Discuss June 2006

discuss@lists.centos.org

217 participants
235 discussions

CentOS 4.3 under VMWare ESX 2.5.3 Server
by Adriano Viscarde 14 Jun '06

14 Jun '06

I have a IBM XSeries 366 with 04 processors Intel Xeon 3.16 Ghz, 16 Gb of memory and a storage IBM with 2 terabytes. I work with virtualization and my OS in this machine is a VMware ESX 2.5.3 version. When I install CentOS 4.X as guest operating system under ESX, the performance is very very bad. When I intsall RHES4 as guest operating system under ESX, the performance is very good. It will be that it has some problem CentOS to work with virtualization?

4 6

Microsoft-ds and H.323/Q.931? Which services are these?
by M. Fioretti 14 Jun '06

14 Jun '06

Hello, I have just ran nmap on a remote server with a minimal (or so I believed) Centos 4.3 installation. Besides what I expected (ssh, httpd, smtp) it found as open for listening these ports: Starting Nmap 3.95 ( http://www.insecure.org/nmap/ ) at 2006-06-14 17:57 CEST Interesting ports on <my.remote.server> (The 1667 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 445/tcp filtered microsoft-ds 1720/tcp filtered H.323/Q.931 which programs are these, and why should they be part of a server install? How can I find them so I can uninstall them? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ Live simply so others may simply live. Ghandi

4 4

How to create a secure user only for ssh login?
by M. Fioretti 14 Jun '06

14 Jun '06

Hello, I've read on several howtos that one way to make ssh more secure, or at least reduce the damage if somebody breaks in, is to NOT allow direct ssh login from root, but allow logins from another user. So you have to know two passwords in order to do any real damage. Does this make sense? IF yes, what is the right way to create an user only for this purpose, that is one that can only login to give me a local prompt to become root, but has no privilege, no possibility to create files, or do anything at all? TIA, Marco -- Marco Fioretti mfioretti, at the server mclink.it Fedora Core 3 for low memory http://www.rule-project.org/ Don't you wish you had more energy... or less ambition?

3 5

RE: [CentOS] How to create a secure user only for ssh login?
by King, John (Greg) (LMIT-HOU) 14 Jun '06

14 Jun '06

> > (must I)/can I reduce as much as possible the privileges/access rights > of the my_aux_login account? so that if somebody breaks _its_ > password, it won't be able to do anything, including browsing around > to see what's installed? Ah. I think I have a clearer idea on what your wanting to do now. You may want to look at SELinux (Comes with CentOS 4 but may either be enabled,set to warn or disabled depending on how it was installed). I have yet had time to understand the SELinux mechanism but I recall a discussion where the person used SELinux to reconfigure what the root account could do, left the console logged in and asked people to break into the system using the root account. If SELinux can be used to change how root behaves it should be able to do the same with non-root accounts. Anyhow here are some links I found that may help. http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guid e/rhlcommon-section-0047.html http://danwalsh.livejournal.com/1538.html http://www.nsa.gov/selinux/ -Greg

2 1

RE: [CentOS] Simple backup program
by Mark Schoonover 14 Jun '06

14 Jun '06

Robin Mordasiewicz wrote: > On Wed, 14 Jun 2006, Les Mikesell wrote: > >> On Wed, 2006-06-14 at 13:09 -0400, Bowie Bailey wrote: >>>>> I am looking for a simple backup program that I can use to backup >>>>> a CentOS box to a local tape drive. >> >>>> http://flexbackup.sf.net >>>> >>>> I used that for years, but the network grew and needed a "bigger" >>>> solution so I switched to backuppc which is working great. >>> >>> I'm using backuppc. I just need something to dump the backuppc >>> machine to tape for an offsite or last-resort backup. The problem >>> is that backuppc is currently using 161GB (compressed) and the >>> tapes only hold 40GB each, so I need something with some sort of >>> intelligent tape-spanning capability. >> >> You are going to have more trouble than that. Backuppc will have >> millions of hardlinks in that 161GB and nearly all file oriented >> backup programs will take an impractical amount of time to deal >> with them. And restoring will be even worse - basically everything >> ends up building a table of inode numbers and scanning it for a >> match on every hardlink. >> >>> I haven't seen flexbackup. I'm currently evaluating afbackup. >> >> You really want a matching external hard drive so you can >> dd an image copy to it. There has been quite a bit of discussion >> on this topic on the backuppc mail list and I'm not sure anyone >> has come up with an ideal solution. Or, you can use the 'archive >> host' feature of backuppc to generate tar images of backup runs >> optionally compressed and split to fit your media, but these >> are copies of individual hosts and you loose the pooling feature. >> > my .02$ is bacula > It spans tapes. fully featured, reliable, well documented etc. I used to use Bacula way back when, but restoring large amounts of data - 1TB range from tape is very slow. Went rsync to drives on another internal server, and a backup server in our colo. Rsync makes it very easy to do hourly, daily, weekly or monthly snapshots of data. HTH Mark

1 0

OpenSSH w/ Kerberos
by Michael B Allen 14 Jun '06

14 Jun '06

I'm slightly shocked to see that ssh doesn't do kerberos. Is this possible or am I being stupid? Mike -- Michael B Allen PHP Extension for SSO w/ Windows Group Authorization http://www.ioplex.com/

3 4

RE: [CentOS] Simple backup program
by Bowie Bailey 14 Jun '06

14 Jun '06

Ajay Sharma wrote: > Bowie Bailey wrote: > > I am looking for a simple backup program that I can use to backup a > > CentOS box to a local tape drive. Hopefully someone here can give > > me a recommendation. > > > > This is what I need: > > - Simple launching of manual backups (preferably from the > > command line) > > - Ability to span tapes for a large backup > > - Proper treatment of hardlinked files > > - Notification via email or similar when it is ready for the > > next tape. > > > > I tried mondo-rescue, but decided against it after it spent 4 hours > > just trying to index the files (it never actually started the > > backup). > > > > I am considering Amanda, but the setup is a bit complex and, based > > on the docs, the tape spanning capability isn't the best. > > > > Anyone have any suggestions? I would think that there would be a > > simple program out there to backup and restore from tape without all > > of the extra scheduling and indexing features. > > http://flexbackup.sf.net > > I used that for years, but the network grew and needed a "bigger" > solution so I switched to backuppc which is working great. I'm using backuppc. I just need something to dump the backuppc machine to tape for an offsite or last-resort backup. The problem is that backuppc is currently using 161GB (compressed) and the tapes only hold 40GB each, so I need something with some sort of intelligent tape-spanning capability. I haven't seen flexbackup. I'm currently evaluating afbackup. -- Bowie

3 2

2 machines running centos and parallel ports
by Jerry Geis 14 Jun '06

14 Jun '06

I have two machines both running centos 4.3. I have a laplink cable (parallel) between them. On one machine I do "echo Hello > /dev/parport0" on the other machine I wrote a short c program to open /dev/parport0 and when characters arrive print them on the screen. Seems simple enough but nothing comes across. Both machines parallel ports are set for PS/2 mode. Is there a reason this would not work? THanks, jerry

2 1

RE: [CentOS] How to create a secure user only for ssh login?
by King, John (Greg) (LMIT-HOU) 14 Jun '06

14 Jun '06

One way is the wheel group in /etc/group. Uncomment the following line in /etc/pam.d/su: auth required /lib/security/$ISA/pam_wheel.so use_uid Uncommenting this line allows only the users in the wheel group to become root by using the su command and entering the root password. All other users will receive a message stating the password is incorrect. You will also want to create the wheel group in /etc/group and add users to it if it does not exist (CentOS 4 I know does but some older redhat implementations did not if I recall correctly). I am unsure of how this interacts with sudo though. If you allow users to use sudo command, make sure they cannot 'sudo su root'. -Greg > -----Original Message----- > From: centos-bounces(a)centos.org > [mailto:centos-bounces@centos.org] On Behalf Of M. Fioretti > Sent: Wednesday, June 14, 2006 11:57 AM > To: centos(a)centos.org > Subject: [CentOS] How to create a secure user only for ssh login? > > Hello, > > I've read on several howtos that one way to make ssh more secure, or > at least reduce the damage if somebody breaks in, is to NOT allow > direct ssh login from root, but allow logins from another user. So you > have to know two passwords in order to do any real damage. > > Does this make sense? IF yes, what is the right way to create an user > only for this purpose, that is one that can only login to give me a > local prompt to become root, but has no privilege, no possibility to > create files, or do anything at all? > > TIA, > Marco > > -- > Marco Fioretti mfioretti, at the server mclink.it > Fedora Core 3 for low memory http://www.rule-project.org/ > > Don't you wish you had more energy... or less ambition? > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

RE: [CentOS] Tape drive throughput
by Bowie Bailey 14 Jun '06

14 Jun '06

Joshua Gimer wrote: > Bowie Bailey wrote: > > I have a backup spooling onto a DLT drive. Is there any tool that > > will let me monitor the data throughput on the device? > > You can use iostat which is part of the sysstat package. > > yum install sysstat > > You can set up an interval and a count and have it redirected to a > file for later reference > > iostat 10 20 >> filename Now why didn't I think of that? :) It doesn't appear to be able to show me the tape device directly, but I can get a pretty good idea from watching the disk reads since this system isn't doing anything else at the moment. Thanks. -- Bowie

1 0

← Newer
1
...
11
12
13
14
15
16
17
...
24
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2006