Application firewall blocking Java when logged out

Question

Application firewall blocking Java when logged out

I'm trying to setup and use Crashplan, which is a multinode backup utility and service, that runs as a java application. The application has an agent that runs in the background, even when logged out, and a front end.

The agent runs for SENDING data to remote servers, but cannot RECEIVE data from other machines when I'm hosting a backup.

I narrowed it down to whether I am logged in or out. As soon as I log in, the remote connection is established and it backs up to my computer. When I log out, the remote machine cannot backup to my machine. However, the agent can backup to other machines, as it is an outbound connection.

When looking in the console log, I see the following:
deny java connecting from 10.0.2.7:xxxxx to port 4242 proto=6 (when logged out)
or
Allow java connecting from 10.0.2.7.xxxxx to port 4242 proto=6 (when logged in)

How can I make an exception for Java? I already have "Java" listed as allowing incoming connections.

2.8 iMac, 2.6 iMac, 2.6 MBP, Mac OS X (10.6.2)

Posted on Mar 22, 2010 11:05 AM

Reply

Answer 1

baltwo

Level 9

62,362 points

Mar 22, 2010 1:54 PM in response to apple_enthusiast

What does Crashplan's developer say?

Reply

Answer 2

Azhrei

Level 1

0 points

Mar 22, 2010 3:53 PM in response to apple_enthusiast

At some point during my upgrade from Leopard to SL I remember seeing a series of directions for how to set certain characteristics. It had something to do with not being logged in as any normal user. Instead it had a description of the process for logging in as root and executing the same commands, with the result being that the changes applied to the system as a whole. You probably need something like that.

Unfortunately, I'm not sure exactly what the values were that I was changing. I think I had done a Google looking for how to change a username. I had used NameA on Leopard and I wanted it to be NameB on SL. So I probably did that Google search and then clicked on the first apple.com link that came up.

Sorry, I realize that may not have been much help. 😟

Reply

Answer 3

Mar 22, 2010 7:25 PM in response to baltwo

Good question. They gave me some ideas to try, but I've been getting the run-around. "You need to open port 4242". How to do that, is another story. All I can figure out is I have to disable the application firewall, and use IPFW, which becomes much more complicated to manage. It appears I can't use a combination of the two.

I did discover it appears to be a problem with the software itself; however, being able to include incoming ports would solve the problem.

If my firewall is on AND the backup repository is on an external drive for the inbound machine, the "connection" is severed when I log out. If I turn off the firewall OR move the backup destination to the main drive, then backups continue as expected when I log out.

I can access my drives when logged out via a network share, and it backs up to the drive with the firewall off. So obviously, the drives are available when logged off. It also shows it's not just a network or firewall issue, as backups work as expected if it's backing up to the main hard drive, and not an attached volume.

Reply

Answer 4

Barney-15E

Level 10

112,638 points

Mar 22, 2010 7:34 PM in response to apple_enthusiast

Where does Crashplan store the plist that launchd uses to start the service?

I am thinking that it is running as a user agent that doesn't have the necessary privileges when logged out. If it is your user/Library/LaunchAgents/ folder, perhaps it would run correctly if in the /Library/LaunchAgents/ folder.

Reply

Answer 5

Mar 23, 2010 9:25 AM in response to Barney-15E

I thought the same, but didn't know where to start.

~/Library/LaunchAgents/ didn't have it, and /Library/LaunchAgents/ is empty. However, I did find a /Library/LaunchDaemons/com.crashplan.engine.plist with the following privileges:

System RW
Wheel R
Everyone R

Reply

Answer 6

Barney-15E

Level 10

112,638 points

Mar 23, 2010 10:32 AM in response to apple_enthusiast

From my limited understanding, that should be the place. It may be that the program doesn't request the appropriate permissions.

Reply

Answer 7

Mar 23, 2010 3:24 PM in response to Barney-15E

Thanks for the help. I set this up on my laptop, and it doesn't exhibit the same behavior. So it appears to be some sort of installation or permissions issue.

Reply

Answer 8

Apr 7, 2010 8:28 PM in response to Barney-15E

ARGH! I ran permissions repair twice before. However, that, coupled with a possible OS installation, seems to have resolved the issue.

My sister seems to have run into the same problem herself. We ran a permissions repair and that resolved her issue.

I tried many different avenues, but it appears to have been a permissions related problem. I cannot say why previous repairs did not resolve this issue.

Reply