The
![]()
User's ManualRelease 0.7.0, (C) 1998
Thorsten Westheider
Carsten Pfeiffer
Christian Demmer
Contents
1. What is kISDN anyways ? 2. Requirements
The K Control Module (kcmkisdn)
The dialup client (kisdn)
9. What's kisdn for ? 10. What kisdn can't do for you 11. Dialup 12. kisdn's displays 14. Customization
Appendix
A. Preparations B. Supported hardware C. ISA Plug&Play configuration D. Proper kernel ISDN configuration, how ?
1. What is kISDN anyways ?
kISDN is a frontend to isdn4linux (I4L), the ISDN package for Linux, and designed mainly for 3 reasons:
- Make ISDN configuration and installation quick and easy for the average Linux user and even for utter Linux newbies
- Give optimum monitoring capabilities for ISDN line activity (you know, ISDN makes no noise on dialup, no lights are flashing and you're online within 2 to 3 seconds)
- Give GUI-guided access to ISDN features that are not accessible using shell scripts (voice calls, for example) or for which you have to install a bunch of single binaries (and read several man pages) without being provided with a GUI.
For example, configuration of the ipppd and the ISDN kernel interfaces is straightforward; it wasn't some years ago, and - especially the pppd/ipppd setup - had quite some aspects of black magic...
With kISDN you will only need a small set of informations concerning your internal ISDN adapter card and your ISP, and you should be online within about 10 minutes.
Starting with release 0.6.0 kISDN consists of 2 parts: The K Control Module kcmkisdn is designed for configuration and needs root permissions to start working (this is meant as a protective mechanism), so either kcmkisdn must be set SUID or is executed directly by root. Once the main configuration is done, root can start to grant access permissions for every single account and every single user on that machine.
The second part of the kISDN package, the dialup client kisdn can then be used by those users to establish connections to internet providers they have access permission for. The single user in turn can only customize Look+Feel (colors, sounds, scaling etc.) of the dialup client but not change ISDN or account configuration.
Starting with release 0.7.0 kISDN offers a voice phone (Professional Edition only), i.e. you can use kISDN as a telephone to call your friends (and your friends can call you at your Linux box as well, in which case you'll get a small signalization dialog asking you to accept or ignore the call). However, you'll need a different sound driver than OSS/Lite (the standard sound driver provided with the kernel), since voice communication only makes sense in both directions (this is called full duplex). There are 2 alternatives:We tested both of them and they're doing their job well; there may, however, be some restrictions on sound card types in the ALSA driver (Creative Labs Soundblaster is no problem, of course, but some more exotic cards may not be supported - please find out yourself).
- The registered version of OSS, available at http://www.4front-tech.com for a fee of $20
- The upcoming ALSA (Advanced Linux Sound Architecture) driver (GPL), available at http://alsa.jcu.cz
In principle, every internal ISDN adapter using the Siemens chipset HSCX/ISAC (thus the name of the driver) is or will be supported by the HiSax driver. If, in a later revision of the I4L package, there is support for an adapter not supported by kISDN, please don't hesitate to inform us, so we can provide you with a patch (the card will be supported in the next release of kISDN, then). Here's a list of adapters already supported by kISDN.
2. Requirements
kISDN was designed for the K Desktop Environment (KDE) on Linux platforms and requires the Qt 1.40 and KDE 1.0 libraries. You can get free copies of both at http://www.troll.no (Qt 1.40) and http://www.kde.org (KDE 1.0). If you want to compile kISDN on your own (kISDN 0.6.0 Free Edition, only), you will need developer versions of both, Qt and KDE (in case you installed Qt/KDE from RPM's sometimes you only get the libraries) and, of course, a working C++ compiler (we recommend egcs-1.0.3a or even egcs-1.1b, available from http://egcs.cygnus.com, but gcc-2.7.2.x will do as well in this case).
Since configuration is done with kcmkisdn, it can only be started with root permissions. This is a particularly delicate issue in Linux (and UNIX in general), since processes running with root permissions are allowed to do anything on your system. There are 2 different ways to handle this:
- Set the s bit on kcmkisdn, i.e. chmod u+s kcmkisdn (being root and kcmkisdn belongs to root, as well). In this way kcmkisdn can be started by all users who have execute permission for kcmkisdn, for example
rwsr-xr-- ... root isdn ... kcmkisdn
gives execute permissions to all members of the group isdn and kcmkisdn will be started such as it was root, who issued the command. This, of course, is a big security hole and we strongly advise against this on systems with more than one user.- Only execute kcmkisdn when being root and only give access on accounts to those users, who are actually allowed to dial out with kisdn and to connect to specific ISP's. The advantages are obvious: The average user can't crash the ISDN setup and access to partly expensive services can be limited to a small group of users.
But what about kisdn, the dialup frontend ? Why does it need root permissions as well (you may have worked with scripts already and didn't need to grant any root permissions - at least you think so) ? Ok, let's think about it a bit more thoroughfully:We recommend setting kisdn SUID and configuration should be done by root using kcmkisdn (i.e. no SUID kcmkisdn on multi user systems !). Second, you should limit execution permission of kisdn by creating a group isdn. In this way you have a somewhat secure setup, since
- In some cases the HiSax driver must be loaded at startup (if you configured kISDN that way), in which case you will need root permissions (the driver becomes part of the kernel). You might solve this problem by creating a group modules, setting the s bit of the command modprobe and only giving execute permissions for that group. Any user on your system using kISDN must now be in both groups, kisdn and modules.
- kISDN communicates with the kernel using ioctl to handle Dial on Demand, getting IP's, setting interface parameters etc. I'm not quite sure if these operations actually require root permissions, but I think so. In those cases you might try so-called preconfigured interfaces, i.e. interfaces already configured at boot time, but you will loose inevitably some of kISDN's features since kISDN has no further knowledge on those interfaces (thus degrading kISDN to a dialout/hangup application in which case you'd be better off with scripts).
- Accounts configured with kISDN always require the user's password and since kISDN was designed to switch between ISP's on the fly, these passwords can't be stored in /etc/pap-secrets but in another place, which is accessible by root only. When switching to another ISP, the new password must be read from the second location and be inserted into /etc/pap-secrets (/etc/chap-secrets in some cases) and thus, the dialup client must be run with root permissions (otherwise, you're stuck to preconfigured interfaces, see above).
- Only users in the group isdn are allowed to invoke kisdn
- kcmkisdn gives access on specific providers only to those users chosen by root
- kcmkisdn can be invoked by root only
Back to Contents
T. Westheider / October 16th, 1998 - kISDN Release 0.7.0