[4036] in arla-drinkers
Re: healthy installation on os x does not connect at some locations
daemon@ATHENA.MIT.EDU (Anton Grigoriev)
Fri Sep 29 07:41:36 2006
From arla-drinkers-bounces@stacken.kth.se Fri Sep 29 11:41:36 2006
Return-Path: <arla-drinkers-bounces@stacken.kth.se>
Delivered-To: arla-drinkers-mtg@bloom-picayune.mit.edu
Received: (qmail 25649 invoked from network); 29 Sep 2006 11:41:36 -0000
Received: from mx1.kth.se (130.237.32.140)
by charon.mit.edu with SMTP; 29 Sep 2006 11:41:36 -0000
Received: from localhost (localhost.localdomain [127.0.0.1])
by mx1.kth.se (Postfix) with ESMTP id 2D8EC1452D8;
Fri, 29 Sep 2006 13:41:34 +0200 (CEST)
Received: from mx1.kth.se ([127.0.0.1])
by localhost (mx1.kth.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP
id 15547-01-75; Fri, 29 Sep 2006 13:41:31 +0200 (CEST)
Received: from tapas.stacken.kth.se (tapas.stacken.kth.se [130.237.234.140])
by mx1.kth.se (Postfix) with ESMTP id 736071452E6;
Fri, 29 Sep 2006 13:41:30 +0200 (CEST)
Received: from tapas.stacken.kth.se (localhost [127.0.0.1])
by tapas.stacken.kth.se (Postfix) with ESMTP id E6168534FC;
Fri, 29 Sep 2006 13:41:29 +0200 (CEST)
X-Original-To: arla-drinkers@tapas.stacken.kth.se
Delivered-To: arla-drinkers@tapas.stacken.kth.se
Received: from brev.stacken.kth.se (brev.stacken.kth.se [130.237.234.84])
by tapas.stacken.kth.se (Postfix) with ESMTP id 23958534FC
for <arla-drinkers@tapas.stacken.kth.se>;
Fri, 29 Sep 2006 13:41:28 +0200 (CEST)
Received: from mx3.kth.se (mx3.kth.se [130.237.48.97])
by brev.stacken.kth.se (8.12.10/8.12.10) with ESMTP id k8TBfR1R028649
for <arla-drinkers@stacken.kth.se>;
Fri, 29 Sep 2006 13:41:27 +0200 (MET DST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mx3.kth.se (Postfix) with ESMTP id 8538B140559
for <arla-drinkers@stacken.kth.se>;
Fri, 29 Sep 2006 13:41:27 +0200 (CEST)
Received: from mx3.kth.se ([127.0.0.1])
by localhost (mx3.kth.se [127.0.0.1]) (amavisd-new,
port 10024) with LMTP
id 28623-01-35 for <arla-drinkers@stacken.kth.se>;
Fri, 29 Sep 2006 13:41:24 +0200 (CEST)
Received: from colibri.its.uu.se (colibri.its.uu.se [130.238.4.154])
by mx3.kth.se (Postfix) with ESMTP id 3063F1449B5
for <arla-drinkers@stacken.kth.se>;
Fri, 29 Sep 2006 13:41:24 +0200 (CEST)
Received: by colibri.its.uu.se (Postfix, from userid 211)
id CC72CB19; Fri, 29 Sep 2006 13:41:23 +0200 (DFT)
Received: from colibri.its.uu.se(127.0.0.1) by colibri.its.uu.se via
virus-scan id s14346; Fri, 29 Sep 06 13:41:13 +0200
Received: from [130.238.194.221] (angr.Fysik.UU.SE [130.238.194.221])
(using TLSv1 with cipher RC4-SHA (128/128 bits))
(No client certificate requested)
by colibri.its.uu.se (Postfix) with ESMTP id DE485B0B;
Fri, 29 Sep 2006 13:41:12 +0200 (DFT)
In-Reply-To: <20060928.151211.06950680.haba@habarber.pdc.kth.se>
References: <DCA9D7F5-BF87-470C-8727-9FF6A9CEAA80@fy.chalmers.se>
<lsrfyec9olb.fsf@kashyyyk.ite.kth.se>
<20060928.151211.06950680.haba@habarber.pdc.kth.se>
Mime-Version: 1.0 (Apple Message framework v752.2)
Message-Id: <96472D64-8FA8-4918-957E-AE10BE31EB58@fy.chalmers.se>
From: Anton Grigoriev <tfsangr@fy.chalmers.se>
Subject: Re: healthy installation on os x does not connect at some locations
Date: Fri, 29 Sep 2006 13:41:12 +0200
To: Harald Barth <haba@pdc.kth.se>
X-Mailer: Apple Mail (2.752.2)
X-Virus-Scanned: by amavisd-new at kth.se
X-Spam-Status: No, hits=-4.9 tagged_above=-200.0 required=5.0 tests=BAYES_00
X-Spam-Level:
Cc: tol@it.su.se, arla-drinkers@stacken.kth.se
X-BeenThere: arla-drinkers@stacken.kth.se
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: Arla discussions <arla-drinkers.stacken.kth.se>
List-Unsubscribe: <https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers>,
<mailto:arla-drinkers-request@stacken.kth.se?subject=unsubscribe>
List-Archive: <http://lists.stacken.kth.se/pipermail/arla-drinkers>
List-Post: <mailto:arla-drinkers@stacken.kth.se>
List-Help: <mailto:arla-drinkers-request@stacken.kth.se?subject=help>
List-Subscribe: <https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers>,
<mailto:arla-drinkers-request@stacken.kth.se?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: arla-drinkers-bounces@stacken.kth.se
Errors-To: arla-drinkers-bounces@stacken.kth.se
X-Virus-Scanned: by amavisd-new at kth.se
Thank you very mach, Harald!
It was very useful.
What I found is that
1) If I can connect to pdc, then I have response on rxdebug towards
sculpin like
AFS version: OpenAFS 1.4.0 built 2006-03-06
otherwise I have no responce
get version call failed with code -1, errno 0
2) I never have any response backwards, i.e. from lise to my Mac
7001 , even if I can connect to afs.
get version call failed with code -1, errno 0
2.a) I will change that at home via opening 7001 in OS X firewall
_and_ setting appropriate NAT rule in the router. Still, I do not
(yet ) see the effect on connectivity. It works without a client.
3) I have a) UU firewall ??? b) department's firewall c) OS X
firewall. d) more firewalls???
NB the setting called 'location' is always the same so computer
thinks it is in the same place, but with DHCP, so that IP is different.
My OS X firewall is set to reject udp in stelth mode. Changing this
does not change connectability.
3.a) System administrators are payed for being paranoid. For this
reason all laptops at my dept are connected OUTSIDE of the dept
firewall, so that they will not kill the system inside.
This leaves the Q if anyone at UU can mount afs from pdc. It also
could be that OS X firewall feels the change off location somehow ...
Ore there is yet another firewall in between. I will find out.
Sincerely
Anton
On Sep 28, 2006, at 15:12, Harald Barth wrote:
>
>> My guess is that there is a firewall blocking the ports that AFS
>> uses (udp
>> 7000-7003 or so). You could try running /usr/arla/bin/rxdebug
>> against
>> those ports on some interesting hosts (like
>> {anna,lise,houting}.pdc.kth.se)
>> to see if you get any packets through at all. Try rxdebug at home
>> or PDC
>> and compare results.
>
> At PDC rxdebug is in /usr/openafs/sbin/rxdebug
>
> The following commands should give output
> from your MAC:
>
> Against one of the AFS DB servers:
>
> rxdebug anna.pdc.kth.se 7007 -version
> rxdebug anna.pdc.kth.se 7003 -version
>
> Against the fileserver your $HOME is on:
>
> rxdebug sculpin.pdc.kth.se 7000 -version
> rxdebug sculpin.pdc.kth.se 7005 -version
>
> The following command should give output
> when executed on PDC:
>
> /usr/openafs/sbin/rxdebug angr.Fysik.UU.SE 7001 -version
>
> The ports are as follows (all UDP):
>
> 7007: AFS Volume location database
> 7003: AFS Users and groups database
> 7000: File server (files)
> 7005: File server (volumes)
> 7001: Client
>
>> Wrong. I mixed up the numbers.
>>
>> The ports are as follows (all UDP):
>>
>> 7003: AFS Volume location database
>> 7002: AFS Users and groups database
>> 7000: File server (files)
>> 7005: File server (volumes)
>> 7001: Client
>>
>> And 7007 is bos but not neccessary for you.
> So for this to work, the firewall has to be opened for these ports.
>
> If your sysadmin has any questions about AFS or firewalls etc, point
> him to the PDC support.
>
> Harald.
_______________________________________________
Arla-drinkers mailing list
Arla-drinkers@stacken.kth.se
https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers
