Discuss August 2011

discuss@lists.centos.org

222 participants
208 discussions

Re: [CentOS] fail2ban help
by Nikos Gatsis - Qbit 10 Aug '11

10 Aug '11

On 9/8/2011 7:00 μμ, centos-request(a)centos.org wrote: >> > Hello list. >> > I have a question for fail2ban for bad logins on sasl. >> > I use sasl, sendmail and cyrus-imapd. >> > In jail.conf I use the following syntax: >> > >> > [sasl-iptables] >> > >> > enabled = true >> > filter = sasl >> > backend = polling >> > action = iptables[name=sasl, port=smtp, protocol=tcp] >> > sendmail-whois[name=sasl, dest=my@email] >> > logpath = /var/log/maillog >> > maxretry = 6 >> > >> > and the following filter: >> > >> > failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL >> > (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: >> > [A-Za-z0-9+/]*={0,2})?$ >> > >> > in iptables: >> > >> > fail2ban-sasl tcp -- anywhere anywhere tcp >> > dpt:smtp >> > ... >> > >> > Chain fail2ban-sasl (2 references) >> > target prot opt source destination >> > RETURN all -- anywhere anywhere >> > >> > >> > The problem is that never ban bad logins. >> > >> > I tried to change action as port="imap,imaps,pop3,pop3s,smtp" but >> > nothing change. >> > >> > Can somebody help me? >> > >> > Thank you, >> > Nikos >> > >> > >> > >> > _______________________________________________ >> > CentOS mailing list >> > CentOS(a)centos.org >> > http://lists.centos.org/mailman/listinfo/centos > Hello Nikos, > I have nearly the same regex as you: > > failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed.* > and it works with > fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/sasl.conf > > > Gru? Hello list I change failregex and finally show results! failregex = : badlogin: [-._\w]+ \[<HOST>\] plaintext [A-Za-z0-9+/] SASL$-13$: authentication failure: checkpass failed fail2ban-regex find hits. However, although a line added in iptables and I recieve an email that show the ban ip address, badlogins still continuing from the same IP. iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-sasl tcp -- anywhere anywhere tcp dpt:smtp fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh ... Chain fail2ban-sasl (1 references) target prot opt source destination DROP all -- [ip.ip.ip.ip] anywhere RETURN all -- anywhere anywhere What is wrong now? Thank you Nikos

1 0

Re: [CentOS] fail2ban help
by Nikos Gatsis - Qbit 10 Aug '11

10 Aug '11

Nikos Gatsis - Qbit <ngatsis(a)qbit.gr> Gesendet von: centos-bounces(a)centos.org 09.08.2011 10:40 Bitte antworten an CentOS mailing list <centos(a)centos.org> An centos(a)centos.org Kopie Thema [CentOS] fail2ban help Hello list. I have a question for fail2ban for bad logins on sasl. I use sasl, sendmail and cyrus-imapd. In jail.conf I use the following syntax: [sasl-iptables] enabled = true filter = sasl backend = polling action = iptables[name=sasl, port=smtp, protocol=tcp] sendmail-whois[name=sasl, dest=my@email] logpath = /var/log/maillog maxretry = 6 and the following filter: failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$ in iptables: fail2ban-sasl tcp -- anywhere anywhere tcp dpt:smtp ... Chain fail2ban-sasl (2 references) target prot opt source destination RETURN all -- anywhere anywhere The problem is that never ban bad logins. I tried to change action as port="imap,imaps,pop3,pop3s,smtp" but nothing change. Can somebody help me? Thank you, Nikos _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos Hello Nikos, I have nearly the same regex as you: failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed.* and it works with fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/sasl.conf Gru? Andreas Reschke --------------------------------------------------------- I try yours and get no matches on maillog. Do you thing that the following is correct? ... port="imap,imaps,pop3,pop3s,smtp" ... Thank you

1 0

mingetty on centos 6
by Jerry Geis 09 Aug '11

09 Aug '11

hi all, on centos 5 - I could trim the number of mingetty's running by editing /etc/inittab on centos 6 there are none in the /etc/inittab file but it reverences /etc/init/tty.conf. I dont see in there how to control how many mingetty's get started. Where is that? THanks, Jerry

4 4

KVM , virt-manager , USB-devices
by Timothy Kesten 09 Aug '11

09 Aug '11

Hi Folks, Using CentOS 6 x86_64. I've installed a WIN-XP guest successful (conversion from a VMWare-Image) Everything works fine - expect USB-Devices. I've installed connected USB-Stick with virt-manager but in the WIN-XP guest no device accessible. What goes wrong? More information needed? Thx Timothy

2 1

Can two machines in the same network have the same hostname with different IPs?
by Indunil Jayasooriya 09 Aug '11

09 Aug '11

Hi, Can two machines in the same network have the *same hostname* with different IPs? I have done it in test environment. I want to do it under production? is it possible ? is it recommended? let's say . one Server is *mail.example.com* with ip address* 192.168.0.1* the other Server is also *mail.example.com* but with another ip address *192.168.0.2 * -- Thank you Indunil Jayasooriya

4 4

fail2ban help
by Nikos Gatsis - Qbit 09 Aug '11

09 Aug '11

Hello list. I have a question for fail2ban for bad logins on sasl. I use sasl, sendmail and cyrus-imapd. In jail.conf I use the following syntax: [sasl-iptables] enabled = true filter = sasl backend = polling action = iptables[name=sasl, port=smtp, protocol=tcp] sendmail-whois[name=sasl, dest=my@email] logpath = /var/log/maillog maxretry = 6 and the following filter: failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$ in iptables: fail2ban-sasl tcp -- anywhere anywhere tcp dpt:smtp ... Chain fail2ban-sasl (2 references) target prot opt source destination RETURN all -- anywhere anywhere The problem is that never ban bad logins. I tried to change action as port="imap,imaps,pop3,pop3s,smtp" but nothing change. Can somebody help me? Thank you, Nikos

2 1

Funny Characters in Midnight Commander??
by Keith Roberts 09 Aug '11

09 Aug '11

I'm on Centos 5.6 and I have a problem with the screen showing funny characters when I run mc in a konsole terminal window, under Xfce desktop. Here's a link to what it looks like: http://tinypic.com/view.php?pic=zojry1&s=7 Any ideas why mc is doing this? Kind Regards, Keith Roberts ----------------------------------------------------------------- Websites: http://www.karsites.net http://www.php-debuggers.net http://www.raised-from-the-dead.org.uk All email addresses are challenge-response protected with TMDA [http://tmda.net] -----------------------------------------------------------------

3 4

CentOS 6 kernel update and grub.conf...
by John Doe 09 Aug '11

09 Aug '11

Hey, I ran a yum update and it installed a new kernel. ... Installed: kernel.x86_64 0:2.6.32-71.29.1.el6 kernel-devel.x86_64 0:2.6.32-71.29.1.el6 but it did not modify the grub.conf file. #boot=/dev/sda default=0 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title CentOS (2.6.32-71.el6.x86_64) root (hd0,0) kernel /vmlinuz-2.6.32-71.el6.x86_64 ro root=UUID=... initrd /initramfs-2.6.32-71.el6.x86_64.img Is this the new behavior or...? Thx, JD

4 7

Does anyone try Xen in Kernel 3.0?
by LHT. Quốc 09 Aug '11

09 Aug '11

Does anyone try Xen in Kernel 3.0? I use "$ git clone git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen.git linux-3.0.0-xen" command and it works. -- Thân ái, Quốc

5 5

Re: [CentOS] Centos6 Migration glitch - ZFS-FUSE
by david 09 Aug '11

09 Aug '11

At 02:03 PM 8/8/2011, you wrote: > > Folks > > > > My experiments with installing ZFS-FUSE in a Centos 6 system reveal > > behavior different from that observed in Centos 5.6. > > > > The version of ZFS-FUSE is that provided on the EPEL repository, and > > was installed on a 32-bit machine. I use it because of its > > deduplication facility. > > > > In Centos 5.6, the facility worked as advertised. > > > > In Centos 6, however, the system "hung" in initialization upon the > > first reboot after installing ZFS-FUSE and creating a pool. By > > "hung", I mean that the cute sliding blue bar that progresses during > >You may want to disable the cute sliding blue crap by editing the grub >options and remove "rhgb quiet" from it. That's what I do most of the >times because I want to see what's going on. > > > bootstrap got to nearly complete and then stood there for at least 20 > > minutes. The identical computer, configured without ZFS-FUSE, > > completed the system initialization within normal time. > > > > Following some clues found by googling the bug, I suspected that > > AUDITD and ZFS-FUSE had a conflict. After several experiments, I > > found what appears to work. > > > > REMEDY: > > > > When you install ZFS-FUSE, it will start the zfs-fuse service, and > > will also automatically issue a "chkconfig zfs-fuse on" command. The > > remedy is to prevent zfs-fuse from running during initializtion by issuing > > chkconfig zfs-fuse off > > and starting the service after the initialization is complete. > >Hm, I've just started running a server with SELinux enabled and already >learned why it was a good thing to stay away from it until now. I guess >that's also where your problems come from: the selinux-policy does not >have support for zfs-fuse, or for the way you are using it. you can check >audit.log to see if SELinux prevents zfs-fuse from starting up. I may be >wrong of course. > >Regards, >Simon > > >I I forgot to add... SELINUX is disabled.

1 0

← Newer
1
...
14
15
16
17
18
19
20
21
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2011