Discuss December 2017

discuss@lists.centos.org

82 participants
59 discussions

yum files in /tmp
by Jerry Geis 07 Dec '17

07 Dec '17

I am getting /tmp/yum_save_tx.2017-12..... files in /tmp one every hour. What process is making these files ??? I have stopped PackageKit so its not running. I am running CentOS 7.4. With GNOME desktop. Thanks Jerry

4 5

Linux IO Performance Monitor
by Ali Mumcu 06 Dec '17

06 Dec '17

Hello Friends, I wanna to ask how to learn disk (read,write) latency on linux server I use "iostat -kx 5" command to learn latency. But i cant understand which field show latency, svctm or iowait ? And if value svctm is gerater than 15 ms can we say there is a slowly io performance ? And i wanna to learn can we list io latency and utilization for per process? Thanks.

2 1

Migrating From CentOS-6 To CentOS-7
by Eugene Poole 05 Dec '17

05 Dec '17

I asked this in Vol 154, Issue 29: I've a system that has been running CentOS 6 64-bit for almost 4-years and I want to start the move to CentOS 7 64-bit. I run software RAID-1 with LVM everywhere except /boot which is a standard partition RAID-1. There are 2 areas that concern me greatly about this migration: 1. How do I duplicate my current grub configuration file that supports a failure of /dev/sda to grub2? 2. How do I install CentOS 7 but use my existing hard drive layout so I only format specific OS file systems. My drive layout goes back to the original proposed FHS layout. The separate partitions related to the operating system are: /boot 1GB (standard boot as defined in fstab is /dev/md0) The following file systems are all defined in volume group vg_jpdopsys (size is 64 GB) / (root) 6GB /home 4GB /opt 4GB /tmp 2GB /usr 12GB /usr/local 2GB /var 8GB The following file system is defined in volume group vg_jpdswap (size is 24 GB) swap 16GB Plus many other file system dedicated to specific applications and data all using logical volume management. When I moved from CentOS 5 to CentOS 6 all of the OS partitions were formatted except /home. All went extremely well then. But I don't see a way to do that with CentOS 7 retaining the existing disk configuration. Is there some detailed installation instructions showing some advanced methods? TIA Gene If you saw the original post you will see that I did clean it up a bit. I'm starting this move now understanding that I have until 2020 to do it. Any suggestions? TIA Gene -- Eugene Poole Woodstock, Georgia

1 0

Run as root w/o terminal/gksu-polkit uses 100 % CPU
by Toralf Lund 05 Dec '17

05 Dec '17

Hi, On CentOS 7, what's the best way to start a GUI program as root without a terminal? I mean, from a launcher or similar where you can't provide terminal input to "sudo". I'm talking about applications that aren't configured to switch to root out-of-the box, of course. I just tried gksu-polkit from EPEL, and it kind of did the job but: 1. It consumed *a lot* of resources - CPU usage was reported at a constant 100 %, more or less. 2. The process did not go away after I closed the application. Which means it's practically unusable, unless someone can provide a way to fix these problems. Thanks, - Toralf

1 0

Re: [CentOS] Broadcom BCM4360
by galtsev＠kicp.uchicago.edu 05 Dec '17

05 Dec '17

On Mon, December 4, 2017 1:40 am, Alice Wonder wrote: > On 12/03/2017 11:10 PM, Phil Perry wrote: >> On 04/12/17 00:38, John R Pierce wrote: >>> On 12/3/2017 4:22 PM, Gregory P. Ennis wrote: >>>> I have not been able to get it to work Centos 7.4 machine. Some of >>>> the >>>> centos user posts had indicated the nux repsitory had a Centos 7 >>>> kmod- >>>> wl, but it is not present when I tried to search or or install it at >>>> this time. >>> >>> this looks potentionally helpful >>> >>> http://elrepo.org/tiki/wl-kmod >>> >>> it appears those are closed source drivers with funky licenses, so >>> they can't just be redistributed without assumption of liability. >>> >>> >> >> Correct, elrepo isn't able to freely redistribute the drivers due >> Broadcom's licensing, but does provide instructions and a SRPM (minus >> tarball) for you to build yourself. Every time I encounter big enough trouble about some chipset to have to learn a bit about its internals, I usually learn about its engineering flaw. BCM43xx has the following one: the chip internally is 32 bit, though it sits on 64 bit bus. (Take that with a grain of salt, it's been long time since I looked into that crap). Once I discover the flaw, I add particular hardware in my black list and do my best to not buy anything containing it. Broadcom as a whole is not in my black list, they have great hardware, but their BCM43XX is, even if they corrected their design flaws since. I would replace that if possible (Intel would be great candidate), or use USB adapters others suggest. Just my $0.02 Valeri > > That's what I have to do, and it can sometimes be a PITA because a > kernel update can break it and you have to build it again. > > With major updates (like 7.3 to 7.4) you sometimes have to download a > new nosrc rpm. > >> >> Alternatively, for $8 you can purchase an adaptor that is natively >> supported and will work out of the box: >> >> https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Supports/dp/B003M… >> >> >> https://www.newegg.com/Product/Product.aspx?Item=N82E16833315091&cm_re=edim… >> >> >> The above adaptor is based on the Realtek RTL8188CUS chipset and uses >> the rtl8192cu kernel driver. > > At some point I will be replacing mine, but with a low-profile PCI-E > card. I've had bad luck with USB wifi adapters, sometimes for example > they lose connection when a microwave is turned on and when I was > visiting my parents, had one that lost connection whenever the AC unit > kicked on. > > My best wifi experience in Linux has been with my T series thinkpad, it > uses some kind of Intel wireless chipset that is in the kernel. > > I'm going to be looking for a low profile Intel PCI-E card, but for now > my broadcom PCI-E actually works quite well - with the exception of > needing to rebuild every now and then (last time was 7.3 to 7.4 update) > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos > ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

3 2

problem with cloud-init-0.7.9-9.el7.centos.2.x86_64 setting up puppet.conf
by ybaumy＠lost-frequencies.cloud 04 Dec '17

04 Dec '17

When running cloud-init im getting the following error Cloud-init v. 0.7.9 running 'modules:config' at Mon, 04 Dec 2017 18:07:26 +0000. Up 2597.52 seconds. Loaded plugins: fastestmirror, product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. Loading mirror speeds from cached hostfile * base: mirror.yannic-bonenberger.com * extras: mirror.yannic-bonenberger.com * updates: centos.bio.lmu.de Package puppet-agent-1.10.9-1.el7.x86_64 already installed and latest version Nothing to do 2017-12-04 18:07:27,102 - util.py[WARNING]: Running module puppet (<module 'cloudinit.config.cc_puppet' from '/usr/lib/python2.7/site-packages/cloudinit/config/cc_puppet.pyc'>) failed This is from /var/log/cloud-init.log ------------------------- 2017-12-04 18:07:26,579 - stages.py[DEBUG]: Running module puppet (<module 'cloudinit.config.cc_puppet' from '/usr/lib/python2.7/site-packages/cloudinit/config/cc_puppet.pyc'>) with frequency once-per-instance 2017-12-04 18:07:26,579 - handlers.py[DEBUG]: start: modules-config/config-puppet: running config-puppet with frequency once-per-instance 2017-12-04 18:07:26,579 - util.py[DEBUG]: Writing to /var/lib/cloud/instances/nocloud/sem/config_puppet - wb: [420] 20 bytes 2017-12-04 18:07:26,580 - util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud/instances/nocloud/sem/config_puppet (recursive=False) 2017-12-04 18:07:26,580 - util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud/instances/nocloud/sem/config_puppet (recursive=False) 2017-12-04 18:07:26,581 - helpers.py[DEBUG]: Running config-puppet using lock (<FileLock using file '/var/lib/cloud/instances/nocloud/sem/config_puppet'>) 2017-12-04 18:07:26,581 - cc_puppet.py[DEBUG]: Attempting to install puppet latest, 2017-12-04 18:07:26,581 - util.py[DEBUG]: Running command ['yum', '-t', '-y', 'install', 'puppet'] with allowed return codes [0] (shell=False, capture=False) 2017-12-04 18:07:27,101 - util.py[DEBUG]: Reading from /etc/puppet/puppet.conf (quiet=False) 2017-12-04 18:07:27,102 - handlers.py[DEBUG]: finish: modules-config/config-puppet: FAIL: running config-puppet with frequency once-per-instance 2017-12-04 18:07:27,102 - util.py[WARNING]: Running module puppet (<module 'cloudinit.config.cc_puppet' from '/usr/lib/python2.7/site-packages/cloudinit/config/cc_puppet.pyc'>) failed 2017-12-04 18:07:27,102 - util.py[DEBUG]: Running module puppet (<module 'cloudinit.config.cc_puppet' from '/usr/lib/python2.7/site-packages/cloudinit/config/cc_puppet.pyc'>) failed Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/cloudinit/stages.py", line 777, in _run_modules freq=freq) File "/usr/lib/python2.7/site-packages/cloudinit/cloud.py", line 54, in run return self._runners.run(name, functor, args, freq, clear_on_fail) File "/usr/lib/python2.7/site-packages/cloudinit/helpers.py", line 187, in run results = functor(*args) File "/usr/lib/python2.7/site-packages/cloudinit/config/cc_puppet.py", line 107, in handle contents = util.load_file(PUPPET_CONF_PATH) File "/usr/lib/python2.7/site-packages/cloudinit/util.py", line 1278, in load_file with open(fname, 'rb') as ifh: IOError: [Errno 2] No such file or directory: '/etc/puppet/puppet.conf ------------------------ To get around this error with the missing /etc/puppet/puppet.conf I created a directory and link for the .conf since the original location is in /etc/puppetlabs/puppet/puppet.conf [root@kent-hanchett puppet]# pwd /etc/puppet [root@kent-hanchett puppet]# ls -la total 12 drwxr-xr-x. 2 root root 29 Dec 4 18:13 . drwxr-xr-x. 79 root root 8192 Dec 4 18:13 .. lrwxrwxrwx. 1 root root 34 Dec 4 18:13 puppet.conf.old -> /etc/puppetlabs/puppet/puppet.conf But after the run you can see that it was renamed to .old and the error appears again. So how can I set either to correct path to puppet.conf or how do I handle this situation? Any ideas would be appreciated. BR Christian

1 1

Apache and web content permissions
by Nicolas Kovacs 04 Dec '17

04 Dec '17

Hi, Until a few months ago, when I had to setup a web server under CentOS, I assigned (I'm not sure about the correct english verb for "chown"ing) all the web pages to the apache user and group. To give you an example, let's say I have a static website under /var/www/myserver on a CentOS server running Apache. Then I would configure permissions for the web content like this: # chown -R apache:apache /var/www/myserver # find /var/www/myserver -type d -exec chmod 0750 {} \; # find /var/www/myserver -type f -exec chmod 0640 {} \; Some time ago a fellow sysadmin (Remi Collet on the fr.centos.org forum) pointed out that this is malpractice in terms of security, and that the stuff under /var/www should *not* be owned by the user/group running the webserver. Which means that for the static website above, I could have something like this, for example: # chown -R microlinux:microlinux /var/www/myserver # find /var/www/myserver -type d -exec chmod 0755 {} \; # find /var/www/myserver -type f -exec chmod 0644 {} \; Or even this: # chown -R nobody:nobody /var/www/myserver # find /var/www/myserver -type d -exec chmod 0755 {} \; # find /var/www/myserver -type f -exec chmod 0644 {} \; Now I'm hosting quite a few Wordpress sites on various CentOS servers. Some stuff in Wordpress has to be writable by Apache. If I want to keep stuff as secure as possible, here's the permissions I have to define. # cd /var/www # chown -R microlinux:microlinux wordpress-site/ # find wordpress-site/ -type d -exec chmod 0755 {} \; # find wordpress-site/ -type f -exec chmod 0644 {} \; # cd wordpress-site/html # chown -R microlinux:apache wp-content/ # find wp-content/ -type d -exec chmod 0775 {} \; # find wp-content/ -type f -exec chmod 0664 {} \; As far as I know, this is the most secure setup for Wordpress as far as permissions are concerned. The problem is, I can't use automatic updates anymore. Whenever Wordpress releases a new version, I have to set permissions temporarily like this: # chown -R apache:apache /var/www/wordpress-site Then I can launch the update from within the Wordpress dashboard. And once the update is complete, I have to redefine sane permissions as above. Which is quite a bit tedious if you have two dozen Wordpress sites to manage, even if you have little scripts to define the permissions. So I'm finally coming to my question. How problematic is it really to have the apache user and group owning the stuff under /var/www? I admit I followed the users' advice out of respect for his competence. But as far as I know, sometimes you get security advice where the resulting hassle far outweighs the real benefits. Any suggestions? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

5 13

Broadcom BCM4360
by Gregory P. Ennis 04 Dec '17

04 Dec '17

Everyone, I just purchased a new wfi card that is identified as using lspci as : Broadcom Limited BCM4360 802.11ac Wireless Network Adapter (rev 03) I have not been able to get it to work Centos 7.4 machine. Some of the centos user posts had indicated the nux repsitory had a Centos 7 kmod- wl, but it is not present when I tried to search or or install it at this time. Has anyone had any success in making the Broadcom BCM4360 chip work for Centos 7.4 Greg

5 6

Fwd: Qwery regarding Selinux Change Id context
by Aman Sharma 04 Dec '17

04 Dec '17

Hi All, Thanks for the information. But after resetting the semanage User/login, and moving the targeted folder to old one and then install the default target. then also its still showing the Id context as context=*system_u:system_r:unconfined_t:s0-s0:c0.c1023.* *What I observed is after changing the permission using semanage command also, its still showing the system_u:system_r. * *Check the semanage login/User output :* *semanage login -l* *Login Name SELinux User MLS/MCS Range Service* *__default__ unconfined_u s0-s0:c0.c1023 ** *root unconfined_u s0-s0:c0.c1023 ** *system_u system_u s0-s0:c0.c1023 ** *semanage user -l* * Labeling MLS/ MLS/ * *SELinux User Prefix MCS Level MCS Range SELinux Roles* *guest_u user s0 s0 guest_r* *root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r* *staff_u user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_r* *sysadm_u user s0 s0-s0:c0.c1023 sysadm_r* *system_u user s0 s0-s0:c0.c1023 system_r unconfined_r* *unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r* *user_u user s0 s0 user_r* *xguest_u user s0 s0 xguest_r* Looks like its related to some other issue. What you think about this. Thanks Aman On Sat, Dec 2, 2017 at 1:05 AM, Simon Sekidde <ssekidde(a)redhat.com> wrote: > > > ----- Original Message ----- > > From: "Stephen Smalley" <sds(a)tycho.nsa.gov> > > To: "Simon Sekidde" <ssekidde(a)redhat.com>, "Aman Sharma" < > amansh.sharma5(a)gmail.com> > > Cc: "SELinux" <selinux(a)tycho.nsa.gov> > > Sent: Friday, December 1, 2017 2:28:17 PM > > Subject: Re: Qwery regarding Selinux Change Id context > > > > On Fri, 2017-12-01 at 14:16 -0500, Simon Sekidde wrote: > > > > > > ----- Original Message ----- > > > > From: "Aman Sharma" <amansh.sharma5(a)gmail.com> > > > > To: "SELinux" <selinux(a)tycho.nsa.gov> > > > > Sent: Thursday, November 30, 2017 11:26:21 PM > > > > Subject: Re: Fwd: Qwery regarding Selinux Change Id context > > > > > > > > Hi , > > > > > > > > mv /var/lib/selinux/targeted /var/lib/selinux/targeted.old > > > > > > > > This targeted folder is not there. > > > > > > > > After searching I got the below result : > > > > > > > > find / -type d -name "*targeted" -print > > > > > > > > /usr/share/selinux/targeted > > > > /etc/selinux/targeted > > > > > > > > Pleas let me know your comments. > > > > > > > > > > Run > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > yum reinstall selinux-policy-targeted > > > > He already tried that and it allegedly didn't help. It also seems to > > leave you without a /etc/selinux/targeted/active/seusers file for some > > reason, such that semanage login -l shows nothing. But you can recover > > by copying /etc/selinux/targeted/seusers to > > /etc/selinux/targeted/active/seusers. That's a bug. > > > > Interesting. Thanks for spotting this. > > > > > > > Also what does this output show > > > > > > ps -aelfZ | grep -i ssh > > > > > > > > > > > On Fri, Dec 1, 2017 at 1:49 AM, Dominick Grift <dac.override@gmail. > > > > com> > > > > wrote: > > > > > > > > > On Thu, Nov 30, 2017 at 11:10:43AM +0530, Aman Sharma wrote: > > > > > > Hi Stephen, > > > > > > > > > > > > After reseting Selinux targeted folder also (the steps you > > > > > > mentioned in > > > > > > > > > > the > > > > > > earlier mail), Still its showing the same Id context i.e. > > > > > > > > > > > > *id* > > > > > > *uid=0(root) gid=0(root) groups=0(root) > > > > > > context=system_u:system_r:unconfined_t:s0-s0:c0.c1023* > > > > > > *[root@cucm2 ~]# id -Z* > > > > > > *system_u:system_r:unconfined_t:s0-s0:c0.c1023* > > > > > > > > > > > > *And semanage login -l is showing blank output. * > > > > > > > > > > > > *Do you have any idea about this.* > > > > > > > > > > > > *Thanks* > > > > > > *Aman* > > > > > > > > > > Try the same procedure again but this time also do before > > > > > reinstalling: > > > > > > > > > > mv /var/lib/selinux/targeted /var/lib/selinux/targeted.old > > > > > > > > > > > > > > > > > > > > > > > On Wed, Nov 29, 2017 at 11:04 PM, Stephen Smalley <sds(a)tycho.ns > > > > > > a.gov> > > > > > > > > > > wrote: > > > > > > > > > > > > > On Wed, 2017-11-29 at 22:01 +0530, Aman Sharma wrote: > > > > > > > > After resetting boolean also, showing the same id context. > > > > > > > > > > > > > > And did you try fully resetting your policy as I suggested: > > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > > > > > yum reinstall selinux-policy-targeted > > > > > > > reboot > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Nov 29, 2017 at 9:50 PM, Stephen Smalley <sds@tycho > > > > > > > > .nsa.gov> > > > > > > > > wrote: > > > > > > > > > On Wed, 2017-11-29 at 21:39 +0530, Aman Sharma wrote: > > > > > > > > > > Hi Stephen, > > > > > > > > > > > > > > > > > > > > After enabling the unconfined module and after reboot > > > > > > > > > > also, Still > > > > > > > > > > showing the same id context. > > > > > > > > > > > > > > > > > > > > Is there any way to make the id context to normal state > > > > > > > > > > again ? > > > > > > > > > > > > > > > > > > Hmmm...try resetting all booleans too? semanage boolean > > > > > > > > > -D > > > > > > > > > > > > > > > > > > Or you could be drastic and completely reset your policy: > > > > > > > > > mv /etc/selinux/targeted /etc/selinux/targeted.old > > > > > > > > > yum reinstall selinux-policy-targeted > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > > > > > Thanks > > > > > > > > Aman > > > > > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > Thanks > > > > > > Aman > > > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > -- > > > > > Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B > > > > > 6B02 > > > > > https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7 > > > > > B6B02 > > > > > Dominick Grift > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > Thanks > > > > Aman > > > > Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com > > > > > > > > > > > > > > -- > Simon Sekidde > gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E > > > -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com

1 0

Fwd: Default User in Selinux
by Aman Sharma 04 Dec '17

04 Dec '17

Hi All, During System boot up, I am running some semanage commands to change the User to sysadm_u. But in Cent OS 7.3 , Below error message is coming i.e. *ValueError: Login mapping for __default__ is not defined.* /usr/sbin/semanage login -m -S targeted -s user_u -r s0 __default__ ValueError: Login mapping for __default__ is not defined But the same command is working fine in Cent OS 6.8. Please let me know why this error message is coming for Cent OS 7. -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com -- Thanks Aman Cell: +91 9990296404 | Email ID : amansh.sharma5(a)gmail.com

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2017