Re: Info on "Can't open display"

[Stephen Mathezer <mathezer at yahoo dot com>]

* Suhaib Siddiqi <ssiddiqi@inspirepharm.com> [010615 17:30]:
> 
> 
> Well first off all if you (I mean any user) are on yahoo, hotmail, excite or
> any web based mail, please do not cc to me.  Your mail will not go through,
> I block at our server any outgoing and incoming traffic to web based mail
> services.  I am against them, for several reasons, basically they 
> are a good source of 'Reply To;" for junk mailers.  Second I tell my users
> at work why do you need those services if you already got an e-mail account
> here, for which I get yelled because I won't let them access those free web
> based mail services URLs too ;-)

Agreed -for the most part-.  I use Yahoo so that I am not dependent on an
employer or ISP for email access.  If I change either (I've changed both
recently) I would rather not have to hassle with forwarding email and
getting everybody using my new address. I use fetchmail to grab my Yahoo
mail and then do whatever makes sense with it. It is nice being able to
get your email anywhere but I agree that spam to/from the web based
accounts is always a problem.

[ snip ]

> > I will reiterate a couple of points here, and let me point out that if I
> > was one of the list regulars/developers I would simply say something
> > like "check the archives this has been answered before",
> 
> Oh I stopped saying it... because each time I said that, a few users email
> to the list and or to me and called me "Asshole" (you will those emails in
> mail archive from 1999, 2000).  They expect a full Technical Support
> Department here, perhaps better then any software vendor provides.  If you
> wish to say it, expect a strong heart and be ready to listen names from a
> bunch of childish and rediculous people.
> 

I know the feeling, I just thought that Robert had gone to some trouble
to do his best to explore all the possibilities and post reasonable
questions, rather than just asking for the step by step childproof
instructions for making Cygwin work on Linux  :) :) :)

> > -Telnet to localhost:6000 is, while not complete in all respects, at
> > least a decent indication that the VPN client is not doing something as
> > basic as blocking all connections to localhost:6000 as some seem to
> > imply. Can somebody please explain to me why TerreTermSSH X forwarding
> > (see below), displaying remote X clients on the cygwin
> > server, and telnet to localhost:6000 all work if the VPN software is
> > truly blocking ports.
> 
> 
> Actually, What I suspect, though I am not 100% sure, VPN, and in particular
> Aventail, does not like Cygwin using UNIXDOMAIN sockets (AF_UNIX).  I think
> that is what going on.... BUT I AM NOT SURE BECAUSE I HAVE NOT LOOKED INTO
> IT SERIOUSLY.  I DO PLAN TO SIT DOWN THIS WEEKEND AND BEAT MY HEAD ON THIS
> ISSUE.
> 

Out of curiosity, if Cygwin is emulating AF_UNIX sockets using files
then how could Aventail have its fingers in there?

Never mind, I just went and read Robert's explanation in a later
message.

> > 
> > -Since the problem occurs even if the VPN client is not running, it is
> > obviously not some case of the VPN client not allowing split-tunneling
> > or something like that.  This has to come down to some interaction with
> > the TCP stack.  Then again, why does adding exceptions to the VPN client
> > cause things to work even when the client isn't running?
> 
> 
> I think adding exception to VPN work because, perpahs, Aventail on
> installation modify TCP/IP stack and owns it.... just like AOL 6.0 browser, 
> Even if you do not use it, it will screw up other browsers once AOL 6.0 is
> intsalled... well not a good example ;-)
> 
> CheckPoint SecureRemote modifies NT kernel and also TCP/IP stack, that I
> know from their documentation, but it does not give any problems.
> 

Yeah I guess so, I just can't imagine anybody writing something that way
in this day and age with so many different things dependent on TCP/IP.
It is really nasty that you still have to add the clients as exceptions
even if the VPN isn't running.

For what its worth for future reference, I have the Nortel VPN client
installed under 2000 and that does not cause me any problems. 

> > 
> > -TeraTermSSH (like any SSH client) can forward X windows connections from
> > remote machines.  This requires the SSH client running under 98 to
> > connect to localhost:6000 to proxy the X windows request that it is
> > forwarding over the encrypted channel from the remote machine.  This has
> > been repeated ad nauseum on the list.  TeraTermSSH is a perfectly good
> > example of an X Windows client that works.  That being said, it
> > certainly would make sense to try another.
> 
> 
> What I think Aventail simply won't let you do X forwarding.  Is there a rule
> to turn it on off?  I do not know because I do not use it.
> 

One would think it would be possible to exclude certain IP addresses
(like 127.0.0.1) but I don't know.

> Suhaib

What I may do if I have some time this weekend is to install Windows ME
under VMWare and see if I can duplicate any of these problems *without*
a VPN client installed.

-Steve

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com