Discuss February 2007

discuss@lists.centos.org

259 participants
310 discussions

Advice, Please.
by Phil Savoie 19 Feb '07

19 Feb '07

Hello, I have a home setup where I am using Centos 4.4 as a sort of mail server. This is what I have done. I have it configured to pop mail locally. I have fetchmail configured to dl from my provider my families mail through a cron job and .fetchmailrc in their home directories. They then pop the server to retrieve their mail. They send their mail directly through the provider. I have been relying on spamassasin on their local boxes to learn and filter out the spam but find it is only doing about half of the job even after months of training. I guess my question is this. Is there a way to do further spam filtering on the mail server incorporating my method of doing mail or am I not just doing this right? Any thoughts, please? Thank you, Phil

2 2

RPM rebuild, cross compiling from x86 to x86_64
by Martin Hamant 19 Feb '07

19 Feb '07

Hi I want to recompile some RPMs (my own) for x86_64 arch from my i386 compatible build host (because of hardware restriction/funds).Is anyone ever done this ? After a google search, it seems not so easy... i just found this: http://www.speedblue.org/cross_compilation/ but haven't tried it yet (i would have to convert these to RPM first). How is it done for Centos SRPMS rebuilds ? is it a different hardware for each target arch ? Thanks ! -- Martin

4 4

Could not mount SATA disk as module scsi_hostadapter is not loaded, although present in modules.conf
by Alexander Georgiev 19 Feb '07

19 Feb '07

Hi people, I installed a via SATA controller in a CentOS release 3.8 (Final) - I needed additional disk space. After the first boot, the kudzu service, added the following line to /etc/modules.conf: alias scsi_hostadapter sata_via and I rebooted. After reboot in dmesg one can see: scsi0 : sata_via scsi1 : sata_via Vendor: ATA Model: SAMSUNG HD080HJ Rev: WT10 Type: Direct-Access ANSI SCSI revision: 05 Attached scsi disk sda at scsi0, channel 0, id 0, lun 0 SCSI device sda: 156301488 512-byte hdwr sectors (80026 MB) sda: sda1 sda2 < sda5 > sda3 scsi : 0 hosts left But the /dev/sda device is not present in the system. If I issue the command: [root@bdc root]# fdisk /dev/sda Unable to open /dev/sda I found out that if at that point I issue the command: [root@bdc root]# modprobe scsi_hostadapter the /dev/sda is inserted in the system and I can access it using fdisk. It appears to me that scsi_hostadapter is initially loaded during boot, later unloaded - therefore the drive is missing. Currently I patch the situation with a file /etc/rc.modules with the following contents: #! /bin/sh modprobe scsi_hostadapter However I assume that this is not the correct way to fix this. Maybe I need additional lines in modules.conf? Best regards, alex

2 1

CPAN.pm failure to install
by Gregory P. Ennis 19 Feb '07

19 Feb '07

Everyone, Have a new install of Centos 4.4 with a Supermicro dual processor. I was trying to install the perl module Astro::Time with CPAN and the initial setup of CPAN suggested a -j3 switch to be used with 'make' on dual processor machines. I followed the suggestion but when the CPAN module tried to use make it failed with the -j3 switch. I thought I would uninstall CPAN to start over without the -j3 switch, but could not figure out how this is done. Any ideas? Greg Ennis

2 2

Event scheduling
by Frank M. Ramaekers 19 Feb '07

19 Feb '07

Okay, I know about 'cron' and 'at', but how do you schedule jobs (scripts) based on events. For instance: Run script xyz when file abcd.efg arrives via ftp? TIA, Frank M. Ramaekers Jr. Systems Programmer; MCP, MCP+I, MCSE & RHCE American Income Life Insurance Company Phone: (254) 761-6649 Fax: (254) 741-5777

11 16

Quick demo guide for SPA ( re: the port knocking thread )
by MrKiwi 19 Feb '07

19 Feb '07

For what it's worth to those who want to play with SPA, here is a demo i whipped up. It is very easy to set up, and i almost guarantee anyone can get this running. What we will demonstrate: Bascially: An SPA demo. Requirements: Very little - a minimal setup of centos. This setup will demonstrate a client who initially cannot connect to a an ssh port on the server (the server is DROPing packets and appears to not be running sshd). After a successful encrypted SPA (Single Packet Authorization) packet is sent to the server, in which a shared key and usercode is required, the ssh port is opened for the client IP only, and the client can then continue to connect with the normally required ssh credentials. After a timeout, the port is CLOSED to all traffic from the client IP, however firewall ESTABLISHED and RELATED rules will allow the connected client to continue to communicate. Setup Details; Server; Almost any kind of CentOS, but i use CentOS 4.4 installed on a VM (vmware workstation build 36983) SELinux Disabled Firewall enabled, no services allowed. "Minimal" installation performed. IP=10.1.1.155 Client; Almost any *nix, but i have used CentOS 4.4 installed on a VM (vmware workstation build 36983) SELinux Disabled Firewall enabled, no services allowed. "Minimal" installation performed. IP=10.1.1.8 =================== Setup the server Optional : Update the server; #yum -y update #reboot Install fwknop #cd /tmp #wget http://www.cipherdyne.org/fwknop/download/fwknop-1.0.1-1.i386.rpm #rpm -i fwknop-1.0.1-1.i386.rpm Backup fwknop's access.conf file and make our own. #mv /etc/fwknop/access.conf /etc/fwknop/access.conf.orig #access=/etc/fwknop/access.conf #echo "SOURCE: ANY;">>$access #echo "OPEN_PORTS:tcp/22;">>$access #echo "DATA_COLLECT_MODE: ULOG_PCAP;">>$access #echo "KEY: pkpassword;">>$access #echo "FW_ACCESS_TIMEOUT: 30;">>$access #echo "REQUIRE_USERNAME: mbr;">>$access Note ... the usercode and password we need to tell the client is; usercode:mbr , password:pkpassword Change the firewall (by default in a CentOS build it REJECTS everything. We want it to DROP instead, so that no-one knows if sshd is running or not) (this step is optional) #service iptables stop #joe /etc/sysconfig/iptables change -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited to -A RH-Firewall-1-INPUT -j DROP Restart the firewall #service iptables start Start fwknopd --debug Leave this debug window open, and you will see the rules that fwknop adds to the firewall. Setup the Client; Install fwknop (the same package contains server and client tools) #cd /tmp #wget http://www.cipherdyne.org/fwknop/download/fwknop-1.0.1-1.i386.rpm #rpm -i fwknop-1.0.1-1.i386.rpm Proof : Try to connect to server on port 22 #nc -v 10.1.1.155 nc will apear to hang waiting for a response. -> no response. (unless you skipped the step above for changing the firewall rules, in which case i think you get a 'no route to host' message) Now knock to open the port, using the usercode and password as above; (password will be prompted for ) #fwknop -A tcp/22 -k 10.1.1.155 --Spoof-user mbr -a 10.1.1.8 -A is the port to send the SPA packet to -k is the server to send to --Spoof-user is because we are not mbr (i am root) we wouldnt need this if we were logged on as 'mbr' -a 10.1.1.8 is because i am on a NATed subnet, and without it fwknop will resolve my IP to a public one, and then tell the server to open port 22 to that public IP, which wont help me. You have 30 seconds to try to connect now ... #nc -v 10.1.1.155 22 pc-00155.xx_hidden_xx.org [10.1.1.155] 22 (ssh) open SSH-1.99-OpenSSH_3.9p1 Ctrl-c to kill this. So we have proved that port 22 has been opened by our knock. Watching the servers debug output as mentioned above will show you the exact rule which was added to iptables to achieve this. If you have exceeded your 30 sec, just run the knock again; #fwknop -A tcp/22 -k 10.1.1.155 --Spoof-user mbr -a 10.1.1.8 and then try to connect; #ssh root(a)10.1.1.155 If you are quick enough you can run #service iptables status|grep 10.1.1.8 ACCEPT tcp -- 10.1.1.8 0.0.0.0/0 tcp dpt:22 This shows you the rule which let you in. Note that port 22 is open to *YOUR IP* only. About 30 sec later you will see; # service iptables status|grep 10.1.1.8 # [no output] This shows you that the open port has been closed. Notes: If you get a message like 'remote time stamp is older than 120 second max age.' then you have a clock sync problem. (common when using vmware) Notes: If you have trouble with clock drift and you dont want to be bothered fixing it, you can make fwknop less sensitive; joe /etc/fwknop/fwknop.conf change MAX_SPA_PACKET_AGE 120; to MAX_SPA_PACKET_AGE 1200; or similar (20 minute window) Thanks to Michael Rash for his great pdf (http://www.usenix.org/publications/login/2006-02/pdfs/rash.pdf) which i blatently ripped content from for the good of the world.

1 0

Defending againts simultanious attacks
by Mohd Syakir 18 Feb '07

18 Feb '07

Hi, i have one centos 4.3 box, exposed to the internet. since several weeks ago, i found numerous attemps to connect through SSH, but failed. they tried with many username, including root. it's comes from different IP. some of them are foreign website. How do i make my centos become smarter in handling this kind of attacks. eventhough i've disable all the user accounts, left only the admin accounts. making the password so hard, longer and combining alphabet, numbers and characters... yet i dont want the attackers keep on trying. any suggestions? thanks in advance.

16 25

CentOS (2.6.9-42.0.8.ELsmp) and CentOS (2.6.9-42.0.8.EL)
by Gregory P. Ennis 18 Feb '07

18 Feb '07

List, I am experimenting with a Dual processor Supermicro and plan to use CentOS 5 when it is released. In the meantime I have installed Centos 4.4. Sorry for asking such a basic question but what is the difference between CentOS (2.6.9-42.0.8.ELsmp) and CentOS (2.6.9-42.0.8.EL) Both kernels have been installed, but I have not been able to find which one is best to use for what purposes. Thanks, Greg Ennis

7 7

A full detailed add user script
by Dwi Suharto 18 Feb '07

18 Feb '07

Anyone here have any sample script, using BASH, for adding user. The script can define: - home directory - quota - create public_html folder - update shadow password (in replace to manually using passwd particularly to related user) Thank you. Dwi Suharto Rumahweb's TSO http://www.rumahweb.com

2 1

How can I batch print html pages
by Theo Band 18 Feb '07

18 Feb '07

I thought this was easy, but it turns out to be not so obvious. My problem: I have a database with hour registration. I need to print out about hundreds of pages and have them signed by employees. Of course I want to do this automatically. Up to now I have a collection of html pages (got them using wget). So the final thing I want is to print them all out in one go. How to do that? I search for a command-line option to convert the html to pdf. Or have firefox/konqueror print them directly without user intervention (there is not a switch like "firefox --print <url>"). Note that the pages are off-line, not on the server. The original pages can only retrieved with after authorization. That's why I used wget with a saved session cookie. Anyone got an simple solution? Thanks, Theo

7 11

← Newer
1
...
10
11
12
13
14
15
16
...
31
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2007