Discuss February 2015

discuss@lists.centos.org

153 participants
158 discussions

Re: [CentOS] Another Fedora decision
by James B. Byrne 03 Feb '15

03 Feb '15

I think it well to recall that the change which instigated this tempest was not to the network operations of a RHEL based system but to the 'INSTALLER' process, Anaconda. Now, I might be off base on this but really, ask yourself: Who exactly uses an installer program? And what is the threat model being addressed by requiring that the installer set a suitably strong password for root? For what purpose? Because RHEL sets the sshd on and allows root access over ssh via password by default? Then is not the correct approach to disable that access instead? But wait! Is it not true that the network services are not started by default? So, exactly where is the threat? Does it not occur much, much later in the workflow than at the installer? Would it not be more sensible to require root access to start sshd (hummmm. . . is that not a requirement now?) and to ask for the root password at that time. And then of course, you could catch those sneaky people that change the root password after the install is complete. Surly, it is when starting network services that then, and only then, one should check that one of the following conditions are true: 1.) root access over the network is disabled; 2.) root access over the network is allowed via RSA only; 3.) if root can log in via ssh using a password then the root password must be strong? That process seems like something that could be setup in a network init script, upstart system job, or systemd service file without a great deal of effort. Why does arbitrarily requiring 'strengthening' of the root password have to go into the installer program? Yes, the alternative approach would adversely impact automatic system restarts. And your point? Is not the easy answer but to disallow root access over the network entirely; or to force the use of RSA certs for root logons? Are not these far, far superior approaches to dealing with this issue than requiring a 'strong' root password everywhere, all the time, regardless of what purpose the system is used for? This change to Anaconda is not security, it is theatre. It is directly equivalent to airport passenger security checks. Totally ineffectual but so intrusive and inconvenient that we have to believe that it works. For otherwise the inescapable conclusion is that we are all fools for putting up with it; and no-one likes to think of themselves as a fool. I call this the 'Buckley's Mixture' approach to social engineering. In any case, allowing an eight character password on credentials exposed to public network access is laughable. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

Kickstart setup
by Ashley M. Kirchner 03 Feb '15

03 Feb '15

Is there a way to use kickstart to boot a machine into a manual setup process? Basically what I'm getting to is this, the machine doesn't not have a CD drive in it (nor can I add one), but I can boot it via kickstart. The install media is on the network. What I'd like to do is boot this machine up and rather than have kickstart do everything for me as far as installing the OS and packages, instead present me with a manual setup (that I can get to via vnc) where I get to pick what I want or don't want on the machine. After it's all done, I'm going to go through the anaconda files and generate a base kickstart for all future installs. Does anyone have an example kickstart file I can go off of to do that?

3 4

Re: [CentOS] Another Fedora decision
by James B. Byrne 03 Feb '15

03 Feb '15

On Mon, February 2, 2015 21:34, PatrickD Garvey wrote: > OK, folks. You're doing a great job of describing the current milieu > with a rough description of some best practices. > > Now how about some specific sources you personally used to learn your > craft that we can use likewise? > > PatrickD > > Go to http://www.ccc.de/en/. Visit and view some of the videos of presentations from previous congresses and hackfests. Educate yourself on the threats. Once you see what you are up against then you will have some ideas about what questions to ask. Then you can find the material you need. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Squid3 on CentOS 6.6: IPv6 PTR endianess
by Max Grobecker 03 Feb '15

03 Feb '15

Hello, I'm running a Squid cache (Version 3.1.10) on CentOS 6.6 as a forward proxy which is reachable over a global IPv6 address. For whatever reason, Squid tries to perform PTR lookups on the client's IPv6 address. The weird thing is, that Squid seems to struggle with the "endianess" of the IPv6 address blocks. For example: My current client IP is 2003:6e:d79:2104:7163:7ecd:9333:f0be. Squid tries to resolve b.e.f.0.3.3.9.3.c.d.7.e.6.3.7.1.0.4.2.1.7.9.0.d.6.e.0.0.0.3.2.0.ip6.arpa. That means: b.e.f.0.3.3.9.3.c.d.7.e.6.3.7.1.0.4.2.1.7.9.0.d.6.e.0.0.0.3.2.0.ip6.arpa -> 0.2.3.0.0.0.e.6.d.0.9.7.1.2.4.0.1.7.3.6.e.7.d.c.3.9.3.3.0.f.e.b -> 0230 : 00e6 : d097 : 1240 : 1736 : e7dc : 3933 : 0feb For comparison: Squid: 0230:00e6:d097:1240:1736:e7dc:3933:0feb Real: 2003:006e:0d79:2104:7163:7ecd:9333:f0be It seems, that Squid just messes with the order of the Bytes on each block. I couldn't find any related bug report on this (checked Squid and CentOS bug tracker), so I'm not sure if it's a CentOS or Squid related problem. Is anyone else experiencing this? It seems to be happen on IPv6 client addresses only - with IPv4 it works just fine. And besides of these broken PTR lookups Squid is working as expected. Greetings from Wuppertal Max

2 1

Re: [CentOS] Very slow disk I/O
by Jatin Davey 03 Feb '15

03 Feb '15

On 2/2/2015 10:32 AM, John R Pierce wrote: > On 2/1/2015 8:25 PM, Jatin Davey wrote: >> >> On 2/2/2015 9:25 AM, John R Pierce wrote: >>> On 2/1/2015 7:31 PM, Jatin Davey wrote: >>>> >>>> I ran your script and here is the output for it: >>>> >>>> Start of the Output*************************** >>>> [root@localhost bin]# lsi-raidinfo >>>> sh: /opt/MegaRAID/MegaCli/MegaCli64: No such file or directory >>>> -- Controllers -- >>> >>> as I said, you need to install the MegaCli software from LSI so you >>> can manage the raid card. >> I am using a server which has a Cisco 12G SAS Modular Raid Controller >> , So wondering if software from LSI would work on it. Please correct >> me if am wrong. > > >> [root@localhost ~]# lspci | grep RAID >> 05:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS-3 >> 3108 [Invader] (rev 02) > > thats a LSI Logic Megaraid 3108 chip. This is used on the LSI > 9361-8i and many other OEM rebranded cards. If cisco has their own > package of the megacli management software, then sure, use that. > Hi John I managed to install the software from LSI on my box and ran the script that you had provided and here is what i get from it. ************Output ****************** [root@localhost bin]# lsi-raidinfo -- Controllers -- -- ID | Model c0 | Cisco 12G SAS Modular Raid Controller -- Volumes -- -- ID | Type | Size | Status | InProgress volume c0u0 | RAID10 2x2 | 1816G | Optimal | None -- Disks -- -- Encl:Slot | vol-span-unit | Model | Status disk 252:1 | 0-0-0 | 9XG7TNQVST91000640NS CC03 | Online, Spun Up disk 252:2 | 0-0-1 | 9XG4M4X3ST91000640NS CC03 | Online, Spun Up disk 252:3 | 0-1-1 | 9XG4LY7JST91000640NS CC03 | Online, Spun Up disk 252:4 | 0-1-0 | 9XG51233ST91000640NS CC03 | Online, Spun Up End of Output ************************** Let me know if i need to change or configure anything else to make the I/O a bit faster than what it currently does. I cannot go in for using SSD's due to budget constraints. Need to make the best use of the SATA disks that i have currently. Thanks Jatin

6 9

Very slow disk I/O
by Jatin Davey 03 Feb '15

03 Feb '15

Hi Users I am using RHEL 6.5 on my server. From top command i can see that the processors in my server are spending a lot of time on wait for I/O. I can see high percentage in terms of 30-50% on "wa" time. Here is the df output about the disk space in my system: ********** [root@localhost images]# df Filesystem 1K-blocks Used Available Use% Mounted on /dev/sda1 1915071844 103227908 1714563936 6% / tmpfs 32931472 0 32931472 0% /dev/shm ********** Could someone point me on how to improve the disk I/O on my server and reduce the wait time on I/O. Thanks Jatin

8 15

NVidia on encrypted Q. RE: Intel Displayport on Centos 7
by Denniston, Todd A CIV NAVSURFWARCENDIV Crane 02 Feb '15

02 Feb '15

> -----Original Message----- > From: Lamar Owen [mailto:lowen@pari.edu] > Sent: Saturday, January 31, 2015 1:53 PM > To: CentOS mailing list > Subject: Re: [CentOS] Intel Displayport on Centos 7 > <SNIP> > the stock ATI drivers. I haven't tried with the fglrx driver; it seems > to be a bit of a problem child on C7 at the moment. For that matter, > the nVidia proprietary driver is a bit of a problem child if you have > any encrypted partitions like I do. <SNIP> I have not gotten to testing C7 (or RHEL7 for that matter) yet, but I expect to need the NVidia driver (from elrepo) on them and for the drives to be encrypted, SO ... What kinds of issues do the proprietary drivers and encrypted partitions together seem to be causing? Are your problems all related to: https://www.centos.org/forums/viewtopic.php?f=49&t=47460 http://elrepo.org/bugs/view.php?id=496 https://www.centos.org/forums/viewtopic.php?f=47&t=49304&start=10 Or are there other issues? Thanks for the feedback. Even when this disclaimer is not here: I am not a contracting officer. I do not have authority to make or modify the terms of any contract.

1 0

CentOS-announce Digest, Vol 120, Issue 1
by centos-announce-request＠centos.org 01 Feb '15

01 Feb '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2015:0106 CentOS 6 libvirt BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Sat, 31 Jan 2015 13:42:07 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2015:0106 CentOS 6 libvirt BugFix Update Message-ID: <20150131134207.GA14009(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2015:0106 Upstream details at : https://rhn.redhat.com/errata/RHBA-2015-0106.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: ea5d48d18878658b540b1f263cf5c6b5275816eef56592f2ad1ea81435a0856c libvirt-0.10.2-46.el6_6.3.i686.rpm c70aef109c73e5a2ea4a1aacd8f994ce082038b7bbf68b78e7463a5295edcf46 libvirt-client-0.10.2-46.el6_6.3.i686.rpm ae2a478f26b7556fb67a280eb9609e62d30bfbb103b691a8bdaff359fa82688f libvirt-devel-0.10.2-46.el6_6.3.i686.rpm e7426898e565a6d173aac3b2f1f22eb24aebbe865923d8d509ccba7fc9391d7a libvirt-python-0.10.2-46.el6_6.3.i686.rpm x86_64: 77ccd05d7ff093dcf14d1f57628df7912754178f02a613ea87ab905114806110 libvirt-0.10.2-46.el6_6.3.x86_64.rpm c70aef109c73e5a2ea4a1aacd8f994ce082038b7bbf68b78e7463a5295edcf46 libvirt-client-0.10.2-46.el6_6.3.i686.rpm 17bfed0bfd3305f1464fa7d145ff7b000f8c720108c2857e8c7799fea0624d54 libvirt-client-0.10.2-46.el6_6.3.x86_64.rpm ae2a478f26b7556fb67a280eb9609e62d30bfbb103b691a8bdaff359fa82688f libvirt-devel-0.10.2-46.el6_6.3.i686.rpm 6c412b887b82b69bbafde5d005c9417f2d256b54aa5a32994813d25fee75473a libvirt-devel-0.10.2-46.el6_6.3.x86_64.rpm 28897e103ff2f7dc7bba07ddde217df7958906df861d8f73e8228e15538d69ac libvirt-lock-sanlock-0.10.2-46.el6_6.3.x86_64.rpm f25e4b29c8ad46f97f6ae2a07db51d5f907d550b2285d5e7bef495e594edc558 libvirt-python-0.10.2-46.el6_6.3.x86_64.rpm Source: 2012ad82ddfcda7d4989f299888e1f6c58812680bfd033130d1c246690575507 libvirt-0.10.2-46.el6_6.3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 120, Issue 1 ***********************************************

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2015