patches are on the Center for Computing Services (ZI/RZU) ftp server.

Correct System Time

The Center for Computing Services (ZI/RZU) provides a Time server that gives the actual time very accurately. To activate the setting of your system clock bu the Center for Computing Services (ZI/RZU) time server you have to do the following as root:

Edit the file /etc/TIMEZONE and make it look like this:

Irix 5.3 Version #ident "@(#)sadmin:etc/TIMEZONE 1.2" #ident "$Revision: 1.6 $" # Set timezone environment to default for the machine #Start: 24.3.96 End: 27.10.96 TZ="MET-1MDT;91/02:00:00,301/03:00:00" Irix 6.2-6.5 Version #ident "@(#)sadmin:etc/TIMEZONE 1.2" #ident "$Revision: 1.6 $" # Set timezone environment to default for the machine # Start Time: 31.3 (96), End Time: 27.10 (95) TZ="MET-01MDT,M3.5.0/2,M10.5.0/3" (note the komma (,) after TZ="MET-1MDT in the 6.2 Version)

 Edit the file  /etc/config/timeslave.options and enter:

    -r 3600 -H time1.unizh.ch

 Now to activate the timeslave you have to type:

    > chkconfig timeslave on

 Reboot your machine.

Last modified:

Dec 23 1999
13:55 / go