Discuss January 2010

discuss@lists.centos.org

296 participants
322 discussions

Securing http authentication from brute force attacks
by James B. Byrne 11 Jan '10

11 Jan '10

We have several web applications deployed under Apache that require a user id / password authentication. Some of these use htdigest and others use the application itself. Recently we have experienced several brute force attacks against some of these services which have been dealt with for the nonce by changes to iptables. However, I am not convinced that these changes are the answer. Therefore I have been looking at http protection and have run across a few independently provided modules for Apache http security, mod_security being one of them. I would like the opinion of other CentOS sysadmins who already have faced this same problem, with respect to the solutions available and those that they choose for themselves. Sincerely, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

Select pam module for select users
by yanagik317 11 Jan '10

11 Jan '10

Dear CentOS people, Maybe I didn't read enough, but is there a way to use pam_ldap for some users (w/o trying pam_krb5 first, which is listed before pam_ldap) and pam_krb5 for others. Thank you, --Koji

1 0

2 CPU's problem(Centos5)
by Anas Alnaffar 11 Jan '10

11 Jan '10

Dears, I hope this email finds you well and in a very good health, I've been installed Centos5 on HP DL380 G5 server(Dual Processor), but actually we are unable to see the other CPU, during boot I get this error message, Module microcode doesn't exit /proc/modules Please advise. Thanks Anas Al-Naffar Anas Al-Naffar Content Manager Tel.: +966 1 2177777 Fax: +966 1 4643 510 Mobile: +966 5 62982104 Riyadh - KSA www.tijaritelecom.com cid:image002.jpg@01C96449.3023C2D0

5 12

Problems with IPTABLES recent module.
by James B. Byrne 11 Jan '10

11 Jan '10

I went to reload (iptables-restore) my iptables configuration and obtained an error at the COMMIT statement. No further details were provided even when I ran restore with the -v option. I determined that none of my backed up configuration files going back to October will load either. This is more than passing strange because I altered and uploaded the iptables configuration on this host several times in December alone. These alterations certainly applied without error at the time. Through painful trial and error (it is a fairly large configuration) I discovered that I cannot add any rule using the __recent__ module. Adding a single rule referencing that module inevitably results in a load error reported at the following COMMIT statement. An example of an actual rule that fails follows: . . . :BRUTE_FORCE - [0:0] . . . -A BRUTE_FORCE -p tcp -m tcp -m state -m recent --set -i eth0 --dport 22 --state NEW -A BRUTE_FORCE -m comment -j RETURN --comment "Return to calling chain" COMMIT Perhaps I am missing something obvious but as far as I can determine the rule using the recent module should simply add all traffic coming in over i/f eth0 consigned to port 22 on any ip-addr to the DEFAULT list. I do not expect it to give an error. If I remove this statement then the iptables file loads without error. An interesting thing happens if I simply add a trailing -j to the end of recent module rule above. It fails with this specific error: -c packet counter not numeric Does anyone see what I am doing wrong? Sincerely, -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 5

apache httpd, webdav, ssl - something is wrong, but what?
by Götz Reinicke - IT-Koordinator 11 Jan '10

11 Jan '10

Hi, happy new year! Today I set up a new web(dav) server for our .ical-System (phpIcalendar) and copied the config and data files from the old server. But somthing is wrong with the configuration and I'm blind to find the error. On the old server, I can still publish my calender from e.g. Apple iCal at the server URL with http http://oldserver.filmakademie.de/DAVdocs On the new server, I can publish only with https - so only ssl secured. https://newserver.filmakademie.de/DAVdocs The webpage for the calendars can be accessed unsecured with http. http://oldserver.filmakademie.de/ http://newserver.filmakademie.de/ Thanks for any hint or support or suggestion to find the error. -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Staatsrätin für Demographischen Wandel und für Senioren im Staatsministerium Geschäftsführer: Prof. Thomas Schadt

1 0

Cloned Centos Boxes - First Run to run again?
by Mr Gabriel 11 Jan '10

11 Jan '10

I need to build a bank of 12 centos boxes, for an experiment I'm doing. I don't want to install centos 12 times, I'm using virtual box across three machines, how can I get the first run scripts to run again to that the box is reconfigured on it's next boot. I want each box to appear like a fresh unique install.

5 5

SNAT
by David Hláčik 11 Jan '10

11 Jan '10

Hello I will briefly draw the situation Router with one interface eth0 , to local network 10.123.0.0/16 on a local network ADSL modem with IP 10.123.10.11 I want to use 10.123.10.11 as a connection to internet . Because of that I have created default route "ip route add default via 10.123.10.11 dev eth0" I do not want my ADSL modem to do NATing , since it shows to be slow. I have configured static route on ADSL modem "10.123.0.0/16 via 10.123.10.11" which ensures traffic comming from internet will ge to my router. Now i want to configure NATTING. My concern is, how to create iptables rule which will match only the traffic going via 10.123.10.11 and only for this will make SNAT. If I will do iptables -A POSTROUTING -o eth0 --j SNAT --to-source 213.194.242.198 this will not work . I need to add there a magic words that only traffic going via 10.123.10.11 should be SNATted. Please help, Thank you in advance. David

3 4

interfaces start-up order
by David Hláčik 10 Jan '10

10 Jan '10

Hello guys, On my Centos5 interfaces start in this order : eth0,eth1,eth2,ppp0 I believe it goes by alpabethical order. Is there a possibility to change this order? I want to start interfaces which connects to internet first , i.e. in order eth0,ppp0,eth1,eth2. Can I just rename ifcfg-* scripts in etc/sysconfig/network-scripts and change alphabetical order? Thank you and Best Regards, David

2 1

ADSL ppp0, persist
by David Hláčik 10 Jan '10

10 Jan '10

Hello guys, I have two ISP's connected to my router. One via eth2, second one via ADSL modem, with ppoe doing on my Centos 5 . The problem I have is, that when ADSL fails , interface ppp0 is removed. This also removes my static routes configured for this interface. I do not want that, as I have load balancing configured and default route is removed when ppp0 interface disapears. This is my ifcfg-ppp0 config : USERCTL=yes BOOTPROTO=dialup NAME=DSLppp0 DEVICE=ppp0 TYPE=xDSL ONBOOT=yes PIDFILE=/var/run/pppoe-adsl.pid FIREWALL=NONE PING=. PPPOE_TIMEOUT=80 LCP_FAILURE=3 LCP_INTERVAL=20 CLAMPMSS=1412 CONNECT_POLL=6 CONNECT_TIMEOUT=60 DEFROUTE=no SYNCHRONOUS=no ETH=eth0 PROVIDER=DSLppp0 USER=O2 PEERDNS=no DEMAND=no PERSIST=yes As you can see, I have PERSIST=yes , which according to documentation should keep ppp0 interface ON. Well it does but only for a couple of seconds. I suspect this to be other parameters problem (CONNECT_TIMEOUT or PPPOE_TIMEOUT). Can you please help me with this? Thank you in advance! David

2 1

Centos5(Oracle10gDB)high load average
by Anas Alnaffar 10 Jan '10

10 Jan '10

Hello I've installed oracle DB and oracle application 10g with Cetnos5(HP Dl380 Dual Processor), but always I have big load average(CPU not id), plz advise Thanks Anas Al-Naffar

6 6

← Newer
1
...
21
22
23
24
25
26
27
...
33
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2010