[GORDYmac]

Yesterday, after setting up DSL via an ethernet modem (worked flawlessly), I restarted my machine an logged in. I noticed that there was a long pause between the blue screen after startup progress bar and the login window. It eventually came up and I logged in (Administrator but not root). This is where it went way wrong...

The next screen was all black, and at the top or the window it said "Welcome to Darwin" along with some other stuff--like the Terminal. Now, I don't know anything about that stuff, only two commands. It required me to login again, which I did. I then typed "shutdown", and it said that I didn't have permission to do that action. I typed "reboot" and it gave me a similar error message.

I eventually turned everything off via the reset button, and it logged in to a user account, then logged out, then logged in to my account. I was able to log in to my Desktop [this time] no problem, but...

What the hell happenned here? I don't know if the DSL screwed something up, if I did, or if I was hacked. All help will be greatly appreaciated.

I immediately turned off any filesharing and turned on the firewall in 10.2.

Specs: OS X 10.2, G4 933, 1.25 GB RAM, 2 HDD (60GB (master), 30GB (slave/classic)), Ethernet DSL Modem

[absmiths]

I had this happen a few times on my TiBook. It was very disconcerting. This used to happen if you logged in as '>console', but now it seems to happen intermittently. BTW, if it does happen, and you have root enabled, just login as root and then do the shutdown.

[tobli]

If you have an administrator account you can use "sudo shutdown now"

[Sword of Orion]

For anyone that's fluent in Unix, here's an excerpt from my /var/log/system.log from when this happened to me:

Sep 12 19:39:39 My-Computer ConsoleMessage: Starting timed execution services
Sep 12 19:39:40 My-Computer configd[104]: executing /usr/sbin/DirectoryService
Sep 12 19:39:41 My-Computer mach_kernel: IP packet filtering initialized, divert enabled, rule-based forwarding enabled, default to accept, logging disabled
Sep 12 19:39:41 My-Computer mach_kernel: IP firewall loaded
Sep 12 19:39:47 My-Computer DirectoryService: NetInfo connection failed for server 127.0.0.1/local
Sep 12 19:39:47 My-Computer loginwindow[372]: AuthorizationRef doesn't have a userID
Sep 12 19:39:47 My-Computer loginwindow[372]: exiting to console
Sep 12 19:39:47 My-Computer mach_kernel: USBF: 63.273 IOUSBInterfaceUserClient[0x2493400]::stop called with outstanding IO!!
Sep 12 19:39:47 My-Computer WindowServer[178]: loginwindow connection closed; closing server.

It looks to me like maybe the firewall was up an running too early, and prevented a connection to/from NetInfo?

[Gul Banana]

Could well be... netinfo is definitely the problem, though, in that because loginwindow can't connect to it it can't determine whether you are a valid user and just drops out into the console.

[absmiths]

So what is the solution, add NetInfo to the firewall? I would have expected Apple to have done that already. Also, the firewall seems to stay out of the way of connections to/from localhost, so maybe the firewall isn't the problem...

[Gary Kerbaugh]

   I would expect that it would be sufficient to explicitly add an allow rule for 127.0.0.1. That's my first rule. It should work to allow any to any via lo0, but I've had trouble with interfaces and the new firewall. I've had even more trouble with logging. Changing how rules are logged actually changes how they match, which is a major bug. However, you may need logging temporarily to figure out what is happening. You can do this with the following:

sudo /usr/sbin/sysctl -w net.inet.ip.fw.verbose=1

[bradoesch]

I had this problem happen to me before. Whenever the computer got to the login screen, it would throw me into Darwin. Nothing I could do. Not enough time to login, but I imagine even if I did login it would still take me to Darwin. I ended up doing the Jaguar 'upgrade' option again, and that fixed everything. Oh, this happened right after I added a theming program and changed the theme.


Brad

[Sword of Orion]

OK, now I'm getting confused. Everything I've read about firewalls (I'm just starting to read about them, so I'm certainly not an expert...) says that you should DENY 127.0.0.0/8 in order to prevent spoofing of your loopback. For example, see http://www.bsdtoday.com/2000/December/Features359.html

BTW, this happened to me only once, and all I had to do was reboot to fix it, so I wasn't planning on tinkering with my firewall just yet.

[Gary Kerbaugh]

Originally posted by Sword of Orion:
Everything I've read about firewalls (I'm just starting to read about them, so I'm certainly not an expert...) says that you should DENY 127.0.0.0/8 in order to prevent spoofing of your loopback.

   Oops, you are exactly right! I'm no expert either and was thinking of the general idea of letting the machine talk to itself. However, I was about to leave for work and didn't check the specifics. Also, I had trouble with Jaguar's firewall and interfaces. Specification of en0 seems to caused some rules to fail to match when they should have. However in this case it is necessary and it works. Here are my first two rules, precisely:

1000 allow ip from any to any via lo0
1100 deny all from any to 127.0.0.0/8

I apologize for the error. I generally check commands and procedures that I post but in this case I was rushed. I'll take a lesson from this and remember that it's better to not post than to rely on a vague recollection. Thank you for correcting my error!

[GORDYmac]

Luckily, the problem hasn't resurfaced. I can only assume it had to to with privledges, DSL, and OSX not being able to verify that I was a valid user. I have restarted a few times since my original post, with no problems. Thanks to all for your input.