Discuss June 2021

discuss@lists.centos.org

34 participants
28 discussions

MATE 1.20 test build for CentOS 7 available
by Greg Bailey 14 Oct '21

14 Oct '21

Hi everyone, There's been discussions in the past about updating MATE RPMs in EPEL-7: https://bugzilla.redhat.com/show_bug.cgi?id=1436260 https://lists.centos.org/pipermail/centos/2019-August/173154.html (and lots of others...) As a proof-of-concept, I've written some scripts that clone specific commits from the Fedora master branches, and then runs a tool to re-apply RPM scriptlets that are required by EL7 but removed from the Fedora .spec files. The scripts are available at: https://github.com/gebailey/mate-rpms/tree/master/1.20/el7 There's also instructions there if you want to try upgrading to MATE 1.20 w/o rebuilding them yourself. If these packages work for others, perhaps we can revisit the idea of updating the epel7 branches of the Fedora git repos and submitting an official update. There's nothing here (yet) about building MATE 1.22 (which might require a newer gcc for EL7), or building anything on CentOS 8, but thought the CentOS 7 users might find this helpful. -Greg

6 17

Transition test report going from CentOS8 to Debian 10.
by Lamar Owen 06 Aug '21

06 Aug '21

Sorry for the length.... I'm posting this here since this particular transition has been mentioned on-list as one possibility for a path forward for current CentOS Linux users. AlmaLinux, the Developer Subscription RHEL, Rocky, CentOS Stream, Springdale, upgrading to full RHEL; all these are also possibilities, too, and all have different strengths and weaknesses. The transition to Debian has a lot of strengths, including a long track-record of support (even if the support time for a particular release is shorter), a fully-open development model with no 'corporate overlord' that I know of, a large set of supported packages, and a huge community of developers and users. For the CentOS user the main weakness is having to learn a few areas of difference in the way the system is setup and maintained; of course, if a ten-year 'stable' timeframe is really that important to you the lack of that is also a weakness. So, last week I transitioned, as a test of sorts, my working CentOS 8 main laptop to Debian 10. I kept a complete backup of the C8 install should I wish to go back to it, and installed Buster to a new mSATA SSD, but ported the two SATA drives (Dell Precision M6700 - has an mSATA slot plus two SATA bays) straight over after making full backups. I posted a pretty complete rundown on the scientific linux users mailing list, so I won't recap it all here. The bottom line was the the transition was not any more difficult, really, than moving from CentOS 7 to CentOS 8. The software versions in Buster are pretty close to what is in CentOS 8, although I have yet to need any third-party repository (PPA) for anything I've needed to install. All the packages I have worked with so far have worked fine with a little bit of massaging. These include commercial (and costly) software such as Harrison Consoles' Mixbus32C, Qoppa's PDFStudio2019 Professional, and others. So if you were to decide that this is the route for you to take, it does work and I found it to be not nearly as hard as I had thought it might be. If you install GNOME 3 you get GNOME 3; it feels pretty much the same as a non-Classic CentOS GNOME 3, just with a different set of extensions installed by default. That's on the workstation. On the server side, I'm evaluating Proxmox for the virtualization solution, and so far I'm finding it to be a pretty easy migration. I'm using the 'non-subscription' repository, so this is a no-cost option. Even getting the box registered to our EMC Clariion SAN was relatively easy; EMC provides the Unisphere Server Utility for Linux x64 in RPM form; the latest I have is "ServerUtil-Linux-64-x86-en_US-1.0.55.1.0044-1.x86_64.rpm" (which is fairly old, but I did say Clariion arrays, so they're pretty old, too). Debian has provided the 'alien' tool for some time; after installing alien, a simple 'alien -i ServerUtil-Linux-64-x86-en_US-1.0.55.1.0044-1.x86_64.rpm' installed the EMC RPM in the correct place. Proxmox already included everything that serverutilcli requires; on a plain Buster install I had to install dm-multipath and the device mapper libraries and tools before serverutilcli would find the arrays; but it ran just like it did on CentOS 8 (and 7). I haven't decided whether to stay on Debian or not; too early to tell. I have time to test and evaluate. My CentOS 7 installs aren't goin anywhere, though, at least until late 2023. And I've registered for a Developer subscription of RHEL so that I can properly evaluate that option, too. This is the beauty of open source: we have OPTIONS.

11 23

Centos versions in the future?
by Carlos Oliva 09 Jul '21

09 Jul '21

Will there be newer versions of Centos? We have heard rumors that version 8 will be the last one. We are concerned with using an OS that will loose support in the future. Thank you.

29 107

Centos 8 crypto-policy to get SSL Labs A rating
by Adrian Jenzer 05 Jul '21

05 Jul '21

Dear Community I try to get an SSL Labs A rating for my CentOS8 Apache-server. I'am sure it has to do with my lack of understanding the crypto-policies configuration, can anybody give me an advice where i am wrong? My understanding is that the configuration in the pmod-file will override the ssl.conf values if PROFILE=SYSTEM is active. *** # Current runtime policy dump # DEFAULT:HTTPS arbitrary_dh_groups = 1 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CTR AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CTR AES-128-CBC group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 SHA2-224 SHA1 ike_protocol = IKEv2 key_exchange = ECDHE DHE DHE-RSA DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS mac = AEAD HMAC-SHA2-256 HMAC-SHA1 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 min_dh_size = 2048 min_dsa_size = 2048 min_dtls_version = DTLS1.2 min_rsa_size = 2048 min_tls_version = TLS1.2 protocol = TLS1.3 TLS1.2 DTLS1.2 sha1_in_certs = 1 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 ECDSA-SHA3-384 ECDSA-SHA2-384 ECDSA-SHA3-512 ECDSA-SHA2-512 EDDSA-ED25519 EDDSA-ED448 RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 RSA-SHA3-256 RSA-SHA2-256 RSA-SHA3-384 RSA-$ ssh_certs = 1 ssh_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM AES-256-CTR AES-256-CBC CAMELLIA-256-CBC AES-128-GCM AES-128-CCM CAMELLIA-128-GCM AES-128-CTR AES-128-CBC CAMELLIA-128-CBC ssh_etm = 1 ssh_group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 tls_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CBC *** cat /etc/crypto-policies/policies/modules/HTTPS.pmod cipher = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 *** Part of /etc/httpd/conf.d/ssl.conf *** # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on # List the protocol versions which clients are allowed to connect with. # The OpenSSL system profile is used by default. See # update-crypto-policies(8) for more details. #SSLProtocol all -SSLv3 #SSLProxyProtocol all -SSLv3 SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2 # User agents such as web browsers are not configured for the user's # own preference of either security or performance, therefore this # must be the prerogative of the web server administrator who manages # cpu load versus confidentiality, so enforce the server's cipher order. SSLHonorCipherOrder on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. # The OpenSSL system profile is configured by default. See # update-crypto-policies(8) for more details. SSLCipherSuite PROFILE=SYSTEM #SSLProxyCipherSuite PROFILE=SYSTEM #SSLCipherSuite HIGH:!aNULL:!MD5 #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256 Thanks for any hint! Adrian

3 4

Tracking down application sending mail in CentOS 7
by H 25 Jun '21

25 Jun '21

I am running CentOS 7 on a server where I have only recently installed postfix. Postfix is configured to only send outgoing mail via an external relay server and test mails created on my server are indeed delivered via this external server. However, I must have some other application on the server generating mails where the recipient's address is incorrect resulting in being rejected by the external relay server. Viewing /var/log/maillog I get some information but cannot see which application generated that e-mail, nor the content of it which would likely allow me to see where it comes from. Can anyone suggest how to track down the app so I can reconfigure the mail address? Thanks.

4 6

Help with default shell
by Hooton, Gerard 24 Jun '21

24 Jun '21

Hi all, I have a computer with CentOS 7. The users are authenticated using OpenLDAP. On LDAP the default shell is csh. When ssh to login it works, i.e. $SHELL = /bin/csh Also, when using xrdp it works. However, a login from the keyboard and screen attached computer we get $SHELL = /bin/bash Any help is welcome. Regards, Ger. -- Gerard Hooton. Senior Technical Officer School of Engineering. University College Cork. College Road. Cork. Ireland.

4 6

libvoikko-devel not available on Centos8?
by Myyrä, Timo 23 Jun '21

23 Jun '21

Hi, Any ideas why CentOS 8 doesn't include the libvoikko-devel package? The libvoikko package is present but it doesn't have the development headers in it. The Fedora RPM SPEC seems to have separate package for the headers: https://src.fedoraproject.org/rpms/libvoikko/blob/rawhide/f/libvoikko.spec I'm looking at using a postgresql extension using libvoikko but it needs those header files. -- Timo Myyrä Palvelinylläpitäjä Puhelin +358 40 860 2103 Käyntiosoite: Verkkosaarenkatu 5, HELSINKI Postiosoite: PL 510, 00043 NORDIC MORNING Edita Prima Oy Edita Prima tuottaa automatisoituja prosesseja asiakasviestinnän hallintaan. Autamme yrityksiä poistamaan tehottomuutta ja parantamaan asiakaskokemusta. www.editaprima.fi

2 1

Security Updates not properly flagged
by Doczkal, Thomas 22 Jun '21

22 Jun '21

Hi, I assumed that it's possible to install security updates with "yum --security update". On the centos-announce mailinglist and I have received several security updates recently. Most are not relevant for us but glib2 and kernel are two we would like to address without updating the whole system. Unfortunately both glib2 and kernel updates are filtered while running yum --security update This is the output: --> glib2-2.56.1-9.el7_9.x86_64 from updates removed (updateinfo) --> kernel-3.10.0-1160.31.1.el7.x86_64 from updates removed (updateinfo) There are probably more security updates which should be installed by yum --security but those are the packages I am most interested in. Please change as necessary to allow yum --security to work. Many thanks. Best Regards, Thomas -- Thomas Doczkal Snr System Engineer Socionext Europe GmbH pittlerstrasse 47 63225 langen, germany tel +49-6103-3745-386 mobile +49-174-9226082 fax +49-6103-3745-122 thomas.doczkal(a)socionext.com www.eu.socionext.com www.socionext.com Geschaeftsfuehrer/Managing Director: Toshihiko Tanaka, Dirk Weinsziehr, Koichi Otsuki, Yutaka Yoneyama Sitz/Seat: Langen, Hessen; Registergericht/Commercial Register: Offenbach/Main HRB 48005 This e-mail and any attachment contains information which is private and confidential and is intended for the addressee only. If you are not an addressee, you are not authorized to read, copy or use the e-mail or any attachment. If you have received this e-mail in error, please notify the sender by return e-mail and then delete it.

6 7

An error occurred while processing your request.
by Kaushal Shriyan 22 Jun '21

22 Jun '21

Hi, I am facing the below issue while hitting https://repo.ius.io/7/src/packages/p/ An error occurred while processing your request. Reference #30.d5961160.1624319418.82c229 Please comment. Thanks in advance. Best Regards, Kaushal

2 2

EL8: openldap-servers migration to 389
by Leon Fauster 21 Jun '21

21 Jun '21

Hey all, in preparation to migrate an EL7 server I noticed that the openldap-servers package is not shipped in EL8 anymore. Is it possible to operate 389-ds as standalone ldap server? I am asking this for the context of CentOS Linux because I read somewhere that 389-ds is mainly used for RHDS only and unsure now about the possibilities to substitute openldap-servers/slapd ... -- Thanks Leon

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2021