Discuss August 2011

discuss@lists.centos.org

222 participants
210 discussions

openssh rpm version greater than 4.3
by Vinay Nagrik 04 Aug '11

04 Aug '11

Hello Team, We ship our own software own top of Centos 5.2 OS and install other applications and rpms on top of rpms available in 5.2 Centos. We are in the process of upgrading to a later version of openssh (5.8 version of openssh is already available), however the latest src.rpm version of openssh available on Centos site is still openssh-4.3p2-72.el5_6.3.src.rpm<http://oss.oracle.com/el5/SRPMS-updates/openssh-4.3p2-72.el5_6.3.src.rpm> Which is a 4.3 and not anything in 5.x. The reason we want to do it because there are many vulnerabilities in older versions of openssh. Few are listed below. -* A signal handler race condition in OpenSSH before Version 4.4 can be exploited to cause a crash, and possibly execute arbitrary code if GSSAPI **authentication is enabled, via unspecified vectors that lead to a double-free. (CVE-2006-50 **- A denial of service vulnerability exists in sshd in OpenSSH before Version 4.4, when using the SSH protocol Version 1, because it does not**properly handle duplicate incoming blocks. This can be exploited by a remote attacker to cause sshd to consume a large quantity of CPU resources. ** (CVE-2006-4924)* *OpenSSH is prone to a plain text recovery attack. The issue is in the SSH protocol specification itself and exists in Secure Shell (SSH) software**when used with CBC-mode ciphers.* *OpenSSH is prone to a vulnerability that allows attackers to hijack forwarded X connections.Successfully exploiting this issue may allow an attackerrun arbitrary shell commands* These are only some of the issues and they are fixed in versions 5.2 or later. We work with openssh src.rpm and we are interested in getting a version 5.2 or greater src.rpm from Centos. I tried compiling these rpms from openssh source, but was unsuccessful. Can anyone thow some light, as to where can I get it or request it, which will work with other centos rpms. thanks in advance Thanks Nagrik

5 4

e-mail serving
by Todd 03 Aug '11

03 Aug '11

I am going to try an experiment with e-mail aggregation where I expect to receive over 1 million e-mails a day from public lists. Can anyone shed some light on hard disk space (to retain this e-mail for long periods) and system specs to be able to handle the load? I am looking to buy a low end box, but that can hold lots of RAM and accomodate a fair number of HD's to store the e-mail while I try my experiments. Can anyone provide some realistic specs while maintaining a small budget? -Jason

9 20

PKA help
by Todd 03 Aug '11

03 Aug '11

Hi All, I was able to create a public key for one of my servers that I log into frequently. Now I want to do this for a few more servers (where I use the same user id) and my user id on my laptop is the same as the servers. I also want to use PKA for other users accounts on the servers (for website editing and SFTP transfers) where my id on my laptop does NOT match the user on the server. I dont see at all how to make these changes as I already have an id_rsa and id_rsa.pub. So as an example: my user id on my laptop is: jtsm and the user id i want to log into the server as is: wwwdata Can anyone shed some light on how to setup multiple PKA on a single laptop with a single user account connecting as multiple user accounts to the server? -Jason

3 4

can't recover LVM volume: Please specify a *single* volume group to restore
by Rudi Ahlers 03 Aug '11

03 Aug '11

Hi everyone, I'm trying to recover a deleted LVM volume but can't see to get the syntax right. Running the following command gives me a list of backed up LVM volumes: root@usaxen02:[~]$ vgcfgrestore -l fluidVG_125094317679 ------- snip --------- File: /etc/lvm/archive/fluidVG_125094317679_00126-1479850541.vg VG name: fluidVG_125094317679 Description: Created *before* executing 'lvremove /dev/fluidVG_125094317679/mars.x.com_root_125152080771' Backup Time: Tue Aug 2 17:40:44 2011 File: /etc/lvm/backup/fluidVG_125094317679 VG name: fluidVG_125094317679 Description: Created *after* executing 'lvremove /dev/fluidVG_125094317679/mars.x.com_root_125152080771' Backup Time: Tue Aug 2 17:40:44 2011 So I want to recover mars.x.com_root_125152080771 and issue the following command: root@usaxen02:[~]$ vgcfgrestore -f fluidVG_125094317679 mars.x.com_root_125152080771 fluidVG_125094317679: stat failed: No such file or directory Couldn't read volume group metadata. Restore failed. root@usaxen02:[~]$ vgcfgrestore -f fluidVG_125094317679 Please specify a *single* volume group to restore. root@usaxen02:[~]$ vgcfgrestore -f mars.x.com_root_125152080771 Please specify a *single* volume group to restore. All different attempts, which apparently should work according to some google search results I've found but doesn't. Another attempt: root@usaxen02:[~]$ vgcfgrestore -vvt /etc/lvm/archive/fluidVG_125094317679_00126-1479850541.vg fluidVG_125094317679 Test mode: Metadata will NOT be updated. Setting global/locking_type to 1 global/wait_for_locks not found in config: defaulting to 1 File-based locking selected. Setting global/locking_dir to /var/lock/lvm Please specify a *single* volume group to restore. Test mode: Wiping internal cache Wiping internal VG cache Does anyone know what the correct syntax should be on CentOS 5.5? -- Kind Regards Rudi Ahlers SoftDux Website: http://www.SoftDux.com Technical Blog: http://Blog.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

1 0

Two ftp clients? Why?
by James B. Byrne 03 Aug '11

03 Aug '11

I had a problem wherein running a script with an embedded ftp call would work in the login shell during integration testing and then fail with an unrecognized option error in cron during acceptance testing. In solving this I discovered that RedHat, and therefore CentOS, ships with at least two ftp clients, /usr/bin/ftp ( which I thought I was using ) and /usr/kerberos/bin/ftp, which I actually was using. even though I had no inkling of its existence. My question is why? Why are there two ftp clients provided in a single distribution and why is the kerberos version effectively made the default whereas one might reasonably assume that anything in /usr/bin/ is the standard ( and by inference default ) ftp client for the distribution? If kerberos ftp is intended to be the default ftp client then why is it not in, or at least linked to from, /usr/bin? I just do not understand why these obscure distribution 'gotchas' are created in the first place, much less permitted to persist. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

18 38

configure
by m.roth＠5-cent.us 03 Aug '11

03 Aug '11

Does anyone know, or have a link, to something that can tell me how to find out exactly what options a ./configure was run with? Is there something in configure.ac, or the Makefile, or ...? mark

4 7

CentOS 6, Postfix Dovecot
by John Hinton 03 Aug '11

03 Aug '11

I only have one Postfix server running at the moment and have some questions. On that install, I did Amavisd-new with ClamAV, SpamAssassin, Postfix and Dovecot. I know this is a bit off topic, but I'm really hoping for performance guidance. Is the added layer of complexity running Amavis worth the effort on a system with moderate mail flow? Or should I just go down the path of getting Clam and SA working with Postfix and be done with it? Whatever path I decide upon now will hopefully be the future for other system builds to come. I have about a dozen Sendmail installs running (which will eventually need to be moved over). Some of what I didn't like about those is Clam/AV and other checks occurred on both incoming and outgoing email. We pretty much don't have an outbound email virus or spam problem, so were getting a number of false positives due to DHCP and clients being assigned a dirty IP address from time to time. So yes, what's a good mailserver setup which hopefully stays as close to upstream as possible on 6.0? John Hinton

4 3

centos speech to text?
by hadi motamedi 03 Aug '11

03 Aug '11

Dear All On my centos 5.6 , the KMouth is functioning for 'text to speech' facility. Can you please let me know if we have 'speech to text' facility for centos? Thank you

2 3

EL6: Hard Disk upgrade howto?
by Benjamin Smith 03 Aug '11

03 Aug '11

I have a tested copy of EL6 that I would like to duplicate to a number of similar servers, but can't seem to find a sane howto on the subject. TLDP's "Hard disk upgrade howto" is embarrassingly antiquated: when's the last time you saw LILO? What's the recommended procedure for doing an HDD copy/upgrade from one disk to another? Is there a nice, detailed howto that explains this in detail? My set up is pretty straight forward. My partitions are all set up as simple partitions, with UUID's in /etc/fstab. I'm not using LVM or RAID. Any ideas? -Ben -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

7 16

Re: [CentOS] Two ftp clients? Why?
by James B. Byrne 02 Aug '11

02 Aug '11

Mike A. Harris mharris at mharris.ca Tue Aug 2 16:45:56 EDT 2011 > What I'm left wondering is: > > 1) Why you are relying on PATH expansion for this from something as > critical as a cron job. It is good sysadmin practice to specify > explicit paths for situations like this rather than to worry about > whether or not there is a good or valid reason for there being 2 > ftp clients installed on the system. Point taken and that is e=indeed what i subsequently did. However, in my defence I explicitly set the PATH variable in the crontab entry prior to invoking the calling script that uses ftp. It never crossed my mind that I should have first done a 'which ftp' to discover which one was being used in my login shell because it never crossed my mind that there would be two different ftp clients on my systems to begin with. And frankly, I do not think that anyone would a priori conceive of there being two separate telnet clients, two different sftp clients, or two of anything else of a similar nature as being a reasonable possibility. > 2) Why you are using an ftp client rather than something like > wget or curl instead, both of which are far more powerful and > script friendly. I tried to use cURL for this particular bit, I in fact use cURL everywhere else in the same script. However, I am unable to determine how to get cURL to give me a meaningful response to the SYST command whereas the ftp client gives me a quite fulsome answer. > Presumably the kerberos client only gets installed if kerberos > infrastructure is installed, and the standard ftp client is > probably part of the default install as people expect it to be > there perhaps. Putting in unnecessary logic to only install one > ftp client and not the other doesn't make much sense either. Leaving it for an unsuspecting user to discover that there are two dissimilar versions of the same utility is not user friendly. > Focusing on finding the best way develop solid solutions to > administrative scripting problems like this is IMHO much more > important than trying to know or guess what the rationale is > behind there being 2 ftp binaries on the system. A rationale is more than I expect. The excuse is likely that it is just too difficult to bother with, as you pointed out above. > Anyhow, if you have expectations of specific software being > installed or not installed on your systems the only reliable > and reproducible way to do that is to use kickstart with a > minimal install and build up the package list to include only > the things you want to have installed. I expected an ftp client to be installed and I found one in the place I expected it to be. What I did not expect was that there was a second one installed somewhere else on a basic CentOS system with few local customizations and that it was the other client that I was using in my login shell. I am sure that paranoia is a valued admin quality but truly I do not expect to have to run which on every stock utility present on a reputable distribution just to discover if there is a second version of something installed somewhere obscure and stuck into my path by the packager. Nor do I expect that this issue or any like it will ever be considered important enough to comment on by upstream, much less looked at and reconciled. Which essentially is why I dropped RH support and went to CentOS in the first place. But I am pissed that this sort of BS still gets me from time to time. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2011