[MLUG] re: fedora core2 post

[Patrick Kiernan]

P at draigBrady.com wrote:

> Patrick Kiernan wrote:
>
>> sorry i should have mention in my last post that I could log in 
>> before and in the mean time all I did was reboot... i swear!
>
>
> Is there anything obvious on the console?
> Ctrl-Alt-F1 should get you a console
> that may have pertinent error messages on it.
> At least you can test that you can login.
>
> After logging in, the next thing to look
> at is ~/.xsession-errors which contains
> any error messages for your X session.
>
[patrick at telex patrick]$ cat ~/.xsession-errors
cat: /home/patrick/.xsession-errors: No such file or directory

However I found the following in /var/log/gdm/:0.log:

AUDIT: Mon Sep  6 19:01:22 2004: 2440 X: client 4 rejected from local host
  Auth name: MIT-MAGIC-COOKIE-1 ID: -1
AUDIT: Mon Sep  6 19:03:22 2004: 2440 X: last message repeated 2 times

I think stopped the firewall and now it logs in fine.

What line should I add to iptabes to allow X logins? My firewall config 
is below:

/etc/sysconfig/iptables
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]

# allow local loopback connections
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT

# drop INVALID connections
-A INPUT -m state --state INVALID -j DROP
-A OUTPUT -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP

# allow all established and related
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow connections to my ISP's DNS servers
-A OUTPUT -d 194.125.2.240 -m state --state NEW -p udp --dport 53 -o 
eth0 -j ACCEPT
-A OUTPUT -d 194.125.2.241 -m state --state NEW -p udp --dport 53 -o 
eth0 -j ACCEPT
-A FORWARD -d 194.125.2.240 -m state --state NEW -p udp --dport 53 -i 
eth1 -o eth0 -j ACCEPT
-A FORWARD -d 194.125.2.241 -m state --state NEW -p udp --dport 53 -i 
eth1 -o eth0 -j ACCEPT

# allow outgoing connections to web servers, irc & realplayer
-A OUTPUT -d 0/0 -m state --state NEW -p tcp -m multiport --dport 
http,https,6667,554,8080,7070 -o eth0 -j ACCEPT
-A FORWARD -d 0/0 -m state --state NEW -p tcp -m multiport --dport 
http,https,6667,554,8080,7070 -o eth0 -i eth1 -j ACCEPT


# allow outgoing mail connections to SMTP and POP3 servers
-A OUTPUT -d 0/0 -m state --state NEW -p tcp -m multiport --dport 
smtp,pop3 -o eth0 -j ACCEPT
-A FORWARD -d 0/0 -m state --state NEW -p tcp -m multiport --dport 
smtp,pop3 -o eth0 -j ACCEPT

# allow echo-requests pings
-A INPUT -p icmp --icmp-type echo-request -j ACCEPT
-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
#log all other attempt out going connections
-A OUTPUT -o eth0 -j LOG
-A FORWARD -j LOG
# default is to DROP outgoing connections

COMMIT

*nat

#set up IP forward and nat
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT