In the previous chapter, the concepts behind the operation of a TCP/IP network were discussed. One important topic was not covered. How do the applications communicate? How do services like print/file sharing, electronic mail, File Transfer Protocol, World-Wide Web and others work?

That's where this chapter comes in.  It aims to provide an overview of how network applications work. How do they operate?  How are the configured? What options are open to you?

The chapter starts by giving an overview of how network services work and then moves onto describing in detail how the UNIX operating system starts network services. The chapter closes with a detailed look at some specific network services including file/print sharing, messaging (email) and the World-Wide Web.

In this section we look at how the various network services are provided. When you telnet to another machine, how does it work? When you send an e-mail message to a user at another host, how is it delivered?

The provision of network services like FTP, telnet, e-mail and others relies on these following components

§         network ports,
Network ports are the logical (that means that ports are an imaginary construct which exists only in software) connections through which the information flows into and out of a machine. A single machine can have thousands of programs all sending and receiving information via the network at the same time. The delivery of this information to the right programs is achieved through ports.

§         network servers,
Network servers are the programs that sit listening at pre-defined ports waiting for connections from other hosts. These servers wait for a request, perform some action and send a response back to the program that requested the action. In general network servers operate as daemons.

§         network clients, and
Users access network services using client programs. Example network clients include Netscape, Eudora and the ftp command on a UNIX machine.

§         network protocols.
Network protocols specify how the network clients and servers communicate. They define the small "language" which both understand.

All network protocols, including http ftp SMTP, use either TCP or UDP to deliver information. Every TCP or UDP header contains two 16 bit numbers that are used to identify the source port (the port through which the information was sent) and the destination port (the port through which the information must be delivered.)  Similarly, the IP header also contains numbers which describe the IP addresses of the computers which are sending and receiving the current packet.

Since port numbers are 16 bit numbers, there can be approximately 64,000 (2¹⁶ is about 64,000) different ports. Some of these ports are used for predefined purposes. The ports 0-256 are used by the network servers for well known Internet services (e.g. telnet, FTP, SMTP). Ports in the range from 256-1024 are used for network services that were originally UNIX specific. Network client programs and other programs should use ports above 1024.

Table 16.1 lists some of the port numbers for well known services.

Table 16.1
Reserved Ports

This means that when you look at a TCP/UDP packet and see that it is addressed to port 25 then you can be sure that it is part of an email message being sent to a SMTP server.  A packet destined for port 80 is likely to be a request to a Web server.

Reserved ports

So how does the computer know which ports are reserved for special services?  On a UNIX computer this is specified by the file /etc/services . Each line in the services file is of the format

service-name port/protocol aliases

Where service-name is the official name for the service, port is the port number that it listens on, protocol is the transport protocol it uses and aliases is a list of alternate names.

The following is an extract from an example /etc/services file. Most /etc/services files will be the same, or at least very similar.

echo 7/tcp
echo 7/udp
discard 9/tcp sink null
discard 9/udp sink null
systat 11/tcp users
daytime 13/tcp
daytime 13/udp
ftp-data 20/tcp
ftp 21/tcp
telnet 23/tcp
smtp 25/tcp mail
nntp 119/tcp usenet # Network News Transfer
ntp 123/tcp # Network Time Protocol

You should be able to match some of the entries in the above example, or in the /etc/services file on your computer, with the entries in Table 16.1.

Exercises

Look at ports, netstat

The netstat command can be used for a number of purposes including looking at all of the current active network connections. The following is an example of the output that netstat can produce (it's been edited to reduce the size).

[david@cq-pan:~]$ netstat -a
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        (State) User                                                                           root
tcp        1   7246 cq-pan.cqu.edu.au:www  lore.cs.purdue.e:42468 CLOSING root
tcp        0      0 cq-pan.cqu.edu.au:www  sdlab142.syd.cqu.:1449 CLOSE   root
tcp        0      0 cq-pan.cqu.edu.au:www  dialup102-4-9.swi:1498 FIN_WAIT2 root
tcp        0  22528 cq-pan.cqu.edu.au:www  205.216.78.103:3058    CLOSE   root
tcp        1  22528 cq-pan.cqu.edu.au:www  barney.poly.edu:47547  CLOSE   root
tcp        0      0 cq-pan.cqu.edu.au:www  eda.mdc.net:2395       CLOSE   root
tcp        0  22528 cq-pan.cqu.edu.au:www  eda.mdc.net:2397       CLOSE   root
tcp        0      0 cq-pan.cqu.edu.au:www  cphppp134.cyberne:1657 FIN_WAIT2 root
tcp        0  22528 cq-pan.cqu.edu.au:www  port3.southwind.c:1080 CLOSE   root
tcp        0      9 cq-pan.cqu.edu.:telnet dinbig.cqu.edu.au:1107 ESTABLISHED root        
tcp        0      0 cq-pan.cqu.edu.au:ftp  ppp2-24.INRE.ASU.:1718 FIN_WAIT2 root  

Explanation

Table 16.2 explains each column of the output.  Taking the column descriptions from the table, it is possible to make some observations

§         All of the entries, but the last two, are for people accessing this machine's (cq-pan.cqu.edu.au) World-Wide Web server.
You can say this because of cq-pan.cqu.edu.au:www.  This tells us that the port on the local machine is the www port (port 80).

§         In the second last entry, I am telneting to cq-pan from my machine at home.
At that stage my machine at home was called dinbig.cqu.edu.au.  The telnet client is using port 1107 on dinbig to talk to the telnet daemon.

§         the last entry is someone connecting to CQ-PAN's ftp server,

§         the connection for the first entry is shut down but not all the data has been sent (this is what the CLOSING state means).
This entry, from a machine from Purdue University in the United States, still has 7246 bytes still to be acknowledged

Table 16.2
Columns for netstat

The /etc/services file specifies which port a particular protocol will listen on. For example SMTP (Simple Mail Transfer Protocol, the protocol used to transfer mail between different machines on a TCP/IP network) uses port 25. This means that there is a network server that listens for SMTP connections on port 25.

This begs some questions

§         How do we know which program acts as the network server for which protocol?

§         How is that program started?

How network servers start

There are two methods by which network servers are started

§         executed as a normal program (usually in the startup files)
Servers started in this manner will show up in a ps list of all the current running processes. These servers are always running, waiting for a connection on the specified port. This means that the server is using up system resources (RAM etc) because it is always in existence but it also means that it is very quick to respond when requests arrive for their services.

§         by the inetd daemon
The inetd daemon listens at a number of ports and when information arrives, it starts the appropriate network server for that port. Which server, for which port, is specified in the configuration file /etc/inetd.conf .

Starting a network server via inetd is usually done when there aren't many connections for that server. If a network server is likely to get a large number of connections (a busy mail or WWW server for example) the daemon for that service should be started in the system startup files and always listen on the port.

The reason for this is overhead. Using inetd takes longer.

/etc/inetd.conf

The /etc/inetd.conf file specifies the network servers that the inetd daemon should execute. The inetd.conf file consists of one line for each network service using the following format (Table 16.3 explains the purpose of each field).

service-name socket-type protocol flags user server_program args

Table 16.3
Fields of /etc/inetd.conf

How it works

Whenever the machine receives a request on a port (on which the inetd daemon is listening on), the inetd daemon decides which program to execute on the basis of the /etc/inetd.conf file.

Exercises

All of you will have used a number of network client programs. If you are reading this online you will be using a WWW browser. It's a network client program. When you used the command telnet in the last exercise you were using a network client program.

A network client is simply a program (whether it is text based or a GUI program) that knows how to connect to a network server, pass requests to the server and then receive replies. 

The telnet client

By default when you use the command telnet jasper, the telnet client program will attempt to connect to port 23 of the host jasper (23 is the telnet port as listed in /etc/services).

It is possible to use the telnet client program to connect to other ports. For example the command telnet jasper 25 will connect to port 25 of the machine jasper.

The usefulness and problem with this will be discussed on the next couple of pages.

Each network service generally uses its own network protocol that specifies the services it offers, how those services are requested and how they are supplied. For example, the ftp protocol defines the commands that can be used to move files from machine to machine. When you use a command line ftp client, the commands you use are part of the ftp protocol.

Request for comment (RFCs)

For protocols to be useful, both the client and server must agree on using the same protocol.  If they talk different protocols then no communication can occur.  The standards used on the Internet, including those for protocols, are commonly specified in documents called Request for Comments (RFCs). (Not all RFCs are standards). Someone proposing a new Internet standard will write and submit an RFC. The RFC will be distributed to the Internet community who will comment on it and may suggest changes. The standard proposed by the RFC will be adopted as a standard if the community is happy with it.

Table 16.4
RFCs for Protocols

Table 16.4 lists some of the RFC numbers which describe particular protocols.  RFCs can and often are very technical and hard to understand unless you are familiar with the area (the RFC for ftp is about 80 pages long).

Text based protocols

Some of these protocols smtp ftp nntp http are text based. They make use of simple text-based commands to perform their duty. Table 16.5 contains a list of the commands that smtp understands. smtp (simple mail transfer protocol) is used to transport mail messages across a TCP/IP network.

Table 16.5
SMTP commands

How it works

When transferring a mail message a client (such as Eudora) will connect to the SMTP server (on port 25). The client will then carry out a conversation with the server using the commands from Table 16.5.  Since these commands are just straight text you can use telnet to simulate the actions of an email client.

Doing this actually has some real use. I often use this ability to check on a mail address or to expand a mail alias. The following shows an example of how I might do this.

The text in bold is what I've typed in. The text in italics are comments I've added after the fact.

beldin:~$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220-beldin.cqu.edu.au Sendmail 8.6.12/8.6.9 ready at Wed, 1 May 1996 13:20:10 +1 000
220 ESMTP spoken here
vrfy david check the address david
250 David Jones <david@beldin.cqu.edu.au
vrfy joe check the address joe
550 joe... User unknown
vrfy postmaster check the address postmaster
250 <postmaster@beldin.cqu.edu.au
expn postmaster postmaster is usually an alias, who is it really??
250 root <postmaster@beldin.cqu.edu.au

Mail spoofing

This same approach can be used to spoof mail, that is, send email as someone you are not. This is one of problems with Internet mail. The following is an example of how it's done.

bash$ telnet aldur 25 connect to the smtp port (see /etc/services)
Trying 138.77.36.29 ...
Connected to aldur.cqu.edu.au.
Escape character is '^]'.
220 aldur.cqu.edu.au Amix Smail3.1.28.1 #2 ready at Sun, 28 Aug 94 12:04 EST
helo aldur tell the machine who I am (the name of another machine not a user)
250 aldur.cqu.edu.au Hello aldur
mail from: god@heaven.com this is who the mail is coming from
250 <god@heaven> ... Sender Okay
data I want to enter some data which is the message
503 Need RCPT (recipient) can't do that yet, must tell it who to send message to
rcpt: david@aldur
500 Command unrecognized oops, typed it wrong
rcpt to: david@aldur
250 <david@aldur> ... Recipient Okay
data
354 Enter mail, end with "." on a line by itself
You have been a naughty boy type in the message
.
250 Mail accepted
quit bye, bye
221 aldur.cqu.edu.au closing connection
Connection closed by foreign host.

There are methods which can be used to identify email sent in this way.

Exercises

Putting your computer on a network, especially the Internet, makes it accessible to a lot of other people and not all of those people are nice.  It is essential that you put in place some sort of security to protect your system from these nasty people.  The next chapter takes a more indepth look at security.  In this section we examine some of the steps you can take to increase the security of your system including TCPWrappers, packet filtering and encryption.

TCPWrappers /tcpd

The following are entries from two different /etc/inetd.conf files. Both are the entries dealing with the telnet service. The second entry is from a "modern" Linux machine, the first is from an earlier UNIX machine.

telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd
telnet stream tcp nowait root /usr/sbin/tcpd  /usr/sbin/in.telnetd

The difference

Do you notice the difference? The program being run on the Linux machine is /usr/sbin/tcpd. If you examine the entries in a Linux machine's /etc/inetd.conf you will find that this program is executed for all (almost) network services.

tcpd is the public domain program TCPWrappers that comes standard on all Linux machines. It is a special daemon that provides some additional services including added security, access control and logging facilities for all network connections. TCPWrappers works by being inserted between the inetd daemon and the various network daemons that are executed by inetd.

Figures 16.1 and 16.2 demonstrate the difference.

Figure 16.1
inetd by itself

Figure 16.2
inetd with tcpd

tcpd features

tcpd works as follows

§         a request for a particular network request is received,

§         the configuration of inetd is such that tcpd is executed rather than the actual server for this request,

§         tcpd logs the request via syslog,
On RedHat 5.0 each connection is logged into the file /var/log/secure.  Information stored includes the time it was made, the host trying to make the connection and the name of the network service being requested. An example entry looks like

May  1 12:13:46 beldin in.telnetd[684]: connect from localhost

§         tcpd then performs a number of checks,

These checks make use of some the extra features of tcpd including

§         pattern-based access control. 
This allows you to specify which hosts are allowed (or not) to use a particular network service.  You can use this feature to restrict who can make use of your network services.  tcpd also allows you to execute UNIX commands when a particular type of connection occurs. 

Exercises

§         hostname verification,
Some of the network protocols rely on hostnames for authentication.  For example, you may only be able to use the rsh command if your computer is called beldin.cqu.edu.au.  It is possible for people to setup computers that will pretend to be another hostname.  tcpd offers a feature which will verify that a host is really who they say they are.

§         protection against host address spoofing.
It is also possible to spoof an IP address.  That is, packets being sent from machine are modified to look as if they are being sent from another, trusted, machine.  tcpd offers a feature to detect and reject any connections of this type.

While most Linux systems come with tcpd as standard many commercial systems don't. tcpd is in the public domain and can be compiled for most UNIX platforms.

Exercises

Other methods for securing a network connection are discussed in the security chapter.

Intranets are the latest buzzword in the computer industry. The buzzword makers have finally realised the importance of the Internet (and the protocols with which it was constructed) and have started adopting it for a number of purposes. An intranet is basically a local area network used by an organisation that uses the Internet protocols to provide the services normally associated with a LAN plus offering Internet services (but not necessarily Internet access).

Services on an Intranet

The following is a list of the most common services that an Intranet might supply (by no means all of them). This is the list of services we'll discuss in more detail in this chapter. The list includes

§         file sharing,
The common ability to share access to applications and data files. It's much simpler to install one copy of an application on a network server than it is to install 35 copies on each individual PC.

§         print sharing, and
The ability for many different machines to share a printer. It is especially economically if the printer is an expensive, good quality printer.

§         electronic mail.
Sometimes called messaging.  Electronic mail is fast becoming an essential tool for most businesses.

There is a famous saying in the computing field.

This statement is especially true in the area of sharing printers and files in a local area network. Some of the different protocols are outlined in Table 16.6 which also describes the origins of each protocol.

Table 16.6
Protocols for sharing files and printers

Due to a number of free software packages, Linux, and most versions of UNIX, can actually act as a server for all of the protocols listed above. Due to the popularity of the Windows family of operating systems, the following will examine the SMB protocols.

The "native" form of file sharing on a UNIX machine is NFS.  If you wanted to share files between UNIX machines, NFS would be the choice.

Samba

Samba is a piece of software, originally written by Andrew Tridgell (a resident of Canberra), and now maintained by a large number of people from throughout the world. Samba allows a UNIX machine to act as a file and print server for clients running Windows for Workgroups, Windows 95, NT and a couple of other operating systems.

The combination of Linux and Samba is possibly the cheapest way of obtaining a server for a Intranet (if you don't include cost and training).  

The following is a very simple introduction to how you might use Samba on a RedHat 5.0 machine.  This process is much simpler on RedHat 5.0 as Samba comes pre-configured.  The readings down below provide much more information about Samba.

The configuration file for Samba is /etc/smb.conf .  An entry in this configuration file which allows a user's home directory to be exported to SMB clients is the following

[homes]
   comment = Home Directories
   browseable = no
   read only = no
   preserve case = yes
   short preserve case = yes
   create mode = 0750

If your Linux machine happens to be on a network and you have a Win95/NT or even 3.11 machine on the same network, you should be able to connect to your home directory from that Windows machine using the standard approach for mapping a network drive.  Figure 16.3 is the dialog box on a Windows 95
machine.

Figure 16.3
Dialog box for mapping a network drive.

In this example, the name of my Linux computer is beldin and my username on beldin is david.  Once connected, I can now read and write files from my home directory from within Windows.

Chances are most of you will not have a local area network (LAN) at home that has your RedHat Linux machine and another Windows machine connected.  This makes it difficult for you to recreate the above example.  Luckily Samba comes with a program called smbclient .  smbclient is a UNIX program which allows you to connect to Samba shares.  This means when you use smbclient you are simulating what would happen if you were using a Windows machine.  The following is an example of using smbclient to connect to the same share as in the Windows example above.

[david@beldin david]$ smbclient '\\beldin\david'
Added interface ip=138.77.36.28 bcast=138.77.36.255 nmask=255.255.255.0
Unknown socket option TCP_NODELAY
Server time is Fri Feb  6 14:04:50 1998
Timezone is UTC+10.0
Password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 1.9.17p4]
security=user
smb: \> help
ls             dir            lcd            cd             pwd           
get            mget           put            mput           rename        
more           mask           del            rm             mkdir         
md             rmdir          rd             pq             prompt        
recurse        translate      lowercase      print          printmode     
queue          qinfo          cancel         stat           quit          
q              exit           newer          archive        tar           
blocksize      tarmode        setmode        help           ?             
!             
smb: \> ls *.pdf
  ei010106.pdf                             129777  Mon Jan 26 12:34:06 1998
  ei020102.pdf                             229292  Mon Jan 26 12:34:54 1998
  ei020103.pdf                             291979  Mon Jan 26 12:35:22 1998

                50176 blocks of size 16384. 2963 blocks available
smb: \>

Once you connect with smbclient you see the smbclient prompt at which you can enter a number of commands.  This acts a bit like a command-line ftp prompt.

Exercises

Electronic mail, at least on the surface, looks fairly easy. However there are a number of issues that make configuring and maintaining Internet electronic mail a complex and occasionally frustrating task. Examining this task in-depth is beyond the scope of this subject. Instead, the following pages will provide an overview of the electronic mail system.

Email components

Programs that help send, reply and distribute email are divided into three categories

§         mail user agents (MUA),
These are the programs that people use to read and send email.  Common MUAs include Eudora, Netscape (it has a mail and news reader as well as a Web browser) and text-based tools such as elm or pine.  MUAs allow a user to read and write email.

§         mail delivery agents (MDA),
Once a mail message is delivered to the right computer, the MDA is responsible for placing it into the appropriate mail file.

§         mail transport agents (MTA).
Perform a number of tasks including some delivery, forwarding of email to other MTAs closer to the final recipient and some address translation.
 

Figure 16.4 provides an overview of how these components fit together.

Figure 16.4
An overview of the mail system

The following is a brief description of how email is delivered for most people

§         Mail server
Most people will have an account on a mail server which will be running UNIX, Windows NT or some other operating system.  At a minimum, the user's account will include a mail file.  All email delivered for that user is appended onto the end of that mail file.

§         Remote mail client
Reading and writing mail for most people is done using a MUA like Eudora or Netscape on a remote mail client.  This "remote mail client" is the user's normal computer they use for normal applications.  The client mail computer will retrieve the user's mail from the mail server using a protocol such as POP or IMAP (see Table 16.6).  Sending email will be via the SMTP protocol to the mail server's SMTP daemon (sendmail if it’s the server is a UNIX computer).

Email Protocols

Table 16.7 lists some of the common protocols associated with email and briefly describes their purpose.

Table 16.7
Protocols and standards associated with Email

Unix mail software

Your RedHat 5.0 Linux machine will include the following software related to email

§         sendmail
sendmail is the UNIX MTA.  It may well be one of the most difficult and hated pieces of software in the world.  However, recent versions have solved many of its problems.  sendmail is the SMTP daemon on most UNIX machines.  That is it is the server that handles SMTP requests.

§         popd
The pop daemon is contacted by MTAs such as Eudora when they wish to transfer a user's email from the server onto the client.

§         imapd
The imap daemon may not be installed on all machines but it is distributed with RedHat 5.0.  imapd responds to MTAs which use imap to transfer email from the server to the client.  The readings below contain a pointer to a document which describes the differences between IMAP and POP.

§         various mail clients
A RedHat 5.0 machine will include a number of mail clients including mutt, elm, pine and mh.

Exercises

The World-Wide Web is the killer application which has really taken the Internet by storm.  Most of the Web servers currently on the Internet are UNIX machines running the Apache Web server (http://www.apache.org/).  RedHat 5.0 comes with Apache pre-installed.  If you use a Web browser to connect to your Linux machine (e.g. http://localhost/) Redhat provides pointers to documentation on configuring Apache.

This chapter has looked in general at how network services work and in particular at file and print sharing with Samba, email and World-Wide Web. Most network services consist of a server program responding to the requests from a client program. The client and server use a predefined protocol to exchange information. Information transferred between the client and server goes through ports.

Network ports are used to deliver information to one of the many network applications that may be running on a computer. Network ports from 0-1024 are used for pre-defined purposes. The allocation of those ports to applications is done in the /etc/services file. The netstat command can be used to examine the currently active network connections including which ports are being used.

Network servers generally run as daemons waiting for a request. Servers are either started in the system start-up scripts (/etc/rc.d/*) or by the inetd daemon. The file /etc/inetd.conf is used to configure which servers inetd will start.

Most Linux systems come already installed with tcpd (TCPWrappers). tcpd works with inetd to provide a number of additional features including logging, user validation and access control.

Intranets are the latest industry buzzword and are simply a local area network built using Internet protocols. Linux in conjunction with Samba and other public domain tools can act as a very cheap Intranet server offering file and print services, WWW server, electronic mail, ftp and other Internet services. Samba is a public domain piece of software that enables a UNIX computer to act as a file and printer server for client machines running Windows and other LanManager clients.

Programs associated with email are placed into one of three categories

§         mail user agents (MUA)

§         mail transport agents (MTA)

§         mail delivery agents (MDA)

sendmail is possibly the most popular and flexible mail transport agent. Much of its fearful reputation comes from the concise syntax of its configuration file /etc/sendmail.cf.

16.1

Explain the role each of the following play in UNIX networking

/etc/services

/etc/inetd.conf

inetd

tcpd

16.2

You've just obtained the daemon for WWWWW (the fictious replacement for the WWW). The daemon uses the protocol HTTTTTTP, wants to use port 81 and is likely to get many requests. Outline the steps you would have to complete to install the daemon including

§         the files you would have to modify and why

§         how you would start the daemon (it's a program called htttttpd)

16.3

People have been trying to telnet to your machine server.my.domain. List all the things that could be stopping them from logging in.