## TCPware V5.7 Installation & Configuration Guide

Appendix B

Sample Configuration

This appendix provides a sample full TCPware configuration.

The system manager's responses are in bold type. Note that your responses might not necessarily be the same as those given in the example.

Example B-1 Sample Configuration

$ @TCPWARE:CNFNET MENU

TCPware(R) for OpenVMS Version 5.7-1 Network Configuration procedure for:
TCP/IP Services:
FTP-OpenVMS
NFS-OpenVMS Client
NFS-OpenVMS Server
SMTP-OpenVMS
TELNET-OpenVMS
Kerberos Services
SSH-OpenVMS Server

This procedure helps you define the parameters needed to get TCPware(R) for OpenVMS running on this system.

This procedure creates the configuration data file,TCPWARE_SPECIFIC:[TCPWARE]TCPWARE_CONFIGURE.COM, to reflect yoursystem's configuration.

Type <return> to continue...Return

TCPware(R) for OpenVMS Configuration Menu

Configuration Options:

1 - Configure TCPware Services

2 - Startup/Restart all TCPware services
3 - Shutdown all TCPware services

L - Display the software licensing information (PASSWORD)
E - Exit the configuration procedure (changes will be saved)

Enter configuration option: 1 Return

TCPware Services Configuration Menu

Configuration Options:

1 - Core environment for TCP/IP services
2 - Configure all TCP/IP components
3 - Configure a specific TCP/IP component

4 - Startup/Restart TCP/IP services
5 - Shutdown TCP/IP services
6 - Startup/Restart a specific TCP/IP component
7 - Shutdown a specific TCP/IP component

E - Exit to previous menu

Enter configuration option: 1 Return

Configuring the core TCP/IP environment....

Please enter your Process Software Maintenance Agreement (MAS) number if you have one and have it available. This number can be found onthe top of your Software Maintenance and Support Acknowledgement form.

If you do not have this number, press <RETURN> at the prompt. If you would like to enter this information later, you can set it using the command:

$ @TCPWARE:CNFNET MAS

Enter your Maintenance Agreement (MAS) number []: 12345 Return

Please wait ... determining default lines.
You need to enter the line identifications for the available networkdevices. The following is a partial list of the network devices that are supported:

Line Id Network Device
------- --------------

QNA-n for Digital's DELQA, DESQA, or DEQNA (XQDRIVER)
UNA-n for Digital's DELUA or DEUNA (XEDRIVER)
BNA-n for Digital's DEBNI, DEBNA, or DEBNT (ETDRIVER)
SVA-n for Digital's DESVA (ESDRIVER)
MNA-n for Digital's DEMNA (EXDRIVER)
ISA-n for Digital's VAX 4000 (EZDRIVER)
MFA-n for Digital's DEMFA FDDIcontroller 400 (FXDRIVER)
FZA-n for Digital's DEFZA FDDIcontroller 700 (FCDRIVER)
PRO-n for Proteon's proNET (PNDRIVER)
HYP-n for NSC's HYPERchannel (NxDRIVER)
SLIP-n for (static) Serial Line IP (any terminal device)
DECNET- for IP over DECnet (requires DECnet)
DSB-n for Digital's DSB32 (SLDRIVER)
DST-n for Digital's DST32 (ZSDRIVER)
DSV-n for Digital's DSV11 (SJDRIVER)
X25-n for VAX P.S.I. (IP over X.25)
LPB-0 for local loopback (no device driver)

Unless your system has more than one controller, n is 0.
Enter the line identifications [LPB-0,EWA-0]: Return

You need to supply the following information for each line:
- The internet address for the line
- The name for the line (same as the host name if single
line host, fully qualified domain name if using DNS)
- The subnet mask for the line
- The line specific information (depends on line)

If there is a DHCP server running on the network and this is a single linehost, you may get the information from DHCP server automatically. To do so, please select 2.

1. Configure Internet address and related items manually.
2. Configure Internet address and related items automatically

Continue with selection [1]: Return

If a network is not subnetted, press Return at the subnet mask prompt. Otherwise, enter the subnet mask for the network as an internet address. These are the default subnet masks for each network class:

Network Class Default Subnet Mask
------------- -------------------
A 255.0.0.0
B 255.255.0.0
C 255.255.255.0

Using LOOPBACK (127.0.0.1) as name for line LPB-0.

What is the local host's INTERNET ADDRESS for line EWA-0: 192.168.2.56 Return
What is the NAME for line EWA-0: LILAC.NENE.COM Return
What is the SUBNET MASK for line EWA-0 [255.255.255.0]: Return
Do you want to enable TRAILER packet support for line EWA-0 [NO]: Return
Do you want to enable RARP (Reverse ARP) support for line EWA-0 [YES]: Return

The network devices are configured as follows:

Line Address Name Options
---- ------- ---- -------
LPB-0 127.0.0.1 LOOPBACK
EWA-0 192.168.2.56 LILAC.NENE.COM /MASK=255.255.255.0 /FLAGS=(NOTRAILERS)

Is this configuration correct [YES]: Return

If your network is connected to other networks, you may wish to enter the internet address of a default gateway. If your network has more than one gateway, enter the gateway "closest" to the networks that you will be connecting to most frequently. The (sub)network portion of the internet address for the gateway MUST match that of a locally connected (sub)network.

Enter 0.0.0.0 if you need to remove a previously defined default gateway or your network does not have any gateways.

Your routing requirements might be more complex if your network has several gateways. Handle this by adding the appropriate NETCU commands (such as ADD ROUTE) to the TCPWARE_COMMON:[TCPWARE]ROUTING.COM command procedure.

For more information on routing, refer to the TCPware for OpenVMS(R)documentation.

Enter the internet address of the default gateway [0.0.0.0]: 192.168.2.126 Return

You need to specify local time zone information. Time zone may be specified as fixed value which must be manually set for the daylight savings time change, or you can use NTP (Network Time Protocol) Daemon to change the system clock and time offset automatically.

Do you want to have NTP set the time and time offset automatically [NO]? Return

You need to provide the offset from universal time (UT) or local timezone name. It is recommended that you specify an offset from UT instead of entering a time zone name.

Offset from universal time

in hours and minutes: +HHMM (east) or -HHMM (west)
Universal time zone: UT, UTC, GMT
North American time zone: EST, EDT, CST, CDT, MST, MDT, PST, PDT
Military time zone: Any single letter A through Z except J

You may enter a non-standard time zone name, although the internet discourages their use. If you use a non-standard name, you will be prompted to enter the offset from universal time as well.

Enter the offset from UT or the local time zone name [UT]: EDT Return

You need to enter the official name of this host as it is known locally and by other hosts on the network. Default is the name you specified for the first network device.

If your system will use Domain Name Services, you must enter the full domain name of the host.

Enter the official host-domain name for this host [lilac.nene.com]: Return

You can enter the host name and the corresponding internet address for the hosts on the network.

The host definition file, TCPWARE_COMMON:[TCPWARE]HOSTS., contains the host names and internet addresses for the hosts on the network. You may also edit this file manually.

Names you defined for each network devices are automatically added:

localhost LOOPBACK (127.0.0.1) added to host definition file. lilac.nene.com (192.168.2.56) added to host definition file.
You may add definitions for the other hosts if you are not going to use DNS. If you use DNS, enter <return> at the next prompt:

Next host name (<return> to end): Return

TCPware Services Configuration Menu

Configuration Options:

1 - Core environment for TCP/IP services
2 - Configure all TCP/IP components
3 - Configure a specific TCP/IP component
4 - Startup/Restart TCP/IP services
5 - Shutdown TCP/IP services
6 - Startup/Restart a specific TCP/IP component
7 - Shutdown a specific TCP/IP component

E - Exit to previous menu

Enter configuration option: 2 Return

Configuring all of the TCP/IP components....

Type <return> to continue...

Configuring the Accounting listener:

TCPware accounting consists of two components: The accounting record logger, which this procedure configures and controls, and the services that can use the accounting process.

This procedure controls the startup of the accounting record logger. The details such as the name of the acccounting file, the port that the accounting record logger listens on, and the list of IP addresses that can use the accounting logger are controled by TCPWARE:ACCOUNTING.CONF

Do you want to activate the Accounting listener on this host [NO]: Retur n

Configuring NFS-OpenVMS Client:

Do you want the NFS Client [YES]: Return

Configuring the Dynamic Host Configuration Protocol (DHCP) Server:

Do you want to enable the Dynamic Host Configuration/Bootstrap
Protocol Server (DHCPD) [NO]: Return

Configuring DECnet over IP tunnels:
DECnet over IP tunneling allows you to establish DECnet lines and circuits over a TCP/IP network.

Do you want to configure DECnet over IP tunnels [NO]: Return

Configuring the Domain Name Services (DNS):

The Domain Name Services (DNS) for this host were previously configured to operate as a server.

Do you want to change the current configuration [YES]: Return
Do you want to enable the DNS Server [YES]: Return
%DNS-I-CONVERT, Setting up default Nameserver Config File

Cluster Load balancing is used to order a list of IP addresses based on their perceived system load. This server must be authoritative for any cluster names that are to use cluster load balancing, and the server must know what those cluster names are. If you would like to use cluster load balancing, enter yes to be prompted to enter cluster names. Use spaces to separate cluster names.

Do you want to configure a list of cluster names [NO]: Return
Do you want to enable DNS client support [YES]: Return
The client needs to obtain information from a DNS server.

Provide the internet address(es) of up to three DNS servers. Use spaces to separate multiple addresses.

Note: If the local host is configured as a server, you can enter the loopback internet address or the local host's internet address to make use of that server.

Enter the internet address of the server(s) [127.0.0.1]: Return

By default, the client appends the local domain name to local queries, and queries that fail resolving as fully qualified names. If you would like other domains appended, provide the name(s) of up to six domains to append.

If you do not want to append a domain other than your default domain, answer no to skip to the next section. Use spaces to separate multiple domains.

Do you want to configure a list of domains [NO]: Return

By default, the client resolves host names with 1 or more dots absolutely before appending your domain name. If you would like host names with 1 or more dots to be resolved with your domain name first, or you would like host names with no dots to be resolved absolutely, you want to change the number of dots.

Do you want to configure number of dots [NO]: Return

By default, the client will retry translation requests up to 4 times, with an initial wait for a reply of 5 seconds. The wait time doubles with each retransmission of the request until an answer is received, or all retries are exhausted. If you have more than one nameserver in your list of nameservers, the actual wait time allowed for each server is divided in an attempt to keep the total retry wait time the same as with a single server. This results in a total timeout of approximately 75 seconds per request if a nameserver does not answer.

Do you want to configure the number of retries or the initial retransmission delay [NO]: Return

This is how your DNS client is configured:

Domain Name: nene.com
Name Server(s): 127.0.0.1

Is this configuration correct [YES]: Return

Configuring FTP-OpenVMS:

Do you want to enable the FTP server [NO]: Return
Configuring GateDaemon (GateD):

GateD is a routing process that automatically exchanges routing information with other hosts using a variety of protocols. The
supported protocols are: RIP Version 1, RIP Version 2, DCN HELLO,
OSPF Version 2, EGP Version 2, BGP Versions 2 through 4, and
Router Discovery.

Please follow the procedure described in the TCPware for OpenVMS Installation and Configuration Guide to configure GateD.

Do you want to use the TCPware for OpenVMS GateDaemon [NO]: Return

Configuring The Internet Message Access Protocol V4 (IMAP) Server:

For detailed information on the following parameters, refer to the TCPware for OpenVMS Management Guide.

Do you want to enable the IMAP server [NO]: Return

Configuring IPP Symbiont (IPP):

IPP Symbiont is an Internet Printing Protocol Client that enables
printing using IPP to IPP-capable printers and servers over a TCP/IP
network. The supported version of the IPP protocol is 1.0.

Please follow the procedure described in the TCPware for OpenVMS Installation and Configuration Guide to configure IPP print queues.

Do you want to use the TCPware for OpenVMS IPP Symbiont [YES]:Return

Configuring the default document format for the IPP symbiont.

IPP allows the specification of the document format using MIME media types, such as "text/plain", "application/postscript" or others. The
default document format entered here will become the default used by all IPP queues that do not specify a different default in their own
configurations. Individual jobs may specify other values as needed. To force the default to be whatever format the individual printers have set as a default, specify "***printer_default***".

What is the default document format [text/plain]: Return
Configuring Job retry Delay for the IPP symbiont.

When there is a problem with a job that appears to be temporary in
nature, the job will be requeued and tried again after a delay. The Job
Retry Delay specifies the default value for how long a job will be
requeued for. Individual queues may specify a different value. Specify
this time as a standard OpenVMS delta time.

What is the job retry delay time [0 00:10:00.00]: Return

Configuring Max Log Bytes for the IPP symbiont.

When logging data in DETAILED_TRACE mode, the actual data being sent and
received is written to the log file in hexidecimal and in ASCII. The default behavior of the symbiont is to log all data. This setting will change that default for all IPP queues to the value entered. Individual queues may be configured to use different values than the default. The value is specified in bytes.

What is the MAX_LOG_BYTES value [-1]:Return

Configuring Max Stream Count for the IPP symbiont.

Each IPP symbiont process can handle data for up to 16 different IPP queues. Each queue handled by a given symbiont process is refered to as a "stream". This setting determines how many streams each queue will handle. When more than this number of IPP queues are started, additional symbiont processes will be created, each handling no more than MAX_STREAMS streams.

What is the maximum number of streams per symbiont process [16]: Return
Configuring Log Level for the IPP symbiont.

There are a number of different detail levels for logging symbiont progress and problem messages. The most detailed level, "DETAILED_TRACE", can generate significant amounts of data, and should be reserved for situations where a problem is being investigated. It is not recommended for normal use.

This value specifies the default level to be used by all queues that do not specify a different value explicitly in their configurations. See the IPP documentation for a list of legal values for this parameter.
What is the default logging level [JOB_TRACE]:Return

Configuring Opcom Log Level for the IPP symbiont.

There are a number of different detail levels for sending symbiont progress and problem messages to OPCOM. The most detailed level, "DETAILED_TRACE", can generate significant amounts of data, and should probably not be used for this setting.

This value specifies the default level to be used by all queues that do not specify a different value explicitly in their configurations. See the IPP documentation for a list of legal values for this parameter.

What is the default OPCOM logging level [INFO]: Return

Configuring Opcom Terminal for the IPP symbiont.

There are several OPCOM "terminals" to which OPCOM messages can be directed. This value specifies the default OPCOM terminal to be used by all queues that do not specify a different value explicitly in their configurations. See the IPP documentation for a list of legal values for this parameter.

Which OPCOM terminal should logging messages be sent to [PRINTER]: Return

Configuring Autostart for the IPP symbiont.

When TCPware is started, or CNFNET is used to start the IPP component in particular, it can automatically issue a START/QUEUE command for all of the queues on the system that use the IPP print symbiont.

Do you want to auto-start the IPP queues [NO]: Return

Configuring Autostop for the IPP symbiont.

When TCPware is shutdown, or CNFNET is used to shutdown the IPP component in particular, it can automatically issue a STOP/QUEUE/RESET command for each of the queues on the system that use the IPP print symbiont. If you do not enable Autostop for the IPP symbiont you will need to make sure that you have stopped all IPP queues by some other means before you shutdown or restart TCPware. Shutting down the kernel while leaving network print symbionts running could result in aborted print jobs.
Do you want to auto-stop the IPP queues [NO]: Return

Configuring Kerberos (Version 4) Services:

Kerberos allows you to control user access to network services.

Do you want the Kerberos Services [NO]: Return
Configuring the Line Printer Services (LPS):

Line Printer Services consists of the client and the server. The client lets users on this OpenVMS host print files on printers attached to remote hosts. The server accepts files from remote hosts to be printed on printers attached to this OpenVMS host. LPS configuration consists of configuring:

- Default remote printer for LPS Client commands (LPR,LPQ,LPRM)
- OpenVMS Print Queue
- LPD Server

Do you want to enable the Line Printer Services (LPS) [NO]: Return

Configuring the Miscellaneous Services:

Do you want the Trivial File Transfer Server (TFTPD) [NO]: Return
Do you want the CHARGEN Server (CHARGEND) [NO]: Return
Do you want the DAYTIME Server (DAYTIMED) [NO]: Return
Do you want the DISCARD Server (DISCARDD) [NO]: Return
Do you want the ECHO Server (ECHOD) [NO]: Return
Do you want the QUOTE Server (QUOTED) [NO]: Return
Do you want the AUTH (Ident Service) [NO]: Return
Do you want the TIME Service [NO]: Return

Configuring NFS-OpenVMS Server:

Do you want the NFS V3 Server (NFSDV3) [YES]: Return

For detailed information on NFS-OpenVMS Server parameters, refer to the
TCPware(R) for OpenVMS Installation & Configuration Guide.

Type <return> to continue... Return

The access identifier parameter, NFS_ACCESS_IDENTIFIER, specifies the
name of the rights identifier to be granted to all NFS users. This
parameter is optional.

To remove a previously entered identifer, enter *.

Enter the access identifier []: MARKETING Return

The security mask parameter, NFS_SECURITY, controls access to the OpenVMS system. Note that these options should normally be specified on a file system basis (rather than a global basis) using the appropriate NETCU ADD EXPORT command qualifiers (as indicated below), if applicable.

Bit Mask Meaning when set
-------- ----------------

1 Superuser mount. Only the superuser is allowed to
mount file systems (/SUPERUSER_MOUNT).
2 Explicit mount. Only file systems explicitly exported
can be mounted (/EXPLICIT_MOUNT).
4 Mount proxy check. The UID/GID used in mount requests
must exist in the PROXY database (/PROXY_CHECK).
8 Privileged port check. All incoming NFS requests must
originate from privileged ports (/PRIVILEGED_PORT).
16 Report all access allowed for files to client (server
does all access checks) (/SERVER_ACCESS).
32 Allow PCNFS batch queue printing.
64 Disable PCNFSD use of the intrusion database.
128 Disable PCNFSD deletion of printed files.

To specify the security mask, add up all the bit mask values for the types of security you want provided.

Enter the security mask [0]: 16 Return

The logging class mask parameter, NFS_LOG_CLASS, controls the types of information written to the log file.

Bit Mask Meaning when set Comments
-------- --------------- --------

1 Warnings Error recovery messages
2 Mount Requests Mount call messages
4 General General operation messages
8 Security Security violation messages
16 NFS Errors NFSERR_IO messages

To specify the logging class mask, add up all the bit mask values for the types of information you want logged. The value -1 logs all classes.

Enter the logging class mask [-1]: Return

The PCNFSD enable parameter, NFS_PCNFSD_ENABLE, enables or disables the PCNFSD protocol.

You may enter YES (to enable PCNFSD), NO (to disable PCNFSD), or PRINTING-ONLY (to enable PCNFSD for printing only - authentication requests are ignored).

Do you want PCNFSD enabled [YES]: Return

The spool directory parameter, NFS_PCNFSD_SPOOL, defines the spool directory used for printing files with PCNFSD. If this parameter is undefined, the printing capability of PCNFSD is disabled. The spool directory name is case sensitive.

To remove a previously entered spool directory, enter *.

Enter the PC-NFS Client spool directory []: /NFS/EXPORTED/SPOOL Return

These are the NFS-OpenVMS Server configuration parameters you selected:
Access Identifier: MARKETING
Security Mask: 16 = All Access
Logging Class Mask: -1 = Warnings, Mounts, General, Security, Errors
PCNFSD enable: 1 (YES)
Spool directory: /NFS/EXPORTED/SPOOL
Is this configuration correct [YES]: Return
Configuring the Network Time Protocol (NTP) Daemon:

Kerberos is installed on this system. For Kerberos to work correctly, use the Network Time Protocol (NTP) Daemon to synchronize the clock on this system with the other systems that are also using Kerberos.

Do you want to use the TCPware for OpenVMS NTP Daemon [YES]: Return

You may set the parameter WAYTOOBIG, which defines the number of seconds difference between the system clock and the reference clock past which no clock adjustment will be performed by the NTP deamon.

While you may set this to any numeric value you wish, you should realize that setting it to lower than 4000 may interfere with NTP attempting to automatically adjust your system clock for Daylight Savings Time (if your timezone rule calls for that).

Enter value for WAYTOOBIG [4000]: Return

Configuring The Post Office Protocol V3 (POP3) Server:

For detailed information on the following parameters, refer to the TCPware for OpenVMS Management Guide.

Do you want to enable the POP3 server [NO]: Return
Configuring the PWIPDRIVER:

The PWIPDRIVER is *required* by Pathworks and DECnet/OSI over TCP/IP.

Do you want to enable the PWIPDRIVER [YES]: Return

Configuring the Berkeley R Commands:

The Berkeley R Commands have 2 parts: services and clients. There are 3 R services: login, shell, and exec. login service allows remote users to log in to this system using the BSD RLOGIN protocol. Authorization is done using equivalence files alone, or with both equivalence files and the user having to enter a password.

shell and exec services both allow remote users to execute a single command on this system. The difference is in the authorization method used. shell uses equivalence files while exec uses explicit username/password strings.

All services can, optionally, use Service Access Lists to further restrict remote access.

There are 3 clients: RLOGIN, RSH, and RMT.

You have the option of making the services available. You should be familiar with the R Commands and the authorization methods before starting the services to insure that you do not inadvertently expose your system to a security risk.

Do you want to activate login service [YES]: Return
There are 2 methods of authorization available for login service.

NORMAL: Uses equivalence files to authorize remote users, and allows
remote user to try a username/password if there isn't an
equivalence file match.
SECURE: Uses equivalence files, and if there is a match, requires the
remote user to enter the account's password correctly. If there is
no equivalence file match, access is denied.
Which type of login authorization (NORMAL, SECURE) [SECURE]: Return
Do you want to activate shell service [YES]: Return
Do you want to activate exec service [YES]: Return

The RLOGIN, RSH, and RMTSETUP (without the /PASSWORD qualifier) commands
require SYSPRV privilege to bind to reserved TCP ports which are needed
for them to work correctly. In a BASIC configuration, the executable images are INSTALLed with SYSPRV privilege to allow all users on your
system to make use of them. In this FULL configuration, you have the
option of restricting the use of these 3 commands.

Answering "NO" to the following questions restricts use of the indicated
command to users with either SYSPRV or BYPASS privilege only.

Answering "YES" allows general use of the command.
Do you want to INSTALL the RLOGIN image [YES]: Return
Do you want to INSTALL the RSH image [YES]: Return
Do you want to INSTALL the RMTSETUP image [NO]: Return
Configuring SMTP-OpenVMS:

For detailed information on the following parameters, refer to the TCPware for OpenVMS Management Guide.

Do you want to use the SMTP Mail Transfer Agent? [NO]: Return

Configuring the SNMP Agent:

SNMP is the Simple Network Management Protocol. If you activate the SNMP agent on this host, the agent will start up when you start up the network and will respond to queries. Answer YES to the next prompt only if your network has an SNMP client (network management station).

Do you want to activate the SNMP agent on this host [NO]: Return

Configuring SSH-OpenVMS:

For detailed information on the following parameters, refer to theTCPware for OpenVMS Management Guide.

TCPware supports both SSH1 and SSH2 servers. You may configure TCPware to support either SSH1 servers or SSH2 servers, or both. Note that the choice of TCPware servers has no impact on the TCPware SSH client, which supports both SSH1 and SSH2 remote servers.

Do you want to enable the SSH1 server [NO]? Return
Do you want to enable the SSH2 server [NO]? Return

Configuring TALK Utility

The TALK client/server operates with other "NTALK" clients and servers. The "NTALK" protocol was introduced in BSD V4.3; the version of TALK shipped with TCPware is not compatible with TALK utilities based on earlier versions of BSD.

In order for users to use TALK, the TALKD server must also be enabled.

Do you want to enable the TALKD server [NO]: Return
Configuring TELNET-OpenVMS:

Determine how many Server-TELNET listeners you want on this system. Set this number to 1 unless you expect a lot of incoming TELNET activity.

This number does not limit the number of incoming TELNET sessions. The number of sessions is limited only by the available system resources (such as the maximum number of processes).

Enter the number of Server-TELNET listeners [1]: Return

Configuring the TIMED Daemon:

Do you want to use the TCPware for OpenVMS TIMED Daemon [NO]: Return
Configuring the X Display Manager (XDM) Server:

Do you want to use the TCPware for OpenVMS XDM Server [NO]: Return

TCPware Services Configuration Menu

Configuration Options:

1 - Core environment for TCP/IP services
2 - Configure all TCP/IP components
3 - Configure a specific TCP/IP component

4 - Startup/Restart TCP/IP services
5 - Shutdown TCP/IP services

6 - Startup/Restart a specific TCP/IP component
7 - Shutdown a specific TCP/IP component

Enter configuration option: E Return