Discuss June 2016

discuss@lists.centos.org

114 participants
99 discussions

UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 24 Jun '16

24 Jun '16

We received a notice from our pci-dss auditors respecting this: CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux. The NVD entry for which contains this note: CHANGE> [Cox changed vote from REVIEWING to NOOP] Cox> So I asked some kernel guys about this - it's not considered an issue. There are several other ways to identify Linux on the wire and people who care about this kind of thing rewrite their packets in various ways via firewall technology to trick the identifier programs. So, what packet mangling may be done in iptables to solve this without breaking udp transmission? I take it that we are talking about something in the prerouting chain but what kind of mangelling is safe? Is there an example somewhere? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

CPU Compatibility Question
by listmail 23 Jun '16

23 Jun '16

Hi All, Hopefully someone with broad overview of CentOS compatibility issues can comment on this: I am evaluating a Supermicro X10SLM motherboard with an Intel E3-1231 v3 CPU. Testing with boots from Live DVDs, the CentOS 6.x family is panicking at boot time. I have tried 6.8, 6.5, and 6.3, and each one panics at slightly different points, but they all seem to fail after udev starts up (or tries to). On the other hand, I was able to boot CentOS 7.0 1511 from the Live CD. According to the compatibility chart over here: https://access.redhat.com/support/policy/intel ...anything later than 6.3 (6.4 and up) should work with the E3-12xx v3 family of processors. But those are not the results I am seeing. Does anyone have experience or commentary on this compatibility issue? Thanks, --Bill

2 2

sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello -- We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP authentication. The ldap packages that are currently installed on the system are the following: python-sss 1.13.0-40.el7_2.4 python-sssdconfig 1.13.0-40.el7_2.4 sssd 1.13.0-40.el7_2.4 sssd-ad 1.13.0-40.el7_2.4 sssd-client 1.13.0-40.el7_2.4 sssd-common 1.13.0-40.el7_2.4 sssd-common-pac 1.13.0-40.el7_2.4 sssd-dbus 1.13.0-40.el7_2.4 sssd-ipa 1.13.0-40.el7_2.4 sssd-krb5 1.13.0-40.el7_2.4 sssd-krb5-common 1.13.0-40.el7_2.4 sssd-ldap 1.13.0-40.el7_2.4 sssd-libwbclient 1.13.0-40.el7_2.4 sssd-libwbclient-devel 1.13.0-40.el7_2.4 sssd-proxy 1.13.0-40.el7_2.4 sssd-tools 1.13.0-40.el7_2.4 I ran the following commands to set up LDAP/AD authentication: # ln -s /bin/bash /bin/PHSshell # ln -s /home /PHShome # authconfig --enablesssdauth --enablemkhomedir --enablesssd -update # chkconfig sssd on # service sssd restart Initially, I ran into problems because I had not created an sssd.conf file. Eventually I did create one, and its contents are the following: [<domain>.org] enumate = true cache_credentials = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.<domain>.org ldap_search_base = dc=<domain>,dc=org tls_reqcert = demand ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt If there are any additions or corrections that I need to make, please let me know. I reran the service sssd restart command, and the error message that I am seeing via journalctl -xe is the following: Unit sssd.service has begun starting up. Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the configuration database [5]: Input/output error. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process exited, code=exited status=4 Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel> -- -- Unit sssd.service has failed. -- -- The result is failed. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered failed state. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed. Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication Agent for unix-process:6369:52587318 (system bus name :1.2287, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Any ideas? The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the following changes to the nsswitch.conf file as suggested by another mailing-list member: Domain = <company>.org ... Method = nsswitch and I have restarted idmapd service. I checked the nsswitch.conf file, and references to sss are mentioned in the following lines: passwd: shadow: group: ... services: netgroup: ... automount: I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the changes to the nsswitch.conf file as suggested, and I have restarted idmapd service. I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

1 0

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello – Thank-you for your e-mail. I corrected the syntax in the file, and I have confirmed the permissions are correct: -rw-------. 1 root root 266 Jun 23 08:45 sssd.conf Unfortunately, the error condition and messages listed in my initial e-mail are still present. From: l(a)avc.su [mailto:l@avc.su] Sent: Thursday, June 23, 2016 8:34 AM To: CentOS mailing list; Kaplan, Andrew H. Subject: Re: [CentOS] sssd.conf file missing Hello Andrew. The sssd.conf should be owned by root:root, mode 0600. Also please note this line in your config: [<domain>.org] enumate = true it's enumerate, not enumate. 23.06.2016, 15:24, "Kaplan, Andrew H." <ahkaplan(a)partners.org<mailto:ahkaplan@partners.org>>: Hello -- We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP authentication. The ldap packages that are currently installed on the system are the following: python-sss 1.13.0-40.el7_2.4 python-sssdconfig 1.13.0-40.el7_2.4 sssd 1.13.0-40.el7_2.4 sssd-ad 1.13.0-40.el7_2.4 sssd-client 1.13.0-40.el7_2.4 sssd-common 1.13.0-40.el7_2.4 sssd-common-pac 1.13.0-40.el7_2.4 sssd-dbus 1.13.0-40.el7_2.4 sssd-ipa 1.13.0-40.el7_2.4 sssd-krb5 1.13.0-40.el7_2.4 sssd-krb5-common 1.13.0-40.el7_2.4 sssd-ldap 1.13.0-40.el7_2.4 sssd-libwbclient 1.13.0-40.el7_2.4 sssd-libwbclient-devel 1.13.0-40.el7_2.4 sssd-proxy 1.13.0-40.el7_2.4 sssd-tools 1.13.0-40.el7_2.4 I ran the following commands to set up LDAP/AD authentication: # ln -s /bin/bash /bin/PHSshell # ln -s /home /PHShome # authconfig --enablesssdauth --enablemkhomedir --enablesssd -update # chkconfig sssd on # service sssd restart Initially, I ran into problems because I had not created an sssd.conf file. Eventually I did create one, and its contents are the following: [<domain>.org] enumate = true cache_credentials = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.<domain>.org ldap_search_base = dc=<domain>,dc=org tls_reqcert = demand ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt If there are any additions or corrections that I need to make, please let me know. I reran the service sssd restart command, and the error message that I am seeing via journalctl -xe is the following: Unit sssd.service has begun starting up. Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the configuration database [5]: Input/output error. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process exited, code=exited status=4 Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel> -- -- Unit sssd.service has failed. -- -- The result is failed. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered failed state. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed. Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication Agent for unix-process:6369:52587318 (system bus name :1.2287, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Any ideas? The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. _______________________________________________ CentOS mailing list CentOS(a)centos.org<mailto:CentOS@centos.org> https://lists.centos.org/mailman/listinfo/centos

3 6

Ovirt migration
by Andrew Dent 23 Jun '16

23 Jun '16

Hi We have a Single box running Ovirt 3.5.6.2-1 + CentOS7. The Engine, VDSM Host and the Storage is all on the Single box, which contains 2 * RAID1 arrays. We are looking to purchase a second box, and I'm wondering if someone can please help me to understand of how best to migrate to a HA environment using both boxes. We do have some additional NFS storage on the network that we can temporarily move VMs to. Is it possible to migrate our current Ovirt setup to be HA using Gluster, or would we need to start again by exporting all VMs, wipe box one and reinstall CentOS & Ovirt, then install CentOS and Ovirt on box two. I'd like to move the Engine to be hosted in a VM as well. Can we do HA without Gluster? Pros/Cons.... Regards Andrew Dent

2 1

KVM HA
by Tom Robinson 23 Jun '16

23 Jun '16

Hi, I have two KVM hosts (CentOS 7) and would like them to operate as High Availability servers, automatically migrating guests when one of the hosts goes down. My question is: Is this even possible? All the documentation for HA that I've found appears to not do this. Am I missing something? My configuration so fare includes: * SAN Storage Volumes for raw device mappings for guest vms (single volume per guest). * multipathing of iSCSI and Infiniband paths to raw devices * live migration of guests works * a cluster configuration (pcs, corosync, pacemaker) Currently when I migrate a guest, I can all too easily start it up on both hosts! There must be some way to fence these off but I'm just not sure how to do this. Any help is appreciated. Kind regards, Tom -- Tom Robinson IT Manager/System Administrator MoTeC Pty Ltd 121 Merrindale Drive Croydon South 3136 Victoria Australia T: +61 3 9761 5050 F: +61 3 9761 5051 E: tom.robinson(a)motec.com.au

9 23

Install C7 VM on C6 Host
by Mark LaPierre 23 Jun '16

23 Jun '16

Hey all, Before I waste myself a bunch of time trying the impossible I figured I would ask if I can install an instance of C7 in a KVM based VM on a C6 host. -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

4 4

Centos 7 boot hanging unless systemd.log_target=console is used
by James Hartig 22 Jun '16

22 Jun '16

I have multiple VMs that are hanging on boot. Sometimes they'll boot fine after 5 mins and other times it'll take over an hour. The problem seems to be related to journald but I'd like to figure out how I can get more information. The VMs are running CentOS 7.1.1503. systemd and journald are both version 208. We are reluctant to upgrade to the newest CentOS because we found that journal-gatewayd is broken on boxes that have been upgraded. If I add the kernel parameter systemd.log_target=console then they boot up fine without hanging at all. I can't seem to get into the debug shell (Ctrl+Alt+F9) while the system is hanging after enabling debug-shell. Adding systemd.log_level=debug without systemd.log_target=console seems to make the problem worse and causes a hang of over an hour. I tried deleting /var/log/journal but that didn't help and I ran fsck on the root drive with no errors. I also tried masking systemd-udev-settle but that didn't help either. While the system is hanging the last console output is "Welcome to CentOS Linux 7 (Core)!". Here's the output from dmesg without "quiet" kernel parameter and without "systemd.log_level=debug": http://gobin.io/zScc systemd-analyze blame doesn't seem to help either (top 3): 10.451s nginx.service 7.149s network.service 2.178s etcd.service What else can I do to debug this? Thanks!

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2016