Discuss November 2010

discuss@lists.centos.org

259 participants
220 discussions

Centos 4 and cgiemail
by Todd Cary 22 Nov '10

22 Nov '10

I am running Centos 4 and want to run cgiemail in a directory under the web application. The setting of the "value" property in the <form> is tricky, but I have the web application running on other servers without a problem. On my server I get the error that it cannot find the file pointed to by the value in the <form>. My question is whether or not I need to do something special like install an application on the server or do something special with permissions (the cgiemail is owned by apache and has 775 for permissions). The web app is in the "interact" folder with the cgiemail in cgi-bin under it. Works on other servers. Many thanks... Todd -- Ariste Software Petaluma, CA 94952 http://www.aristesoftware.com

2 5

LDAP clients fail to connect with SSL enabled
by bluethundr 21 Nov '10

21 Nov '10

I am attempting to setup SSL/TLS support on my openLDAP 2.4 server on FreeBSD. LBSD2# pkg_info | grep openldap openldap-sasl-client-2.4.23 Open source LDAP client implementation with SASL2 support openldap-sasl-server-2.4.23 Open source LDAP server implementation I put my cert file, key file and CA certfile in a directory called /usr/local/etc/openldap/cacerts Here's how it looks: [root@LBSD2:/usr/local/etc/openldap/cacerts]#ls -l total 48 dr--r----- 2 root ldap 512 Nov 21 17:12 bak -r--r----- 1 root ldap 1960 Nov 21 07:05 bsd2.summitnjhome.com.crt -r--r----- 1 root ldap 4604 Nov 21 17:16 gd_bundle.crt -r--r----- 1 root ldap 4689 Nov 21 18:59 sf_bundle.crt -r--r----- 1 root ldap 1537 Nov 21 17:16 sf_issuing.crt -r--r----- 1 root ldap 1090 Nov 21 12:29 slapd.csr -r--r----- 1 root ldap 1743 Nov 21 12:26 slapd.key -r--r----- 1 root ldap 1675 Nov 21 17:25 slapd.pem My cert flie is a GoDaddy turbo-ssl certfile named bsd2.summitnjhome.com.crt. slapd.key is the key file and slapd.pem is the same thing only with the password removed. I'm a little unsure of which CA file to use but I think that sf_issuing.crt _should_ work as this is the CA file that I used to setup a similar SSL enabled LDAP server for a client recently. Although I have tried all three CA files in this directory: (gd_bundle.crt, sf_bundle.crt, and sf_issuing.crt). I put the various cert/key files into my slapd.conf file like this: LBSD2# cat slapd.conf | grep -i tls ## TLS options for slapd TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /usr/local/etc/openldap/cacerts/bsd2.summitnjhome.com.crt TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/slapd.pem TLSCACertificateFile /usr/local/etc/openldap/cacerts/sf_issuing.crt Slapd restarts cleanly! LBSD2# /usr/local/etc/rc.d/slapd restart Stopping slapd. Waiting for PIDS: 81924. Starting slapd. Then I attempt to setup a virtual instance of CentOS 5.5 on the client side and that's where things fall apart...I attempt to ssh to localhost as an LDAP account: [root@VIRTCENT08:/etc/openldap/cacerts]#ssh bluethundr@localhost [...tectonic plates drift, careers begin and end, babies learn to walk, talk and grow to adulthood..] Connection closed by 127.0.0.1 [root@VIRTCENT08:/etc/openldap/cacerts]#getent passwd | grep ldapAccount [same interminable wait as above] This is what my /etc/ldap.conf file looks like on the client: [root@VIRTCENT08:/etc/openldap/cacerts]#cat /etc/ldap.conf # Your LDAP server. Must be resolvable without using LDAP. # Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on # whether your LDAP client library supports configurable # network or connect timeouts (see bind_timelimit). #host 127.0.0.1 # The distinguished name of the search base. base dc=summitnjhome,dc=com # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=manager,dc=example,dc=com # The port. # Optional: default is 389. #port 389 # Search timelimit #timelimit 30 timelimit 120 # Bind/connect timelimit #bind_timelimit 30 bind_timelimit 120 # Idle timelimit; client will close connections # (nss_ldap only) if the server has not been contacted # for the number of seconds specified below. #idle_timelimit 3600 idle_timelimit 3600 # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control uri ldap://ldap.summitnjhome.com/ ssl start_tls tls_cacertdir /etc/openldap/cacerts pam_password crypt This is how my nsswitch on the client side is setup: passwd: files ldap shadow: files ldap group: files ldap And here is the cert dir on my CentOS client: [root@VIRTCENT08:/etc/openldap/cacerts]#ls -l total 72 lrwxrwxrwx 1 root root 13 Nov 21 09:44 97552d04.0 -> gd_bundle.crt lrwxrwxrwx 1 root root 14 Nov 21 09:44 b737b221.0 -> sf_issuing.crt dr--r--r-- 2 root root 4096 Nov 21 2010 bak -r--r--r-- 1 root root 1960 Nov 21 07:05 bsd2.summitnjhome.com.crt lrwxrwxrwx 1 root root 25 Nov 21 09:44 c75be861.0 -> bsd2.summitnjhome.com.crt -r--r--r-- 1 root root 4604 Nov 21 2010 gd_bundle.crt -r--r--r-- 1 root root 1537 Nov 21 2010 sf_issuing.crt -r--r--r-- 1 root root 1090 Nov 21 12:29 slapd.csr -r--r--r-- 1 root root 1743 Nov 21 12:26 slapd.key -r--r--r-- 1 root root 1675 Nov 21 2010 slapd.pem Back on the server side there is a lot of activity in the ldap logs (here is an excerpt) Nov 21 20:21:38 LBSD2 slapd[81972]: daemon: read activity on 11 Nov 21 20:21:38 LBSD2 slapd[81972]: daemon: select: listen=6 active_threads=0 tvp=NULL Nov 21 20:21:38 LBSD2 slapd[81972]: daemon: select: listen=7 active_threads=0 tvp=NULL Nov 21 20:21:38 LBSD2 slapd[81972]: connection_read(11): input error=-2 id=1017, closing. Nov 21 20:21:38 LBSD2 slapd[81972]: connection_closing: readying conn=1017 sd=11 for close Nov 21 20:21:38 LBSD2 slapd[81972]: daemon: activity on 1 descriptor I've encloses a more complete log file as an attachment. I then try to show the CA files with an openssl command. First with sf_issuing.crt - slapd.conf: TLSCACertificateFile /usr/local/etc/openldap/cacerts/sf_issuing.crt On the client: [root@VIRTCENT08:/etc/openldap/cacerts]#openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile sf_issuing.crt CONNECTED(00000003) 3143:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188 Next with sf_bundle.crt - slapd.conf: TLSCACertificateFile /usr/local/etc/openldap/cacerts/sf_bundle.crt [root@VIRTCENT08:/etc/openldap/cacerts]#openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile sf_bundle.crt 3149:error:02001002:system library:fopen:No such file or directory:bss_file.c:122:fopen('sf_bundle.crt','r') 3149:error:2006D080:BIO routines:BIO_new_file:no such file:bss_file.c:125: 3149:error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib:by_file.c:279: CONNECTED(00000003) 3149:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: Next with gd_bundle.crt - TLSCACertificateFile /usr/local/etc/openldap/cacerts/gd_bundle.crt [root@VIRTCENT08:/etc/openldap/cacerts]#openssl s_client -connect ldap.summitnjhome.com:389 -showcerts -CAfile gd_bundle.crt CONNECTED(00000003) 3156:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: Disabling TLS on the client side authentication works again! [root@VIRTCENT08:/etc/openldap/cacerts]#ssh bluethundr@localhost bluethundr@localhost's password: Last login: Sun Nov 21 09:41:34 2010 from 192.168.1.50 ######################################################### # SUMMITNJHOME.COM # # TITLE: VIRTCENT08 BOX # # LOCATION: SUMMIT BASEMENT # # # ######################################################### Any thought on how to resolve the current situation would be most appreciated! ;) -- Here's my RSA Public key: gpg --keyserver pgp.mit.edu --recv-keys 5A4873A9 Share and enjoy!!

1 0

Auto-Re: CentOS Digest, Vol 70, Issue 20
by 韦加宁 21 Nov '10

21 Nov '10

信已收到,谢谢!

2 1

Auto-Re: CentOS Digest, Vol 70, Issue 21
by 韦加宁 21 Nov '10

21 Nov '10

信已收到,谢谢!

1 0

Old thread:how many people still use NIS?
by Nico Kadel-Garcia 21 Nov '10

21 Nov '10

Good morning! I've been offlist for years, and hopping back on for various reasons, I see a thread that I'd like to add to. There's an old thread on NIS use in Centrify that I'd like to add some comments to. I'm still forced to work with NIS for various reasons, including interaction with heavy duty NAS's that require it for NFSv4. I have been busy falling in serious love with Centrify (www.centrify.com) for this. For an environment that already has an extensive Active Directory investment, it's a way to save weeks or months of expensive engineering time and get on with your job. It's a commercial toolkit, reasonably open source friendly and with free components for home users. It provides a very good plug-and-play solution to merging Linux and UNIX authentication, including NIS support, to an Active Directory back end. They basically do what I'd do if I had the time, including workable GUI's and error reporting. You get genuine single-sign-on, commercially supported Putty for your Windows clients, Kerberos password handling, commercially supported OpenSSH 5.x with GSSAPI, good support for multiple "zones" that have different sets of authorized users, scriptable toolkits for adding or adding machines to the relevant zones, etc., etc. It works well with CentOS 5.x, and saves me the work of having to manually compile my own OpenSSH to get GSSAPI support. And the NIS plugin works *very* well and saves weeks of work building your own solution with the limited and out of date components in CentOS or RHEL 5. It "Just Works(tm)".

1 0

PATA Hard Drive woes
by Keith Roberts 21 Nov '10

21 Nov '10

Hi All. Yesterday I was installing Centos 5.5 to my web server, and it looks like the main hard drive has gone AWOL. Fedora 12 put the file system into r/o mode. The drive is an Hitachi, still under warranty. There are bad sectors on it, and running the Hitachi DFT tool confirms this. Also I cannot repair the bad sectors. Would this be caused by a faulty I/O chip, or is it safe to say it's definately the HDD at fault? Kind Regards, Keith Roberts -- In theory, theory and practice are the same; in practice they are not. This email was sent from my laptop with Centos 5.5

12 30

Old metadata for centosplus 4 repo.
by I.Piasecki 20 Nov '10

20 Nov '10

Hi Centos maintainers ! Could You please refresh repo data for centosplus reposytory 4 ? There are new kernels rpms, but repo index files arn't updated. Please fix that. For example: http://mirror.centos.org/centos/4/centosplus/x86_64/ rpm from 20 oct 2010 but meatadata from 28 sep 2010 ... P.S: That was 17 nov 2010 fixed for centosplus 5 repo, but centosplus 4 was omitted. Best regards, -- Ireneusz Piasecki

2 1

centos 5.5--gnome desktop--all icons disappeared.
by fred smith 20 Nov '10

20 Nov '10

gang, I feel dumb having to ask this... I've got a Centos 5.5 installation (it's not new, I've been using it for over a year on this machine) and all of a sudden just a few minutes ago everything on the gnome desktop disappeared. no icons, right-click doesn't bring up a context menu. the panels are still there, though, thank goodness. tried logging off and back on but that didn't help. I'm perusing the centos forums for clues, and thought I should ask all of you too in parallel. Suggestions appreciated, thanks in advance! Fred -- ------------------------------------------------------------------------------- Under no circumstances will I ever purchase anything offered to me as the result of an unsolicited e-mail message. Nor will I forward chain letters, petitions, mass mailings, or virus warnings to large numbers of others. This is my contribution to the survival of the online community. --Roger Ebert, December, 1996 ----------------------------- The Boulder Pledge -----------------------------

2 2

kickstart raid disk partitioning
by Roberto Nunnari 20 Nov '10

20 Nov '10

Hello. A couple of years ago I installed two file-servers using kickstart. The server has two 1TB sata disks with two software raid1 partitions as follows: # cat /proc/mdstat Personalities : [raid1] md1 : active raid1 sdb4[1] sda4[0] 933448704 blocks [2/2] [UU] md0 : active raid1 sdb1[1] sda2[2](F) 40957568 blocks [2/1] [_U] Now the drives are starting to be failing and next week I'll backup /homes, reinstall OS with kickstart, and finally restore /homes. There's a problem with how the kickstart process partitions the disks, though. As you may have noticed above, md0 is made up of sdb1 and sda2. Could anybody help me understand how to make the partitions on the two drives identical still using kickstart? Here's the relevant part from the kickstart file: zerombr yes clearpart --all --initlabel bootloader --location=mbr part /boot --fstype ext3 --size 250 --asprimary --ondisk sda part swap --size 2048 --asprimary --ondisk sda part raid.01 --size 40000 --asprimary --ondisk sda part raid.03 --size 1 --grow --asprimary --ondisk sda part /boot2 --fstype ext3 --size 250 --asprimary --ondisk sdb part swap --size 2048 --asprimary --ondisk sdb part raid.02 --size 40000 --asprimary --ondisk sdb part raid.04 --size 1 --grow --asprimary --ondisk sdb raid / --level=1 --device=md0 --fstype ext3 raid.01 raid.02 raid /home --level=1 --device=md1 --fstype ext3 raid.03 raid.04 ..but here's the produced partitioning on the two drives: # parted /dev/sda print Disk geometry for /dev/sda: 0.000-953869.710 megabytes Disk label type: msdos Minor Start End Type Filesystem Flags 1 0.031 251.015 primary ext3 boot 2 251.016 40248.786 primary ext3 raid 3 40248.787 42296.132 primary linux-swap 4 42296.133 953867.219 primary ext3 raid # parted /dev/sdb print Disk geometry for /dev/sdb: 0.000-953869.710 megabytes Disk label type: msdos Minor Start End Type Filesystem Flags 1 0.031 39997.771 primary ext3 boot, raid 2 39997.771 42045.117 primary linux-swap 3 42045.117 42296.132 primary ext3 4 42296.133 953867.219 primary ext3 raid I'm not asking because I'm picky, but just because, it would have made my life easier to fix bad blocks on disks by dd from good block on disk1 to bad block on disk2, and as next week I'll reinstall, I'd prefer to do it the right way. Some more bits about my environment: # cat /etc/redhat-release CentOS release 4.8 (Final) # uname -rms Linux 2.6.9-89.0.18.ELsmp i686 Thank you and best regards. Robi

5 14

juniper netscreen (ssg5) and centos
by aurfalien＠gmail.com 20 Nov '10

20 Nov '10

Hi all, Lookin to do an IPSEC VPN between a Juniper SSG5 and Centos 5.5. Reading some docs that ref /etc/ipsec-tools.conf but they do not exist on my box being Centos 5.5. The package ipsec-tools is installed and I'm guessing /etc/racoon/ racoon.conf is what I am looking for. Anyways, some help would be very appreciated. - aurf

1 0

← Newer
1
...
7
8
9
10
11
12
13
...
22
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2010