Discuss January 2008

discuss@lists.centos.org

311 participants
383 discussions

Start a nNew thread

When will CentOS 5 Plus be available?
by Mark Hull-Richter 13 Feb '08

13 Feb '08

I know that 5 isn't quite out yet, but I'm wondering how soon after 5 will 5 Plus be available? Thanks. mhr

15 24

Turning Wireless Radio on and off: how?
by Mark Weaver 11 Feb '08

11 Feb '08

Hi all, I've got a Dell Inspiron 1501 with a Broadcom 1390 Wlan mini card (integrated) wireless lan chipset. I've got an init script setup to activate the wireless connection at boot time, however when the system boots the adapter doesn't connect. I'm not able to get a connection until after the desktop is done loading and I run the script from the command line. After some log review apparently as the system is booting the radio for the wireless lan card is "off", so I need to know how to turn the wireless radio on just before the init script for the adapter fires off. How can I turn on/off the wireless lan radio? I'm using ndiswrapper and the dell windows driver for this wireless card. thanks, Mark

4 9

New Adobe Reader works on CentOS-4.x, speech synthesis reader & more.
by William L. Maltby 08 Feb '08

08 Feb '08

Just and FYI. In RPM form, works on 4.x and I will try on 5.x too. Speech is tacky, but if I can get something but the Gnome Festival synthesizer, maybe it will improve? http://www.adobe.com/products/acrobat/readstep2.html?promoid=BONRM -- Bill

1 2

NFS problem in the latest kernel (Was: [CentOS] MySQL issues with kernel-2.6.18-53.1.6.el5.x86_64.rpm)
by Akemi Yagi 06 Feb '08

06 Feb '08

On Jan 30, 2008 8:25 AM, Johnny Hughes <johnny(a)centos.org> wrote: > Joshua Baker-LePain wrote: > > On Wed, 30 Jan 2008 at 10:18am, Johnny Hughes wrote > > > >> Bent Terp wrote: > > > >>> Has something changed with regard to the mount options? We use > >>> (rw,noatime,rsize=8192,wsize=8192,hard,udp,context="system_u:object_r:httpd_sys_content_t:s0) > >>> > >>> which has worked fine until now. > >> > >> I am trying to duplicate your options ... and noatime is not a valid > >> option. > >> > >> Could you please double check the /etc/export options again so I can > >> try to duplicate the issue. > >> > >> Using my standard /etc/exports on 2 i686 test platforms I have no > >> problems at all. > >> > >> Here are the options I used on my test: > >> > >> (rw,insecure,sync,no_subtree_check) > > > > Those are NFS export options. The OP's list is *mount* options (i.e. on > > the client side). He stated that his NFS server is actually an EMC > > Cellera. > > > AH ... now I see. > > In any event, I can not duplicate the problem with an nfs export on c4 > or c5 and connecting with a c5 client, regardless of the kernel using i686. One other person has reported seemingly the same nfs problem in the Scientific Linux mail list: http://listserv.fnal.gov/scripts/wa.exe?A2=ind0801&L=scientific-linux-devel… According to this post, "It only seems to affect x86_64 systems, or affects them much more noticeably than it does i386 ones." Akemi

3 5

One approach to dealing with SSH brute force attacks.
by James B. Byrne 04 Feb '08

04 Feb '08

Message-ID: <479F2A63.2070408(a)centos.org> On: Tue, 29 Jan 2008 07:30:11 -0600, Johnny Hughes <johnny(a)centos.org> Subject Was: [CentOS] Unknown rootkit causes compromised servers > > SOME of the script kiddies check higher ports for SSH *_BUT_* I only see > 4% of the brute force attempts to login on ports other than 22. > > I would say that dropping brute force login attempts by 96% is quite a > good reason to move the SSH port from 22 to something else. I am not a fan of security through obscurity. If a port is open to the internet then it must be secured whether it is well known or not and if it is properly secured then changing the port number customarily assigned provides no measurable benefit. In my opinion, arbitrarily switching port numbers for well known services provides only the illusion of security while often inconveniencing the legitimate users in unpredictable, and sometimes expensively resolved, fashions. To deal with brute force attacks (not just on ssh) I spent some time tracking down how others had dealt with the problem. I discovered thereby that one can use the simple linux firewall iptables to restrict the number of connections to a given port from a single source over a specified interval. I therefore added these rules to my /etc/sysconfig/iptables file: ... # This is usually present in all setups but, you never know.... # Established connections go right through. -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ... # Block brute force attacks # Drop repeated ssh connection attempts within 20 seconds interval -A RH-Firewall-1-INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW -j DROP --rcheck --seconds 20 --name THROTTLE --rsource # Accept ssh connection if not attempted within past 20 sec. -A RH-Firewall-1-INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 --state NEW -j ACCEPT --set --name THROTTLE --rsource You can change the interval from 20 seconds to whatever you feel represents a decent compromise between user satisfaction and security. Many authorities considered a value between 3 and 6 seconds sufficient to render brute force attacks impractical. These rules can be trivially modified to protect any destination port (-dport 21 for ftp for instance) or protocol (-p udp). I hope this information is of use to some of you. I find this list and its archives very helpful myself. Regards, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

11 12

Re: [CentOS] One approach to dealing with SSH brute force attacks.
by Les Bell 04 Feb '08

04 Feb '08

mouss <mouss(a)netoyen.net> wrote: >> If you consider this security through obscurity, then why not publish the list of your users on a public web page? after all, you should use strong passwords, so why hide usernames? << Usernames are comparatively hard to guess, and chosen from a large space - although email addresses often provide a huge clue. By contrast, there are only 64K port numbers (and only 1K privileged ports, all of which will be scanned by default with nmap) - and to make it worse, the attacker only has to telnet or nc to a port and sshd will obligingly send back its version number and protocol version info as plaintext. So, the added "obscurity" is effectively zero. I sort of half-buy the log volume/noise argument, but rate-limiting and good analysis tools deal with this as well. And it does nothing for the stress level, since the serious adversary will see through your non-standard port number in seconds. Best, --- Les Bell, RHCE, CISSP [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

3 2

DVD support on CentOS 5.1
by Sysadmin＠dte.net 03 Feb '08

03 Feb '08

Hello out there! Been around the block trying to get DVD support for Totem, but I keep running into dead ends everywhere I go. Looking for CentOS 5.1-compatible xine and xine-lib packages as that seems to be the answer, but the only ones I find (like on DAG) seem to be just dead links or I get a message that the mirrors are unavailable when I try to run the rpm. Can anyone provide a link for rpm's that will provide DVD support on CentOS 5.1 32bit? I installed the Gstream rpm's so at least I have mp3 and mpeg support, I just really want DVD support as well. Many thanks in advance, Manuel Alvarez P.S. If anyone can chime in the question below I would greatly appreciate it. I still have no idea on this one. L From: Sysadmin(a)dte.net [mailto:Sysadmin@dte.net] Sent: Tuesday, January 22, 2008 5:14 PM To: 'centos(a)centos.org' Subject: Wireless PCMCIA/PC Card for CentOS 5.1? Hello everyone, I would really like to get wireless working on my CentOS 5.1 install. I have a LinkSys WPC54G (I guess version 1 since no version is listed) but everything I've read indicates that this would be a nightmare for a Linux newbie like myself. I got as far as NDISWrapper, but right off the bat I am getting issues with KBuild and I guess my kernel source so I can't even get as far as compiling NDISWrapper. My question is mainly: Can anyone recommend a PC Card for a laptop that will work on CentOS without NDISWrapper? If not, is there an idiot guide for installing NDISWrapper on Centos 5.1? Thanks and best wishes, Manuel Alvarez

7 8

CentOS plus mysql server
by David Hrbáč 02 Feb '08

02 Feb '08

Hi, a few days there was thread about Centos Plus mysql. Today Mysql released mysql-5.0.51a. Where does Centos Plus mysql-5.0.54 come from? Thanks, David

7 9

Re: [CentOS] Two Instances of Apache; Primary IP / Secondary IP
by Al Sparks 02 Feb '08

02 Feb '08

> do you mean making apache use a specific IP when it proxies the request? > (you really lost me, so I may be misunderstanding). why do need that at > all? whatever IP is used should not matter since the backend will reply > over the socket that was opened by the proxy (be it a production proxy > or the test proxy). > Both IP addresses are actually assigned to the same physical interface (eth1 and eth1:1). The proxy instance is accepting connections from clients using the eth1:1 secondary interface, but the same PHYSICAL interface as eth1. When it turns around and connects to the back-end service, it seems to be using eth1 even though it's listening on eth1:1. Since it's not listening to eth1, the packets are going to the bit-bucket. At least that's my theory. > otherwise, the IP is selected by the kernel depending on the > destination. so if you use something like > ProxyPass / http://10.1.2.3:8080/ > in one proxy and > ProxyPass / http://10.4.5.6:8080/ > > each will use the "selected" IP. > >> Is there something I can do with routing tables that can help? >> > That would require "advanced" routing. standard routing is based on > destination and the source IP is selected by the kernel after the route > has been computed (this allows setting the right IP should you have > multiple network interfaces...). > > but you should not need this. In the end, I may just have to either use a separate server or a second physical interface, probably in another VLAN, to make this work. And my idea seemed like such a good one. === Al

2 1

MySQL issues with kernel-2.6.18-53.1.6.el5.x86_64.rpm
by Bent Terp 01 Feb '08

01 Feb '08

Hi all! Just a word of warning: after updating a few of our x86_64 based web frontend boxes to the new kernel, we began to get weird MySQL timeouts. The problem went away again when we downgraded to the previous kernel-2.6.18-53.1.6.el5.x86_64.rpm regards, Bent Terp

7 16

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2008