These pages are moving to the @Home server

Linux on Wave

See also:

The Linux Wave - Home Upgrade Page
Neil Schneider's cox@home and Linux page
Unix@Home FAQ

How well does it work? - Pretty darn good; after all, Unix was designed as a networking system.

What do you get? - Currently (July 97 in Richmond, BC):

A LANcity LCPET-2 cable modem - an external box about 7" x 11".
A 10Base-T Ethernet cable
A new 75 ohm cable to your desired location
An SMC 8416 Ethernet card
A thick blue book with remarkably little information about the service. It does, however, have quite a lot about the Internet, email, search engines, etc.
A set of software for your second choice OS (Win3.1, Win95, MacOS) including Netscape 3.0
Up to 5 email accounts on a POP3 server
An outgoing SMTP server
NNTP access to a newsserver with over 20,000 groups (though it's slightly flakey at the moment)
ftp access to 5Mb of personal space on a nearby Web server (like this one)

Installation

As I recall, the time budget for cable installation is one hour, so make it easy for the guy. I routed a smaller cable previously to pull through the new one. It almost worked - the tape join gave way and I had to redo the last leg. (This being a house with no crawlspace and all cables roughed-in during construction, and I didn't want cable stapled around the outside.)

The total time budget is two hours, which may include a virus scan of the DOS partition, installation of the SMC card, installation of the driver, installation of tcp/ip and Netscape/MSIE, and verification that peripherals such as modem, sound card, etc. are still working. In my case installation coincided with a temporary network outage and we tried to use an existing NE2000 card under Win3.1 which had only been used under Linux, so it took at least that long.

Note: I've read (Ted Powell) that if you swap the Ethernet card, you must power-cycle the cable modem.

How does it Work ?

The cable modem functions as a bridge - it is transparent to your computer, which thinks it is on a common Ethernet segment with everyone on your street (up to 250 homes). If you dump the arp cache (arp -a) you will see the Ethernet address of your local router, plus any other local PCs that might have conected to you. The rest is straight Internet stuff - routers, gateways, DNS etc. The modem does have its own ip address for diagnostics, but you don't need to know it.

What does it Cost ?

See the Wave page. Currently $55/month plus an installation fee.

What to Expect ? - or rather, what not to expect:

Don't expect to connect to Europe (or anywhere much, for that matter) at 400kbps. After all, this is the Internet we're talking about... Connectivity to the local segments is pretty good, and on a Pentium/Alpha/PPC you might actually get 400kbps to www.wave.ca. Currently, routing is via MCI to Seattle, so it's pretty good to Microsoft, not so good to UBC, SFU, gov.bc.ca etc. The modems are capable of up to 10Mbps, but are currently set to a lower rate until the networks are upgraded.

Sometime soon (fall 97 ?) Wave will connect to the @Home network, and will probably have access to high-speed mirrors and caches. Meanwhile ... it's a lot better than 28.8, and maybe you can hook up your own cache.

Configuration

Rogers give you values for

IPADDR
NETMASK
GATEWAY
DOMAIN
DNS (3)
NNTPSERVER
POPSERVER
SMTPSERVER

They may not give you values for

NETWORK
BROADCAST

so you have to calculate these. I have
BROADCAST = (IPADDR | 255), NETWORK = (GATEWAY & 255.255.255.0)
(bitwise OR, AND).

Note: (From Ted Powell) with SMC EtherPower (PCI), you may need to add "alias eth0 tulip" to /etc/conf.modules.

Connecting Multiple PCs

Yes, it can be done. See my localnet page for details of setting up Linux with 2 Ethernet cards, ip masquerading, SMB (Windows for Workgroups) server, etc.

Security - Be careful out there!

With Wave, you are On the Internet. Of course, this is what you wanted! You now have a static ip address and a continuous connection. This means that people out there can find your machine and potentially do nasty things to it. These include, among others:

Logging in to your system using accounts with no password, guest accounts, etc.
Exploiting security holes in programs such as imapd or sendmail to execute useful commands on your machine, such as rm -rf / or ping -s 10000 -f home.netscape.com
NFS mounting your disks and trashing your files
Using your machine as an SMTP relay to send spam to 10,000 irate users
Sending you megabytes of code as a mail bomb
Exploiting your anonymous ftp area as a Warez site for pirated code

You get the idea. For more information on this kind of thing, see e.g. CERT.

Solutions:

Go through /etc/inetd.conf. Read, understand, and comment out what you don't want.
Use tcpwrappers and /etc/hosts.allow, /etc/hosts.deny.
Do not export things to the world in /etc/exports
Don't create accounts without passwords for your kids, just to make it easier to login.
Go through /etc/ftp*. Read, understand, and edit.
Go through /etc/httpd/conf/*conf. Read, understand, and edit. Consider setting up controls using .htaccess, create htdocs/robots.txt
Occasionally examine the process list and administrative logs (in /var/adm or /var/log)
If you suspect you are under attack:
- Gather as much information about current processes using something like ps -alxewww > ps.log, and netstat > net.log
- Disconnect the Ethernet cable from the modem.
- Consider doing a kernel dump
- Reboot
- Go through the logs for everything - ftp, httpd, messages, secure, syslog etc. By correlating timestamps between these you may be able to figure out what happened and fix it.

Joy, joy! - Not only are you open to the Internet without a firewall, which is a pretty common situation in an academic environment, you are also open to an unsupervised Ethernet segment, which isn't so common. This means that various other protocols such as IPX, NetBUI, DECnet, LAT etc. will also work. Also, it means that someone on your local segment can use a packet sniffer.

Note: It iseems that hat the LanCity cable modems are configured to filter foreign TCP packets, so you can't sniff passwords in Telnet, ftp, POP, WWW so easily. However, other protocols such as Novell and Microsoft (BEUI, etc.) are not filtered, so any data you transfer using these may be exposed.

Although your TCP packets can't be sniffed, your computer can be "discovered" from WWW logs, BEUI packets, your WWW server, or just scanning the segment. A port scan may then be done of your machine, and any exposed holes exploited. Or something like a ping-of-death or denial-of-service attack may bring your machine down.

Juggernaut warning!

It's also possible to have your computer physically stolen from your house. To guard against that, encrypt your sensitive data and back it up elsewhere (your Wave ftp area, for instance ...) Solutions:

Go through /etc/rc.d/rc2.d etc. Read, understand, and comment out services you don't need, such as Samba, Novell, bootp, News.
Consider using e.g. ssh (available from sunsite.unc.edu/pub/packages/security/ssh/ or your favourite mirror) for remote access (prevents your passwords being sniffed and encrypts login sessions). See also the SSH homepage, F-Secure.
Don't send sensitive information unencrypted, in e.g. Web forms.

With ssh, a sniffer sees something like this:

^MSSH-1.5-1.2.20
ÿ^M^@^@^A^K^@^@^@^@^@^BmEÐ:Ì![Á^@^@^C^@^@^F%^BÿxÆkÂ
~NSÓuÐ±^Y¤èC~BÖÛ^Fz=£~D-µ]^^â\÷ m^@^@^@^E~T!í4^

The Blue Book talks a bit about this for the Windows and Mac environments.