Discuss February 2012

discuss@lists.centos.org

205 participants
195 discussions

Configuration Compliance auditing for many CentOS 5.x boxes
by Tom H 06 Feb '12

06 Feb '12

Hi CentOS experts,* Short Version* I would like to produce a weekly report in HTML for each CentOS 5.x server we have indicating configuration compliance with some industry benchmark. I am looking for a tool or tools to implement this, I am happy to use 3rd party proprietary stuff if necessary. * Long(er) Version* Current Situation.. I have a client with many (200x) CentOS 5.x servers deployed in various web, mail, database and file server roles, and these boxes have been variously administrated to a lessor or greater degree. All the boxes have EPEL repository included as part of their base-install, and all boxes have cron jobs for "yum -y update" running frequently, and are rebooted when kernels are available. (so they are not in a terrible state) For network, local and external vulnerabilities - We use a 3rd party firm, who use WebInspect to monitor for external facing ports and vulnerable services and produce various regular reports to my boss. (hence am not looking at Nessus, OpenVAS or network based scanning tools right now, or indeed any vulnerability tools) However we now have a New Big Boss in Town - who is an ex security compliance dude. The new rules are; that if its not being regularly tested, then its not in compliance, even if it is in compliance etc. (to be honest, I quite like that rule) So now I am looking for a way to generate a report of server compliance with some compliance standard for all the boxes regularly. We have a basic list of configuration settings, that is a weaker form of various compliance recommendations, so I am confident that most compliance benchmarks like CIS, EAL3 or the linux web STIG level would be sufficient. We have chef installed on the CentOS instances, hence I can push out yum based packages, (and I can install from source tarballs, but it will make me cry, on these instances) I Would like to have... a tool that runs locally on each CentOS box and produces a reasonably comprehensive html report regarding configuration compliance (and a massive bonus would be to send email alert for severe problems, but I can script that if required) Ideally I could generate a weekly report that indicates compliance with 1 or more of the recognised linux server benchmarks. I am happy to pay for a subscription for the checklist, but I suspect the kind per instance 100 USD licenses I see are going to blow my budget. Current progress is... I see that OPENSCAP and OVAL have tools in CentOS-base or EPEL, such as OpenSCAP-utils ovaldi - oval reference interpreter Which can be used to create reports. However they seem a little unrefined. For SCAP and OVAL content I have found the following. 1. NIST provide SCAP content for RHEL desktop, which is kinda close; 2. http://usgcb.nist.gov/usgcb/rhel_content.html 3. There is a tool called sectool in the fedora repos, but I can't get it to run on CentOS due to a missing python-slip module. Any suggestions on functioning stacks for this problem would be helpful. Thanks, Tom ps SORRY FOR THE LONG EMAIL

6 8

Re: [CentOS] schily tools
by Dennis Clarke 06 Feb '12

06 Feb '12

> I doubt if they are as well maintained in linux distros as the GNU > tool set, particularly in terms of having recent fixes backported into > the versions carried in enterprise distros. They are updated pretty much every month. >> My basic requirement with what I'm doing is to use standard tools and >> formats so that archives I write today can be readable in 10 years. > > I've never had any doubts that current GNU tar would extract archives > made with it 10+ years ago - in fact I'm fairly sure I've done that. > Or that I'd be able to obtain a copy of it in the future. GNU tar .. has its own bugs. Is it really standards compliant? >> Is the use of Schily tools going to be contrary to my basic requirement? >> Is that considered a risk for future readability? > > It shouldn't matter if you don't use either of the version's > extensions, and for archiving you probably don't need them. For > example, star and GNUtar use very different concepts for incremental > backups - star is sort of like dump and must work on filesystem > boundaries where GNUtar's --listed incremental needs a file to hold > state but will work on arbitrary directories and can span mount > points. same sort of deal with star .. but you should go ask the author. dc -- -- http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x1D936C72FA35B44B +-------------------------+-----------------------------------+ | Dennis Clarke | Solaris and Linux and Open Source | | dclarke(a)blastwave.org | Respect for open standards. | +-------------------------+-----------------------------------+

2 1

Unknown KERNEL Warning in boot messages
by Jonathan Vomacka 06 Feb '12

06 Feb '12

CentOS Community, Would someone who is familiar with reading boot messages and kernel errors be able to assist with advising me on what the following errors might mean in dmesg. It seems to come up randomly towards the end of the logfile. ------------[ cut here ]------------ WARNING: at arch/x86/kernel/cpu/mtrr/generic.c:467 generic_get_mtrr+0x11e/0x140() (Not tainted) Hardware name: empty mtrr: your BIOS has set up an incorrect mask, fixing it up. Modules linked in: Pid: 0, comm: swapper Not tainted 2.6.32-220.2.1.el6.x86_64 #1 Call Trace: [<ffffffff81069997>] ? warn_slowpath_common+0x87/0xc0 [<ffffffff81069a86>] ? warn_slowpath_fmt+0x46/0x50 [<ffffffff8102713e>] ? generic_get_mtrr+0x11e/0x140 [<ffffffff81c2bfd1>] ? mtrr_cleanup+0x8c/0x3fd [<ffffffff81c2ae47>] ? get_mtrr_state+0x2ec/0x2fb [<ffffffff81c2a988>] ? mtrr_bp_init+0x1ab/0x1d2 [<ffffffff81c254d8>] ? setup_arch+0x4b8/0xaea [<ffffffff814ec4c5>] ? printk+0x41/0x44 [<ffffffff81c1fc2e>] ? start_kernel+0xdc/0x430 [<ffffffff81c1f33a>] ? x86_64_start_reservations+0x125/0x129 [<ffffffff81c1f438>] ? x86_64_start_kernel+0xfa/0x109 ---[ end trace a7919e7f17c0a725 ]--- ------------[ cut here ]------------ WARNING: at kernel/sched.c:5914 thread_return+0x232/0x79d() (Tainted: G W ---------------- ) Hardware name: empty Modules linked in: ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 raid1 e1000e serio_raw i2c_i801 i2c_core sg iTCO_wdt iTCO_vendor_support ioatdma dca i5000_edac edac_core i5k_amb shpchp ext4 mbcache jbd2 raid10 sd_mod crc_t10dif ahci pata_acpi ata_generic ata_piix dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] Pid: 5696, comm: md1_resync Tainted: G W ---------------- 2.6.32-220.2.1.el6.x86_64 #1 Call Trace: [<ffffffff81069997>] ? warn_slowpath_common+0x87/0xc0 [<ffffffff810699ea>] ? warn_slowpath_null+0x1a/0x20 [<ffffffff814eccc5>] ? thread_return+0x232/0x79d [<ffffffffa0073654>] ? raise_barrier+0xb4/0x1e0 [raid10] [<ffffffff8105e770>] ? default_wake_function+0x0/0x20 [<ffffffffa00747d1>] ? sync_request+0x541/0xa70 [raid10] [<ffffffffa0073599>] ? raid10_unplug+0x29/0x30 [raid10] [<ffffffff813ea428>] ? is_mddev_idle+0xc8/0x120 [<ffffffff813eab6d>] ? md_do_sync+0x6ad/0xbe0 [<ffffffff813eb336>] ? md_thread+0x116/0x150 [<ffffffff813eb220>] ? md_thread+0x0/0x150 [<ffffffff810906a6>] ? kthread+0x96/0xa0 [<ffffffff8100c14a>] ? child_rip+0xa/0x20 [<ffffffff81090610>] ? kthread+0x0/0xa0 [<ffffffff8100c140>] ? child_rip+0x0/0x20 ---[ end trace a7919e7f17c0a727 ]--- md: md1: data-check done. x86 PAT enabled: cpu 0, old 0x7040600070406, new 0x7010600070106 ------------[ cut here ]------------ WARNING: at arch/x86/kernel/cpu/mtrr/generic.c:467 generic_get_mtrr+0x11e/0x140() (Not tainted) Hardware name: empty mtrr: your BIOS has set up an incorrect mask, fixing it up. Modules linked in: Pid: 0, comm: swapper Not tainted 2.6.32-220.4.1.el6.x86_64 #1 Call Trace: [<ffffffff81069a17>] ? warn_slowpath_common+0x87/0xc0 [<ffffffff81069b06>] ? warn_slowpath_fmt+0x46/0x50 [<ffffffff8102713e>] ? generic_get_mtrr+0x11e/0x140 [<ffffffff81c2bfd1>] ? mtrr_cleanup+0x8c/0x3fd [<ffffffff81c2ae47>] ? get_mtrr_state+0x2ec/0x2fb [<ffffffff81c2a988>] ? mtrr_bp_init+0x1ab/0x1d2 [<ffffffff81c254d8>] ? setup_arch+0x4b8/0xaea [<ffffffff814ec3c6>] ? printk+0x41/0x43 [<ffffffff81c1fc2e>] ? start_kernel+0xdc/0x430 [<ffffffff81c1f33a>] ? x86_64_start_reservations+0x125/0x129 [<ffffffff81c1f438>] ? x86_64_start_kernel+0xfa/0x109 ---[ end trace a7919e7f17c0a725 ]---

2 1

Re: [CentOS] schily tools
by Dennis Clarke 06 Feb '12

06 Feb '12

> Hey folks, > > I'm reading up on gtar for tape archiving and it sounds kind of nasty and > not something I really want to rely on. > > It looks like star from the schily tools is preferred. I'm using Centos > (and RHEL) 5.7 which seems to have star but not sdd. > > Which leads me to believe that the Schily tools are maybe a bit "rogue" > > My basic requirement with what I'm doing is to use standard tools and > formats so that archives I write today can be readable in 10 years. > > Is the use of Schily tools going to be contrary to my basic requirement? > Is that considered a risk for future readability? Use star like so : star -c -p -acl -sparse -dump -fs=32m -fifostats -time \ -C /some_dir dir1 dir2 dir3 file=/dev/rmt/0mbn or something like that will work like a charm and be POSIX spec compliant. That means you can still read it in 20 years .. if the tape survives. dc -- -- http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x1D936C72FA35B44B +-------------------------+-----------------------------------+ | Dennis Clarke | Solaris and Linux and Open Source | | dclarke(a)blastwave.org | Respect for open standards. | +-------------------------+-----------------------------------+

1 0

mysql won't start with service, but starts with mysqld_safe
by Larry Martell 06 Feb '12

06 Feb '12

Just installed mysql on centos 6.2. When I try to start it with service I get: #service mysqld start MySQL Daemon failed to start. Starting mysqld: [FAILED] Nothing at all is written to the error log. But if I start it with mysqld_safe it comes up and works fine. Anyone know what's going on here? -larry

4 5

Postfix - no nfs mounted shares on server - but nfs related problem in maillog.
by Rafał Radecki 06 Feb '12

06 Feb '12

Hi all. I have one server with problem in maillog: Feb 6 06:46:26 host1 postfix/qmgr[24296]: fatal: qmgr_move: update active/4DE015AC536 time stamps: Stale NFS file handle Feb 6 06:46:27 host1 postfix/master[4487]: warning: process /usr/libexec/postfix/qmgr pid 24296 exit status 1 Feb 6 06:46:27 host1 postfix/master[4487]: warning: /usr/libexec/postfix/qmgr: bad command startup -- throttling ls -la /var/spool/postfix/active | tail -10 -rwx------ 1 postfix postfix 25367 lut 5 03:28 9F38A2D89FD -rwx------ 1 postfix postfix 22198 lut 5 03:28 9F5D45AC094 -rwx------ 1 postfix postfix 22219 lut 5 03:28 9F90F5AC323 ?--------- ? ? ? ? ? 9FBB22DAE65 So there are problems with filesystem(ext3). df -h /var/spool/postfix/active System plików rozm. użyte dost. %uż. zamont. na /dev/sda5 69G 24G 43G 36% / mount | grep sda5 /dev/sda5 on / type ext3 (rw) /var/spool is a local filesystem, there are no nfs shares mounted on server. Also nfs, nfslock, autofs services are disabled. I've run fsck on / 3 days ago, there have been errors which I repaired (fsck -y). Now the problems like ?--------- ? ? ? ? ? 9FBB22DAE65 show again. smartctl -a /dev/sda SMART Attributes Data Structure revision number: 16 Vendor Specific SMART Attributes with Thresholds: ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE 1 Raw_Read_Error_Rate 0x000b 100 100 016 Pre-fail Always - 0 2 Throughput_Performance 0x0005 133 133 054 Pre-fail Offline - 138 3 Spin_Up_Time 0x0007 142 142 024 Pre-fail Always - 178 (Average 109) 4 Start_Stop_Count 0x0012 100 100 000 Old_age Always - 120 5 Reallocated_Sector_Ct 0x0033 100 100 005 Pre-fail Always - 0 7 Seek_Error_Rate 0x000b 100 100 067 Pre-fail Always - 0 8 Seek_Time_Performance 0x0005 139 139 020 Pre-fail Offline - 26 9 Power_On_Hours 0x0012 100 100 000 Old_age Always - 5725 10 Spin_Retry_Count 0x0013 100 100 060 Pre-fail Always - 0 12 Power_Cycle_Count 0x0032 100 100 000 Old_age Always - 120 192 Power-Off_Retract_Count 0x0032 100 100 000 Old_age Always - 308 193 Load_Cycle_Count 0x0012 100 100 000 Old_age Always - 308 194 Temperature_Celsius 0x0002 176 176 000 Old_age Always - 34 (Lifetime Min/Max 22/51) 196 Reallocated_Event_Count 0x0032 100 100 000 Old_age Always - 0 197 Current_Pending_Sector 0x0022 100 100 000 Old_age Always - 0 198 Offline_Uncorrectable 0x0008 100 100 000 Old_age Offline - 0 199 UDMA_CRC_Error_Count 0x000a 200 200 000 Old_age Always - 0 dmesg | grep sda EXT3-fs warning (device sda5): ext3_unlink: Deleting nonexistent file (2982233), 0 Any tips?

2 1

How to boot into a different kernel
by Jonathan Vomacka 06 Feb '12

06 Feb '12

CentOS Community, Is there a command to boot into a different version of the kernel? I believe this is setup via grub.conf but unsure. There are a few different kernels loaded into /boot but I want to see if there is a command to boot into a different kernel as a single instance or permanent if needed. Please advise [root@titanium boot]# ls -ltr total 62768 -rw-r--r--. 1 root root 2312369 Dec 6 15:35 System.map-2.6.32-220.el6.x86_64 -rw-r--r--. 1 root root 100943 Dec 6 15:35 config-2.6.32-220.el6.x86_64 -rwxr-xr-x. 1 root root 3938288 Dec 6 15:35 vmlinuz-2.6.32-220.el6.x86_64 -rw-r--r--. 1 root root 171087 Dec 6 15:36 symvers-2.6.32-220.el6.x86_64.gz -rw-r--r--. 1 root root 2313220 Dec 23 04:14 System.map-2.6.32-220.2.1.el6.x86_64 -rw-r--r--. 1 root root 100947 Dec 23 04:14 config-2.6.32-220.2.1.el6.x86_64 -rwxr-xr-x. 1 root root 3940752 Dec 23 04:14 vmlinuz-2.6.32-220.2.1.el6.x86_64 -rw-r--r--. 1 root root 171175 Dec 23 04:17 symvers-2.6.32-220.2.1.el6.x86_64.gz drwx------. 2 root root 12288 Jan 18 10:36 lost+found drwxr-xr-x. 3 root root 1024 Jan 18 10:45 efi -rw-r--r--. 1 root root 14888469 Jan 18 10:45 initramfs-2.6.32-220.el6.x86_64.img -rw-r--r--. 1 root root 14885287 Jan 18 11:23 initramfs-2.6.32-220.2.1.el6.x86_64.img -rwxr-xr-x. 1 root root 3940016 Jan 23 22:02 vmlinuz-2.6.32-220.4.1.el6.x86_64 -rw-r--r--. 1 root root 2313117 Jan 23 22:02 System.map-2.6.32-220.4.1.el6.x86_64 -rw-r--r--. 1 root root 100947 Jan 23 22:02 config-2.6.32-220.4.1.el6.x86_64 -rw-r--r--. 1 root root 171175 Jan 23 22:02 symvers-2.6.32-220.4.1.el6.x86_64.gz -rw-r--r--. 1 root root 14885301 Jan 26 08:13 initramfs-2.6.32-220.4.1.el6.x86_64.img drwxr-xr-x. 2 root root 1024 Feb 6 01:06 grub [root@titanium boot]#

2 1

configure network bridge listing bridged intefaces
by Mihamina Rakotomandimby 06 Feb '12

06 Feb '12

Hi all, Having a 4 NIC server, I want to bridge eth2 and eth3, with a bridge named br0. Searching the web I only found about creating a file /etc/sysconfig/network-scripts/ifcfg-br0, but did not find where to explicitely list what ports will be bridged. Where is it configured? Thank you. -- RMA.

6 10

a cloud VM under CentOS
by Boris Epstein 05 Feb '12

05 Feb '12

Hello everyone, Does anyone know if it is possible to construct a cloud of sorts out of several CentOS machines so as to enable a VM (or several VM's) that would run on top of that cloud and have failover capability? Boris.

3 3

CentOS 6.2 New Kernel Issues
by Jonathan Vomacka 05 Feb '12

05 Feb '12

CentOS 6.2 Community / Developers, Are there any known issues with the latest Kernel on CentOS 6.2? I performed a yum update and the kernel downloaded. When the system rebooted I started having intermittent latency issues when trying to perform certain commands on the system such as top or ls -ltr, etc. I was having extreme latency getting to root. I am unsure if there is a hardware compat issue but I found my server in kernel PANIC mode the next day and was unable to login entirely. Has this been reported before?

1 0

← Newer
1
...
13
14
15
16
17
18
19
20
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2012