We are a group of consultants where our areas of speciality include providing services to many different sites and companies. We provide consulting services for business who wish to run open-source programs and services. At this time, we can provide consultation for:

• Mail Servers
• DNS Servers
• Web Servers
• Firewalling and NAT
• Financial Accounting
• Business financial analysis
• Budget Management.

I’m trying to play with the latest JES/Outlook connector combo. It seems to have come a long way since the last time I tried it, but I’m still having some problems. When I start Outlook, it prompts me to log into the addressbook. I enter the correct password, but it just reprompts me until I eventually just hit cancel. Here is the solution:

I installed JES 2005q4 on a test system, per http://docs.sun.com/app/docs/coll/1480.1 to install it all one one system.

I set up the outlook connector (7.1.222.4 – the one that comes on the jes 2005q4 cd’s) to point at this, and most of what I have tested works pretty well. But… The addressbook functionality isn’t working. The symptoms/logs I’m seeing are:

- When I start Outlook, it prompts me to log into the addressbook. I enter the correct password, but it just reprompts me until I eventually just hit cancel.

- On the Web server, I see the access in the access logs:
- – [09/Dec/2005:11:15:41 -0500] “POST /uwc/wabp/login.wabp?now=1134148064 HTTP/1.1″ 200 184

- I see the following in the uwc logs (/opt/SUNWuwc/data/logs/uwc.logs):
Dec 9, 2005 11:17:44 AM com.sun.uwc.common.auth.IdentitySSOAuthFilter doFilter
FINE: uid… jdoedomain…example.com
Dec 9, 2005 11:17:44 AM com.sun.uwc.common.auth.IdentitySSOAuthFilter doFilter
FINE: username… jdoe
Dec 9, 2005 11:17:44 AM com.sun.uwc.common.auth.IdentitySSOAuthFilter doFilter
FINE: 1. session is not present.. get token manager..
Dec 9, 2005 11:17:44 AM com.sun.uwc.common.auth.LDAPAuthFilter doFilter
FINE: Check If Identity is enabled
Dec 9, 2005 11:17:44 AM com.sun.uwc.common.auth.LDAPAuthFilter doFilter
FINE: Identity is enabled….return
Dec 9, 2005 11:17:44 AM com.sun.uwc.abclient.ABInitFilter doFilter
WARNING: Session is not created, user not authenticated!!

If I log into uwc, everything seems to work there correctly – I can see the addressbook, create entries, etc. Any ideas where I went wrong or where else I should look?

Answer.
You need to follow these steps:

Access Manager domain service configuration

Following steps are required to be completed manually in Access Manager for Access Manager domain service configuration
Steps:
add-
– Authentication Configuration
– Core
– Ldap

* Go to Authentication Configuration–>New–>(Give some meaningful name)–>select added services
o Authentication Configuration –> Edit –> in edit mode ‘Add..’ module –> Select LDAP as module name –> OK –> Submit.
o Core –> Select added Ldap service in following drop down boxes –>
+ Administrative Authentication Configuration
+ Organization Authentication Configuration
+ Click Save

Restart UWC webcontainer.

In case your Base DN is similar to ou=people,o=domain.com, o=isp , you need to this to the domain.com as well. See the link below

Also, I believe similar steps to the above are given in the technical document you reference, under the category ‘To add services to the lower level organization.’

http://docs.sun.com/source/819-4879/index.html#wp35351

I believe the end result is the same. This will be necessary in order for the OC to be able to login to the AB Server.

I’ve had the Acer Ferrari 4005 WMLi for about 3 days now and I don’t like it! Read on more on why I think this may not be the best laptops in the market

Well, first and foremost this is a beautiful machine. Sturdy, well built and impressive. But it has it’s cons.

1. It’s noisy fan! – Now, I have had many different laptops of varying variety (Dell’s, IBM Thinkpads, Mac’s/Powerbooks, Toshiba’s) and everyone has some fans that make noise. But of all the laptops, this suckers makes the most irritating whirring noise I can’t imagine to tell how you irritating it can get when the fan runs 24/7! I can place this laptop alongside a Dell D600 which runs quiet as a whisper.
2. The broken ACPI – Almost every non-windows OS I have tried on this (So far: RR64Linux, SuSE 10.0 64-bit, Ubuntu Breezy 5.10, Fedora Core 4 64-bit, Solaris 10 01/06) do not work well on this machine. The ACPI implementation is very broken and needs a lot of work to fix.
3. Broadcom Wireless Drivers - NDiswrapper sucks! The only distro it has worked has been SuSE 10.0. All others, I just cannot associated with AP (Plain ‘ol 128 Bit WEP). The best working has been sadly with Windows XP. Interestingly, I find that I always come back and use Windows. The interface is clean, simple and almost everything….including suspend/resume works.
4. Suspend-Resume on non-Microsoft OS’s. - No other OS has worked with suspend/resume.

With the availability of the new intel based mac’s which are the same ball park range of this machine, this Acer Ferrari costing around $2800 CAD (inc. taxes)..looks a bit too expensive. I am seriously considering returning this and waiting till the next version of intel mac’s or dual-core laptops start showing up.

Here are some profiles (tcshrc/cshrc/bashrc) found on my systems. Source of some of these are comp.unix.solaris,dotfiles.com etc.

TCSH

First the keyboard – the tab key does no autocompletion and the arrow keys cause funny characters on my screen instead of making the cursor > back up or move forward. Backspace and the other keys seem to work OK.

Type the following in:

su -
stty erase ^H
TERM=vt100
export TERM
exec tcsh -l
eval `/usr/openwin/bin/resize -c`

And now you’re ready to work comfortably: TERM is defined properly, [BACKSPACE] key will work, window size is defined, and you can do autocompletion, and MUCH, MUCH more. Why this had to be done, more on that later. But first, let’s configure your SHELL.

Now, type in:

passwd -e

as the new shell, type in “/bin/tcsh”. Your default shell has now been changed to the Tenex C-shell; it can do everything bash can, and then some, AND THEN SOME MORE.

Don’t modify root’s SHELL.

type in “exit”
type in “exit” again, then log in.

Create and edit the following files with your preferred text editor:

~/.login:
stty erase ^H

~/.cshrc:
set Resize=”/usr/openwin/bin/resize”

set autolist
set notify
set correct=cmd
set prompt=”[%B%U%n@%m%b%u][%B%~%b]> “
set savehist=7000

eval “$Resize” -c

setenv TERM vt100
setenv PAGER ‘less -s’

You may also want to edit ~/.logout:
clear

but this is optional.

Anyways, now your cursor keys and the [BACKSPACE] will always work properly, you will have autocompletion (try pressing the [TAB] key on its own!), and everything will just magically work (and better than in bash, too).

The reason you saw ESCape sequences instead of cursor keys moving is that Solaris uses the Bourne SHELL (/bin/sh) as the default. This is the lowest common denominator guaranteed to always work. It is also the standard on all System V, release 4 UNIX operating systems and environments.

Have fun!

I have never really liked the syslogd shipped by Sun for Solaris. Syslog-ng offeres a lot more features and performs much better IMHO.. So I ended up replacing my syslogd to syslog-ng. Read on more on how to do so:

Steps

1. Download the Solaris 10 syslog-ng Package.

2. Remove your current syslog defs from svc database

# svcadm disable system-log
# svccfg
svc:> delete system-log*

3. Install the package:

# pkgadd -d NCsysng-1.6.7-1.pkg

The following packages are available:
1 NCsysng next gen syslog server
(sparc) 1.6.7-1

Select package(s) you wish to process (or ‘all’ to process
all packages). (default: all) [?,??,q]:

[…]

Ensure that syslog-ng is now in your svc manifest

# svcs | grep system-log-ng
online 17:28:52 svc:/site/system-log-ng:default

You can use a a better configuration than the one shipped with this package:

====================================================
####################################################
# See syslog-ng(8) and syslog-ng.conf(5) for more
# information
####################################################

# Options
options {
sync(0);
use_fqdn(yes);
};

# Sources of syslog messages (only local on clients)
source s_local {
sun-streams(”/dev/log” door(”/etc/.syslog_door”));
internal();
};

# Destinations: local files, the console, and the remote syslog server
destination l_authlog { file (”/var/log/authlog”); };
destination l_messages { file (”/var/log/messages”); };
destination l_maillog { file (”/var/log/maillog”); };
destination l_ipflog { file (”/var/log/ipflog”); };
destination l_imaplog { file (”/var/log/imaplog”); };
destination l_console { file (”/dev/console”); };
destination l_syslog { file (”/var/log/syslog”); };

# Level Filters
filter f_emerg { level (emerg); };
filter f_alert { level (alert .. emerg); };
filter f_crit { level (crit .. emerg); };
filter f_err { level (err .. emerg); };
filter f_warning { level (warning .. emerg); };
filter f_notice { level (notice .. emerg); };
filter f_info { level (info .. emerg); };
filter f_debug { level (debug .. emerg); };

# Facility Filters
filter f_kern { facility (kern); };
filter f_user { facility (user); };
filter f_mail { facility (mail); };
filter f_daemon { facility (daemon); };
filter f_auth { facility (auth); };
filter f_syslog { facility (syslog); };
filter f_lpr { facility (lpr); };
filter f_news { facility (news); };
filter f_uucp { facility (uucp); };
filter f_cron { facility (cron); };
filter f_local0 { facility (local0); };
filter f_local1 { facility (local1); };
filter f_local2 { facility (local2); };
filter f_local3 { facility (local3); };
filter f_local4 { facility (local4); };
filter f_local5 { facility (local5); };
filter f_local6 { facility (local6); };
filter f_local7 { facility (local7); };
# Custom Filters
filter f_user_none { not facility (user); };
filter f_kern_debug { filter (f_kern) and filter (f_debug); };
filter f_daemon_notice { filter (f_daemon) and filter (f_notice); };
filter f_mail_crit { filter (f_mail) and filter (f_crit); };
filter f_mesg { filter (f_kern_debug) or
filter (f_daemon_notice) or
filter (f_mail_crit); };
filter f_authinfo { filter (f_auth) or program (sudo); };

# Log statements
# Log things locally
log { source (s_local); filter (f_authinfo); destination (l_authlog); };
log { source (s_local); filter (f_mail); destination (l_maillog); };
log { source (s_local); filter (f_local0); destination (l_ipflog); };
log { source (s_local); filter (f_local1); destination (l_imaplog); };
log { source (s_local); filter (f_syslog); destination (l_syslog); };
log { source (s_local); filter (f_emerg); filter (f_user_none);
destination (l_console); };
log { source (s_local); filter (f_mesg); filter (f_user_none);
destination (l_messages); };
====================================================

Save this file as /usr/local/etc/syslog-ng/syslog-ng.conf and restart syslog-ng (svcadm restart system-log-ng)

Voila! You should have syslog-ng working on your system…

Painless?

Every user on a UNIX® system has a password associated with their account. It seems obvious that these passwords need to be known only to the user and the actual operating system. In order to keep these passwords secret, they are encrypted with what is known as a “one-way hash”, that is, they can only be easily encrypted but not decrypted. In other words, the operating system itself does not really know the password. It only knows the encrypted form of the password. The only way to get the “plain-text” password is by a brute force search of the space of possible passwords.

By default, user passwords are encrypted with the crypt_unix algorithm. Since Solaris 9 12/02, extended methods of authentication and securing the local passwords exist. You can now use a stronger encryption algorithm, such as MD5 or Blowfish, by changing the default password encryption algorithm. The next time that your users change their password, the algorithm that you specified encrypts the password

Identify your release

$ cat /etc/release

Solaris 9 8/03 s9s_u4wos_08a SPARC
Copyright 2003 Sun Microsystems, Inc. All Rights Reserved.
Use is subject to license terms.
Assembled 13 June 2003

Select encryption algorithgm: You have the option of using blowfish or MD5 as algorithms to encrypt your passwords. This algorithm is suitable for a mixed network of machines that run the Solaris, BSD, and Linux versions of UNIX. In terms of cryptographic security, Blowfish is MUCH stronger than MD5 and has yet to be cracked. Hence, I highly recommend to choose blowfish over MD5.

Change to Blowfish Algorithm for Password Encryption

As root edit the CRYPT_DEFAULT variable in the /etc/security/policy.conf file and change it to 2a as your value for the CRYPT_DEFAULT variable. The policy.conf entries that control password encryption would look like the following:

AUTHS_GRANTED=solaris.device.cdrw
PROFS_GRANTED=Basic Solaris Use
# crypt(3c) Algorithms Configuration
#
# CRYPT_ALGORITHMS_ALLOW specifies the algorithms that are allowed to
# be used for new passwords. This is enforced only in crypt_gensalt(3c).
#

CRYPT_ALGORITHMS_ALLOW=1,2a,md5

# To deprecate use of the traditional unix algorithm, uncomment below
# and change CRYPT_DEFAULT= to another algorithm. For example,
# CRYPT_DEFAULT=1 for BSD/Liux MD5.
#
CRYPT_ALGORITHMS_DEPRECATE=__unix__

# The Solaris default is the traditional UNIX algorithm. This is not
# listed in crypt.conf(4) since it is internal to libc. The reserved
# name __unix__ is used to refer to it.
#
CRYPT_DEFAULT=2a

Change the User Password

Finally, here’s how /etc/shadow entry for a user looks like when using the Blowfish hash function:

testuser:$2a$04$/dlXUpiyQTHSyB1.iG97t.Tpwjlmn4QaTvpQzFZUNDX.MREFFljp2

A tell-tale sign of the blowfish password is the $2a$. (MD5 passwords have $1$ at the beginning. DES passwords have short hashes with no leading characters) Notice how the hash is larger in size as stronger encryption algorithms are used… Longer hashes don’t necessarily mean better, but for the algorithms mentioned here, it does.

Troubleshooting

8 char password still works

I was bitten by this problem on one of our machines. As per Casper Dik, if you really use crypt blowfish then there’s no way the 8 byte password should be acceptable. In my case, I had modified the pam.conf when I had installed Titan (a security module that secures your Solaris installs). Once I replaced the original pam.conf, the password length started working.

Other Misc troubleshooting tricks

Check function that passwd is using

One of the ways to check which function (getpass() or getpassphrase() ) passwd is using, do something like:

[root@chromium:~]# sotruss passwd
passwd -> libc.so.1:*atexit(0xff3cd050, 0×24c00, 0×0)
passwd -> libpam.so.1:*pam_authenticate(0×26ae0, 0×0, 0×25090)
passwd -> libc.so.1:*str2spwd(0×27868, 0×56, 0xffbfebec)
passwd -> libc.so.1:*calloc(0×1, 0×8, 0×26ae0)
passwd -> libc.so.1:*getpassphrase(0xffbfaa78, 0×0, 0xffffffff)

As you can see from the above sotruss output, passwd is indeed using getpassphrase. The getpass() function opens the process’s controlling terminal, writes to that device the null-terminated string prompt, disables echoing, reads a string of characters up to the next newline character or EOF, restores the terminal state and closes the terminal. The getpassphrase() function is identical to getpass(), except that it reads and returns a string of up to 256 characters in length.

Another way to check which library (in this case /usr/lib/security/crypt_bsdbf.so.1) passwd is using to encrypt /etc/shadow you can truss passwd’s output and look for the library being used. For example, if we use Blowfish, passwd should use crypt_bsdbf.so, i.e.:

[root@chromium:~]# truss passw
read(4, ” #\n # C o p y r i g h”.., 8192) = 250
close(4) = 0
stat(“/usr/lib/security/crypt_bsdbf.so.1″, 0xFFBFDC3C) = 0
open(“/usr/lib/security/crypt_bsdbf.so.1″, O_RDONLY) = 4
fstat(4, 0xFFBFDC3C) = 0
mmap(0×00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xFF2C0000
mmap(0×00000000, 90112, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xFEEB0000
mmap(0xFEEC4000, 659, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 16384) = 0xFEEC4000
munmap(0xFEEB4000, 65536) = 0
resolvepath(“/usr/lib/security/crypt_bsdbf.so.1″, “/usr/lib/security/crypt_bsdbf.so.1″, 1023) = 34
memcntl(0xFEEB0000, 1592, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
close(4) = 0

Hopefully you found this useful. If you have further problems, you can always email me or try the sunmanager’s list (and archive).

–
Bruno Saverio Delbono

[1] – http://docs.sun.com/db/doc/816-4883/6mb2joatc?a=view
[2] – http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/crypt.html
[3] – http://bsdvault.net/sections.php?op=printpage&artid=89

Note: This requires you to flash your firmware to an unofficial firmware which voids your warranty. You’re on your own. But don’t worry, if you flash your router properly, everything should go ok.

What’s needed:

Firmware – You must have the sveasoft firmware installed on your router. I’m currently using WRT54G_Wolf_W42_Alchemy_6rc1 which can be found at
http://wrt54g.thermoman.de/ or here’s the ed2k link:
http://tinyurl.com/5vxkh

Note: You can also run the openwrt firmware. I’m running sveasoft and which is why I’ll focus on setting up IPv6 with this firmware. There already are other howtos for openwrt. There are a few firmware’s listed there and I chose the latest one with IPv6 enabled.

If you’re interested to read up on the GPL licensing issues and sveasoft, please read the website above or visit it’s forums.

IPv6 Tunnel Broker – Goto http://tunnelbroker.net/ and set yourself an account + a /64 allocation. You can also visit www.hs247.com for reading up more on IPv6. Once setup, your tunnel should be activated within 24 hours (Hint – If you give the right information at registration, it takes even less time).

Background on ports on the linksys router:

From the point view of CPU or OS:

1. the wireless interface acts as eth1
2. the VLAN0 acts as eth0.
3. bridge br0 slaves eth0 and eth1

From the point view of Switch Controller:

1. 4 LAN ports and the Internal port form VLAN0
2. WAN port form and the Internal port form VLAN1
3. VLAN0 and VLAN1 share the Internal interface

Therefor, the IPv6 tunnel to your tunnel broker should be setup for vlan1 and your radvd should advertise on br0 for your local network.

Setup:

Install the firmware. Once installed, your router should be reset and setup again. While you’re here, you can also change your Xmit Power to something like 54 – 61 (safe) to 82 (high, but safe enough). This should give you a considerable boost in signal. The through the Administration page, open either the telnet or the ssh port for the outer. This should allow you to telnet/ssh into your router respectively.

lucifer:~$ telnet 192.168.2.1
Trying 192.168.2.1…

Connected to 192.168.2.1.
Escape character is ‘^]’.

VPN login: root
Password:
——————————————

Welcome to the Sveasoft WRT54G/GS Firmware

Alchemy-6.0-RC1.w42 contributor build
version v2.04.4.8sv

USE OF THIS FIRMWARE IS AT YOUR OWN RISK

http://www.sveasoft.com

——————————————

BusyBox v1.00-rc3 (2004.09.17-13:23+0000) Built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

~ # uname -a
Linux VPN 2.4.20 #56 Sun Nov 7 05:34:08 EST 2004 mips unknown

Now enable IPv6 and radvd:

~# nvram set ipv6_enable=1
~# nvram set radvd_enable=1
~# nvram set radvd_conf=/tmp/radvd.conf

Now commit your changes and reboot

~# nvram commit
nvram_commit(): start
nvram_commit(): end

Once rebooted, you should have the sit0 interface in your ifconfig and ipv6 loaded in lsmod:

br0 Link encap:Ethernet HWaddr 00:0F:66:44:22:26
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

eth0 Link encap:Ethernet HWaddr 00:0F:66:44:22:26
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:5 Base address:0×2000

eth1 Link encap:Ethernet HWaddr 00:0F:66:44:22:28
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:4 Base address:0×1000

imq0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:30
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

imq1 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:30
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

sit0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP RUNNING MULTICAST MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

sixbone Link encap:UNSPEC HWaddr
18-55-BF-E1-00-00-00-00-00-00-00-00-00-00-00-00
UP POINTOPOINT RUNNING MULTICAST MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

teql0 Link encap:UNSPEC HWaddr
00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

vlan0 Link encap:Ethernet HWaddr 00:0F:66:44:22:26
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

vlan1 Link encap:Ethernet HWaddr 00:0F:66:44:22:27
inet addr:24.85.191.225 Bcast:24.85.191.255 Mask:255.255.252.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

~ # lsmod
Module Size Used by Tainted: P
ip_nat_proto_gre 1920 0 (unused)
ip_nat_pptp 2620 0 (unused)
ip_conntrack_pptp 3420 1
ip_conntrack_proto_gre 2712 0 [ip_nat_pptp ip_conntrack_pptp]
ipv6 181648 -1
adm6996 30304 0 (unused)
wl 401592 0 (unused)
et 22336 0 (unused)

Now setting it all up:

- Using the example configs option in the tunnelbroker site, choose Linux-route2 and click show config. This should give you an ouput something like this:

modprobe ipv6
ip tunnel add sixbone mode sit remote 64.71.128.82 local 24.85.191.225
ttl 255
ip link set sixbone up
ip addr add 2001:470:1F00:FFFF::45B/127 dev sixbone
ip route add ::/0 dev sixbone
ip -f inet6 addr

IGNORE the first and the last line and create a simple file such as
PLEASE note the changes needed for your local IP

———————cut-here——————————–
# File to setup Linksys WRT54GS router with ipv6
# by Bruno Saverio Delbono
# Adapted from Martin Hicks mort at bork.org’s script
# made specifically for openwrt
# License – BSD.
#!/bin/sh

echo “1″ > /proc/sys/net/ipv6/conf/all/forwarding

extif=vlan1
intif=br0
tundev=sixbone

# This doesn’t work the busytools implementation of
# sveasoft firmware. So please ignore.
#ipv4=`ifconfig $extif | grep inet | grep -v inet6 | # awk ‘{print $2}’ | sed -e ’s/addr://g’`
#ipv6=`printf “%02x%02x:%02x%02x” \`echo $ipv4 | tr . ‘ ‘\“

echo “bringing up sixbone tunnel”

# NOTE, NOTE, NOTE: PLEASE CHANGE YOUR IP to local
ip tunnel add sixbone mode sit remote 64.71.128.82 local 24.85.191.225
ttl 255
ip link set sixbone up
ip addr add 2001:470:1F00:FFFF::45B/127 dev sixbone
ip route add ::/0 dev sixbone
ip route add default dev sixbone

echo ip -6 route add 2001:470:1F00:657::/64 dev $intif
ip -6 route add 2001:470:1F00:657::/64 dev $intif
echo ip -6 addr add 2001:470:1F00:657::1 dev $intif
ip -6 addr add 2001:470:1F00:657::1 dev $intif

echo “bringing up router advertisment daemon”
/sbin/radvd -C /tmp/radvd.conf
———————cut-here——————————–

Also create a a file radvd_conf such as:

# conffile is from radvd package found on:
# http://openwrt.org/ipkg/
# For more examples, see the radvd documentation.

interface br0
{
AdvSendAdvert on;

#
# These settings cause advertisements to be sent every 3-10
seconds. This
# range is good for 6to4 with a dynamic IPv4 address, but can
be greatly
# increased when not using 6to4 prefixes.
#

MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;

#
# Disable Mobile IPv6 support
#
AdvHomeAgentFlag off;

#
# example of a standard prefix
#
prefix 2001:470:1F00:657::/64
{
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr on;
};

};

~# cp radvd_conf > /tmp/radvd.conf

Run the script above “AFTER” you’ve modified the settings to include your IP. Once done you can issue a command “ip show route” which produced output such as:

1: lo: mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
inet6 ::1/128 scope host
2: teql0: mtu 1500 qdisc noop qlen 100
link/void
3: imq0: mtu 1500 qdisc noop qlen 30
link/void
4: imq1: mtu 1500 qdisc noop qlen 30
link/void
5: eth0: mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:0f:66:44:22:26 brd ff:ff:ff:ff:ff:ff
inet6 fe80::20f:66ff:fe44:2226/10 scope link
6: eth1: mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:0f:66:44:22:28 brd ff:ff:ff:ff:ff:ff
inet6 fe80::20f:66ff:fe44:2228/10 scope link
7: vlan0: mtu 1500 qdisc noqueue
link/ether 00:0f:66:44:22:26 brd ff:ff:ff:ff:ff:ff
inet6 fe80::20f:66ff:fe44:2226/10 scope link
8: vlan1: mtu 1500 qdisc noqueue
link/ether 00:0f:66:44:22:27 brd ff:ff:ff:ff:ff:ff
inet 24.85.191.225/22 brd 24.85.191.255 scope global vlan1
inet6 fe80::20f:66ff:fe44:2227/10 scope link
9: sit0@NONE: mtu 1480 qdisc noqueue
link/sit 0.0.0.0 brd 0.0.0.0
15: br0: mtu 1500 qdisc noqueue
link/ether 00:0f:66:44:22:26 brd ff:ff:ff:ff:ff:ff
inet 192.168.2.1/24 brd 192.168.2.255 scope global br0
inet6 fe80::200:ff:fe00:0/10 scope link
inet6 2001:470:1f00:657::1/128 scope global
16: sixbone@NONE: mtu 1480 qdisc noqueue
link/sit 24.85.191.225 peer 64.71.128.82
inet6 fe80::1855:bfe1/128 scope link
inet6 2001:470:1f00:ffff::45b/127 scope global

- Check to make sure that radvd is running:

~ # ps -ef | grep rad
17178 root 352 S radvd -C /tmp/radvd.conf

That’s it folks. Setup your local clients to include IPv6 support. In windows XP/2003 this means going to your network neighbourhood icon, selecting properties, choosing your link and adding Protocol -> Microsoft IPv6 and hitting ok. Once done, you should simply check to see if you have ipv6 running by starting the command prompt and running ipv6 if. This should give you an output such as:

Interface 10: Ethernet: InBuilt-Wifi
Guid {AC2D697B-3753-42C4-BC0F-F2954DD7BB26}
uses Neighbor Discovery
uses Router Discovery
link-layer address: 00-0e-9b-55-00-e4
preferred global 2001:470:1f00:657:49a5:42db:7bb3:344e, life
6d23h27m8s/23h2
3m28s (temporary)
preferred global 2001:470:1f00:657:20e:9bff:fe55:e4, life
29d23h59m58s/6d23h
59m58s (public)
preferred link-local fe80::20e:9bff:fe55:e4, life infinite
multicast interface-local ff01::1, 1 refs, not reportable
multicast link-local ff02::1, 1 refs, not reportable
multicast link-local ff02::1:ff55:e4, 2 refs, last reporter
multicast link-local ff02::1:ffb3:344e, 1 refs, last reporter
link MTU 1500 (true link MTU 1500)
current hop limit 64
reachable time 41000ms (base 30000ms)
retransmission interval 1000ms
DAD transmits 1
default site prefix length 48

Let’s ping some IPv6 enabled host to see if it’s all working:

C:\>ping6 ftp.netbsd.org

Pinging ftp.netbsd.org [2001:4f8:4:7:2e0:81ff:fe21:6563]
from 2001:470:1f00:657:49a5:42db:7bb3:344e with 32 bytes of data:

Reply from 2001:4f8:4:7:2e0:81ff:fe21:6563: bytes=32 time=63ms
Reply from 2001:4f8:4:7:2e0:81ff:fe21:6563: bytes=32 time=59ms
Reply from 2001:4f8:4:7:2e0:81ff:fe21:6563: bytes=32 time=63ms
Reply from 2001:4f8:4:7:2e0:81ff:fe21:6563: bytes=32 time=85ms

Ping statistics for 2001:4f8:4:7:2e0:81ff:fe21:6563:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 59ms, Maximum = 85ms, Average = 67ms

To setup IPv6 in solaris:

touch /etc/hostname6.hme0 (or your NIC interface) and reboot. Alternatively you can also setup IPv6 by running sys-unconfig. Solaris should just work easily.

On Linux:

modprobe ipv6 and nic should just the ipv6 address from the router advertising daemon.

On BSD:

Aw..come on, do I have to explain to all this ..If you’re running *BSD, you should simply check the excellent man pages

I hope I’ve explained on how all of this works and setup. If you have any problems, re-read this and check google to see if your question has been answered. Alternatively, if you’re going to bug me..please understand that I may or may not respond back in time.

Have fun.

–
Bruno Saverio Delbono
Systems Engineer – Open-Systems Group
http://www.mail.ac/ http://www.open-systems.org
Personal Homepage: http://www.mail.ac/users/bruno/