Welcome to the MacNN Forums.

besson3c · Nov 1, 2007, 12:26 PM

kman: how are you detecting that Kerberos is open?

kman42 · Nov 1, 2007, 01:37 PM

My port scan revealed Port 88 kerberos as being open.

Just to add to the confusion, I brought in my laptop to work to connect to my work desktop and was not able to connect until I turned on Allow all incoming connections, even though I had file sharing turned on and my desktop was listed in the SHARED sidebar of my laptop. I even tried using cmd-k to connect to no avail. The connection just kept failing. As soon as I turned my desktop back to Allow all incoming connections I was able to connect immediately.

I am now very confused.

kman

besson3c · Nov 1, 2007, 01:39 PM

You did a local port scan? There are a lot of local ports that are open, that doesn't mean a whole lot. I'm not sure why Apple needs to run a Kerberos server, but whatever...

The real concern is connections from the outside world. For this, you'll have to use nmap, not netstat to query yourself (and from another machine, of course)

besson3c · Nov 1, 2007, 01:40 PM

kman: were you connecting via AFP? Samba? NFS? Maybe Samba needs the netbios port open that the firewall blocks? I dunno, very rarely connect to Windows machines.

kman42 · Nov 1, 2007, 01:43 PM

Afp.

kman42 · Nov 2, 2007, 12:21 AM

[edit] just plain wrong, so I deleted it [/edit]

kman

besson3c · Nov 2, 2007, 12:26 AM

kman: I think the ultimate test would be to do a port scan while the firewall is in each of its three possible settings. Maybe I'll try this tomorrow....

kman42 · Nov 2, 2007, 01:59 PM

Any idea why Word suddenly wants access through my firewall?

kman42 · Nov 2, 2007, 02:09 PM

Well, here are my results with post scanning. Note that File Sharing (AFP) and Screen Sharing are on in all cases.

1) Allow all incoming connections:
Open TCP Port: 88 kerberos
Open TCP Port: 548 afpovertcp
Open TCP Port: 3998
Open TCP Port: 5900 vnc-server

2) Block all incoming connections:
Open TCP Port: 88 kerberos
Open TCP Port: 548 afpovertcp
Open TCP Port: 5900 vnc-server

3) Set access for specific services and applications
Open TCP Port: 88 kerberos
Open TCP Port: 548 afpovertcp
Open TCP Port: 5900 vnc-server

kman42 · Nov 3, 2007, 10:25 PM

Did we decide this was no longer an important issue?

besson3c · Nov 4, 2007, 12:50 AM

kman42: I'm not sure it is an issue. Seems to me that it's just a poorly designed, unclear GUI. Am I missing something?

The Yorkshire Rapper · Nov 4, 2007, 01:29 AM

MAC need to fix this fast, viruses are cropping up much more as leopard is released, im sure i'm infected, im going to the Apple store to complain about his.

besson3c · Nov 4, 2007, 01:44 AM

Originally Posted by The Yorkshire Rapper

MAC need to fix this fast, viruses are cropping up much more as leopard is released, im sure i'm infected, im going to the Apple store to complain about his.

Your Mac has a built-in microphone. What you need to do to keep your computer safe is speak clearly into the mic: "enter Macintosh stealth mode". This will prevent you from getting any viruses.

The Yorkshire Rapper · Nov 4, 2007, 02:08 AM

Originally Posted by besson3c

Your Mac has a built-in microphone. What you need to do to keep your computer safe is speak clearly into the mic: "enter Macintosh stealth mode". This will prevent you from getting any viruses.

Yes, I know that, but its no good if i am already infected.

besson3c · Nov 4, 2007, 02:15 AM

stealth mode will also help disinfect. I suggest putting your computer in stealth mode right now. It may take a few tries before your voice is correctly recognized though, Apple needs to work on improving the speech recognition...

The Yorkshire Rapper · Nov 4, 2007, 02:18 AM

where is the microphone, is it next to the camera?

fortepianissimo · Nov 4, 2007, 10:28 AM

Now this thread is officially dead?

ghporter · Nov 4, 2007, 10:35 AM

Yep, dead as a doornail. Yorkshire, they're pulling your leg. You are NOT infected-you can't be infected with a Mac the way a PC user can. It cannot happen. Post a new thread (probably in this forum) about what gives you the impression you're infected, and I'm sure we'll figure it out with you.

besson3c · Nov 4, 2007, 12:39 PM

Originally Posted by The Yorkshire Rapper

where is the microphone, is it next to the camera?

Top center of your Mac desktop/laptop..

0157988944 · 01:13 PM

ghporter, don't have fun with him. If his MAC is infected, heneeds to enter stealth mode ASAP!

the MAC systme is very vulnrable nowadays and it's a good thing they introduced stealth mode.

Please also note, Yorkshire, that since stealth mode, by it's very nature is "stealthy," you will not notice a difference in what the omputer shows on screen. The best way to figure out if you've entered stalth mode is to Right Click on your Hard Drive icon, select "Get Info" and them look down to "Details." If under details it says the owner is "System", it means your HD has been taken over by the system to wipe out the virus.

drdocument · Nov 4, 2007, 06:57 PM

I liked the firewall interface in Tiger because with the firewall on you could activate certain functions and the firewall would make the needed ports available. The firewall in Leopard is more confusing to me. I wish someone would make it clear.

fortepianissimo · Nov 4, 2007, 11:00 PM

Originally Posted by fortepianissimo

This is just perfect - even after "Install startup file" in Flying Buttress, the ruleset installed doesn't survive between boots. Actually from time to time the ipfw ruleset is just reverted by some mysterious force!

So how do we make ipfw ruleset stick?

I guess the reason why Flying Buttress rules don't stick is that the fwutil in /Library/StartupItems/Firewall is a.. PPC binary! For now I switched to WaterRoof

WaterRoof ipfw firewall frontend

besson3c · Nov 5, 2007, 12:46 AM

If you guys really want hands on, direct control of your firewall, why not just create your rules in a text editor? It's really not that hard to do, and you can copy the examples generated by these GUI apps...

TETENAL · Nov 5, 2007, 05:16 PM

For those of you who can't get Skype to work in Leopard, it's the Firewall:

Mac OS X Leopard firewall damages programs - heise Security

I disagree with their conclusion that signing applications is the same as "damaging" them.