Discuss January 2009

discuss@lists.centos.org

272 participants
261 discussions

Re: [CentOS] Support for i7 architecture?
by Les Bell 23 Jan '09

23 Jan '09

"Michael St. Laurent" <mikes(a)hartwellcorp.com> wrote: >> I hate that stupid thing but the suits have insisted on it. My apologies for any implied insult. << Just so you know, such disclaimers are *all* bluster and have no legal force whatsoever (with one exception: privileged attorney-client communications). If someone is silly enough to mis-route an email to me, it's their problem and they cannot enforce any contractual obligations on me whatsoever, since no contract exists (I didn't invite the email and there is no exchange of considerations). Even the ITAR stuff is BS - it;s *your* company's responsibility to control such information and it means nothing to anyone else - especially us "foreign persons". ;) All these disclaimers do is further reduce the signal/noise ratio of the SMTP protocol. . . Best, --- Les Bell, RHCE, CISSP, M.Info.Tech. (System Security) [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

1 0

Re: [CentOS] Antivirus for CentOS? (yuck!)
by Les Bell 23 Jan '09

23 Jan '09

Adam Tauno Williams <awilliam(a)whitemice.org> wrote: >> CLAMAV, or any package, isn't THE answer, it is part of an answer. And PCI/DSS requires a server be scanned on a regular basis. Fighting against that directive just makes no sense. You should scan an entire system on some interval regardless of OS. << It's worth noting that the type of scan required by PCI DSS is not a filesystem scan by an antivirus product. It is a vulnerability scan performed by an Approved Scanning Vendor. Some other miscellanous points triggered by posts in this thread that I've read this morning: According to the Verizon 2008 Data Breaches Report, in over 90% of cases where a successful attack exploited a vulnerability, there was a patch available for at least six months prior to the breach. So the first thing we can say is that there is good reason to patch your system - it's definitely an effective activity. While the most popular attack methods of cybercriminals are hacking and malcode (again, the Verizon report confirms this), malcode is much more popular in the Windows world and hacking is the method of choice against Linux boxes, imho (SSH brute-forcing worms notwithstanding). This means that anti-virus products will be less effective in safeguarding the data on a Linux box, and host intrustion detection systems are correspondingly more effective. Most attacks against servers are conducted against the application layer code (PHP vulnerabilities, especially, but also SQL injection, etc.) Again, anti-virus products are not effective here, particularly since the original poster seems to be running custom code (internally-developed or outsourced). The best controls here will be HIDS like AIDE and Tripwire, as well as network IDS. An attacker who exploits a server might upload some recognisable malware, and an anti-virus scanner might pick it up, but I'm not sure whether (e.g.) ClamAV has signatures for stuff like eggdrop IRC servers, phishing sites and other stuff sometimes turns up on compromised hosts. The bulk of the signature database is undoubtedly Windows malware. However, a determined attacker, who knows what the server hosts, is much more likely to either use SQL injection or command injection techniques to extract credit card info (use NIDS to detect this) or to install a rootkit to allow him to come and go more easily (and HIDS will detect this). Remember, there are two problems to be solved here: a) Get the systems past the PCI-DSS Assessor b) Do something useful to actually protect the systems It would be great if both problems had the same solution, but that depends on how clueful the Assessor is (and how artfully the original poster can "manage" him). Right now, the original poster's employer is paying him to solve a), and will probably only worry about b) much later, should the excrement actually hit the fan. If installing ClamAV is what it takes to solve a), just do it and then get to work on b). Best, --- Les Bell, RHCE, CISSP, M.Info.Tech (Systems Security) [http://www.lesbell.com.au] Tel: +61 2 9451 1144 FreeWorldDialup: 800909

1 0

lvm metadata recovery
by Brian Krusic 23 Jan '09

23 Jan '09

Hi all, I am looking for a way to recover my primary VolGroup00 that has my root partition. Here is my scenario; 1 - I add an external drive to my VolGroup00 which is sdc1. 2 - I make that external drive a snapshot of my / 3 - After I remove that new volume of sdc1 using lvremove, all os fine. 4 - When I turn off the sdc1 drive, I loose my VolGroup00. If by chance, the sdc1 breaks in such a way that the system doesn't se it any more and the system happens to reboot, it will longer recognize a VolGroup00 and therefore not boot. I backed up my original /etc/lvm to /etc/lvm.backup and would like to know how I can restore it from booting to a LiveCD and simply restoring the files located in /etc/lvm.back/backup/VolGroup00 which is my original metadata config. - Brian

1 0

RHEL 5.3 released
by Pasi Kärkkäinen 23 Jan '09

23 Jan '09

Hello list! http://www.redhat.com/about/news/prarchive/2009/rhel_5_3.html kernel (2.6.18-128.el5) changelog: http://rhn.redhat.com/errata/RHSA-2009-0225.html -- Pasi

14 16

OT: Infrastructure Documenting
by Joseph L. Casale 23 Jan '09

23 Jan '09

We are moving all our (limited and badly organized) documentation to a wiki. Anyone got any examples/pointers to a hierarchy that made logical sense? We are hoping to move everything from topology to application specific notes in to the wiki. Given the size of this task, I only want to do this once:) Thanks for any reco's! jlc

3 2

Re: [CentOS] Antivirus for CentOS? (yuck!)
by David G. Miller 23 Jan '09

23 Jan '09

Amos Shapira <amos.shapira(a)gmail.com> wrote: > Hi All, > > Yes, I know, it's really really embarrassing to have to ask but I'm > being pushed to the wall with PCI DSS Compliance procedure > (http://en.wikipedia.org/wiki/PCI_DSS) and have to either justify why > we don't need to install an anti-virus or find an anti-virus to run on > our CentOS 5 servers. > > Whatever I do - it needs to be convincing enough to make the PCI > compliance guy tick the box. > > So: > > 1. Has anyone here gone though such a procedure and got good arguments > against the need for anti-virus? > 2. Alternatively - what linux anti-virus (oh, the shame of typing this > word combination :() do you use which doesn't affect our systems > performance too much. > > The reviewed servers run both Internet-facing web applications and > internal systems, mostly using proprietary protocol for internal > communications. They are being administrated remotely via IPSec VPN > (and possibly in the future also OpenVPN). > > Thanks, > > --Amos After reading all of the other replies (including the ones that pointed out that the PCI DSS requirement had changed the terminology from "virus" to "malware"), why not claim you are meeting the requirement by doing something useful like running chkrootkit or rkhunter on a regular basis? That way you would be scanning the systems for the only malware known to actually pose a threat to a Linux box. It may be a low probability of infection (as others have pointed out) but should satisfy the auditor and hopefully will just be a low cost exercise in futility as long as reasonable security policies are followed. Cheers, Dave -- Politics, n. Strife of interests masquerading as a contest of principles. -- Ambrose Bierce

2 1

disable rquotad and pop
by Jerry Geis 22 Jan '09

22 Jan '09

> > Jerry Geis wrote on Thu, 22 Jan 2009 09:22:16 -0500: > > >/ for rquotad /etc/sysconfig/nfs has it quoted out but yet it is running? > />/ How do I disable it? > />/ > />/ also what about pop? > / > service name start/stop > > chkconfig name off to disable starting > Sure I familiar with those commands, problem is there is not rquota service... SO these dont help. I did do service nfs stop I changed /etc/sysconfig/nfs removed all RQUOTAD lines and added RQUOTAD="no" service nfs start however I still have an rpc.rquotad running. AHHH... What am I missing? Thanks, Jerry

2 1

disable rquotad and pop
by Jerry Geis 22 Jan '09

22 Jan '09

Hi all, I am trying to find out how to disable rquotad and pop (port 443) for rquotad /etc/sysconfig/nfs has it quoted out but yet it is running? How do I disable it? also what about pop? Jerry

2 2

help with udev rules needed
by rray_1＠comcast.net 22 Jan '09

22 Jan '09

I am migrating from Fedora 8 to CentOS 5.2 I have usb dvd On F8 I have /etc/udev/rules/00-my-custom.rules BUS=="scsi", SYSFS{vendor}=="TSSTcorp", SYSFS{model}=="CDDVDW SH-S203N ",SYMLINK="dvd",OWNER="rray" When I plug in dvd I get $ ll /dev/scd1 lrwxrwxrwx 1 root root 3 Aug 25 08:17 /dev/scd1 -> sr1 ll /dev/sr1 brw-r----- 1 rray disk 11, 1 2009-01-21 12:29 /dev/sr1 Everything is ok On C5.2 I have /etc/udev/rules/00-my-custom.rules BUS=="scsi", SYSFS{vendor}=="TSSTcorp", SYSFS{model}=="CDDVDW SH-S203N ",SYMLINK="dvd",OWNER="rray" When I plug in dvd I get # ll /dev/scd0 brw-rw---- 1 root disk 11, 0 Jan 21 12:30 /dev/scd0 I have also tried MODE="0666" and it also has no affect I have checked "udevinfo -a -p $(udevinfo -q path -n /dev/scd0/1)" on both machines and they are the same Any suggestions Thanks Richard Ray

2 5

Issues with Ldap client on Centos 5
by ankush grover 22 Jan '09

22 Jan '09

Hi Friends, We are running some of the Centos 5 32 bit, 5.2 64-bit systems. These systems are ldap clients and the ldap server is Windows 2003 Server. Sometimes 1 or 2 services on these servers sucks 100% cpu and the load becomes high on the server. Below is an example where one the httpd process was eating 100% cpu and we took dump of this process gcore 17711 Core was generated by `/usr/sbin/httpd'. #0 0x00002ad1849cd997 in ldap_chase_v3referrals () from /usr/lib64/libldap-2.3.so.0 (gdb) bt full #0 0x00002ad1849cd997 in ldap_chase_v3referrals () from /usr/lib64/libldap-2.3.so.0 No symbol table info available. #1 0x00002ad1849bc4dd in ldap_msgdelete () from /usr/lib64/libldap-2.3.so.0 No symbol table info available. #2 0x00002ad1849bceb0 in ldap_result () from /usr/lib64/libldap-2.3.so.0 No symbol table info available. /etc/ldap.conf file host dc.example.com base ou=users,dc=example,dc=com binddn cn=ldap,ou=extra accounts,dc=example,dc=com bindpw QrQcepFKHR6wGNXu4 scope sub ssl no nss_base_passwd dc=example,dc=com?sub nss_base_shadow dc=example,dc=com?sub nss_base_group dc=example,dc=com?sub nss_map_objectclass posixAccount user nss_map_objectclass shadowAccount user nss_map_attribute uid sAMAccountName nss_map_attribute uidNumber UidNumber nss_map_attribute gidNumber GidNumber nss_map_attribute loginShell LoginShell nss_map_attribute gecos name nss_map_attribute userPassword unixUserPassword nss_map_attribute homeDirectory unixHomeDirectory nss_map_objectclass posixGroup Group nss_map_attribute uniqueMember msSFU30PosixMember nss_map_attribute cn cn pam_login_attribute sAMAccountName pam_filter objectclass=user pam_password md5 timelimit 0 sizelimit 0 tls_cacertdir /etc/openldap/cacerts There are 2 bugs listed on the redhat site but no solution for this problem has been provided. https://bugzilla.redhat.com/show_bug.cgi?id=222667 https://bugzilla.redhat.com/show_bug.cgi?id=474181 Thanks & Regards Ankush

2 1

← Newer
1
...
8
9
10
11
12
13
14
...
27
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2009