The
User's Manual
Release 0.7.0, (C) 1998
Thorsten Westheider
Carsten Pfeiffer
Christian Demmer
Contents
The K Control Module (kcmkisdn)
The dialup client (kisdn)
Appendix
kISDN is a frontend to isdn4linux (I4L), the ISDN package for Linux,
and designed mainly for 3 reasons:
- Make ISDN configuration and installation quick and easy for the average
Linux user and even for utter Linux newbies
- Give optimum monitoring capabilities for ISDN line activity (you know, ISDN makes
no noise on dialup, no lights are flashing and you're online within
2 to 3 seconds)
- Give GUI-guided access to ISDN features that are not accessible using shell
scripts (voice calls, for example) or for which you have to install
a bunch of single binaries (and read several man pages) without
being provided with a GUI.
For example, configuration of the ipppd and the ISDN kernel interfaces is
straightforward; it wasn't some years ago, and - especially the pppd/ipppd
setup - had quite some aspects of black magic...
With kISDN you will only need a small set of informations concerning your
internal ISDN adapter card and your ISP, and you should be online within about 10 minutes.
Starting with release 0.6.0 kISDN consists of 2 parts: The K Control Module
kcmkisdn is designed for configuration and needs root permissions
to start working (this is meant as a protective mechanism), so either kcmkisdn
must be set SUID or is executed directly by root. Once the main configuration
is done, root can start to grant access permissions for every single
account and every single user on that machine.
The second part of the kISDN package, the dialup client kisdn can
then be used by those users to establish connections to internet providers they
have access permission for. The single user in turn can only customize Look+Feel
(colors, sounds, scaling etc.) of the dialup client but not change ISDN or account
configuration.
Starting with release 0.7.0 kISDN offers a voice phone (Professional
Edition only), i.e. you can use
kISDN as a telephone to call your friends (and your friends can call you
at your Linux box as well, in which case you'll get a small signalization
dialog asking you to accept or ignore the call). However, you'll need a different
sound driver than OSS/Lite (the standard sound driver provided with the kernel),
since voice communication only makes sense in both directions (this is called
full duplex). There are 2 alternatives:
- The registered version of OSS, available at
http://www.4front-tech.com
for a fee of $20
- The upcoming ALSA (Advanced Linux Sound Architecture) driver
(GPL), available at http://alsa.jcu.cz
We tested both of them and they're doing their job well; there may, however,
be some restrictions on sound card types in the ALSA driver (Creative Labs Soundblaster
is no problem, of course, but some more exotic cards may not be supported - please
find out yourself).
In principle, every internal ISDN adapter using the Siemens chipset
HSCX/ISAC (thus the name of the driver) is or will be supported by the HiSax driver.
If, in a later revision of the I4L package, there is support for an adapter not
supported by kISDN, please don't hesitate to inform us, so we can provide
you with a patch (the card will be supported in the next release of kISDN,
then). Here's a list of adapters already supported by kISDN.
kISDN was designed for the K Desktop Environment (KDE) on Linux platforms and requires
the Qt 1.40 and KDE 1.0 libraries. You can get free copies of both at
http://www.troll.no (Qt 1.40) and
http://www.kde.org (KDE 1.0).
If you want to compile kISDN on your own (kISDN 0.6.0 Free Edition, only),
you will need developer versions of both, Qt and KDE (in case you installed Qt/KDE
from RPM's sometimes you only get the libraries) and, of course, a working C++
compiler (we recommend egcs-1.0.3a or even egcs-1.1b, available from
http://egcs.cygnus.com, but gcc-2.7.2.x will
do as well in this case).
Since configuration is done with kcmkisdn, it can only be started with root permissions.
This is a particularly delicate issue in Linux (and UNIX in general), since processes
running with root permissions are allowed to do anything on your system. There
are 2 different ways to handle this:
- Set the s bit on kcmkisdn, i.e. chmod u+s kcmkisdn
(being root and kcmkisdn belongs to root, as well). In this way
kcmkisdn can be started by all users who have execute permission
for kcmkisdn, for example
rwsr-xr-- ... root isdn ... kcmkisdn
gives execute permissions to all members of the group isdn
and kcmkisdn will be started such as it was root, who issued
the command. This, of course, is a big security hole and we
strongly advise against this on systems with more than one user.
- Only execute kcmkisdn when being root and only give
access on accounts to those users, who are actually allowed
to dial out with kisdn and to connect to specific
ISP's. The advantages are obvious: The average user can't crash
the ISDN setup and access to partly expensive services can be
limited to a small group of users.
But what about kisdn, the dialup frontend ? Why does it need root permissions
as well (you may have worked with scripts already and didn't need to grant any
root permissions - at least you think so) ? Ok, let's think about it a bit more
thoroughfully:
- In some cases the HiSax driver must be loaded at startup (if you
configured kISDN that way), in which case you will need
root permissions (the driver becomes part of the kernel). You
might solve this problem by creating a group modules,
setting the s bit of the command modprobe
and only giving execute permissions
for that group. Any user on your system using kISDN must
now be in both groups, kisdn and modules.
- kISDN communicates with the kernel using ioctl
to handle Dial on Demand, getting IP's, setting interface parameters
etc. I'm not quite sure if these operations actually require
root permissions, but I think so. In those cases you might try
so-called preconfigured interfaces, i.e. interfaces already
configured at boot time, but you will loose inevitably some of kISDN's
features since kISDN has no further knowledge on those
interfaces (thus degrading kISDN to a dialout/hangup
application in which case you'd be better off with scripts).
- Accounts configured with kISDN always require the user's
password and since kISDN was designed to switch between
ISP's on the fly, these passwords can't be stored in /etc/pap-secrets
but in another place, which is accessible by root only. When switching
to another ISP, the new password must be read from the second location
and be inserted into /etc/pap-secrets (/etc/chap-secrets
in some cases) and thus, the dialup client must be run with root
permissions (otherwise, you're stuck to preconfigured interfaces,
see above).
We recommend setting kisdn SUID and configuration should be done by root using kcmkisdn
(i.e. no SUID kcmkisdn on multi user systems !). Second, you should limit execution permission
of kisdn by creating a group isdn. In this way you have a somewhat secure
setup, since
- Only users in the group isdn are allowed to invoke kisdn
- kcmkisdn gives access on specific providers only to those users
chosen by root
- kcmkisdn can be invoked by root only
Back to Contents
T. Westheider / October 16th, 1998 - kISDN Release 0.7.0