Discuss February 2008

discuss@lists.centos.org

286 participants
340 discussions

pgadmin and Centos 5?
by Scott Ehrlich 02 Feb '08

02 Feb '08

I've been fighting to get the latest source of pgadmin compiled on Centos 5 64-bit. I obtained gnu-c++ (so it was happy with g++). It then complained about wxWidgets, so I obtained the source for that, compiled and installed, and ./configure for pgadmin saw wxWidgets and was happy with that. Go to make... It complains that some header file is missing. A google search reveals limited answers, but the same couple of searches reveal the wxwidgets modules need to be installed. What are these modules that are needed for pgadmin? I've found plenty of modules when performing a google search of wxwidgets, such as python, etc. Thanks for any help. Scott

5 9

Re: [CentOS] Two Instances of Apache; Primary IP / Secondary IP
by Al Sparks 02 Feb '08

02 Feb '08

> do you mean making apache use a specific IP when it proxies the request? > (you really lost me, so I may be misunderstanding). why do need that at > all? whatever IP is used should not matter since the backend will reply > over the socket that was opened by the proxy (be it a production proxy > or the test proxy). > Both IP addresses are actually assigned to the same physical interface (eth1 and eth1:1). The proxy instance is accepting connections from clients using the eth1:1 secondary interface, but the same PHYSICAL interface as eth1. When it turns around and connects to the back-end service, it seems to be using eth1 even though it's listening on eth1:1. Since it's not listening to eth1, the packets are going to the bit-bucket. At least that's my theory. > otherwise, the IP is selected by the kernel depending on the > destination. so if you use something like > ProxyPass / http://10.1.2.3:8080/ > in one proxy and > ProxyPass / http://10.4.5.6:8080/ > > each will use the "selected" IP. > >> Is there something I can do with routing tables that can help? >> > That would require "advanced" routing. standard routing is based on > destination and the source IP is selected by the kernel after the route > has been computed (this allows setting the right IP should you have > multiple network interfaces...). > > but you should not need this. In the end, I may just have to either use a separate server or a second physical interface, probably in another VLAN, to make this work. And my idea seemed like such a good one. === Al

2 1

RAID Hot Spare
by Dean Maluski 02 Feb '08

02 Feb '08

I've googled this question without a great deal of information. Monday I'm rebuilding a Linux server at work. Instead of purchasing 3 drives for this system I purchased 4 with intent to create a hot spare. Here is my usual setup which I'll do again but with a hot spare for each partion. Create /dev/md0 mount point /boot RAID1 3 drives with 1 hot spare Create two more raid setups /dev/md1 mount point / RAID5 3 drives with 1 hot spare /dev/md2 mount point /home RAID5 3 drives with 1 hot spare Now do I create partions of equal size for each set then if I remember correctly when creation the RAID there is a check box for hot spare. Do I just marry the 3 equal partions, click the check box and assume the system will find the partition of equal size and use it when needed? Makes no sense to me. Of couse will be creating RAID0 swap but leaving that out of the question for obvious reasons.

3 5

dhcp & squid
by Gregory P. Ennis 02 Feb '08

02 Feb '08

Everyone, I have set up squid as a proxy http server in order to filter web access for an office that wants to block certain web sites. Is there a way to use the dhcpd server to assign the squid server and port number 3128 to each Linux desktop when they boot using the existing dhcpd server. Or do I need to change each user's network preference setup in firefox. The dhcpd server and squid are on the same server. I have looked at the man pages for dhcpd, dhcpd.conf, dhcp-options, dhcllient, and dhclient.conf. I found an option : option www-server ###.###.###.### However there was no reference to stipulate a port number like 3128 that is used by squid. Other searching on the web has uncovered the use of: option custom-proxy-server "http://192.168.1.1/wpad.pac" but I am uncertain as to how to configure wpad.pac file Any answers or suggestions on reading material would be appreciated. Thanks, Greg Ennis

3 4

MySQL issues with kernel-2.6.18-53.1.6.el5.x86_64.rpm
by Bent Terp 02 Feb '08

02 Feb '08

Hi all! Just a word of warning: after updating a few of our x86_64 based web frontend boxes to the new kernel, we began to get weird MySQL timeouts. The problem went away again when we downgraded to the previous kernel-2.6.18-53.1.6.el5.x86_64.rpm regards, Bent Terp

7 16

Re: [CentOS] General questions about security
by Ross S. W. Walker 02 Feb '08

02 Feb '08

Yes, but be aware of any requirements that if revealed afterwards can put a project in jeopardy both in terms of budget and schedule. There may be policies governing encryption or firewall setup or monitoring that are general and need to be covered in all environments. Or another type of requirement that might exist is to have low-vision access for the vision impaired for all public terminals. Not security related but can definitely pose a problem if it isn't covered in the build spec. -Ross ----- Original Message ----- From: centos-bounces(a)centos.org <centos-bounces(a)centos.org> To: CentOS mailing list <centos(a)centos.org> Sent: Fri Feb 01 14:24:29 2008 Subject: Re: [CentOS] General questions about security Ross S. W. Walker a écrit : > > Check to see if the town/county has any policies in place for computer > systems and networks for public services and follow those guidelines. > > Otherwise look at surrounding public library systems to see if they have > any you can adopt. > The surrounding places here (town halls, police stations) mostly run Windows (98, Me, 2000, XP). So I'd better follow my nose than their security standards :oD Cheers, Niki _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

1 0

RE: [CentOS] NTP server
by James D. Parra 01 Feb '08

01 Feb '08

-----Original Message----- From: Scott Ehrlich [mailto:scott@MIT.EDU] Sent: Friday, February 01, 2008 11:37 AM To: centos(a)centos.org Subject: [CentOS] NTP server I have a Centos 5 64-bit server that has ntp service enabled. Windows XP with SP2 cannot properly sync to it for time, but can communicate with it via samba, ssh, and anything else. I also disabled the Windows Firewall. The C5 system does not have any firewall enabled. Other C5 workstations can successfully sync to it via ntpdate. What else could cause the XP machine to not be able to time sync with the C5 server? ~~~~~~ Try this; create a DNS entry called ntp.yourinternaldomain.com, then plug that name into XP's internet time. I had a similar problem and changing the IP address to FQDN fixed it. Perhaps it will work for you. Good luck, ~James

3 2

Megraid SAS virtual disc question
by Joseph L. Casale 01 Feb '08

01 Feb '08

Hi, Is there something OS related (CentOS 5.1) I would need to do for a CLI created array to become visible to the OS after the array is created and initialized? I don't want to reboot... Thanks! jlc

3 6

Re: [CentOS] General questions about security
by techlists＠comcast.net 01 Feb '08

01 Feb '08

CI Security has some good hardening guidelines for Linux based servers. Any public facing server should be hardened before deploying it online. www.cisecurity.org Paul -------------- Original message ---------------------- From: Niki Kovacs <contact(a)kikinovak.net> > Hi, > > I admit I never gave security that much thought, that is, except the > most basic security rules like choosing good passwords, or reasonable > file and directory permissions. But now I have to change that, since > I'll soon have to setup a dedicated production server for our public > libraries. > > I wonder where to begin. I would say first thing is get a series of > "auditing" tools such as, for example, the port scanner nmap, to test > the firewall on the server. Any other ideas for that? > > The firewall: CentOS includes a default firewall, where ports can be > chosen using a simple graphical (or ncurses) tool. Is that solid enough > for a web server? Or do you recommend diving into the innards of > iptables? Or maybe, other solution, can you recommend some good > "reasonable" set of rules for a web server, for example? > > Last but not least: SELinux. For the moment I don't use it. I read the > chapter on SELinux in "Red Hat Enterprise Linux 5 Unleashed" by Tammy > Fox, and I simply wonder if it's worth the pain. I'm curious about your > opinions about this subject. > > Maybe some good reads on security? That is, articles that don't require > you to be a doctor in computer science to get a grasp of the subject? > And also documentation that doesn't require me to have a life expectance > of 500+ years > :oD > > Any suggestions? > > Niki > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos

2 1

Re: [CentOS] General questions about security
by Ross S. W. Walker 01 Feb '08

01 Feb '08

Check to see if the town/county has any policies in place for computer systems and networks for public services and follow those guidelines. Otherwise look at surrounding public library systems to see if they have any you can adopt. For a LAMP setup your definitely going to want to use selinux to limit what each application can read and write to, and you should use audit too to set auditing on sensitive directories like, /etc, /bin, /lib, /sbin, /usr/bin, /usr/lib, /usr/sbin. You will probably want to use smartmon to monitor drive health and something else to monitor resource usage (drive space, memory, cpu, mysql db space) with email/sms alerts. -Ross ----- Original Message ----- From: centos-bounces(a)centos.org <centos-bounces(a)centos.org> To: CentOS mailing list <centos(a)centos.org> Sent: Fri Feb 01 06:47:36 2008 Subject: Re: [CentOS] General questions about security Les Bell a écrit : > Policy. It's a drag, writing policies, but without policies, you're in the > "Ready! Fire! Aim!" school of security. The top tier of policy is the > "Enterprise Security Policy", which establishes the security function, > roles, responsibilities, budget, etc. It also gives the power to enforce > penalties for breaches of policies. At the next tier, you have system- and > issue-specific policies, such as the "Use of corporate email" policy, the > "Inappropriate content in the workplace" policy. You may then move down to > standards (platforms, SOE, etc.) and procedures (e.g. for provisioning user > accounts, resetting passwords, etc.). <snip> Thanks for your very detailed response. Though I can't help feeling a bit like having asked for an identity photo... and getting a 10-foot oil painting :oD Basically, all I'm concerned about security-wise is a modest Apache/PHP/MySQL server running a single public library management software, and interconnecting eleven (small) public libraries, with a total of 60.000 database entries. No (very) big deal. The configuration is supposed to run on a dedicated server, so my question will be more practical: - Is it worth the hassle to bother with SELinux? - Is the standard firewall configuration enough, or do I really have to fine-tune the thing? - Basically, what auditing tools besides NMap can you recommend for such a thing? cheers, Niki _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos ______________________________________________________________________ This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender and permanently delete the original and any copy or printout thereof.

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2008