Q: What is "racoon"

William, thanks for quick reply and info. I went to the link and from what I read, this looks like something that might be used when a program crashes and gives the response to send a message to Apple (Report) or ignore, right?


Gary

OK, I went to the link, but I don't understand what it is that I'm looking at. It seems that this is something for Linux. If that is true, then how did I get it my Mac? Should I be concerned that my system has been, or could be, compromised? Is this spy-ware?


Just to clarify, I did a search for 'racoon' on my 15" MBP running 10.5.8, and found nothing.

Gary

William, I really, really appreciate your help. Other than being totally lost trying to find "private/etc" and "/usr/sbin" anywhere on my Mac, I guess what has me concerned is that this 'racoon' is a working process that shows in the activity monitor. And, as you've said, on my Mac is a file named "private/etc/racoon.conf." And that file resides on a hardrive that is NOT my startup drive. When I double click that file, AppleWorks 6.x starts and then I see this:



# $KAME: racoon.conf.in,v 1.17 2001/08/14 12:10:22 sakane Exp $



# "path" must be placed before it should be used.

# You can overwrite which you defined, but it should not use due to confusing.

path include "/etc/racoon" ;

#include "remote.conf"; ;



# search this file for presharedkey with various ID key.

path presharedkey "/etc/racoon/psk.txt"; ;



# racoon will look for certificate file in the directory,

# if the certificate/certificate request payload is received.

path certificate "/etc/cert" ;



# "log" specifies logging level. It is followed by either "notify", "debug"

# or "debug2".

#log debug;



# "padding" defines some parameter of padding. You should not touch these.

padding

{

maximum_length 20; # maximum padding length.

randomize off; # enable randomize length.

strict_check off; # enable strict check.

exclusive_tail off; # extract last one octet.

}



# if no listen directive is specified, racoon will listen to all

# available interface addresses.

listen

{

#isakmp ::1 [7000];

#isakmp 202.249.11.124 [500];

#admin [7002]; # administrative's port by kmpstat.

#strict_address; # required all addresses must be bound.

}



# Specification of default various timer.

timer

{

# These value can be changed per remote node.

counter 5; # maximum trying count to send.

interval 20 sec; # maximum interval to resend.

persend 1; # the number of packets per a send.



# timer for waiting to complete each phase.

phase1 30 sec;

phase2 15 sec;

}



remote anonymous

{

#exchange_mode main,aggressive;

exchange_mode aggressive,main;

doi ipsec_doi;

situation identity_only;



#my_identifier address;

my_identifier user_fqdn "macuser@localhost";

peers_identifier user_fqdn "macuser@localhost";

#certificate_type x509 "mycert" "mypriv";



nonce_size 16;

lifetime time 1 min; # sec,min,hour

initial_contact on;

support_mip6 on;

proposal_check obey; # obey, strict or claim



proposal {

encryption_algorithm 3des;

hash_algorithm sha1;

authentication_method presharedkey ;

dh_group 2 ;

}

}



remote ::1 [8000]

{

#exchange_mode main,aggressive;

exchange_mode aggressive,main;

doi ipsec_doi;

situation identity_only;



my_identifier user_fqdn "macuser@localhost";

peers_identifier user_fqdn "macuser@localhost";

#certificate_type x509 "mycert" "mypriv";



nonce_size 16;

lifetime time 1 min; # sec,min,hour



proposal {

encryption_algorithm 3des;

hash_algorithm sha1;

authentication_method presharedkey ;

dh_group 2 ;

}

}



sainfo anonymous

{

pfs_group 1;

lifetime time 30 sec;

encryption_algorithm 3des ;

authentication_algorithm hmac_sha1;

compression_algorithm deflate ;

}



# sainfo address 203.178.141.209 any address 203.178.141.218 any

# {

# pfs_group 1;

# lifetime time 30 sec;

# encryption_algorithm des ;

# authentication_algorithm hmac_md5;

# compression_algorithm deflate ;

# }



sainfo address ::1 icmp6 address ::1 icmp6

{

pfs_group 1;

lifetime time 60 sec;

encryption_algorithm 3des, cast128, blowfish 448, des ;

authentication_algorithm hmac_sha1, hmac_md5 ;

compression_algorithm deflate ;

}





Again, this is not on my startup disk, but somehow I have an active process. I know I can stop the process, but how do I stop it and permanently remove it?


Gary

To clarify etresoft's comment, I would first have to ask, "what is VPN?" I believe it has something to do with a network, usually corporate, and someone from I/T would install or give directions how to setup on the company network. All of my Macs are used personally, in my home. I would like to ask if either of you have had Virtual PC installed on a Mac. I no longer own the G5, but at one time I had installed Virtual PC on at least a G4 PowerBook and I might have copied files from the PowerBook to the G5.


As far as other problems, yes they do seem minor and could be preference related. They include such things as:
1) my two AccuWeather widgets might default to Cupertino when I first activate
Dashboard
2) my Radar in Motion widget won't hold settings from one start-up to another
3) EyeTV 3.2 has 'forgotten' how to shade the "eyeTV" section of the controller
in red when recording
4) on occasion the startup chime has taken over 10 seconds to sound at startup
5) hard drives (counting startup volume I have 4) seem to be reading/writing for
no apparent reason and if I activate Activity Monitor usually it is a
kernel task that is running



I've reset PRAM (forgotten how to reset NV-RAM if that is still necessary on Intel Macs), moved pref.panes out and then restarted, but these things continue. Apple support says they don't believe that the PRAM battery is bad, mainly because I haven't seen any date/time changes.

William, thanks for that info. I finally found it and I've found it on my MBP, thanks to your help. But, it is not running on the MBP. In fact, the created, modified, and opened dates on the MBP show 10/5/07. Strange.

Anyway, I may just start all over with an archive and install.


Gary

I decided to try Little Snitch, and found out some more interesting stuff. First, Little Snitch gave me a warning for a kernel task, at start-up, that was trying to connect to "IPV-6-ICMP." Second, at shut-down, my Mac Pro was trying to connect to "pm-member.mac.com via port 5354." I've looked at this forum and googled "pm-members.mac.com" and everything seems to indicate this is related to Back To My Mac. That may be, but I don't have that running.


Oh there is one (actually two) more interesting thing that I found when I ran Activity Monitor on the Mac Pro and that is:

1) coreaudio (Not Responding)
2) UserEventAgent (Not Responding)

And, you guessed it, they are both running on my 15" MBP.

Gary

Etresoft...

Thanks for the info. Apple Support was also concerned about the two normal functions that weren't responding, too.

One more thing I'd like to ask, I have an extra external drive and was thinking about using it to put my original OS X (10.4.x) on (the 10.5.x was the $9.95 upgrade disk that Apple offered to qualified purchasers in October of 2007 and I'm not sure if I can use it to 'start from scratch'). That is possible, right? And if so, then I would just use System Preferences to choose which start up disk to boot from. If the answer is 'no you can't do that,' then I could just install the drive in bay 1 and go from there.

Gary


p.s.: hope you had a Happy Thanksgiving

Message was edited by: Gruene Guy