==Phrack Magazine== Volume Five, Issue Forty-Five, File 8 of 28 **************************************************************************** Running a Board on x.25 ======================= In this article, I want to inform the reader about advantages, problems, experiences and fun about running a BBS on x.25. I also want to do a few comparisons between x.25 on one hand and the Internet and phone system on the other. This article may also help you to setup a BBS on a UNIX, no matter if on x.25 or not. I. Systems on x.25... ========================== In my article for Phrack 42 about the German scene (read it if you haven't done so yet! :-) I also mentioned the x.25 scene and a few Bulletin Board Systems (BBS / boards) on it. One of the most popular ones, LUTZIFER, just went down on December 20, 1993. Lutzifer used to be one of the most popular x.25 boards back in 1990 and early 1991, when US people were still able to use Tymnet ("video" and "parmaster") and Sprintnet without much of a hassle. I spoke with Lutz (sysop of Lutzifer) at the CCC Congress in Hamburg a week later. He told me that he first just wanted to change the speed for his x.25 connection from 9600 to 2400 to save some money (actually 50%), because he didn't get too many calls anyway. But the German Telekom (who handle x.25 AND the phone lines) wanted him to cancel his old x.25 connection, get a new NUA, pay the $300 installation fee, all to get a 2400 bps connection. This really made Lutz mad, and he finally decided to cancel all x.25 - so goodbye to Lutzifer! On the other side, QSD (the lamest chat system one can imagine) is still up and running on x.25. Back in Summer 1993, there have been many rumors that QSD would go down. It wasn't reachable from most networks in the world anymore, including Sprintnet, Datex-P and others. They were probably just "testing" something - but QSD will never have its >80 online users again (sounds pretty ridiculous compared to IRC :) that it had back in the good old days. II. Advantages of x.25 ========================== You may wonder what the advantages of running a board on x.25 are. Wouldn't an Internet link or a phone dialup be enough? In fact, the Internet is getting more and more popular, the number of its hosts is increasing dramatically. This, and the fact that ISDN is faster and available to more and more people at cheaper rates, makes x.25 seem unattractive. But x.25 is a very old and safe network. It hasn't really changed in 10 years. There are hardly any netsplits like on the Internet, and it has a very low rate of data errors. X.25 is available in almost every country (far over 200) in the world, even in countries that never heard of Internet like Mauritius or United Arab Emirates. This means that a lot of people from all over the world can call you at a cheap rate (at least cheaper than international phone charges, for some people even free at all :). To the sysop it offers a couple of features that modems can't offer, and where the Internet isn't safe enough. This is also a reason why most banks, insurances and credit agencies still rely on x.25. I will describe those features in the next chapter. III. Setting up your X.25 board ================================== So let's get practical after all this boring theory! How do you start if you want to setup your own x.25 board? First of all, you need your own x.25 line. In most countries your phone company would be responsible; in a few countries like the US you may even have a choice of different x.25 providers like "Sprintnet". The prices for those lines really vary. You may check the Sprintnet or Tymnet Toll Free information service, that also gives you information and prices about other countries. E.g. in Germany a 2400 bps (the slowest) link would be US$130 a month, a 9600 bps link about $260. The good thing though is that each additional virtual channel is just $3 more per month (in Germany). A number of 16 channels is typical and 128 channels aren't exotic. But remember, all channels have to share the maximum bandwidth of - let's say - 9600 bps. So if 10 people would start to leech the latest Phrack at the same time, they would all just have 960 bps each or 96 cps. But downloading isn't always that easy. In fact, many of my users have been reporting problems while trying to download. While a few x.25 networks like Datapak Norway and German Datex-P are true 8 bit networks, many networks and PADs just handle 7 bit connections. It's not always that easy to transfer binaries at 7 bit, though it was possible for me to download from a Sprintnet dialup using a 'good' version of Z-Modem. X.25 is not the right choice if you want to transfer huge amounts of data anyway. It is meant for people who work interactively. It is recommended for people who want to do a database research, read and write email and news or just chat. You will also notice that, if you are a paying x.25 user (aren't you all :-) and get your bills, connection time is really cheap; up to 70 times cheaper than long distance phone charges. What counts are the transmitted bytes, no matter how fast you are! You easily pay $30 for transferring 1 MB. But what else do you need after you got your x.25 link? You need a PC (which doesn't have to be fast; I was using a 386sx for quite some time. In fact, my new 486/40 board is 'too fast' for my old x.25 8 bit adaptor :). It might also be interesting to run it on a Sun or HP workstation; but the x.25 cards for those machines are rather expensive. Then you need a good operating system. Don't even think of running DOS. You want to have a multi-user multi-tasking system after all, don't you? So your choice is UNIX. Systems with pretty good x.25 solutions are Interactive and SCO Unix. They are both old fashioned System V / 386's, but are running safely, hardly ever crash and are popular in the commercial world. I chose Interactive. How do you connect your PC to the x.25 line? Good guess. Yes, you need an adaptor card. I got an EICON/PC card. EICON cards are probably the best supported and most common x.25 cards - they are made in Canada. However, they aren't cheap. Usually they are around $1000, if you are lucky you could get a used one for $600. You might get a cheaper x.25 adaptor, but check in advance if the software you want to use supports that adaptor. There is no real standard concerning x.25 cards! Anything else you need? Yes, the most important thing - the software. UNIX doesn't come with x.25 drivers. However, there is a really good x.25 solution available from netCS Software in Berlin, Germany. (The company was co-founded by "Pengo" Hans H. Send them mail to postmaster@netcs.com for info.) IV. Features ================ This software, and x.25 in general, has a few nice features. If you receive an x.25 call from somewhere, the NUA ("Network User Address") of the caller is being transmitted to you. This works pretty much like Caller-ID, with the exception that the caller can't prevent it from being transmitted, and he usually can't fake the address he is calling from. Of course he can call through a couple of systems, and you would just see the NUA of the last system he calls you from. This feature can easily be used to accept or reject calls from certain NUAs/systems or whole countries. Many systems like banks just allow certain NUAs to call them, just the ones that they know. You could also give different access to different people: people from country A may login to your system, country B may just write you a mail, all other countries are forced into chat and the NUA of CERT is being rejected and received a "nice" goodbye message. Of course you will also keep a logfile (and 99% of the systems you call will have a logfile with YOUR call and the calls you might place using its pad). This logfile usually contains the NUA that calls you (or that is being called), the programs that are being executed, the userid of the caller, duration, reason for termination and more. Another interesting feature is the 'Call User Data' (CUD). The caller may transmit up to 16 bytes (default is 4 bytes) to your host before he establishes an x.25 connection. In these bytes he may send you a Service Request. The default CUD is 01/00/00/00 and means 'interactive login'. You may define any CUD you want and just accept calls that use that certain CUD - it would work like a system password then. Many systems may also have a service request that allows the caller to execute commands on that host remotely, without supplying any additional password (be aware of this!) For more technical information about x.25 read one of the articles in the previous issues of Phrack. I am glad that Phrack is still covering x.25 with plenty of interesting articles after all these years! IV. Chosing the BBS Software ================================ Okay. Now we decided to choose UNIX as operating system. Of course, you could give all your users shell access, create a guest account with limited shell access and a chat account that kicks you just into chat. That's what I used to do first. But since we want to run an open system and give accounts to many hackers, it might be a scary vision that all of them have shell access and try to hack your system. This is the point when you are looking for a BBS software for UNIX. There aren't too many free BBSes for UNIX around, most of them cost some hundred dollars (check out the latest Boardwatch issue for more information). However, I found a pretty decent BBS software called 'Uniboard'. It runs fine on most System V's including Interactive and SCO; versions for Sun OS and Linux are available too. It offers you a nice colorful (you may turn it to black & white) menu driven interface. You have to have C-News and sendmail installed and running. Instead of sendmail I use smail, which is bug-free, much easier to install and offers at least the same features. C-News though isn't that easy to install and takes quite some time and document reading. But these packages are used by Uniboard for messages (news) and email. This is pretty nice, because you can just exchange mail with everyone on the Internet. You can also read your favorite newsgroups in Uniboard like alt.sex.bondage and post to local groups. The filebase is designed okay, but it doesn't feature the concept of ratios yet. (You just get one byte download ability for each byte you upload!). Rick, the author, promised me to put it into the next version though. The biggest drawback is that you will just get the binary, no sources available, so you can't put in all the features you would like. For more information send email to the author Rick in Italy at pizzi@nervous.com. He will give you a free demo key that works for a few weeks, if you ask him. Afterwards you could get a key for $40 and more, depending how many users you want to have. V. How to get more users ============================= You may think: Okay, fine. But not everybody has x.25 access, though (almost) everybody has Internet access. How could these people call me? Well, the solution isn't easy. I was told though that someone installed an Internet site that would forward the call through an x.25 PAD to my system. Of course, the system administrator of that Internet site found out after a while and installed the following banner (he obviously has a sense of humor :) - someone sent me this log: telnet> open pythia.csi.forth.gr 2600 Trying 139.91.1.1 ... Connected to pythia.csi.forth.gr. Escape character is '^]'. Welcome to Sectec Direct. Please hold the line. :) Calling...connected... MUniBoard v. 1.12 400 users Runtime System S/N 345968791 Licensed for single machine use to Seven Down on sectec Unauthorized duplication allowed Loading.. ________________________________________________ /~ .~ / _ . ~/~ _ . |~ __ ~| _ . \~ _ _ ~/ // ____/_ |_\__/. | \__|. |__| | |_\__/\/ | | \/ /____ ~/ _|__|| | __|: _| _|__ || | // . //: |_/. \: |_/. || |\ \\: |_/. \ |: | /_____ /|________\______|__| \__\_______\ |__| ___________________________________________ ___________________ \~ _ _ ~/ _ . ~/ _ .\~ _ _ ~/ __ |~ ~\ |~~|~| _ . ~/~ .~ / \/ | | \/ |_\__/ | \__\/ | | \/ / \|| \| || || \__// ____/_ || | || _|__| | __ || | \\ \ /|: \ \ :| || ______ ~/ |: | |: |_/. \ |_/. \ |: | \ \/ || |\ .| ||_/. \/ . // |__| |________\______\ |__| \____|__| \___|_|______\___ / Dear fellow hacker, Please use YOUR telephone to make long distance calls Using other's systems over the Internet is just NOT fair let alone that is ILLEGAL. Anyway, your hosts computer names/IP addresses and location, as well as accurate logs of most of your recent/6 months unauthorized calls are in file and might be used against you in court. Legal service courtesy of FIRST/CERT sorry if we ruined your day... Connection closed by foreign host. V. Modem Ports =================== Also, every board on x.25 should have a direct modem dialup (and I guess every board does! The dialup for Lutzifer wasn't public, but it had one!) You need to have a modem at least for uucp polling of news and mail. If you are running UNIX, you don't need one of those really expensive 'intelligent' cards like DigiBoard for $1000. But make sure you have a 16550 chip on your I/O controller or you won't be happy. A pretty good deal are AST compatible cards with 4 ports. You can get them for $60 if you are lucky. They just use one IRQ for all 4 ports and let you select the IRQ and the base addresses. This is pretty convenient, because it is even more likely to get an IRQ conflict under UNIX than under DOS. Try to get a card with 16550's on it, or one that has sockets that let you replace the old 16450's or whatever with 16550's, without playing with your soldering iron. If you buy 16550's, try to get the original NS (National Semiconductor) ones: NS16550AFN; Texas Instrument's aren't as good. Then you should get a good serial port driver like the excellent FAS 2.10. It is quite flexible with default drivers for AST compatible and standard I/O cards, supports speeds up to 115,200 bps, and supports both incoming and outgoing calls on the same line very well. It only works with System V though. I can't help smiling when people tell me about their ElEeT WaR3Z boards running on DOS and Novell with a separate PC for each node. With the configuration mentioned above, you can easily have 4 or 8 high speed modems with a host speed of 57.600 connected to a single 386 PC and no performance loss. Email me for information or accounts, or just send me love letters :) sec@g386bsd.first.gmd.de. by Seven Up (damiano @ irc)