Discuss February 2011

discuss@lists.centos.org

267 participants
208 discussions

RECALL: http://www.securityweek.com/high-severity-bind-vulnerability-advisory-issued
by Larry Vaden 24 Feb '11

24 Feb '11

On Wed, Feb 23, 2011 at 11:27 AM, Larry Vaden <vaden(a)texoma.net> wrote: > US-CERT encourages users and administrators using the affected > versions of BIND to upgrade to BIND 9.7.3. > > Optionally, one can wait on a backport. This message is RECALLED even though: 1) US-CERT used the word "affected." 2) the "optionally" was directed to those who might have used RHEL/CentOS' excellent facility to draw in code from other repos.

9 8

redirecting traffic using iptables
by Jobst Schmalenbach 24 Feb '11

24 Feb '11

Hi. I have two internet connections, the ADSL2+ is very very cheap (but fast 10mb) and I want to use the SHDSL (2mb) only for mail,ssh,http OUT and the ADSL2+ only for surfing. I all works fine if people specify the proxy in the browser, but in case like flash it of no use. Further if I can make the 80/443 traffic go through the proxy only, its an added bonus. If this can be done, fine. Bue I want all 80/443 traffic go through host2. SHDSL ADSL2+ ------ ------- host 1 host2 SQUID ------ ------- | | ------------ host3 ------------ | eth1 On host 3 I have been trying to do this with IPtables, but I am stuck, I tried to utilise squid too, does not work tried: iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to $PROXY:3128 iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to $PROXY:3128 browser tell me "invalid request". All I want is to redirect all traffic through host2 if ports 443 and 80 are encountered, thats all. If it goes through the proxy it is an added bonus, but not required. ANy ideas, anyone? Jobst -- 'Two things are infinite: the universe and human stupidity, and I'm not sure about the first one. - Albert Einstein | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

3 3

Unicode in C++
by Michael D. Berger 24 Feb '11

24 Feb '11

On my CentOS box, in C++ programs, is there a way to print Unicode characters? Thanks, Mike.

7 10

Air Conditioning - ON!
by John Hinton 23 Feb '11

23 Feb '11

All, (and please do not turn this into the next long thread) We have a small team which volunteers their time to create the CentOS releases. They are pounded right now with getting that done... it is as simple as that. Each of us 'chose' to use CentOS and with that choice comes nothing more. Why are we complaining? To me, it is all very self-centered. Basically we're all complaining because we 'want' something. And yes, I'm on edge wanting something as well... but that is life with RedHat in general. Some of the suggestions made: 1. Send money. OK, so using a very loose or reapplied definition of a word... we want to 'prostitute' the CentOS team. In other words, if we send money we have the 'right' to gripe and press for rapid releases? Demand services? 2. Add more staff. As a small business owner, the very last thing you want to do is add more staff when you are in a slammed state. It takes all of the 'productive' workers time to train the new staff and output slows to a crawl. 3. Make any other number of 'helpful' suggestions. Well, I think by now the CentOS team knows better than us how this needs to be done based on infrastructure and team members. And even if they aren't doing it right, we don't get to make demands that it be done differently as this is how they have decided to do it. Remember, you chose CentOS based on how they operate. You can go away if you like. 4. Bringing up other distros that are ahead of CentOS. This just an attempt at indirect pressure on the CentOS team to get a competition going. Only the team gets to choose their competition. CentOS 'rates' how it rates and that is up to the CentOS team and their decisions. Some cheerleading might be welcomed, as long as it doesn't become an "I cheer for you therefore you owe me". 5. MOST IMPORTANT---- discussing this right now is the wrong time. The CentOS team needs to be focused on the builds. They need to 'feel good'. They do not need these distractions, complaints, suggestions, pressures and generally negative comments at this moment in time. If it really bothers you, save it for later and bring it up when things are back to normal loads. Perhaps some good will come out of it, but not now. I know that most mean well, but look inside of yourself and the rush is about something you want... and YOU chose a FREE distro, which just so happens to convert to the paid version very easily. 6,7,8,9 and 10 (fill in your own but keep them to yourself) If I were a member of the CentOS team right now, I'd likely be looking at the door. I positively would be needing to step back and take some time to myself to try to cool off and feel positive about what I'm doing. To me and from what I have heard from the CentOS team, very little of what is being said on the list is helping but instead is counterproductive at the moment. Obviously the team is 'reading' the list and 'obviously' some of us have pushed them further at a very high stress time, than they have ever been pushed before. You may also note that upstream was also 'very late' with these new releases. Could it be we are discovering why? (please don't try to answer that) Please please please... ease up, give them the time they need. Make notes for future conversations, but quit distracting them and making them feel bad. Or, write your scathing reply to a thread... get really down angry and in the dirt... then when you're done, just delete it. CentOS team, I do have just one suggestion (and I have no rights to ask this). It seems that the list goes quiet and waits for a while and then explodes a few days/weeks/months later with this banter. If you would consider a public release to this list, perhaps once per week during major releases with just some tidbit of how things are going, perhaps these threads wouldn't explode. With that would be the need for it to be an announcement or something that does not allow it to become a drawn out thread with hoards of perceived 'helpful' suggestions. I can't blame you for not doing this prior, as I'm sure it will fuel fires such as the one raging at the moment. Is there a way this could be done with a 'no-reply' setting or something? With Much Appreciation, John Hinton

18 24

OT: please moderade or remove Larry Vaden
by Rudi Ahlers 23 Feb '11

23 Feb '11

Can an admin please moderate ALL posts from Larry Vaden, or remove him from the list? -- Kind Regards Rudi Ahlers SoftDux Website: http://www.SoftDux.com Technical Blog: http://Blog.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

1 0

openldap problems authenticating
by Tim Dunphy 23 Feb '11

23 Feb '11

Hello list, I am running an openldap 2.4 server under FreeBSD that was working well until the config was tweaked by someone on the team without properly documenting their work # /usr/local/etc/ldap.con on ldap server (FreeBSD 8.1) host LBSD.summitnjhome.com base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com bindpw {SSHA}secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com # grep for ldap account shows ldap account on the ldap server itself succeeds [root@LBSD2:/usr/local/etc/openldap] #getent passwd | grep walbs walbs:secret/:1002:1003:Walkiria Soares:/home/walbs:/usr/local/bin/bash [root@LBSD2:/usr/local/etc/openldap] #grep walbs /etc/passwd [root@LBSD2:/usr/local/etc/openldap] # # /etc/ldap.conf on ldap client (centos 5.5) host LBSD2.summitnjhome.com base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com bindpw {crypt}secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com # grep getent passwd for ldap account on the client nothing turns up after a long pause [root@LCENT01:~] #getent passwd | grep walbs [root@LCENT01:~] # # nsswitch on the client passwd: files ldap shadow: files ldap group: files ldap sudoers: ldap #hosts: db files nisplus nis dns hosts: files dns # this is what's going on in the logs on the ldap server during th getent from the #client Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 op=0 RESULT tag=97 err=49 text= Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 op=1 UNBIND Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 fd=22 closed Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 fd=22 ACCEPT from IP=192.168.1.42:53811 (IP=192.168.1.44:389) Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=0 BIND dn="cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com" method=128 Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=0 RESULT tag=97 err=49 text= Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=1 UNBIND Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 fd=22 closed #ldap search from the client as the pam services account is able to locate the ldap user info [root@LCENT02:~] #ldapsearch -xH 'ldap://LBSD2.summitnjhome.com' -D 'cn=pam_ldap ,ou=Services,dc=summitnjhome,dc=com' -w 'secret' -b 'dc=summitnjhome,dc=com' '(uid=walbs)' # extended LDIF # # LDAPv3 # base <dc=summitnjhome,dc=com> with scope subtree # filter: (uid=walbs) # requesting: ALL # # walbs, People, summitnjhome.com dn: uid=walbs,ou=People,dc=summitnjhome,dc=com uid: walbs cn: Walkiria Soares givenName: Walkiria sn: Soares mail: walbs(a)example.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 gidNumber: 1003 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 #pam_ldap services account in the ldap directory 3 cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com cn: pam_ldap objectClass: top objectClass: inetOrgPerson sn: PAM userPassword: {SSHA}secret I have also tried doing anonymous binds on the client as well as using plain text passwords. I get the same tag=97 err=49 messages on the client either way. Some advice is sorely needed here. Thank you very kindly in advance! -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 1

massive mirror errors
by John R Pierce 23 Feb '11

23 Feb '11

I'm trying to ... yum groupinstall "Development Tools" on a reasonably current 5.5 system and getting massive mirror failures... is there a problem, or is this my employer's network messing up? (45/74): rpm-build-4.4.2.3-20.el5_5.1.i386.rpm | 302 kB 00:03 http://mirror.singleedge.com/pub/centos/5.5/addons/i386/CentOS/imake-1.0.2-…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.nwresd.org/pub/centos/5.5/addons/i386/CentOS/imake-1.0.2-3.i3…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://hpc.arc.georgetown.edu/mirror/centos/5.5/addons/i386/CentOS/imake-1.…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.its.uidaho.edu/pub/centos/5.5/addons/i386/CentOS/imake-1.0.2-…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.flhsi.com/centos/5.5/addons/i386/CentOS/imake-1.0.2-3.i386.rpm: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.highspeedweb.net/CentOS/5.5/addons/i386/CentOS/imake-1.0.2-3.…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.atlanticmetro.net/centos/5.5/addons/i386/CentOS/imake-1.0.2-3…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://ftp.lug.udel.edu/pub/centos/5.5/addons/i386/CentOS/imake-1.0.2-3.i38…: [Errno 14] HTTP Error 404: Not found Trying other mirror. http://mirror.vcu.edu/pub/gnu%2Blinux/centos/5.5/addons/i386/CentOS/imake-1…: [Errno 12] Timeout: <urlopen error timed out> Trying other mirror. http://mirrors.greenmountainaccess.net/centos/5.5/addons/i386/CentOS/imake-…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.singleedge.com/pub/centos/5.5/addons/i386/CentOS/libXaw-1.0.2…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.nwresd.org/pub/centos/5.5/addons/i386/CentOS/libXaw-1.0.2-8.1…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://hpc.arc.georgetown.edu/mirror/centos/5.5/addons/i386/CentOS/libXaw-1…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.its.uidaho.edu/pub/centos/5.5/addons/i386/CentOS/libXaw-1.0.2…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.flhsi.com/centos/5.5/addons/i386/CentOS/libXaw-1.0.2-8.1.i386…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.highspeedweb.net/CentOS/5.5/addons/i386/CentOS/libXaw-1.0.2-8…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://mirror.atlanticmetro.net/centos/5.5/addons/i386/CentOS/libXaw-1.0.2-…: [Errno 14] HTTP Error 404: Not Found Trying other mirror. http://ftp.lug.udel.edu/pub/centos/5.5/addons/i386/CentOS/libXaw-1.0.2-8.1.…: [Errno 4] IOError: <urlopen error (111, 'Connection refused')> Trying other mirror.

1 1

squashfs in the hundreds of GB range
by Boris Epstein 23 Feb '11

23 Feb '11

Hello listmates, I am running mksquashfs trying to archive a 400GB+ directory. It has already taken about a day and the resultant archive is only about 40GB thus far and the command is not done yet. Has anyone made a squashfs that size? Is it normal for the process to take this long? If it is not - what am I doing wrong. I am using the most basic syntax: mksquashfs <directory name> <image name> The process is running at 100% CPU. Thanks for any and all help. Boris.

1 0

sendmail, port 465/587, auth and imap
by Jobst Schmalenbach 23 Feb '11

23 Feb '11

Hi. Apologies to the list for sending this twice as I forgot to enter a proper subject line, I wanted to write the content first and then make up the subject line ;-) -------------------------------------------------------------------- I am trying to configure sendmail that is looks up the users credentials to allow them to send email via that server via an imap server on the same machine when sending email while on the road. I can send email when specifying a user that is stored in the servers /etc/shadow ... no problem but I cannot get my head around it how to do make saslauth OR sendmail lookup the user via the imap daemon. This is the working config (mc) for the sendmail daemon when using a locally created user (I knock the PLAIN off once I got it to work): define(`confAUTH_MECHANISMS', `LOGIN PLAIN DIGEST-MD5 CRAM-MD5') TRUST_AUTH_MECH(`LOGIN PLAIN DIGEST-MD5 CRAM-MD5') DAEMON_OPTIONS(`Family=inet, Port=465, Name=MTA-SSL, M=s') etc. How can I make sendmail (or saslauth) to get the user credentials via an imap server running on the same machine (the credentials are from an internal samba server) so I do not need to enter users details twice? Jobst -- 186,262 miles/second : Not just a good idea, it's the LAW. | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

1 1

asd
by Jobst Schmalenbach 23 Feb '11

23 Feb '11

Hi. I am trying to configure sendmail that is looks up the users credentials to allow them to send email via that server via an imap server on the same machine when sending email while on the road. I can send email when specifying a user that is stored in the servers /etc/shadow ... no problem but I cannot get my head around it how to do make saslauth OR sendmail lookup the user creds via the imap daemon. This is the working config (mc) for the sendmail daemon when using a locally created user (I knock the PLAIN off once I got it to work): define(`confAUTH_MECHANISMS', `LOGIN PLAIN DIGEST-MD5 CRAM-MD5')dnl TRUST_AUTH_MECH(`LOGIN PLAIN DIGEST-MD5 CRAM-MD5')dnl DAEMON_OPTIONS(`Family=inet, Port=465, Name=MTA-SSL, M=s')dnl etc. How can I make sendmail (or saslauth) to get the user credentials via an imap server running on the same machine (the credentials are from an internal samba server) so I do not need to enter users details twice? Jobst -- Passwords are like underwear. You don't share them, you don't hang them on your monitor, or under your keyboard, you don't email them, or put them on a web site, and you must change them very often. | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2011