googleearth e firewall guarddog

[paolo t]

Avviando googleearth, ho il msg "e' stato rilevato un errore durante l'autenticazione. Verifica : -la connessione di rete -le impostazioni del firewall (e' in esecuzione un blocco per /home/"nome utente"/google-earth/googleearth-bin?)

Sulla "guida" trovo :

Se utilizzi un firewall software, crea un'eccezione per Google Earth e per i tre server seguenti sulla porta 80:
* http://kh.google.com/
* http://geo.keyhole.com/
* http://auth.keyhole.com/
Per istruzioni sulla creazione di un'eccezione o sullo sblocco di questi server, consulta la documentazione del firewall.

Come inserire queste eccezioni? E comunque, googleearth da' lo stesso messaggio anche disabilitando del tutto Guarddog

[sacarde]

per vedere le regole attive:


iptables -L

[paolo t]

Dopo aver disabilitato Guarddog, l'output del comando e' troppo lungo per essere postato tutto in un "colpo".
Posto la 1. parte, per ora

[root@paolo paolo]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain f0to1 (3 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:www state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:http-alt state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ftp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:3900:3999 state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp dpts:6970:7170
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:6881:6889 state NEW
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:4662 state NEW
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:4666
logdrop all -- anywhere anywhere

Chain f0to2 (11 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:www state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:http-alt state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:8888 state NEW
logdrop all -- anywhere anywhere

Chain f1to0 (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:ntp
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:ntp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:www state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:http-alt state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain state NEW
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:sunrpc state NEW
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT tcp -- anywhere anywhere tcp dpts:1024:65535 state NEW
ACCEPT udp -- anywhere anywhere udp
ACCEPT tcp -- anywhere anywhere tcp dpt:nfs state NEW
ACCEPT udp -- anywhere anywhere udp dpt:nfs
ACCEPT udp -- anywhere anywhere udp dpt:aol
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:1024:65535 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:6969 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:ldap state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:msnp state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:mmcc state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:telnet state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpts:5000:5001 state NEW
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:5000
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:ftp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dptop3s state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpts:6660:6669 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dptop3 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:rtsp state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:7070 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpts:6881:6889 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:smtp state NEW
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dptop2 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:4661 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:4662 state NEW
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4665
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4666
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:ssmtp state NEW
logdrop all -- anywhere anywhere

Chain f1to2 (11 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:www state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:http-alt state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:1024:5999 dpt:8888 state NEW
logdrop all -- anywhere anywhere

Chain f2to0 (1 references)
target prot opt source destination
logdrop all -- anywhere anywhere

Chain f2to1 (3 references)
target prot opt source destination
logdrop all -- anywhere anywhere

Chain logaborted (0 references)
target prot opt source destination
logaborted2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '

Chain logaborted2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `ABORTED '
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain logdrop (8 references)
target prot opt source destination
logdrop2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
DROP all -- anywhere anywhere

Chain logdrop2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `DROPPED '
DROP all -- anywhere anywhere

Chain logreject (0 references)
target prot opt source destination
logreject2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

Chain logreject2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `REJECTED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

[paolo t]

e poi la 2. parte (mi scuso per la lunghezza) .

Chain nicfilt (0 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
logdrop all -- anywhere anywhere

Chain s0 (1 references)
target prot opt source destination
f0to1 all -- anywhere paolo.homenet.telecomitalia.it
f0to1 all -- anywhere 192.168.1.255
f0to1 all -- anywhere localhost
f0to2 all -- anywhere fx-in-f190.1e100.net
f0to2 all -- anywhere fx-in-f91.1e100.net
f0to2 all -- anywhere fx-in-f93.1e100.net
f0to2 all -- anywhere fx-in-f136.1e100.net
f0to2 all -- anywhere 74.125.54.206
f0to2 all -- anywhere fx-in-f101.1e100.net
f0to2 all -- anywhere fx-in-f102.1e100.net
f0to2 all -- anywhere fx-in-f113.1e100.net
f0to2 all -- anywhere fx-in-f138.1e100.net
f0to2 all -- anywhere fx-in-f139.1e100.net
f0to2 all -- anywhere fx-in-f100.1e100.net
logdrop all -- anywhere anywhere

Chain s1 (0 references)
target prot opt source destination
f1to2 all -- anywhere fx-in-f136.1e100.net
f1to2 all -- anywhere fx-in-f190.1e100.net
f1to2 all -- anywhere fx-in-f91.1e100.net
f1to2 all -- anywhere fx-in-f93.1e100.net
f1to2 all -- anywhere 74.125.54.206
f1to2 all -- anywhere fx-in-f139.1e100.net
f1to2 all -- anywhere fx-in-f100.1e100.net
f1to2 all -- anywhere fx-in-f101.1e100.net
f1to2 all -- anywhere fx-in-f102.1e100.net
f1to2 all -- anywhere fx-in-f113.1e100.net
f1to2 all -- anywhere fx-in-f138.1e100.net
f1to0 all -- anywhere anywhere

Chain s2 (11 references)
target prot opt source destination
f2to1 all -- anywhere paolo.homenet.telecomitalia.it
f2to1 all -- anywhere 192.168.1.255
f2to1 all -- anywhere localhost
f2to0 all -- anywhere anywhere

Chain srcfilt (0 references)
target prot opt source destination
s2 all -- fx-in-f93.1e100.net anywhere
s2 all -- fx-in-f136.1e100.net anywhere
s2 all -- fx-in-f190.1e100.net anywhere
s2 all -- fx-in-f91.1e100.net anywhere
s2 all -- 74.125.54.206 anywhere
s2 all -- fx-in-f100.1e100.net anywhere
s2 all -- fx-in-f101.1e100.net anywhere
s2 all -- fx-in-f102.1e100.net anywhere
s2 all -- fx-in-f113.1e100.net anywhere
s2 all -- fx-in-f138.1e100.net anywhere
s2 all -- fx-in-f139.1e100.net anywhere
s0 all -- anywhere anywhere

[sacarde]

per eliminare le regole:

iptables -F

[paolo t]

Dato il comando iptables -F (da root), accetta il comando ma senza nessuna risposta.
E... non cambia nulla all'avvia di terraGoogle.

[sacarde]

ma dopo dato:

iptables -F

da

iptables -L

non dovresti vedere nessuna regola

[paolo t]

esatto.

[root@paolo paolo]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere

[sacarde]

non e' completamente disabilitato..



prova con:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

[paolo t]

dati i comandi, sempre... negativo