Discuss March 2021

discuss@lists.centos.org

73 participants
53 discussions

MATE 1.20 test build for CentOS 7 available
by Greg Bailey 14 Oct '21

14 Oct '21

Hi everyone, There's been discussions in the past about updating MATE RPMs in EPEL-7: https://bugzilla.redhat.com/show_bug.cgi?id=1436260 https://lists.centos.org/pipermail/centos/2019-August/173154.html (and lots of others...) As a proof-of-concept, I've written some scripts that clone specific commits from the Fedora master branches, and then runs a tool to re-apply RPM scriptlets that are required by EL7 but removed from the Fedora .spec files. The scripts are available at: https://github.com/gebailey/mate-rpms/tree/master/1.20/el7 There's also instructions there if you want to try upgrading to MATE 1.20 w/o rebuilding them yourself. If these packages work for others, perhaps we can revisit the idea of updating the epel7 branches of the Fedora git repos and submitting an official update. There's nothing here (yet) about building MATE 1.22 (which might require a newer gcc for EL7), or building anything on CentOS 8, but thought the CentOS 7 users might find this helpful. -Greg

6 17

Transition test report going from CentOS8 to Debian 10.
by Lamar Owen 06 Aug '21

06 Aug '21

Sorry for the length.... I'm posting this here since this particular transition has been mentioned on-list as one possibility for a path forward for current CentOS Linux users. AlmaLinux, the Developer Subscription RHEL, Rocky, CentOS Stream, Springdale, upgrading to full RHEL; all these are also possibilities, too, and all have different strengths and weaknesses. The transition to Debian has a lot of strengths, including a long track-record of support (even if the support time for a particular release is shorter), a fully-open development model with no 'corporate overlord' that I know of, a large set of supported packages, and a huge community of developers and users. For the CentOS user the main weakness is having to learn a few areas of difference in the way the system is setup and maintained; of course, if a ten-year 'stable' timeframe is really that important to you the lack of that is also a weakness. So, last week I transitioned, as a test of sorts, my working CentOS 8 main laptop to Debian 10. I kept a complete backup of the C8 install should I wish to go back to it, and installed Buster to a new mSATA SSD, but ported the two SATA drives (Dell Precision M6700 - has an mSATA slot plus two SATA bays) straight over after making full backups. I posted a pretty complete rundown on the scientific linux users mailing list, so I won't recap it all here. The bottom line was the the transition was not any more difficult, really, than moving from CentOS 7 to CentOS 8. The software versions in Buster are pretty close to what is in CentOS 8, although I have yet to need any third-party repository (PPA) for anything I've needed to install. All the packages I have worked with so far have worked fine with a little bit of massaging. These include commercial (and costly) software such as Harrison Consoles' Mixbus32C, Qoppa's PDFStudio2019 Professional, and others. So if you were to decide that this is the route for you to take, it does work and I found it to be not nearly as hard as I had thought it might be. If you install GNOME 3 you get GNOME 3; it feels pretty much the same as a non-Classic CentOS GNOME 3, just with a different set of extensions installed by default. That's on the workstation. On the server side, I'm evaluating Proxmox for the virtualization solution, and so far I'm finding it to be a pretty easy migration. I'm using the 'non-subscription' repository, so this is a no-cost option. Even getting the box registered to our EMC Clariion SAN was relatively easy; EMC provides the Unisphere Server Utility for Linux x64 in RPM form; the latest I have is "ServerUtil-Linux-64-x86-en_US-1.0.55.1.0044-1.x86_64.rpm" (which is fairly old, but I did say Clariion arrays, so they're pretty old, too). Debian has provided the 'alien' tool for some time; after installing alien, a simple 'alien -i ServerUtil-Linux-64-x86-en_US-1.0.55.1.0044-1.x86_64.rpm' installed the EMC RPM in the correct place. Proxmox already included everything that serverutilcli requires; on a plain Buster install I had to install dm-multipath and the device mapper libraries and tools before serverutilcli would find the arrays; but it ran just like it did on CentOS 8 (and 7). I haven't decided whether to stay on Debian or not; too early to tell. I have time to test and evaluate. My CentOS 7 installs aren't goin anywhere, though, at least until late 2023. And I've registered for a Developer subscription of RHEL so that I can properly evaluate that option, too. This is the beauty of open source: we have OPTIONS.

11 23

What to do when a selinux policy doesn't work?
by hw 14 Apr '21

14 Apr '21

Hi, I'm getting log file entries about ejabberd not being able to remove files that were uploaded by client through the file upload facility of XMPP. With the help of audit2allow, I have already created and installed some selinux modules to solve such issues, and still files can't be expired. So I used grep '/srv/data/ejabberd' /var/log/audit/audit.log | audit2allow -w to find out what might cause this, and the answer is: type=AVC msg=audit(1606302910.314:2905): avc: denied { open } for pid=18687 comm="8_dirty_io_sche" path="/srv/data/ejabberd/[...]" dev="md100" ino=166 scontext=system_u:system_r:ejabberd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file permissive=1 Was caused by: Unknown - would be allowed by active policy Possible mismatch between this policy and the one under which the audit message was generated. Possible mismatch between current in-memory boolean settings vs. permanent ones. I have reloaded the policies with 'semodule -R', and that didn't change anything. The files in question seem to have the correct attributes like: ls -laZ /srv/data/ejabberd/[...] -rw-r--r--. 1 ejabberd ejabberd system_u:object_r:var_t:s0 1384362 Nov 25 12:15 /srv/data/ejabberd/[...] Ejabberd is supposed to expire files when they are older than desired, and selinux prevents it. How can I solve this problem other than by disabling selinux or by deleting the files manually?

2 3

How to find out what's eating the bandwidth
by Frank Cox 14 Apr '21

14 Apr '21

Is there a program that will tell me what's eating the bandwidth on a lan? I'm thinking of something that would tell me that a.b.c.d is using so many mbps and a.b.c.e is using this many and so on. Or can just-another-computer-on-the-network actually see that sort of information? I don't know enough about the low level nuts and bolts of networking to know if it has that kind of access. I'm really just interested in volume of traffic per attached device rather than specific origin/destination information if that's easier to obtain. This way if something is eating the network I can find out what it is without having to start unplugging cables and so on to find out when it stops. -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

5 6

"System error" when trying to logon via SSH to CentOS 8 joined to AD
by Konstantin Boyandin 11 Apr '21

11 Apr '21

Hello, I joined a CentOS 8 box to an AD, using the below document as general guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/ht… (section 14.1) A problem: after I tried to log on via SSH (as an AD user) to the box, the journalctl gets the below records: March 23 12:41:01 sandbox.lan sshd[2262]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.10.0.55 user=username March 23 12:41:01 sandbox.lan sshd[2262]: pam_sss(sshd:account): Access denied for user username: 4 (System error) March 23 12:41:01 sandbox.lan sshd[2262]: Failed password for username from 10.10.0.55 port 57610 ssh2 March 23 12:41:01 sandbox.lan sshd[2262]: fatal: Access denied for user username by PAM account configuration [preauth] Quick and dirty fix: When I comment a line in /etc/pam.d/password-auth (the one commented below), error goes away: ======= /etc/pam.d/password-auth below auth required pam_env.so auth required pam_faildelay.so delay=2000000 auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth [default=1 ignore=ignore success=ok] pam_localuser.so auth sufficient pam_unix.so nullok try_first_pass auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_usertype.so issystem #account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so ======= /etc/pam.d/password-auth above If I understand correctly, the commented line means "account is invalid by default; if found in SSSD, it's good; if not found - ignore and proceed". Commenting it is not a good idea, but I can't figure out what's wrong (according to first line from jornalctl authentication *is* passed normally). Additional data (AD domain in this example is EXAMPLE.COM): $ realm list realm list example.com type: kerberos realm-name: EXAMPLE.COM domain-name: example.com configured: kerberos-member server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools login-formats: %U login-policy: allow-realm-logins $ cat /etc/sssd/sssd.conf [sssd] domains = example.com config_file_version = 2 services = nss, pam, ssh debug_level = 9 [domain/example.com] ad_domain = example.com krb5_realm = EXAMPLE.COM realmd_tags = manages-system joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_sasl_authid = SANDBOX$ ldap_id_mapping = True use_fully_qualified_names = False ad_gpo_ignore_unreadable = True fallback_homedir = /home/%u access_provider = ad debug_level = 9 === end of /etc/sssd/sssd.conf $ cat /etc/krb5.conf includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake_preauth_groups = edwards25519 default_ccache_name = KEYRING:persistent:%{uid} default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true [realms] EXAMPLE.COM = { kdc = dc.example.com kdc = bdc.example.com admin_server = dc.example.com } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM === end of /etc/krb5.conf GPO cache exists and is properly owned: ls -al /var/lib/sss/gpo_cache/example.com/ total 0 drwx------. 3 sssd sssd 22 Mar 22 14:52 . drwxr-xr-x. 3 sssd sssd 24 Mar 22 14:52 .. drwx------. 3 sssd sssd 52 Mar 22 14:52 Policies I would appreciate pieces of advice on how to fix authentication issue without commenting out the pam.d configuration file line. Thank you. Sincerely, Konstantin

5 6

Can't upgrade sssd-*
by Warren Young 09 Apr '21

09 Apr '21

Is anyone else getting this on dnf upgrade? [MIRROR] sssd-proxy-2.3.0-9.el8.x86_64.rpm: Interrupted by header callback: Server reports Content-Length: 9937 but expected size is: 143980 [MIRROR] sssd-proxy-2.3.0-9.el8.x86_64.rpm: Interrupted by header callback: Server reports Content-Length: 9937 but expected size is: 143980 [MIRROR] sssd-proxy-2.3.0-9.el8.x86_64.rpm: Interrupted by header callback: Server reports Content-Length: 9937 but expected size is: 143980 [MIRROR] sssd-proxy-2.3.0-9.el8.x86_64.rpm: Interrupted by header callback: Server reports Content-Length: 9937 but expected size is: 143980 I can install almost everything else in the latest batch of updates but not any of sssd-* or anything directly dependent upon it. (Basically, gvfs, samba, and assorted libraries built atop sssd.)

5 10

Prevent Anaconda from switching root and swap partition
by Nicolas Kovacs 07 Apr '21

07 Apr '21

Hi, More often than not, when installing CentOS, I choose manual partitioning and then apply the KISS principle, with a very simple partitioning scheme that looks more or less like this: * /boot partition: 500 MB, ext2 * swap partition: equivalent to amount of RAM * root partition: available space, ext4 Now when I do this, Anaconda insists on switching my swap and root partitions, so instead of this: * /dev/sda1: boot partition * /dev/sda2: swap partition * /dev/sda3: root partition ... I get this: * /dev/sda1: boot partition * /dev/sda2: root partition * /dev/sda3: swap partition Up until now this hasn't bothered me much. But for my needs right now it does, because I need my root partition to be at the end of the disk, so it can be expanded later on. Anyone knows how I can prevent Anaconda from switching my root and swap partitions? What I'm doing right now is switching to a text console with Ctrl-Alt-F5, manually partition using fdisk, switch back to Anaconda and then rescan the disk, but it's quite a PITA. These are the moments where I miss the good old bone-headed Slackware installer. :o) Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32 Mob. : 06 51 80 12 12

6 5

RHEL/Centos 8 power off issue
by R C 05 Apr '21

05 Apr '21

Hello, I have a laptop, in a docking station. When running RHEL/Centos 7 I could shut it down and power it off by using 'shutdown -h now' In did a new install of Centos 8 (and also RHEL 8) and when I do a "shutdown -h now" it just reboots (behaves the same as if I'd do a reboot). Is that a known issue? thanks, Ron

3 5

KVM vs. incremental remote backups
by Nicolas Kovacs 04 Apr '21

04 Apr '21

Hi, Up until recently I've hosted all my stuff (web & mail) on a handful of bare metal servers. Web applications (WordPress, OwnCloud, Dolibarr, GEPI, Roundcube) as well as mail and a few other things were hosted mostly on one big machine. Backups for this setup were done using Rsnapshot, a nifty utility that combines Rsync over SSH and hard links to make incremental backups. This approach has become problematic, for several reasons. First, web applications have increasingly specific and sometimes mutually exclusive requirements. And second, last month I had a server crash, and even though I had backups for everything, this meant quite some offline time. So I've opted to go for KVM-based solutions, with everything split up over a series of KVM guests. I wrapped my head around KVM, played around with it (a lot) and now I'm more or less ready to go. One detail is nagging me though: backups. Let's say I have one VM that handles only DNS (base installation + BIND) and one other VM that handles mail (base installation + Postfix + Dovecot). Under the hood that's two QCOW2 images stored in /var/lib/libvirt/images. With the old "bare metal" approach I could perform remote backups using Rsync, so only the difference between two backups would get transferred over the network. Now with KVM images it looks like every day I have to transfer the whole image again. As soon as some images have lots of data on them (say, 100 GB for a small OwnCloud server), this quickly becomes unmanageable. I googled around quite some time for "KVM backup best practices" and was a bit puzzled to find many folks asking the same question and no real answer, at least not without having to jump through burning loops. Any suggestions ? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32 Mob. : 06 51 80 12 12

8 11

Migrating to nvme and expand
by Jerry Geis 02 Apr '21

02 Apr '21

I have older SATA disks (2 of them size 2T) in a software raid config running CentOS 7. /dev/md127 is / and xfs /dev/sda2 is swap /dev/md126 is /home and xfs I desire to get a new (single) NVME 4T disk. What is the correct way to copy the software raid to a single "new" NVME disk ? then expand the /home file system to All the remaining space? Thanks, Jerry

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2021