Leopard firewall blocks Retrospect Client

[Maser]

*at this point* (on the machine I just did), I'm not getting a prompt to add "pitond" with the machine I used the delta update on and manually hunting down the process is non-trivial for an end-user.

 

If the communication/reality is to just reinstall the client -- that's fine. But there's clearly a difference on my end when I'm seeing the prompt for pitond and when I'm not -- and I've just not been able to isolate when it occurs (unfortunately.)

 

I'd rather see an updated client installer from EMC that forces this to happen for 10.5.x than have to manually massage this accordingly.

[rhwalker]

Quote:

---

I'd rather see an updated client installer from EMC that forces this to happen for 10.5.x than have to manually massage this accordingly.

 

---

Hmm... if an installer program is able to punch holes in the firewall, I would have problems with that. Makes the firewall close to useless.

 

Russ

[Maser]

Current installer does this (prompts for it), though. Been doing that for years...

 

Anyway, here's another data point:

 

*Clean* install of 10.5.0 on a G4 Powerbook. No updates. Nothing.

 

Installed Retrospect Client.

 

No firewall

 

Updated to 10.5.1 (SU)

 

Set firewall to "set specific..."

 

Manually added client to firewall GUI.

 

Rebooted.

 

Client is still *not* seen by the Server app.

 

And no prompts for "pitond"

 

 

- Steve

[Mayoff]

Just some notes about the firewall:

 

I have a German version of Leopard 10.5.1 installed. This was a new install of 10.5.1. I set the firewall to only allow specific applications. I downloaded and installed the Retrospect Client (german).

 

During the client install, I was asked if I want to allow the client to open the firewall. I clicked allow. Before the installer quit, another dialog box came up from the Finder asking me to open the firewall (I didn't really look at the dialog box closely because it was in german). I clicked okay/allow

 

The end result was: Pitond was automatically added to the firewall exception list. I had no problem logging in and connecting to the client computer.

[Maser]

So -- at this point -- the only way to get it to work under 10.5.1 with the firewall is to reinstall the client, then?

[CallMeDave]

Quote:

---

Client is still *not* seen by the Server app.

 

And no prompts for "pitond"

 

---

 

 

If you manually add /Applications/Retrospect Client.app/Contents/Resources/pitond to the firewall exception list by Showing Contents of the Retrospect Client package then dragging and dropping the Resources folder into the standard GetFile dialog box, does it work?

 

> So -- at this point -- the only way to get it to work under 10.5.1 with the firewall is to reinstall the client, then?

 

Certainly Robin did not say that. What he did was provide a set of steps that worked. Other steps might also work.

[Mayoff]

One more test:

 

Hello,

 

I did some additional testing today and did find a problem

 

1) Launched Retrospect on a 10.5.1 system

2) My Firewall is set to only allow specific applications

3) Went to Configure>Clients>network

4) The Finder asked if I wanted to allow Retrospect traffic. I said "yes"

5) The Firewall settings in System Preferences now list Retrospect

6) Clients do NOT appear in the live network window

7) I opened System Preferences>Security>Firewall and changed the settings to allow all applications (Firewall off). Clients then start to display in Configure>Clients>Network.

 

Watch a video of the test at http://screencast.com/t/Va8LRAtZQh

 

 

If I go back into my Retrospect Application with the firewall turned on (Retrospect Exception added), I can add clients by address.

 

More about having the firewall turned on:

On this same computer, I have a Retrospect Client installed, with pitond listed in the firewall settings. This client is available on the network to other copies of Retrospect.

 

 

We are going to investigate a way to get the UDP port 497 open easily for Leopard users.

[rhwalker]

Quote:

---

We are going to investigate a way to get the UDP port 497 open easily for Leopard users.

 

---

hopefully it doesn't require that we learn German.

[sdrandis]

Just wanted to share my experience of today.

 

I've been using Retrospect since 2005 continuously until I installed Leopard on both my home Macs (end October 2007) with very satisfying results. At the beginning I used to backup only to a LaCie FW hard disk (no glitch at all), then I tried to add a further backup to a LaCie DVD±R DL drive (at first with major problems, then after switching to DVD+R media all went well).

 

But with Time Machine I stopped using Retrospect for a while, until I felt that I was anyway missing the backup on DVD feature, so today I gave it a new try.

 

My setup is as follows: Leopard (10.5.0) was installed on both Macs (1 PowerBook G4 Alu and 1 Mac mini G4) by UPDATING Tiger, all went well the first time. Then I updated the OS to 10.5.1 when it was released.

 

So today I first downloaded the new Retrospect app update (6.1.138) and installed it on the Mac mini (my backup server); then checked if there was also a Client update (no, I already had version 6.1.130 on my PowerBook).

 

I fired Retrospect on the Mac mini, and it wasn't able to find the network volume (the PB). So I started browsing the internet and found this thread. Of course I added Retrospect Client to the list of apps that on my PB are allowed to receive income connections, but it didn't help. Then I read that simply choosing the "Allow all incoming connections" would do the game, and it worked. Then I tried to uninstall and reinstall the Retrospect Client, but to no avail.

 

I noticed that immediately after installing I was getting the "first" dialogue box asking if I wanted to allow incoming connections to the "Retrospect Client" app, but didn't get the second one (that asking the same for pitond). There seemed no way to get this second dialogue, any combination of uninstalling/reinstalling wouldn't do.

And since you can't drag and drop the pitond icon to the list, nor you may add its path (no way at all, I guarantee you), I was stuck.

I even tried to figure how to open UDP port 497 with WaterRoof, but wasn't willing to go on opening ports in an environment which has switched to another paradigm, I felt uneasy.

 

At last I read somewher on the web that somebody did the trick by trashing the plist file that traces the apps that are allowed incoming connections by the new Leopard "application level firewall". The plist file is:

 

[your startup disk]/Library/Preferences/com.apple.alf.plist

 

Of course I made a copy of this file before deleting it, then uninstalled Retrospect Client (all the action happens on the client Mac, while nothing has to be done on the server), then deleted com.apple.alf.plist, rebooted, and went to install Retrospect Client again.

 

And boom! After finishing the install process, the installer itself asked as usual if I wanted to allow the Retrospect Client app to allow (bla bla bla), and I confirmed "yes". But then came the new thing: something prompted a new dialogue box (I guess it was the Finder) asking me if I wanted to allow incoming connections for "pitond". I accepted and looked immediately at the firewall System Preferences screen, and there it was, pitond accepting incoming connections.

 

The I rebooted the PB to see if the change was permanent, and it is! So I went on and did a well overdue backup on a DVD+R ("only" 2.5 GB, but I'm no photo or video pro, so it's a lot of data), and everything went perfectly.

 

I even did all the process described above sitting on my couch, from my PowerBook through Airport thanks to Leopard's Screen Sharing (the Mac mini is understairs). All well, no glitch, completely satisfied.

 

So if others who are failing to succeed at the moment can reproduce this behaviour then there would be no need of an overhaul in Retrospect, since it is (correctly) the Finder/OS X who cares about this detail.

 

Of course there must be anyway a bug which prevents the trick to work without deleting the plist file, but even so that would be better than nothing.