[UKUUG Logo] Copyright © 1995-2004 UKUUG Ltd

UKUUG


news@UK 4.3

The newsletter of the UK UNIX User Group.
Volume 4 Number 3 (June 1995)

UKUUG News

Editor's Column

(Susan Small)

I'm delighted that your Council members and others have contributed so many reviews to this issue - this was one of the areas that you asked for more of in our membership survey. A number of reviews are still in the pipeline and I would be glad to hear of any books, or other products which you would like to see reviewed.

In this issue your Chair reports on a disturbing lack of new members and general feedback on the Group's activities as a whole. I think the newsletter reflects this situation by containing items from the same few people in each issue. I am grateful to them for the time they devote to giving me copy. Any Group, however, must feed on new blood and I again encourage you to offer your services as a reviewer.

One piece of good news is that the Group now has a Treasurer. As reported elsewhere, his appointment was confirmed at the AGM and we welcome Ivan Gleeson to the Group and the Council.


Report from the Chair

(Mick Farmer)

This should be a shorter than normal column from me because our usual activities were replaced by more formal ones last month, which I report upon below.

As you will see from the Financial Report, the UKUUG made a substantial loss in 1994 caused, in the main, by our cancellation of the joint event with EurOpen planned for Egham. This was discussed at our recent AGM and the overall feeling was that the days of the large, unfocussed, computing event are over. Our sister groups, such as EurOpen and USENIX, and other national groups, such as AFUU and NLUUG, have also found this. The trend is towards smaller (possibly shorter) events arranged around one or two core subjects.

My other major worry is the continuing downward trend in our membership. The big events of the past were always good for attracting new members, but the smaller events less so. The fact that we didn't organise so many events in 1994 certainly didn't help our image, or our membership figures.

At the recent AGM, your Council was charged with looking at these problems as a matter of urgency. This we will do. However, you, our membership, can help with this exercise. Please, please let us know of things that you think we do well, things that you think we should be doing, or anything that your Council should know about our services to the membership.

Finally, another clutch of general questions. How should the UKUUG make itself more visible to potential members? Should we advertise ourselves (we haven't done so up until now)? Should we accept adverts in our newsletter as a way of increasing revenue? Come on, let us know what you think.


UKUUG Ltd AGM

(Mick Farmer)

The AGM of UKUUG Ltd. was held at 1830hrs on Thursday 25 May 1995 at the Institute of Education, London. Members present were counted in double figures, but this was mainly due to the LUUG meeting that followed (see report elsewhere in this issue). Although members will receive a full report in due course, this article briefly covers the main points of the meeting.

The Minutes of the third AGM held on 13 April 1994 were approved.

I then presented the Chairman's Report and the Financial Report (as we have been without a Treasurer since Zdravko Podolski resigned at the last AGM). You will find these reports elsewhere in this issue. Discussions followed concerning what, and who, the UKUUG represented, and how we could attract new members. It was left for your Council to consider this matter with some urgency and to present their ideas to the membership as quickly as possible. Charles Curran asked for futher details on the £9,500 loss on the cancelled Egham event and these will be presented with the full report of the AGM.

Messrs. Price Bailey were re- appointed as auditors for the coming year.

Four nominations had been received for election to Council from Mick Farmer, Ivan Gleeson, Andrew Macpherson, and Jim Reid. As there were five vacancies, these four were duly elected. I am particularly pleased to welcome Ivan onto your Council. He works in the Audit department of the Bank of England and has volunteered to take on the task of Treasurer.


Annual Report for 1994

(Mick Farmer)

Preamble

Before writing this report, I looked back at what I had written for the year 1993 and compared that with the notes I had made for this year. Wow, I thought. I wonder if anybody would notice if I simply submitted last year's report, but changed the year! Seriously though, these two years have been very similar.

Membership

We now have approximately 400 members, the lowest it has been since the heady days of our large conferences at the Queen Elizabeth Conference Centre and at the Royal Lancaster Hotel. Big events, such as these, were always good for attracting new members who join as part of the cost of the conference. This is difficult to justify with smaller, more focused, events, so we have to find new ways of attracting new members.

We have kept the membership fees fixed for three years now, and hope to keep them at this level for another year. See the separate financial report.

Newsletter

All members receive our bi-monthly newsletter, news@UK. This is now firmly established and your editor tries to include material that you, the members, want to see. As I said last year, if you have any comments or suggestions concerning the newsletter, please contact the editor or your secretariat at Owles Hall.

Remember that, especially if you are an academic or institutional member, additional copies of the newsletter are available at no extra charge. Contact your secretariat and let them know how many you require.

Events

In January we organised SunScope 94, our second joint event with the SUKUG. Although the conference went well, the exhibition was poorly attended and both groups were disappointed.

Our joint event with EurOpen, EurOpen Forum 94, due to be held in March at Egham, was cancelled due to lack of support. I think that this is the last that we will see of the large, general computing, conferences.

UniForum 94 was held in the USA, but the UKUUG and UniForum/UK jointly held a satellite link-up in London. This was the first time the two groups had worked together, and I hope we can look forward to more collaboration in the future.

Jim Reid organised an extremely successful IP Workshop in October at London Zoo. The tutorials, led by Richard Stevens and William LeFebvre, were fully subscribed and the workshop was well-attended. This is obviously a hot topic and we intend to run more such focused events in the future.

Peeking into January 1995, we ran a very successful UNIX and Internet Security seminar with Rik Farrow as the presenter. This will be repeated in the near future.

Publications

We continue to send all members the proceedings of any events that we organise (except tutorials) as well as a year's issues of Computer Systems, published by our sister organisation in the USA, USENIX.

In August we sent every member a CD containing a sample of the software available on the SunSite archive at Imperial College. The UKUUG has supported the archive throughout the year, mainly by providing modems, allowing our members better access to all those gigabytes of information. A second CD will be sent out to members this August.

Local User Groups

We currently have three active LUGs, in Cambridge, London, and Oxford. The Cambridge LUG is organised in conjunction with the Cambridge arm of the SUKUG.

Special Interest Groups

The success story of the year must be the foundation of our Linux SIG. Martin Houston, the current organizer, has put a lot of work into getting this SIG off the ground. His hard work has paid off and the membership is growing. This SIG is unusual in that non-UKUUG members may enrol for a fee of £20 per annum. The SIG is already publishing its own newsletter, Linux@UK.

Our SAGE SIG was launched last year, but it has been pretty quiet this year according to our organizer, Lindsay Marshall.

Postscript

If the UKUUG is going to continue as an innovative and vibrant group then we have got to attract new members. I would like every one of you existing members to go out, evangelise if necessary, and bring back just one new member. This will improve the financial position of the group and enable us to provide yet more services for you, our members.

Finally, please, please let us know what you think about our existing activities. Tell us about new and exciting things you would like us to organise for you (or even you to organise for us :-). Feedback is vital to an organise like ours, and there has been too little of late.


Financial Report for 1994

(Mick Farmer)

Preamble

As most of you know, Zdrav Podolski resigned as Treasurer last April because he was taking up a job in the USA. Since then the group has been without a Treasurer, so I have been handling the day-to-day financial affairs of the group.

Membership

Last year our income from subscriptions dropped by 14% to £62,184. Since the bulk of our income comes from subscriptions, I think that the group must do something about recruiting new members as soon as possible.

Events

Last year we made an overall loss of £4,139 on our events. The culprit was the cancelled event at Egham which created a loss of £9,500 to the UKUUG (and a similar loss for EurOpen).

Publications

Last year we decided to give each member a year's subscription to Computer Systems a USENIX publication. This cost us approximately £2,500 in 1994.

Income and Expenditure

Overall our income was down by 25% and our expenditure was down by 14% on 1993. This has contributed to an overall deficit of £8,752 for 1994.

Postscript

It is obvious that the group must both attract new members and host financially successful events in order to recover from a bad year.

To finish on a good note, we hope to have a new Council member, who will be our new Treasurer, elected at the AGM.


UKUUG Archive

(Stuart McRobert)

SunSITE Northern Europe (src.doc.ic.ac.uk) is one of the busiest and largest Archives on the Internet, with users from all around the world flocking to access its rich and up to date collection of publicly and freely available data via a wide variety of user interfaces (ftp, ftpmail, telnet, http, archie, etc.).

However, earlier this year the recent (and ongoing) exponential growth of the Internet with its widespread global appeal and the general interest in the Information Superhighway, resulted in a serious performance (congestion) problem. Apparently, we believe, it was chiefly in the kernel IP networking area. After a considerable amount of work and effort both locally and at Sun, this has now been resolved and network performance is back on track - "turbo" warp drive has been fully restored.

Solaris 2.4 was installed (it was quite a challenge to get the upgrade option to finally work), along with a seventh Sparc CPU on a new motherboard, extra memory allowing improved interleaving and consequently faster memory access, more efficient FDDI interfaces, and yes, yet more disk space.

Currently The Archive is using over 40GB of disk space (with around a million files) and we are currently awaiting delivery of a further 18GB. Growth is well on target, with both short and longer term expansion plans being successfully negotiated with Sun. The future of The Archive looks very bright.

Next year sees the Internet 1996 World Exposition, "A World's Fair for the Information Age" to be held around the world on the Internet throughout the year. We are pleased to announce our involvement both in terms of UK coordination and most significantly as the main UK node for this great project (more exciting news towards the end of the year).

If you are not yet "on the Internet", UKUUG members can dial in to The Archive at speeds of up to 14.4Kbps on +44 171 225 3162. The Annex terminal server that answers will prompt you for a password, currently TheArchive. Once logged into the Annex you will be connected straight through to The Archive.

We can also make CDs of any area in The Archive (up to 650MB per CD) to ISO 9660 standard with Rock Ridge extensions (so it looks just like a normal read-only UNIX filesystem). To order, please contact Jane at Owles Hall.

Finally, Lee and I would like to gently remind you that The Archive is primarily run in our "spare" time - its not our paid job, we do our best for free and face some quite interesting and challenging problems, which sometime take a little while to resolve (although we are often waiting for input from others to help). We hope you will continue to enjoy The Archive and find it a useful and valuable facility.

Stuart McRobert is Head of Systems in the Department of Computing at Imperial College, London where he manages both the day to day system and network support teams and implements the future. Stuart's hobbies include building and planning the next generation of archives, since in their spare time both Lee McLoughlin and Stuart manage one of the world's most successful and ever expanding Archives on the Internet -- SunSITE Northern Europe.


Cambridge LUG

(Jane Shute)

The last meeting in May, at which Sun spoke about their Solstice products, wasn't very well attended. However, the next meeting which is scheduled for Thursday 20 July will have a presentation of MAE by Applesoft.

Please contact me for further details of venue and time, nearer the date.

Jane entered IT in 1985 after completing a degree in Physics. She was employed by Logica for four years as a systems manager and later as office systems manager before leaving to form Shute Associates. She has two kids, 18 and 13, one dog called Samson - a soppy Golden Retriver. She likes travelling and beer, and used to drive racing cars. She is also the Editor of the Sun UK User Group newsletter.


London LUG

(Andrew Findlay)

Network Management: A Discussion Meeting (April 1995)

Network Management is a hot topic, and there are quite a few products available of varying quality, coverage, and price, but what do people really do with them? For that matter, what do people really want to know about their networks?

These were the questions on the agenda for the April LUUG meeting, and 20 people found their way to Birkbeck College to debate them.

Several people gave descriptions of the networks that they manage, which range from a single ethernet segment with 30 machines up to multinational networks with hundreds of sites and tens of thousands of users. Not surprisingly, the concerns were different depending on the scale and type of network.

Small networks usually have to look after themselves most of the time, and network management becomes an all-embracing term that covers everything from wiring plugs to writing programs. In these cases, the physical network can often be visually inspected very quickly so topology-finding software is not much use!

The main problems faced by the managers of very large networks seem to be knowing where the equipment and wiring really is, and dealing with the constant state of change caused by the large user population.

Several software products were discussed, though often with only one person knowing about each:

Sun Net Manager
This was used by several people present. It is relatively cheap, and quite flexible in the way it can manage many different types of resource: some people were using it to monitor network links, others for server load and filesystem capacity.
HP OpenView
Known by several people at the meeting, but none were actively using it. Said to be a good choice for networks with 1000+ machines.
IBM NetView/6000
Less widely installed but possibly more capable product related to OpenView. This is now expanding into systems management and has a galaxy of related products to feed data to it.
HP NetMetrix
Used by one of the big multi-national networks. Expensive, but capable of dealing with large numbers of active nodes.
Cabletron Spectrum
The first product mentioned that tries to diagnose the problem as well as reporting the symptoms. Also for big networks.
NetCortex
Another correlation engine, related to Tivoli Net Console?
TKInet and Scottie
Public Domain network mapping tools.
BTNG (Behold The Next Generation!)
Public Domain RMON monitoring software.

Several people pointed out that software cannot replace the experience of the people who manage the network, though it can relieve them of some mundane tasks and give them the ability to cope with larger networks.

As soon as anyone starts talking about network management it is not long before trouble-ticket systems and helpdesks get brought in, and this occasion was no different. It was widely agreed that network management had to be part of an overall people-system with procedures and powers defined for tracking problems and getting the service going again. There was much discussion of how difficult it is to do this from the bottom , especially if the aim is to avoid fault reports by dealing with developing situations before they become incidents. The discussion then moved to trend analysis and the data gathering required to support it, with reports of 6-10GB of historical data storage being common: one person found that the network monitoring was producing over 1GB per month of trend data.

The meeting adjourned to the traditional LUUG restaurant at 9pm and was still in progress at 11pm, but I had stopped making notes - so the report stops here!

Andrew Findlay organises LUUG events, barndances, and ox-roasts. He has just returned from a weekend shepherding 260 racing crews into place at Wallingford Regatta and now hopes for a quiet weekend sawing up railway sleepers in the garden. Between these momentous events, he is in charge of the team that deals with the exponential computing requirements of Brunel University.


SAGE/UK News

System Administration: The Ever Evolving Profession

(Eric Pearce)

I've found that my interests have changed quite a bit over the 15 years that I've been using computers. One thing that I've always tried to do is to keep learning. It bothers me if I haven't had to figure something out in a few days. This is why I like system administration and, more recently, network administration.

I don't think you could find another field in the computer industry where you get to use such a variety of hardware and software. Sysadmins are constantly pushed into situations where they have to learn something quickly, although they have no prior experience with the hardware or software and probably would never have been exposed to it on their own.

After a while, you get to the point where you think you can solve anything, as long as you have the right tools, the phone number for tech support, and an Internet connection (to communicate with technical groups in Usenet news).

I think the modern system/network administrator has to know an incredible amount to be effective. This doesn't mean you have to have everything memorized, but you do have to know how to go about finding something out. Once you have these skills, most problem solving involves finding the person who has solved this problem or a similar one in the past. This could mean a combination of calling or emailing technical support, technical newsgroups or forums, friends, peers, and consultants, or buying books at a technical book store.

You also need to be flexible. I'm always surprised when other administrators or consultants say things like "Oh, I don't do ___" (insert "PCs," "Macs," "Unix") and refuse to look at a problem because it doesn't occur within their preferred area of expertise. I think this is career suicide and short-sighted. As part of building a network, I'm connecting machines running MacOS, various Unixs, DOS, Windows, WindowsNT, OS/2, etc. A particular piece of equipment may carry TCP/IP, AppleTalk and IPX traffic, and I have to know or learn enough about each of these to make intelligent decisions and solve problems. This is what makes the job interesting.

Eric Pearce is manager of system and network administration for O'Reilly & Associates. He also co-authored the X Window System Administrator's Guide (Volume 8 of O'Reilly's X Window System series).


News from Owles Hall

(Jane Morrison)

Have you paid you Subscription Invoice yet? We have just chased the outstanding invoices and I know a great deal of members have paid, but we still have quite a few who have not. After this issue Newsletter we shall stop sending the Newsletters to the non-payers...........

I am in the middle of preparing for the AGM and hope that there will be a good turnout of members. Normally very few turn up, which must mean that you are all quite happy with the way your Council runs things, but still we would like to see you and have the chance of discussing our policies with you.

One problem we have faced in the last couple of weeks was our dying e-mail system on the old ICL machine. It died completely, but we are now up and running again on the new SUN machine (well stumbling along is probably more apt than running). Our thanks must go to Andrew Macpherson (UKUUG Council member and EurOpen Treasurer), who just happens to live quite near to us, who has been very helpful in getting the new system started, together with talking me through how to use it! Thank you Andrew.

The next Council meeting is scheduled just before the AGM and any news of events etc. will appear in the next issue Newsletter.


Reviews

Firewalls and Internet Security (Repelling the Wily Hacker)

Bill Cheswick & Steven Bellovin
Addison-Wesley (1994)
ISBN 0-201-63357-4
(Reviewed by Mick Farmer)

This is the book recommended, and referenced, by Rik Farrow during his "Advanced UNIX and Internet Security Seminar" held in London last February (see details in news@UK Vol.4, No.2, p.6- 8). Rik recommends this book instead of his own work on the subject [Farrow, 1991] because it is plumb up-to-date, so I was looking forward to reading it with interest.

The authors both work at AT&T Bell Labs where they built the Labs' firewall gateway and tracked down "Berferd", an infamous hacker in 1991 [Cheswick, 1992]. They aim this book primarily at an audience of network administrators with a background in system administration and networking, or system and network designers. Some chapters are of general interest while others get highly technical. Their examples and discussion relate to UNIX systems and programs, focusing mainly on the TCP/IP protocol suite. This reflects the success of TCP/IP, as the majority of the multi-user systems on the Internet are running some version of UNIX using the TCP/IP protocols. The book is organised into four major sections; the first of these introduces the problem of security and surveys the TCP/IP protocol suite from the point of view of security; the second section describes how to construct a firewall based on the authors' own experiences at Bell Labs; the third section is devoted to hacking, including an analysis of different classes of attacks; the fourth section is entitled "Odds and Ends" and includes chapters on legal issues, encryption, and the future when millions of people start connecting their home systems to the Internet. There are appendices describing where to obtain security- conscious software, a list of dangerous TCP and UDP ports, and security recommendations to vendors.

In the first section of this book, the authors make their case for establishing a firewall, and their arguments follow the UNIX philosophy of "Small is Beautiful":

All programs contain bugs and large programs contain proportionally more bugs than smaller programs. Most hosts run too many programs that are too large. Therefore, the only solution is to isolate them behind a firewall. QED.

A corollary of this is that a firewall machine should run as few programs as possible and those that are run should be as small as possible. The authors use a "bomb" symbol to indicate serious security risks and I personally found it alarming that they identified 29 such risks during their dissection of the TCP/IP and related protocols, and this did not include the mundane subject of password failures!

The second section of the book starts by discussing the philosophy of firewalls and the different levels at which firewall gateways can be constructed. The authors then take us through the stages of building an application-level gateway with a high level of security. Their configuration is the one actually in use at Bell Labs. They also describe their authentication strategies, some other tools and monitors that they use, and some hacking tools they have built to test their own security. Once again, the UNIX philosophy shows through. The authors prefer small tools, each doing one job well. Their log files contain a single line per incident, with different fields delimited by some fixed character. The format does not have to be human-friendly; the logs are going to be scanned by standard UNIX tools such as awk or perl. I especially liked the quoted treatise saying that discussion on the security of locks would not show others how to be dishonest, and this was written in 1853 (for rogues read hackers):

Rogues are very keen in their profession, and already know much more than we can teach them respecting their several kinds of roguery. Rogues knew a good deal about lockpicking long before locksmiths discussed it among themselves, as they have done lately.

The third section contains interesting statistics taken from the logs on the authors' firewall gateway during 1992. Of the 16,709 attempted logins (of which 6,319 failed), the top four usernames were netlib (1831), anonymous (1256), guest (448), and ^C (238), with all the others in double figures. The FTP login attempts, netlib and anonymous, were considered by the authors as being almost certainly people with evil intent, as were root (38) and sync (18). One figure plotting a year's login probes by day of the week shows conclusively that the average hacker takes the weekend off. Not surprisingly, most probes came from the edu domain (educational sites in the USA), though there were seven from the UK (surely not from UKUUG members :-). Of course, this does not imply that the attackers are actually at those sites; hackers soon learn how to hide their trail. Amazingly, individuals attempted to fetch the authors' password file at a rate exceeding once every other day.

The fourth section starts with a chapter on legal considerations, but these are highly biased towards the federal laws of the USA. I found it interesting that several aspects of computer security work carry liability implications (in the USA at least). For example, having too little security can be a negligent act. Conversely, knowingly permitting a hacker to use your system, even for the purpose of monitoring his or her activities, may expose you to lawsuits from other parties attacked via your machine (bomb 42). The authors finish by saying that, although the face of the network security problem will certainly change over the years, it will not go away.

Overall, I thought that this book was excellent. It is well written and covers the material in a direct and clear manner. Although I did not understand every intensely technical section I still felt that I understood the broad outline. I am sure that system administrators will find the firewall installation check lists useful as well as the table of TCP and UDP ports that should be blocked by a packet filter. Certainly a fascinating insight into the realm of computer networks and their hackers.

References

[Cheswick, 1992] William Cheswick. An evening with Berferd, in which a cracker is lured, endured, and studied. In Proc. Winter USENIX Conference, San Francisco (1992).

[Farrow, 1991] Rik Farrow. UNIX System Security: How to Protect your Data and Prevent Intruders. Addison-Wesley (1991).


Running Linux

Matt Welsh and Lar Kaufman
O'Reilly & Associates, Inc
February 1995
ISBN 1-56592-100-3
(Reviewed by Stuart McRobert)

This is a great book well worth reading and keeping handy. It is especially good for the beginner trying to understand everything Linux has to offer, and wanting to know how to get started and how Linux works. Running Linux helps by trying to show how various parts of Linux successfully work together, and providing a rather good overview to an awful lot of information facing a new user/system manager. It is also of use to those readers already familiar with UNIX but wanting to learn more about Linux.

Running Linux will save you a considerable amount of time and trouble looking through the many READMEs and HOWTOs for the answer to some tricky question. Instead the book has neatly gathered together detailed descriptions and answers to a lot of questions. Of course with a rapidly developing system like Linux, the online READMEs will always be more up to date than nearly everything else, so watch for changes there.

The book is well laid out and covers aspects like how to obtain and install Linux, along with the answers to many of the possible error messages you might encounter, plus solutions to a wide range of installation problems. There are also sections covering basic Unix commands, useful tools, essential system management tasks, programming and networking.

The only word of warning is to look for a copy from a recent print run, since the book cover of the very first (and only the first) print run comes off very easily (as has happened with my review copy) and I believe O'Reilly are offering to replace them. But probably far more important for most readers, especially new users, is that a number of typos have been fixed in more recent print runs that might otherwise have easily confused and upset the unwary user.

It is fairly easy to determine how recent the print run is by looking around page iv (the back of the title page) for the "Printing History". According to a note from O'Reilly & Associates "...if the only date there is February 1995, and if there is no date on the very last line of the page, to the right of the ISBN, ..." you have a first printing. On the other hand "...If you do see a date in brackets on the bottom right-hand side of the page (i.e. [4/95]), then you do not have the first printing, ..."

So in summary, Running Linux is a very good book, covering many of the aspects you are likely to encounter when running your own system, well worth obtaining a recent copy.


POSIX.4: Programming for the Real World

Bill O Gallmeister
O'Reilly & Associates, Inc. January 1995
(Reviewed by Andrew Findlay)

So you want to write portable programs? Simple! Just follow the Posix Way and all will be sweetness and light.... Well, it is not quite that simple, but as the author points out: Portability becomes easier, not trivial .

POSIX.1 has been around since 1990, defining the basic OS interfaces needed to write simple programs. Very useful, but it leaves out a lot of functions that people really need: select/poll, fsync, and mmap for a start. POSIX.4 was approved in 1993 and it standardises functions necessary for real-time programming. Even if you do not want to write real time programs you probably need some of POSIX.4, if only to get fsync()!

At 550 pages this is a heavy book, but it does not take too long to read the relevant bits because almost half is reference material in the form of manual pages. The Posix Way is explained early, together with a set of tests that can be applied to find out which parts are implemented by the system you are using. POSIX.4 is structured as a set of options so the tests are very important, and my favourite quote of the whole book derives from this: "It's enlightening to see that vendor S supports all the POSIX options, while vendor M supports nothing it doesn't absolutely have to in order to get the check on the Government list!"

The book is readable, and it's subtitle "Programming for the Real World" is well justified by discussions of the traps and pitfalls that lie in wait for the programmer whose program dices with Time. Certainly one for the bookshelf.


A Quarter Century of UNIX

Peter H. Salus
Addison-Wesley Publishing Company, 256pp
ISBN 0-201-54777-5
(Reviewed by Lindsay Marshall)

Gossipy, anecdotal, full of name dropping - I love it! When it comes to UNIX and its history Peter Salus knows where the bodies are buried. In fact I wouldn't be surprised if he didn't help bury some of them himself; though, purely in a managerial role - he doesn't strike me as a spadesman really. Nearly everything you could want to know about UNIX is somewhere in these pages (256 of them, I note - good planning or just luck?) and there are photographs and a lovely UNIX versions tree.

The text is easy to read and delivers the facts without ever being just dry history. There are lots of quotable quotes from the founding fathers, and from several of their by-blows as well. The European dimension to the UNIX world is not forgotten and receives its full due.

I have two quibbles and one beef (well a nut cutlet anyway). I couldn't find any mention of Mark WIlliams and his clone UNIX (whose name eludes me at the moment) in the book, and there is an error in the index in the WIlliams section. My beef is that there is almost no coverage of the various efforts to produce distributed versions of UNIX. Ok, I admit it, I am peeved because NFS got a mention (only in the Glossary though!) and the Newcastle Connection didn't, but it was an important area with lots of work done and I think it ought to be covered no sour grapes, honest.

This is a book for people who love UNIX written by someone who loves UNIX, and it will make them sad to see how far we have fallen from the true faith. It should be compulsory reading on every undergraduate operating system course. We need a new UNIX, a system for the new millenium, a system that breaks the rules, and where better to start than by looking at how other people did just that 25 years ago. Buy this book.

Lindsay Marshall is a lecturer in the Department of Computing Science at the University of Newcastle upon Tyne. He has some UNIX DECtapes and a paper tape machine in his office.


PGP: Pretty Good Privacy

Simson Garfinkel
O'Reilly & Associates, Inc.
393 pages 178 x 235mm
ISBN 1-56592-098-8
(Reviewed by Andrew Macpherson)

In previous issues we have had much publicity for Phil Zimmerman, his program PGP and his current problems with the US Authorities. He is accused of exporting munitions by allowing the program to be posted to the net. In late January Simson Garfinkel's book, PGP: Pretty Good Privacy from O'Reilly, became available through their European distributors, International Thompson Publications. The book looks at the background to the program as well as how the program works.

O'Reilly used to publish books that were 153mm wide. They were good and easily readable. They also fitted my shelves. Fortunately the publisher has resisted the temptation to put an excessive print line length in this wider volume. PGP the book is readable, if unwieldy. Some other recent books from O'Reilly (e.g. Managing INTERNET Information Services) are simply a strain to read.

Layout

The book has four major sections. If you are interested in diving straight into using PGP the program then you may be tempted to go directly to the third section. I would recommend passing GO and reading the first as well; it has many of the ideas about how cryptography is used which make the other parts clearer.

As with other books in the series, there is a quick-reference card for one to tear from the back of the book.

PGP Overview

As well as the outline overview promised, this is "Cryptography 101" with a quick overview of ciphers, codes and digital signatures. Most interesting is also a (US) description of the legal situation in which all discussion is framed. In general the USA does not permit the export of cryptographic technology, classing it as munitions. Then there is Lotus Notes.

Lotus Notes

Lotus Notes is a US exported product. It uses cryptographic techniques to ensure integrity and privacy of messages, and builds on the integrity feature for workflow automation. The cryptography export restriction is avoided by restricting the key-length in the exported versions to 40 bits (5 octets).

Notes uses the RC2 block cipher, and the RC4 stream cipher. Both are inventions of Professor Rivest, and trade secrets. Unfortunately RC4 was posted to the Internet some years back, so the secret has been revealed, and can now be found on various servers. The comments in the book on the strength of the algorithm imply that finding the algorithm is still part of the problem for any attacker.

Cryptography History and Policy

For me this section was the most interesting. Much of the material has been rehashed to death in alt.security and similar fora; here it is presented in a cogent, co-ordinated structure. At the end of the section one can expect to understand the difference between symmetric and asymmetric ciphers, know about one time pads and be comfortable with the ideas of key-escrow as applied to clipper .

Key distribution

I found the discussion of the mesh of trust inadequate. This area is PGP's unique selling point when compared with schemes such as PEM. Whether the web of trust is indeed an appropriate method for establishing a framework for mutual authentication, is open to attack. Commercial users will probably prefer an institutional third party scheme, while the individual may well prefer the free and informal scheme developed by Zimmerman.

Using PGP

The tutorial section of the book does what is needed. There are the usual problems of having to avoid sub-issues in one area until the major topic is covered later. There is nothing of special note otherwise.

Appendices

The first and obvious question of where to get PGP is covered for US citizens only. Other nationals should get the UI version (see below Fast facts for Europe). Otherwise the installation instructions can be followed as presented.

This is the only part of the book where the reader is exposed to anything that looks even remotely mathematical. Even here the descriptions are constrained to nice short bits, and easy numbers. Even so, part of reviewing a book is finding the deliberate error, just to prove you've been paying attention. The worked example of Diffie-Hellman on page 356 gets seriously lost, and will be corrected for the second edition. The RSA description is clear.

I found the included analysis of the difficulty of factorisation fascinating.

Who should buy this book?

If you are at all interested in What is cryptography, and what can it do for me?, but do not want to be swamped with mathematics, this is the book for you. The topics are well covered, clear, and the anecdotes clarify the points. The section on the program itself will lead you into using it in a friendly step-by-step manner.

If you think that Phil Zimmerman is a hero/thief, and want the view reinforced, avoid chapter 4 A Pretty Good History of PGP.

Fast facts for Europe

In the USA it is possible to obtain patents on algorithms, and to apply for them for up to a year after first publication. Neither is the case throughout most of the rest of the civilised world. It would none the less be polite to avoid embarrassing the owners of US based ftp servers by picking up one's copy of PGP from outside North America. For the Web Connected, please start with the page maintained by Stäle Schumacher staalesc@ifi.uio.no, as this will give one a good background:

http://www.ifi.uio.no/~staalesc/PGP/home.html

The software one requires is the 2.6.2i release. In fact the unencumbered international software is to be found on:

ftp://sable.ox.ac.uk/pub/crypto/pgp/

for both UNIX and DOS.

There are a few things that people usually forget when they start with PGP. The main one being how to revoke a public key whose private key you can no longer access, or which has become compromised.

After you have installed your copy of PGP, and made the various tests suggested in the documentation, you should make a key pair for yourself. Before you start to use the key, or to add other people's public keys to your keyring, you need to finish making it useful. Attach all the many names to your new key that you might ever use (e.g. your multiple mail accounts) with the pgp -ke command. Then sign the key yourself (pgp -ks). Signing the key prevents the names you have attached being changed when the key leaves your control. You then wind up with something like (pgp -kvv) the output shown in footnote 1.

Now make a copy of your public-keyring file (e.g. to copy.pgp), and revoke your newly created public key in the copy file: pgp -kd andrew copy.pgp

When you check this with pgp -kv copy.pgp you get the output shown in footnote 2.

You now have a revocation certificate. Put this file on a floppy disk and lock the floppy away. Delete the file from your computer. This is your ultimate backout you can use the revoked key to tell the world that the key is no longer valid.

The other thing you ought to do is to put the key to your secret keyring in a secure deposit somewhere (home safe, with your will, in a bank deposit.) This is for that time when you have the apocryphal meeting with a moving bus. There are better ways of doing this described in Chapter 13 of the book.

The key servers act as a repository for public keys. They make no warranty on the validity of the names associated with the keys - you have to validate them yourself on the basis of the web of trust or by some other means, such as a business card with the key signature on it. The servers are a good starting point for finding if your correspondent has a public key.

Before you deposit your key on the server, it might be a good idea to get some of your friends to sign your key. This means that they are prepared to warrant that you own the key, nothing more. Equally you might sign their keys.

As is becoming common, there are two classes of citizen. The WEB-connected and the mail user. The web connected may pull up:

http://www-swiss.ai.mit.edu/~bal/pks-commands.html

and follow the instructions. Mail users should send mail to: pgp-public-keys@pgp.ox.ac.ukwith a subject of help.

The patent issue is of course a non-issue outside the USA as far as RSA goes. The other code used heavily by PGP is IDEA, which certainly is protected in Europe, though I understand from the net it is available for personal, non-commercial use. More interesting are our governments' attitudes to cryptography. It's probably illegal to import good cryptography into most states of the EU (definitely France), and there are re-export restrictions in many countries as well.

Andrew Macpherson works for an International Telecoms Manufacturer. His interests are computer and network security, distributed access and messaging systems. He is active in the user groups, both UKUUG and EurOpen. He never did submit his MSc thesis.


Exploring Expect

Don Libes
O'Reilly & Associates, Inc.
(1995) 566 pages
ISBN 1-56592-090-2
(Reviewed by Adrian Percival)

Expect is an extension to tcl (Tool Command Language) which allows the full automation of interactive applications, removing the need for any human input whatsoever. For example scripts can be developed to perform full FTP sessions, change every password on a system, or manage rlogin sessions - and in doing so can save enormous amounts of time, effort and frustration.

Expect is named after the specific command (expect surprisingly), that waits for output from a program, which is under its control. The command describes a list of patterns to match from the spawned program's output, and provides an associated action to be taken. For example, if expect matches the string exit then the program should terminate.

The first part of the book gives an overview of expect, and then provides a brief (but good) tour of the essentials of Tcl. Several chapters are then dedicated to the intricacies of pattern matching (regular, as in ed, and glob, as in the C shell).

By this stage you will no doubt be itching to sit down and start creating your own expect scripts - precisely what I did. A word of warning, however. There are a number of considerations to be taken when using expect that aren't revealed until (much) later in the book, and whilst you will be able to produce working scripts, you may come across some unexplained behaviour - so do persevere to the end of the book!

The book then examines each of expect's commands in detail (expect, send, spawn etc) presenting numeous handy scripts along the way. By way of an example of an expect script, here is how FTP logons can be automated (noting that this is a very superficial treatment):-

spawn ftp unix.hensa.ac.uk     ;#Start ftp running

expect "Name"                  ;#Wait for ftp prompt

send "anonymous\r"             ;#Send user name

expect Password                ;#Wait for password prompt

send "ubacr66@dcs.bbk.ac.uk"   ;#Send e-mail address

interact                       ;#Go interactive

A chapter is then devoted to expect's extremely useful debugging tools, and it is probably worth reading this chapter out of sequence, as it can provide an antidote to earlier frustrations.

Chapter 19 is about "expect + tk = expectk", and looks at the Tool Kit extension. This provides commands to build user interfaces for X windows, and is an extremely convenient and flexible way to create smart, usable GUIs based on the creation and manipulation of "widgets" (buttons, scrollbars, menus, text boxes, etc). This chapter also presents an extended example for setting passwords.

The last major chapter explores the use of C and C++ to write expect programs, whereby the expect commands are provided as library functions that can be linked with your other object files.

Exploring Expect is an extensive tour through the major features of an exciting, new(ish) programming language. It is written by the author of expect - Don Libes, and as is usual with O'Reilly publications, is presented in a clear and readable format. Its value is further enhanced when you consider that the source for expect is freely available (for the time being). However, it should be noted that in order to get the most from expect you must have a firm grounding in tcl, so you may need to buy Ousterhout's book as well.

Adrian is a student in the Department of Computer Science, Birkbeck College, University of London, where he is studying for a PhD in Distributed Databases. If you would like any more information you can reach him at the address in the contact list. He is using expectk as a front-end to ORACLE 7 as part of his research.


Around Europe

EurOpen Governing Board

(Mick Farmer)

The EurOpen Governing Board met at the ISS University Hotel in Holte, outside Copenhagen, over the weekend of 13/14 May. The meeting was scheduled to start at 1.00pm on the Saturday when the delegates split up into "regional" groups to discuss common interests, difficulties, services, etc. Some groups, such as the Scandinavian countries and the Eastern European countries found this useful and came back with interesting statistics concerning their region.

Some delegates failed to materialise, so our region consisted of France, Ireland, The Netherlands, and the United Kingdom. This didn't seem very regional to us, so we concentrated on identifying services that we could provide for other groups. We soon decided to concentrate on producing CDs, an activity undertaken by all those in our group. We decided that we could produce CDs containing software, in both source and binary formats, and documents, such as conference proceedings, where appropriate. We considered that these CDs should contain uncompressed data so that they could be mounted as read-only file systems. Simon Kenyon presented our conclusions to the Governing Board under the grand title of "Information Providers"!

In order to vote at such Governing Board meetings each national group must have paid its subscription for the current year. Although most groups had paid, I personally found it disappointing that none of the full members were willing to upgrade to sponsor members nor were any junior members willing to become full members. As subscriptions are a major form of income for EurOpen, smaller groups should be prepared to upgrade their category of membership as they become established.

Kim Biel-Nielsen gave the Chairman's report. Rik Farrow's Internet Security Seminar had been well received in both London and Copenhagen and this was going to be repeated in September 1995 in Budapest and Stockholm and in January 1996 in London and Copenhagen. A two-day conference on WWW publishing is planned for October/November 1995, probably in London and Stockholm. Kim reported that EurOpen's WWW pages were now available on Simon Kenyon's machine and that EurOpen needs to commit funds to maintain it. [Ed's Note: The URL is http://www.koala.ie/EurOpen]

The first issue of EurOpen Quarterly was sent to over 4,000 subscribers (UKUUG members receive this) and the second issue will be distributed around the beginning of June. EurOpen is continuing to be an active member of the ICT Round Tables and is involved in a proposal to the EC for funding a WWW Information project. In concluding, Kim stressed that EurOpen must provide more visible services to its members, and that this required commitment and money.

Andrew Macpherson's financial report showed that EurOpen was still spending slightly more money each year than it received in income. If this situation were to continue then EurOpen would be bankrupt in six years. However, it's hoped that the increasing number of events will start to generate serious profits.

Four people were standing for three places on the Executive. Under the Single Transferable Vote system (it was a good job that Helen had remembered to bring the program with her :-) Lothar Koch was the first to be eliminated, which meant that Andrew Macpherson (UKUUG), Jan Saell (EurOpen.SE), and Mario Zagar (HrOpen) were elected to the Executive. From my experience of being on the Executive, I wish them many happy hours spent in Airport Lounges around Europe.

On the Sunday, Jean-Michel Cornu brought the meeting up-to-date on the activities within the ICT Round Tables and presented details of our bid to the EC. One aspect of this is concerned with multi-lingual WWW pages and it was very gratifying to see members of the Governing Board offering to translate one or two WWW pages into over twenty languages! I offered the services of one of our Greek postgraduate students in this effort.

I reported on this January's meeting of the USENIX Board, which I attended on EurOpen's behalf and Kim stated that relations with UniForum were improving.

After a very short official AGM, the meeting finished earlier than expected. Some delegates immediately rushed off to the airport to see if they could get on earlier flights home. I and three others took this opportunity to take the train into Copenhagen and do a little sightseeing. We walked through the centre and down past the docks to see the little mermaid on the water's edge. Finally arriving at the airport, we located some of our frustrated colleagues, peering at their laptops, who failed to get on earlier flights and had spent four or five hours sitting in the departure lounge!


Across the Pond

Men Who Use Computers Are The New Sex Symbols Of The `90s

I get about 100 e-mail messages a day from readers of my comic strip "Dilbert." Most are from disgruntled office workers, psychopaths, stalkers, comic-strip fans that sort of person. But a growing number are from women who write to say they think Dilbert is sexy. Some say they've already married a Dilbert and couldn't be happier.

If you're not familiar with Dilbert, he's an electrical engineer who spends most of his time with his computer. He's a nice guy but not exactly Kevin Costner.

Okay, Dilbert is polite, honest, employed and educated. And he stays home. These are good traits, but they don't exactly explain the incredible sex appeal. So what's the attraction?

I think it's a Darwinian thing. We're attracted to the people who have the best ability to survive and thrive. In the old days it was important to be able to run down an antelope and kill it with a single blow to the forehead. But that skill is becoming less important every year.

Now all that matters is if you can install your own Ethernet card without having to call tech support and confess your inadequacies to a stranger whose best career option is to work in tech support.

It's obvious that the world has three distinct classes of people, each with its own evolutionary destiny:

Obviously, if you're a woman and you're trying to decide which evolutionary track you want your offspring to take, you don't want to put them on the luge ride to the dung-flinging Olympics. You want a real man. You want a knowledgeable computer user with evolution potential.

And women prefer men who listen. Computer users are excellent listeners because they can look at you for long periods of time without saying anything. Granted, early in a relationship it's better if the guy actually talks. But men use up all the stories they'll ever have after six months. If a woman marries a guy who's in, let's say, retail sales, she'll get repeat stories starting in the seventh month and lasting forever. Marry an engineer and she gets a great listener for the next 70 years.

Plus, with the ozone layer evaporating, it's a good strategy to mate with somebody who has an indoor hobby. Outdoorsy men are applying suntan lotion with SPF 10,000 and yet by the age of 30 they still look like dried chili peppers in pants. Compare that with the healthy glow of a man who spends 12 hours a day in front of a video screen.

It's also well established that computer users are better lovers. I know because I heard an actual anecdote from someone who knew a woman who married a computer user and they reportedly had sex many times. I realize this isn't statistically valid, but you have to admit it's the most persuasive thing I've written so far.

If you still doubt the sexiness of male PC users, consider their hair. They tend to have either: (1) male pattern baldness a sign of elevated testosterone or (2) unkempt jungle hair the kind you see only on people who just finished a frenzied bout of lovemaking. If this were a trial I think we could reach a verdict on the strong circumstantial evidence alone.

I realize there are a lot of skeptics out there. They'll delight in pointing out the number of computer users who wear wrist braces and suggest it isn't the repetitive use of the keyboard that causes the problem. That's okay. Someday those skeptics will be flinging dung at tourists. Then who'll be laughing? (Answer to rhetorical question: everybody but the tourists.)

Henry Kissinger said power is the ultimate aphrodisiac. And Bill Clinton said that knowledge is power. Therefore, logically, according to the U.S. government, knowledge of computers is the ultimate aphrodisiac. You could argue with me I'm just a cartoonist but it's hard to argue with the government. Remember, they run the Bureau of Alcohol, Tobacco and Firearms, so they must know a thing or two about satisfying women.

You might think this was enough to convince anyone that men who use computers are sexy. But look at it from my point of view: I'm getting paid by the word for this article. I'm not done yet.

In less enlightened times, the best way to impress women was to own a hot car. But women wised up and realized it was better to buy their own hot cars so they wouldn't have to ride around with jerks.

Technology has replaced hot cars as the new symbol of robust manhood. Men know that unless they get a digital line to the Internet no woman is going to look at them twice.

It's getting worse. Soon anyone who's not on the World Wide Web will qualify for a government subsidy for the home-pageless. And nobody likes a man who takes money from the government, except maybe Marilyn Monroe, which is why the CIA killed her. And if you think that's stupid, I've got 100 words to go.

Finally, there's the issue of mood lighting. Nothing looks sexier than a man in boxer shorts illuminated only by a 15-inch SVGA monitor. If we agree that this is every woman's dream scenario, then I think we can also agree that it's best if the guy knows how to use the computer. Otherwise, he'll just look like a loser sitting in front of a PC in his underwear.

In summary, it's not that I think non-PC users are less attractive. It's just that I'm sure they won't read this article.

Scott Adams
Reprinted from Windows Magazine
May 1995


Calendar of Events

1995

6-8 Sep, EurOpen Security Workshop, Budapest, Romania

11-13 Sep, EurOpen Security Workshop, Sweden

18-22 Sep, LISA IX, USA

1996

10-12 Jan, EurOpen Security Workshop, London, UK (UKUUG)

15-17 Jan, EurOpen Security Workshop, Copenhagen, Denmark (DKUUG)


Acronyms for 1995

AFUU
French UNIX User Group
ARPA
Advanced Research Projects Agency
ASCII
American Standard Code for Information Interchange
BBS
Bulletin Board Service
BITNET
Because It's Time NETwork
CD-ROM
Compact Disk-Read Only Memory
CDE
Common Desktop Environment
COPS
Security Checker System from Purdue University
CPU
Central Processing Unit
DEC
Digital Equipment Corporation
DKUUG
Danish UNIX User Group
EARN
European Academic and Research Network
EBONE
European Networking Backbone
ECU
European Currency Unit
EU
European Union
EurOpen.SE
Swedish UNIX User Group
FTP
File Transfer Protocol
GUI
Graphical User Interface
IBM
International Business Machines
ICT
Information and Communication Technology
IP
Internet Protocol
ISO
International Standards Organisation
ISS
Internet Security Scanner
LAN
Local Area Network
LISA
Large Installation System Administration
LSI-11
16-bit microcomputer manufactured by DEC
LUG
Local (UNIX) User Group
MIT
Massachusetts Institute of Technology
NFS
Network File System
NIS
Network Information System
PC
Personal Computer
SAGE
System Administrators' Guild
SEAL
DEC's Firewall Consultancy Service
SIG
Special Interest Group
SOCKS
SOCK-et-S (Firewall Proxy Host)
SU2SG
Small UNIX Users Systems Group
Tcl
Tool Control Language
Tcl/Tk
See Tcl and Tk
TCP/IP
See TCP and IP
TCP
Transmission Control Protocol
TED
TriTeal Enterprise Desktop
TELNET
Internet Remote Login
TIS
Trusted Information Systems (Firewall toolkit)
Tk
Toolkit for the X Window System
Tripwire
Change Control Software from Purdue University
WAIS
Wide Area Information Server
WAN
Wide Area Network
WWW
World Wide Web
XINU
XINU Is Not UNIX, an operating system for LSI-11s
Tel: 01763 273 475
Fax: 01763 273 255
Web: Webmaster
Queries: Ask Here
Join UKUUG Today!

UKUUG Secretariat
PO BOX 37
Buntingford
Herts
SG9 9UQ