[4038] in arla-drinkers
Re: healthy installation on os x does not connect at some locations
daemon@ATHENA.MIT.EDU (Anton Grigoriev)
Wed Oct 4 04:28:54 2006
From arla-drinkers-bounces@stacken.kth.se Wed Oct 04 08:28:54 2006
Return-Path: <arla-drinkers-bounces@stacken.kth.se>
Delivered-To: arla-drinkers-mtg@bloom-picayune.mit.edu
Received: (qmail 25973 invoked from network); 4 Oct 2006 08:28:53 -0000
Received: from mx2.kth.se (130.237.48.98)
by charon.mit.edu with SMTP; 4 Oct 2006 08:28:53 -0000
Received: from localhost (localhost.localdomain [127.0.0.1])
by mx2.kth.se (Postfix) with ESMTP id 78D89141335;
Wed, 4 Oct 2006 10:28:52 +0200 (CEST)
Received: from mx2.kth.se ([127.0.0.1])
by localhost (mx2.kth.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP
id 21616-01-72; Wed, 4 Oct 2006 10:28:51 +0200 (CEST)
Received: from tapas.stacken.kth.se (tapas.stacken.kth.se [130.237.234.140])
by mx2.kth.se (Postfix) with ESMTP id E8220141311;
Wed, 4 Oct 2006 10:28:50 +0200 (CEST)
Received: from tapas.stacken.kth.se (localhost [127.0.0.1])
by tapas.stacken.kth.se (Postfix) with ESMTP id B5627534FC;
Wed, 4 Oct 2006 10:28:50 +0200 (CEST)
X-Original-To: arla-drinkers@tapas.stacken.kth.se
Delivered-To: arla-drinkers@tapas.stacken.kth.se
Received: from brev.stacken.kth.se (brev.stacken.kth.se [130.237.234.84])
by tapas.stacken.kth.se (Postfix) with ESMTP id 69FBF534FC
for <arla-drinkers@tapas.stacken.kth.se>;
Wed, 4 Oct 2006 10:28:49 +0200 (CEST)
Received: from mx3.kth.se (mx3.kth.se [130.237.48.97])
by brev.stacken.kth.se (8.12.10/8.12.10) with ESMTP id k948Snie015395
for <arla-drinkers@stacken.kth.se>;
Wed, 4 Oct 2006 10:28:49 +0200 (MET DST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mx3.kth.se (Postfix) with ESMTP id A6D2B1439F4
for <arla-drinkers@stacken.kth.se>;
Wed, 4 Oct 2006 10:28:48 +0200 (CEST)
Received: from mx3.kth.se ([127.0.0.1])
by localhost (mx3.kth.se [127.0.0.1]) (amavisd-new,
port 10024) with LMTP
id 07982-01-4 for <arla-drinkers@stacken.kth.se>;
Wed, 4 Oct 2006 10:28:47 +0200 (CEST)
Received: from elvira.its.uu.se (unknown [IPv6:2001:6b0:b:400::5])
by mx3.kth.se (Postfix) with ESMTP id 3E57A143D60
for <arla-drinkers@stacken.kth.se>;
Wed, 4 Oct 2006 10:28:47 +0200 (CEST)
Received: by elvira.its.uu.se (Postfix, from userid 204)
id 51807D0E; Wed, 4 Oct 2006 09:55:57 +0200 (MSZ)
Received: from elvira.its.uu.se(127.0.0.1) by elvira.its.uu.se via virus-scan
id s276502; Wed, 4 Oct 06 09:55:50 +0200
Received: from [130.238.194.221] (angr.Fysik.UU.SE [130.238.194.221])
(using TLSv1 with cipher RC4-SHA (128/128 bits))
(No client certificate requested)
by elvira.its.uu.se (Postfix) with ESMTP id 77A15C9A;
Wed, 4 Oct 2006 09:55:50 +0200 (MSZ)
In-Reply-To: <96472D64-8FA8-4918-957E-AE10BE31EB58@fy.chalmers.se>
References: <DCA9D7F5-BF87-470C-8727-9FF6A9CEAA80@fy.chalmers.se>
<lsrfyec9olb.fsf@kashyyyk.ite.kth.se>
<20060928.151211.06950680.haba@habarber.pdc.kth.se>
<96472D64-8FA8-4918-957E-AE10BE31EB58@fy.chalmers.se>
Mime-Version: 1.0 (Apple Message framework v752.2)
Message-Id: <B245AF4E-4378-4F3A-AF76-0F5EBFEDCC69@fy.chalmers.se>
From: Anton Grigoriev <tfsangr@fy.chalmers.se>
Subject: Re: healthy installation on os x does not connect at some locations
Date: Wed, 4 Oct 2006 09:55:47 +0200
To: Anton Grigoriev <tfsangr@fy.chalmers.se>
X-Mailer: Apple Mail (2.752.2)
X-Virus-Scanned: by amavisd-new at kth.se
X-Spam-Status: No, hits=-4.9 tagged_above=-200.0 required=5.0 tests=BAYES_00
X-Spam-Level:
Cc: tol@it.su.se, arla-drinkers@stacken.kth.se
X-BeenThere: arla-drinkers@stacken.kth.se
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: Arla discussions <arla-drinkers.stacken.kth.se>
List-Unsubscribe: <https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers>,
<mailto:arla-drinkers-request@stacken.kth.se?subject=unsubscribe>
List-Archive: <http://lists.stacken.kth.se/pipermail/arla-drinkers>
List-Post: <mailto:arla-drinkers@stacken.kth.se>
List-Help: <mailto:arla-drinkers-request@stacken.kth.se?subject=help>
List-Subscribe: <https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers>,
<mailto:arla-drinkers-request@stacken.kth.se?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: arla-drinkers-bounces@stacken.kth.se
Errors-To: arla-drinkers-bounces@stacken.kth.se
X-Virus-Scanned: by amavisd-new at kth.se
I want to thank once more everyone who responded my mail. I am
contacting my sysadmin to see if he can fix the firewall.
Meanwhile, I found that the presence of the client connection from
pdc to my Mac:7001 does not affect the work of arla afs. I made a NAT
rule at home and opened OS X to listen on 7001, so that /usr/openafs/
sbin/rxdebug from pdc sees my Mac. I found that nothing changed in my
(working) afs connection.
Sincerely
Anton
On Sep 29, 2006, at 13:41, Anton Grigoriev wrote:
> Thank you very mach, Harald!
> It was very useful.
>
> What I found is that
> 1) If I can connect to pdc, then I have response on rxdebug towards
> sculpin like
> AFS version: OpenAFS 1.4.0 built 2006-03-06
> otherwise I have no responce
> get version call failed with code -1, errno 0
>
> 2) I never have any response backwards, i.e. from lise to my Mac
> 7001 , even if I can connect to afs.
> get version call failed with code -1, errno 0
> 2.a) I will change that at home via opening 7001 in OS X firewall
> _and_ setting appropriate NAT rule in the router. Still, I do not
> (yet ) see the effect on connectivity. It works without a client.
>
> 3) I have a) UU firewall ??? b) department's firewall c) OS X
> firewall. d) more firewalls???
> NB the setting called 'location' is always the same so computer
> thinks it is in the same place, but with DHCP, so that IP is
> different.
> My OS X firewall is set to reject udp in stelth mode. Changing this
> does not change connectability.
> 3.a) System administrators are payed for being paranoid. For this
> reason all laptops at my dept are connected OUTSIDE of the dept
> firewall, so that they will not kill the system inside.
> This leaves the Q if anyone at UU can mount afs from pdc. It also
> could be that OS X firewall feels the change off location
> somehow ... Ore there is yet another firewall in between. I will
> find out.
>
> Sincerely
>
> Anton
>
>
> On Sep 28, 2006, at 15:12, Harald Barth wrote:
>
>>
>>> My guess is that there is a firewall blocking the ports that AFS
>>> uses (udp
>>> 7000-7003 or so). You could try running /usr/arla/bin/rxdebug
>>> against
>>> those ports on some interesting hosts (like
>>> {anna,lise,houting}.pdc.kth.se)
>>> to see if you get any packets through at all. Try rxdebug at
>>> home or PDC
>>> and compare results.
>>
>> At PDC rxdebug is in /usr/openafs/sbin/rxdebug
>>
>> The following commands should give output
>> from your MAC:
>>
>> Against one of the AFS DB servers:
>>
>> rxdebug anna.pdc.kth.se 7007 -version
>> rxdebug anna.pdc.kth.se 7003 -version
>>
>> Against the fileserver your $HOME is on:
>>
>> rxdebug sculpin.pdc.kth.se 7000 -version
>> rxdebug sculpin.pdc.kth.se 7005 -version
>>
>> The following command should give output
>> when executed on PDC:
>>
>> /usr/openafs/sbin/rxdebug angr.Fysik.UU.SE 7001 -version
>>
>> The ports are as follows (all UDP):
>>
>> 7007: AFS Volume location database
>> 7003: AFS Users and groups database
>> 7000: File server (files)
>> 7005: File server (volumes)
>> 7001: Client
>>
>
>>> Wrong. I mixed up the numbers.
>>>
>>> The ports are as follows (all UDP):
>>>
>>> 7003: AFS Volume location database
>>> 7002: AFS Users and groups database
>>> 7000: File server (files)
>>> 7005: File server (volumes)
>>> 7001: Client
>>>
>>> And 7007 is bos but not neccessary for you.
>
>
>> So for this to work, the firewall has to be opened for these ports.
>>
>> If your sysadmin has any questions about AFS or firewalls etc, point
>> him to the PDC support.
>>
>> Harald.
>
_______________________________________________
Arla-drinkers mailing list
Arla-drinkers@stacken.kth.se
https://lists.stacken.kth.se/mailman/listinfo/arla-drinkers
