Discuss April 2012

discuss@lists.centos.org

181 participants
172 discussions

forwarding packets to service in same host without using loopback network
by Arif Hossain 25 Apr '12

25 Apr '12

This question is not about linux usage. But still i think user list is a good crowd for linux programmer. So here it goes. I have this libnetfilter_queue application which receives packets from kernel based on some iptables rule. Before going straight to my problem, i'm giving a sample workable code and other tools to set up a test environment so that We problem definition and possible solutions can be more accurate and robust. The following code describes the core functionality of the application: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <netinet/in.h> #include <linux/types.h> #include <linux/netfilter.h> /* for NF_ACCEPT */ #include <errno.h> #include <libnetfilter_queue/libnetfilter_queue.h> #define PREROUTING 0 #define POSTROUTING 4 #define OUTPUT 3 /* returns packet id */ static u_int32_t print_pkt (struct nfq_data *tb) { int id = 0; struct nfqnl_msg_packet_hdr *ph; struct nfqnl_msg_packet_hw *hwph; u_int32_t mark, ifi; int ret; unsigned char *data; ph = nfq_get_msg_packet_hdr (tb); if (ph) { id = ntohl (ph->packet_id); printf ("hw_protocol=0x%04x hook=%u id=%u ", ntohs (ph->hw_protocol), ph->hook, id); } hwph = nfq_get_packet_hw (tb); if (hwph) { int i, hlen = ntohs (hwph->hw_addrlen); printf ("hw_src_addr="); for (i = 0; i < hlen - 1; i++) printf ("%02x:", hwph->hw_addr[i]); printf ("%02x ", hwph->hw_addr[hlen - 1]); } mark = nfq_get_nfmark (tb); if (mark) printf ("mark=%u ", mark); ifi = nfq_get_indev (tb); if (ifi) printf ("indev=%u ", ifi); ifi = nfq_get_outdev (tb); if (ifi) printf ("outdev=%u ", ifi); ifi = nfq_get_physindev (tb); if (ifi) printf ("physindev=%u ", ifi); ifi = nfq_get_physoutdev (tb); if (ifi) printf ("physoutdev=%u ", ifi); ret = nfq_get_payload (tb, &data); if (ret >= 0) printf ("payload_len=%d ", ret); fputc ('\n', stdout); return id; } static int cb (struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_data *nfa, void *data) { uint32_t ip_src, ip_dst; struct in_addr s_ip; struct in_addr d_ip; uint16_t src_port; uint16_t dst_port; int verdict; int id; int ret; unsigned char *buffer; struct nfqnl_msg_packet_hdr *ph = nfq_get_msg_packet_hdr (nfa); if (ph) { id = ntohl (ph->packet_id); printf ("received packet with id %d", id); } ret = nfq_get_payload (nfa, &buffer); ip_src = *((uint32_t *) (buffer + 12)); ip_dst = *((uint32_t *) (buffer + 16)); src_port = *((uint16_t *) (buffer + 20)); dst_port = *((uint16_t *) (buffer + 22)); s_ip.s_addr = (uint32_t) ip_src; d_ip.s_addr = (uint32_t) ip_dst; *(buffer + 26) = 0x00; *(buffer + 27) = 0x00; printf ( "source IP %s", inet_ntoa (s_ip)); printf ( "destination IP %s", inet_ntoa (d_ip)); printf ( "source port %d", src_port); printf ( "destination port %d", dst_port); if (ret) { switch (ph->hook) { case PREROUTING: printf ( "inbound packet"); //my_mangling_fun(); break; case OUTPUT: printf ( "outbound packet"); //my_mangling_fun(); break; } } verdict = nfq_set_verdict (qh, id, NF_ACCEPT, ret, buffer); if (verdict) printf ( "verdict ok"); return verdict; } int main (int argc, char **argv) { struct nfq_handle *h; struct nfq_q_handle *qh; struct nfnl_handle *nh; int fd; int rv; char buf[4096] __attribute__ ((aligned)); printf ("opening library handle\n"); h = nfq_open (); if (!h) { fprintf (stderr, "error during nfq_open()\n"); exit (1); } printf ("unbinding existing nf_queue handler for AF_INET (if any)\n"); if (nfq_unbind_pf (h, AF_INET) < 0) { fprintf (stderr, "error during nfq_unbind_pf()\n"); exit (1); } printf ("binding nfnetlink_queue as nf_queue handler for AF_INET\n"); if (nfq_bind_pf (h, AF_INET) < 0) { fprintf (stderr, "error during nfq_bind_pf()\n"); exit (1); } printf ("binding this socket to queue '0'\n"); qh = nfq_create_queue (h, 0, &cb, NULL); if (!qh) { fprintf (stderr, "error during nfq_create_queue()\n"); exit (1); } printf ("setting copy_packet mode\n"); if (nfq_set_mode (qh, NFQNL_COPY_PACKET, 0xffff) < 0) { fprintf (stderr, "can't set packet_copy mode\n"); exit (1); } fd = nfq_fd (h); for (;;) { if ((rv = recv (fd, buf, sizeof (buf), 0)) >= 0) { printf ("pkt received\n"); nfq_handle_packet (h, buf, rv); continue; } /* if your application is too slow to digest the packets that * are sent from kernel-space, the socket buffer that we use * to enqueue packets may fill up returning ENOBUFS. Depending * on your application, this error may be ignored. Please, see * the doxygen documentation of this library on how to improve * this situation. */ if (rv < 0 && errno == ENOBUFS) { printf ("losing packets!\n"); continue; } perror ("recv failed"); break; } printf ("unbinding from queue 0\n"); nfq_destroy_queue (qh); #ifdef INSANE /* normally, applications SHOULD NOT issue this command, since * it detaches other programs/sockets from AF_INET, too ! */ printf ("unbinding from AF_INET\n"); nfq_unbind_pf (h, AF_INET); #endif printf ("closing library handle\n"); nfq_close (h); exit (0); } Notice in the callback function two calls to my_mangling_fun() is commented out. This is where i mangle the incoming and outgoing packet. I think this code would be sufficient to describe my case. If further clarification is need please ask, i will post further details. Lets say accompanying iptables rules are following : $iptables -t mangle -A PREROUTING -p udp --dport 5000 -j NFQUEUE $iptables -t mangle -A OUTPUT -p udp --sport 5000 -j NFQUEUE lets compile and fire udp the thing. $gcc -g3 nfq_test.c -lnfnetlink -lnetfilter_queue $./a.out (should be as root) now we can feed garbage udp payload to this thing by netcat both client and server mode $nc -ul 5000 $nc -uvv <IP> 5000 This will print the packet from my netfilter_queue app in stdout. Now that the development environment is set up, we can move to the next thing. What we are trying to achieve is following : Our server is listening on 5000 port. Now all incoming packet destined to udp port 5000 will be queued by kernel. And the handle to this queue will be given to user application we listed earlier. This queue mechanism works like this: When a packet is available, the callback function(cb() in our code) is called. after processing, the callback function calls nfq_set_verdict(). after a **verdict** is returned, next packet will pop from the queue. notice that a packet will not pop from queue if its preceding packet has not been issued a verdict. This verdict values are NF_ACCEPT for accepting packet, NF_DROP for dropping the packet. Now what if i want to concatenate the udp payloads of the incoming and outgoing packet without touching client and server side code? If i want to concatenate udp payloads from our app this very app, then we need to have multiple packets at hand. But we have seen that a packet does not pops from queue before a verdict is issued to its preceding one. So how can this be done? One possible solution is issue a NF_DROP to every packet and save those packets in an intermediate data structure. Let's say we have done it. But how can this packet can be delivered to the service listening on 5000 port? We can't use network stack for delivering the packet, because if we do, then packets will end up in NFQUEUE again. Another problem is, the server is totally agnostic about this app. That means it should not see any difference in the packets. It should see packets as if it came from the original client. I have heard that a application can send data to a server in the same host without using network layer(ip,port) by writing some files. I do not know the validity of this statement. But if anyone knows anything about it , it will be wonderful. Another possible solution proposed to me is : 1.store packets in the application and return verdict NF_DROP 2.re-inject packets into the network stack using RAW sockets 3.tag concatenated UDP packets with a DSCP (see IP packet format) 4.in iptables, add a rule to match on this DSCP (--dscp) and ACCEPT the packet directly, without it passing through your netfilter application 5.If the provider already tags some packets with DSCP, you can add some iptables rules to clear them, like: $iptables -t mangle -A INPUT -j DSCP --set-dscp 0 -- -aft

2 4

Windows 2008R2 AD, kerberos, NFSv4
by janice.psyop 25 Apr '12

25 Apr '12

Hi, I'm trying to set up NFSv4 on two boxes (centos 5.5) and have it authenticate against our Windows 2008R2 AD server acting as the KDC. (samba/winbind is running ok with "idmap config MYCOMPANY: backend = rid" so we have identical ids across the servers.) I can mount my test directory fine via NFSv4 *without* the sec=krb5 option. However, once I put the sec=krb5 option in, then I get a mount error: "mount.nfs4: Permission denied" and rpc.gssd reports: "Failed to obtain machine credentials for connection to server" The computers have an AD computer account and for the service-principal, I created an AD user account "nfsHostname" and mapped the UPN e.g. NFS/ hostname.mycompany.tv(a)MYCOMPANY.TV to it using ktpass. This is the closest post similar to my issue I could find: http://lists.centos.org/pipermail/centos/2010-July/096378.html However, I'm trying not to run the createupn command via smbutils. Side note: Eventually we will also be using a HDS nas which doesn't provide us with samba net utils (e.g. net ads join createupn) only their proprietary webadmin/cli. When that nas joined our AD domain, it created a computer account with SPNs of HOST/HOSTNAME, HOST/hostname.MYCOMPANY.TV and a UPN of HOST/hostname.mycompany.tv(a)MYCOMPANY.TV And the HDS nas only wants encryption type: des-cbc-crc:normal. This is why on my test nfs server (nas002), I'm trying to use the same limited commands as I would if I were using the HDS nas. Any suggestions where to look next or get more verbose info from kerberos/KDC or the nfs server? (nothing shows up in either syslog -- plus, I'm not all that familiar with kerberos.) thanks in advance! JA. info: 10.100.1.11 KDC server (Windows 2008 R2, AD) 10.100.1.35 bk001 (nfsv4 client, kernel 2.6.18-194.32.1.el5) 10.100.1.82 nas002 (nfsv4 server, kernel 2.6.18-194.32.1.el5) 10.100.1.99 monitoring server intsalled on both nfsv4 client and server: nfs-utils.x86_64 1.0.9-60.el5 nfs-utils-lib.x86_64 1.0.8-7.9.el5 nfs4-acl-tools.x86_64 0.3.3-3.el5 krb5-workstation.x86_64 1.6.1-70.el5 samba (nas002) 3.3.8-0.52.el5_5.2 samba (bk001) 3.5.10-0.107.el5 [root@bk001 ~]# net ads testjoin Join is OK [root@bk001 ~]# kinit administrator(a)MYCOMPANY.TV Password for administrator(a)MYCOMPANY.TV: [root@bk001 ~]# kinit nfs/nas002.mycompany.tv(a)MYCOMPANY.TV Password for nfs/nas002.mycompany.tv(a)MYCOMPANY.TV: [root@bk001 ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: nfs/nas002.mycompany.tv(a)MYCOMPANY.TV Valid starting Expires Service principal 04/13/12 16:08:51 04/14/12 02:08:51 krbtgt/MYCOMPANY.TV(a)MYCOMPANY.TV renew until 04/16/12 16:08:51 Kerberos 4 ticket cache: /tmp/tkt0 klist: You have no tickets cached [root@bk001 ~]# showmount -e nas002.mycompany.tv Export list for nas002.mycompany.tv: /array gss/krb5,* [root@bk001 ~]# mount -v -t nfs4 -o proto=tcp,sec=krb5 nas002.mycompany.tv:/ /mnt/nfs4test Warning: rpc.idmapd appears not to be running. All uids will be mapped to the nobody uid. Warning: rpc.gssd appears not to be running. mount: pinging: prog 100003 vers 4 prot tcp port 2049 mount.nfs4: Permission denied [root@bk001 ~]# ps -elf | egrep 'gss|idmap' 1 S root 2498 1 0 75 0 - 8016 - Apr12 ? 00:00:00 rpc.gssd -rrrvvvv 1 S root 4575 1 0 76 0 - 14833 - Apr12 ? 00:00:00 rpc.idmapd -vvv [root@bk001 ~]# tail /var/log/messages Apr 13 16:09:09 bk001 rpc.idmapd[4575]: New client: 16 Apr 13 16:09:09 bk001 rpc.gssd[2498]: handling krb5 upcall Apr 13 16:09:09 bk001 rpc.idmapd[4575]: New client: 17 Apr 13 16:09:09 bk001 rpc.idmapd[4575]: Opened /var/lib/nfs/rpc_pipefs/nfs/clnt16/idmap Apr 13 16:09:09 bk001 rpc.gssd[2498]: Using keytab file '/etc/krb5.keytab' Apr 13 16:09:09 bk001 rpc.gssd[2498]: WARNING: Failed to obtain machine credentials for connection to server nas002.mycompany.tv Apr 13 16:09:09 bk001 rpc.gssd[2498]: doing error downcall Apr 13 16:09:09 bk001 rpc.idmapd[4575]: Stale client: 16 Apr 13 16:09:09 bk001 rpc.idmapd[4575]: -> closed /var/lib/nfs/rpc_pipefs/nfs/clnt16/idmap Apr 13 16:09:09 bk001 rpc.idmapd[4575]: Stale client: 17 Apr 13 16:09:09 bk001 rpc.idmapd[4575]: -> closed /var/lib/nfs/rpc_pipefs/nfs/clnt17/idmap Apr 13 16:09:09 bk001 rpc.gssd[2498]: destroying client clnt17 Apr 13 16:09:09 bk001 rpc.gssd[2498]: destroying client clnt16 tshark capture of commands I performed (above): [root@bk001 ~]# cat /var/tmp/tshark_041312-1608.out 366 9.948504 10.100.1.35 -> 10.100.1.11 TCP 42564 > kerberos [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=86719599 TSER=0 WS=7 367 9.948813 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42564 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 TSV=396813568 TSER=86719599 368 9.948824 10.100.1.35 -> 10.100.1.11 TCP 42564 > kerberos [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=86719599 TSER=396813568 369 9.948849 10.100.1.35 -> 10.100.1.11 KRB5 AS-REQ 370 9.949976 10.100.1.11 -> 10.100.1.35 KRB5 KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED 371 9.949982 10.100.1.35 -> 10.100.1.11 TCP 42564 > kerberos [ACK] Seq=181 Ack=154 Win=6432 Len=0 TSV=86719600 TSER=396813568 372 9.950031 10.100.1.35 -> 10.100.1.11 TCP 42564 > kerberos [FIN, ACK] Seq=181 Ack=154 Win=6432 Len=0 TSV=86719600 TSER=396813568 373 9.950288 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42564 [ACK] Seq=154 Ack=182 Win=65160 Len=0 TSV=396813568 TSER=86719600 374 9.950297 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42564 [RST, ACK] Seq=154 Ack=182 Win=0 Len=0 444 11.840921 10.100.1.35 -> 10.100.1.11 TCP 42565 > kerberos [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=86721491 TSER=0 WS=7 446 11.841178 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42565 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 TSV=396813757 TSER=86721491 447 11.841185 10.100.1.35 -> 10.100.1.11 TCP 42565 > kerberos [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=86721491 TSER=396813757 448 11.841206 10.100.1.35 -> 10.100.1.11 KRB5 AS-REQ 449 11.842812 10.100.1.11 -> 10.100.1.35 TCP [TCP segment of a reassembled PDU] 450 11.842817 10.100.1.35 -> 10.100.1.11 TCP 42565 > kerberos [ACK] Seq=259 Ack=1449 Win=8688 Len=0 TSV=86721493 TSER=396813757 451 11.842819 10.100.1.11 -> 10.100.1.35 KRB5 AS-REP 452 11.842822 10.100.1.35 -> 10.100.1.11 TCP 42565 > kerberos [ACK] Seq=259 Ack=1518 Win=8688 Len=0 TSV=86721493 TSER=396813757 453 11.842852 10.100.1.35 -> 10.100.1.11 TCP 42565 > kerberos [FIN, ACK] Seq=259 Ack=1518 Win=8688 Len=0 TSV=86721493 TSER=396813757 454 11.843043 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42565 [ACK] Seq=1518 Ack=260 Win=65160 Len=0 TSV=396813758 TSER=86721493 455 11.843050 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42565 [RST, ACK] Seq=1518 Ack=260 Win=0 Len=0 827 21.821693 10.100.1.35 -> 10.100.1.11 TCP 42566 > kerberos [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=86731472 TSER=0 WS=7 828 21.821920 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42566 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 TSV=396814755 TSER=86731472 829 21.821930 10.100.1.35 -> 10.100.1.11 TCP 42566 > kerberos [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=86731472 TSER=396814755 830 21.821958 10.100.1.35 -> 10.100.1.11 KRB5 AS-REQ 831 21.822968 10.100.1.11 -> 10.100.1.35 KRB5 AS-REP 832 21.822974 10.100.1.35 -> 10.100.1.11 TCP 42566 > kerberos [ACK] Seq=191 Ack=618 Win=6787 Len=0 TSV=86731473 TSER=396814756 833 21.823003 10.100.1.35 -> 10.100.1.11 TCP 42566 > kerberos [FIN, ACK] Seq=191 Ack=618 Win=6787 Len=0 TSV=86731473 TSER=396814756 835 21.823278 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42566 [ACK] Seq=618 Ack=192 Win=65160 Len=0 TSV=396814756 TSER=86731473 836 21.823287 10.100.1.11 -> 10.100.1.35 TCP kerberos > 42566 [RST, ACK] Seq=618 Ack=192 Win=0 Len=0 1472 39.980317 10.100.1.35 -> 10.100.1.82 TCP 40520 > nfs [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=86749629 TSER=0 WS=7 1473 39.980491 10.100.1.82 -> 10.100.1.35 TCP nfs > 40520 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3789493491 TSER=86749629 WS=7 1474 39.980498 10.100.1.35 -> 10.100.1.82 TCP 40520 > nfs [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=86749631 TSER=3789493491 1475 39.980533 10.100.1.35 -> 10.100.1.82 NFS V4 NULL Call 1476 39.980701 10.100.1.82 -> 10.100.1.35 TCP nfs > 40520 [ACK] Seq=1 Ack=45 Win=5888 Len=0 TSV=3789493492 TSER=86749631 1477 39.980705 10.100.1.82 -> 10.100.1.35 NFS V4 NULL Reply (Call In 1475) 1478 39.980707 10.100.1.35 -> 10.100.1.82 TCP 40520 > nfs [ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=86749631 TSER=3789493492 1479 39.980733 10.100.1.35 -> 10.100.1.82 TCP 40520 > nfs [FIN, ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=86749631 TSER=3789493492 1480 39.980896 10.100.1.82 -> 10.100.1.35 TCP nfs > 40520 [FIN, ACK] Seq=29 Ack=46 Win=5888 Len=0 TSV=3789493492 TSER=86749631 1481 39.980901 10.100.1.35 -> 10.100.1.82 TCP 40520 > nfs [ACK] Seq=46 Ack=30 Win=5888 Len=0 TSV=86749631 TSER=3789493492 1482 40.001039 10.100.1.35 -> 10.100.1.82 TCP connendp > nfs [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=86749651 TSER=0 WS=7 1483 40.001210 10.100.1.82 -> 10.100.1.35 TCP nfs > connendp [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3789493512 TSER=86749651 WS=7 1484 40.001221 10.100.1.35 -> 10.100.1.82 TCP connendp > nfs [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=86749651 TSER=3789493512 1485 40.001244 10.100.1.35 -> 10.100.1.82 NFS V4 NULL Call 1486 40.001409 10.100.1.82 -> 10.100.1.35 TCP nfs > connendp [ACK] Seq=1 Ack=45 Win=5888 Len=0 TSV=3789493512 TSER=86749651 1487 40.001414 10.100.1.82 -> 10.100.1.35 NFS V4 NULL Reply (Call In 1485) 1488 40.001418 10.100.1.35 -> 10.100.1.82 TCP connendp > nfs [ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=86749652 TSER=3789493512 1489 40.002363 10.100.1.35 -> 10.100.1.82 TCP connendp > nfs [FIN, ACK] Seq=45 Ack=29 Win=5888 Len=0 TSV=86749653 TSER=3789493512 1490 40.002526 10.100.1.82 -> 10.100.1.35 TCP nfs > connendp [FIN, ACK] Seq=29 Ack=46 Win=5888 Len=0 TSV=3789493513 TSER=86749653 1491 40.002532 10.100.1.35 -> 10.100.1.82 TCP connendp > nfs [ACK] Seq=46 Ack=30 Win=5888 Len=0 TSV=86749653 TSER=3789493513 1493 40.002880 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: New client: 16\n 1497 40.003611 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: handling krb5 upcall \n 1498 40.004069 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: New client: 17\n 1499 40.004489 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: Opened /var/lib/nfs/rpc_pipefs/nfs/clnt16/idmap\n 1500 40.004949 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: Using keytab file '/etc/krb5.keytab' \n 1501 40.005369 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: WARNING: Failed to obtain machine credentials for connection to server nas002.mycompany.tv \n 1502 40.005829 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: doing error downcall \n 1503 40.012862 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: Stale client: 16\n 1504 40.013326 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: \t-> closed /var/lib/nfs/rpc_pipefs/nfs/clnt16/idmap\n 1505 40.013740 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: Stale client: 17\n 1506 40.014157 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.WARNING: rpc.idmapd[4575]: \t-> closed /var/lib/nfs/rpc_pipefs/nfs/clnt17/idmap\n 1507 40.014621 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: destroying client clnt17 \n 1508 40.015082 10.100.1.35 -> 10.100.1.99 Syslog DAEMON.ERR: rpc.gssd[2498]: destroying client clnt16 \n [root@bk001 ~]#

2 2

CentOS, XFS, VirtualBox - can they just get along?
by Boris Epstein 25 Apr '12

25 Apr '12

Hello all, I am running VirtualBox 4.1 on CentOS 6 and I got this warning that putting your VM's into an XFS filesystem is risky. I have also heard some rumors on the net to this effect. Does anyone know in more detail what's behind those rumors? Thanks. Boris.

2 1

Does SMTP Connection Drop When Posfix Reload is Issued ?
by Prabhpal S. Mavi 25 Apr '12

25 Apr '12

Dear Community Friends Greetings, i work with ISP, we host email service for almost 500+ companies and 200+ mail servers relay through my smart host. i implemented something that when our smart host would become blacklisted. It will automatic switch to next available smart host (which is ready sitting). that mean it will start relaying message through another smart host automatically. i think i must tell little background as well. it is actually php script that perform blacklist check every minute through cron. if it found that IP is blacklisted. It will then insert "relay host =" value in main.cf and reload postfix service. When IP is no more blacklisted it will then remove the same directive from main.cf and reload postfix. everything is working as expected. i have one question, when we reload postfix does it drop active SMTP session? for example lets say that remote SMTP server is delivering message to my postfix that has 8MB attachment. message was not fully transferred. lets say that 4MB was transferred. and i issued "postfix reload". will that connection drop or continue to deliver the mail? Thanks / Regards Prabhpal S. Mavi

7 10

CentOS-announce Digest, Vol 86, Issue 14
by centos-announce-request＠centos.org 25 Apr '12

25 Apr '12

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2012:0518 Important CentOS 5 openssl Update (Johnny Hughes) 2. CESA-2012:0515 Critical CentOS 5 firefox Update (Johnny Hughes) 3. CESA-2012:0516 Critical CentOS 5 firefox Update (Johnny Hughes) 4. CESA-2012:0516 Critical CentOS 5 thunderbird Update (Johnny Hughes) 5. CESA-2012:0518 Important CentOS 6 openssl Update (Johnny Hughes) 6. CESA-2012:0515 Critical CentOS 6 firefox Update (Johnny Hughes) 7. CEBA-2012:0511 CentOS 6 matahari Update (Johnny Hughes) 8. CEBA-2012:0512 CentOS 6 aide Update (Johnny Hughes) 9. CESA-2012:0516 Critical CentOS 6 thunderbird Update (Johnny Hughes) 10. CESA-2012:0523 Moderate CentOS 5 libpng Update (Johnny Hughes) 11. CESA-2012:0523 Moderate CentOS 6 libpng Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Apr 2012 01:22:21 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0518 Important CentOS 5 openssl Update To: centos-announce(a)centos.org Message-ID: <20120425012221.GA5708(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0518 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0518.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: d8e4fe4b31be6324ed03ad70d86156a3168efc55c5b06ffd4fde486feb9fe2d6 openssl097a-0.9.7a-11.el5_8.2.i386.rpm c65df6dec7b008e84ab414c6970fb2c409a5e00cba23a4a4350b1a716b229559 openssl-0.9.8e-22.el5_8.3.i386.rpm 586a15a6bc19278bee19a2572bd1bc788003ff4c198431d0f4663adbb1b3184c openssl-0.9.8e-22.el5_8.3.i686.rpm 639974e459e9f6c0403360fc41067f48394f512d0ba5e579ea45b8992d2da168 openssl-devel-0.9.8e-22.el5_8.3.i386.rpm 92a492519329325336183c23929df620c8f8ddfd0e82b10c57664ec6d55e7bad openssl-perl-0.9.8e-22.el5_8.3.i386.rpm x86_64: d8e4fe4b31be6324ed03ad70d86156a3168efc55c5b06ffd4fde486feb9fe2d6 openssl097a-0.9.7a-11.el5_8.2.i386.rpm 7fa89e3ca44626a62c98bc84be77959f66a9b8eba6bbb9fd98365e74e6e103aa openssl097a-0.9.7a-11.el5_8.2.x86_64.rpm 586a15a6bc19278bee19a2572bd1bc788003ff4c198431d0f4663adbb1b3184c openssl-0.9.8e-22.el5_8.3.i686.rpm a5492f5973452f6193a3fb6cd3249f2791c52cebd1e1d12560d2d64b256c2784 openssl-0.9.8e-22.el5_8.3.x86_64.rpm 639974e459e9f6c0403360fc41067f48394f512d0ba5e579ea45b8992d2da168 openssl-devel-0.9.8e-22.el5_8.3.i386.rpm f2bd64faebbd7b5dc0124cca14b217ace539e04913f9eb266e8c2274b7dc94b8 openssl-devel-0.9.8e-22.el5_8.3.x86_64.rpm 75c9372cf9aa77e8d245254b3696b56d6bed262f3245e8c95278a07e74ffb42c openssl-perl-0.9.8e-22.el5_8.3.x86_64.rpm Source: d152bcff32227dd08cc0495718cfd19ad3ca2e1c15011ae41dc9ef0f434d4176 openssl097a-0.9.7a-11.el5_8.2.src.rpm 63492a08a2e0cd5277925dc88d34a85a381bd4c087787715e57645008a5bbace openssl-0.9.8e-22.el5_8.3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Wed, 25 Apr 2012 01:27:20 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0515 Critical CentOS 5 firefox Update To: centos-announce(a)centos.org Message-ID: <20120425012720.GA5926(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0515 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0515.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: c2e589aadfac0a7c5977431242a268743d4a223c4da6cab73919c0af8cba3278 firefox-10.0.4-1.el5.centos.i386.rpm eaa1f4d40f40f2c20310a7234a80d643dfd3cf6124a38466dfe700581f166304 xulrunner-10.0.4-1.el5_8.i386.rpm 67a66eb67a74646e261340123f32fc604ae072feb475674a86532b30deaec4e4 xulrunner-devel-10.0.4-1.el5_8.i386.rpm x86_64: c2e589aadfac0a7c5977431242a268743d4a223c4da6cab73919c0af8cba3278 firefox-10.0.4-1.el5.centos.i386.rpm 9f1a1179d341db3846865cb0c7e39a2a9e23c3e06067760ebeb07090f20ba9c0 firefox-10.0.4-1.el5.centos.x86_64.rpm eaa1f4d40f40f2c20310a7234a80d643dfd3cf6124a38466dfe700581f166304 xulrunner-10.0.4-1.el5_8.i386.rpm aa76e67d4a67b6c919176f37906b224ef0bcf4217ec2995b121528c594557cd3 xulrunner-10.0.4-1.el5_8.x86_64.rpm 67a66eb67a74646e261340123f32fc604ae072feb475674a86532b30deaec4e4 xulrunner-devel-10.0.4-1.el5_8.i386.rpm f34186000619626cb784b3f7a916bddd1b7416e6b731ef04842788ca797e64fd xulrunner-devel-10.0.4-1.el5_8.x86_64.rpm Source: 1fbc0bd8c0045baeb7e75a8a5162752b0b4c0253e96cacc22cc426f5351a3b33 firefox-10.0.4-1.el5.centos.src.rpm be2954b3d1a4f9309fb097188d0bcd684985f2c62801bcaf4b0ed224f672abcb xulrunner-10.0.4-1.el5_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Wed, 25 Apr 2012 01:30:17 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0516 Critical CentOS 5 firefox Update To: centos-announce(a)centos.org Message-ID: <20120425013017.GA7324(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0516 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0516.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f9867946d381c189979c309151f633bc51596909c160dbc03e5324582d664c20 thunderbird-10.0.4-1.el5.centos.i386.rpm x86_64: e67a3cc7f4319d39d9b23e59b03113224bd9ffaec8ed7ac76081211ce16a27c0 thunderbird-10.0.4-1.el5.centos.x86_64.rpm Source: be26754c255f7058be311dad0c8b0a7d515f6b20b6f0d50f4372a796db682d53 thunderbird-10.0.4-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Tue, 24 Apr 2012 20:39:28 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0516 Critical CentOS 5 thunderbird Update To: CentOS-Announce <centos-announce(a)centos.org> Message-ID: <4F9755D0.7020105(a)centos.org> Content-Type: text/plain; charset="iso-8859-1" CentOS Errata and Security Advisory 2012:0516 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0516.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f9867946d381c189979c309151f633bc51596909c160dbc03e5324582d664c20 thunderbird-10.0.4-1.el5.centos.i386.rpm x86_64: e67a3cc7f4319d39d9b23e59b03113224bd9ffaec8ed7ac76081211ce16a27c0 thunderbird-10.0.4-1.el5.centos.x86_64.rpm Source: be26754c255f7058be311dad0c8b0a7d515f6b20b6f0d50f4372a796db682d53 thunderbird-10.0.4-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net

1 0

Latest 6.2 kernel is broken
by Lars Hecking 25 Apr '12

25 Apr '12

I just kickstarted a new machine with the latest CentOS 6.2 files, including kernel 2.6.32-220.13.1.el6.x86_64. It came up without network interfaces. dmesg says: bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.2.1 (Dec 18, 2011) alloc irq_desc for 36 on node -1 alloc kstat_irqs on node -1 bnx2 0000:01:00.0: PCI INT A -> GSI 36 (level, low) -> IRQ 36 bnx2 0000:01:00.0: setting latency timer to 64 bnx2 0000:01:00.0: firmware: requesting bnx2/bnx2-mips-09-6.2.1b.fw bnx2: Can't load firmware file "bnx2/bnx2-mips-09-6.2.1b.fw" bnx2 0000:01:00.0: PCI INT A disabled bnx2: probe of 0000:01:00.0 failed with error -2 The firmware file is missing from /lib/firmware and the kernel-firmware rpm. I found a copy of it on a Fedora site and dumped it into the right location, but it wasn't found after a reboot. Yet, it was found after a second reboot. Why is that? Is a rebuild of initramfs triggered somehow? What I don't understand is: I have an identical machine that I installed under 6.2 a while back, and kept up to date, and it doesn't have this problem. However, it tells me it uses version v2.1.11 (July 20, 2011) of the driver, how is that possible? # grep bnx2 /var/log/messages Apr 23 17:10:03 localhost kernel: bnx2: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v2.1.11 (July 20, 2011) Apr 23 17:10:03 localhost kernel: bnx2 0000:01:00.0: PCI INT A -> GSI 36 (level, low) -> IRQ 36 Apr 23 17:10:03 localhost kernel: bnx2 0000:01:00.0: firmware: requesting bnx2/bnx2-mips-09-6.2.1a.fw Apr 23 17:10:03 localhost kernel: bnx2 0000:01:00.0: firmware: requesting bnx2/bnx2-rv2p-09-6.0.17.fw Apr 23 17:10:03 localhost kernel: bnx2 0000:01:00.0: eth0: Broadcom NetXtreme II BCM5716 1000Base-T (C0) PCI Express found at mem da000000, IRQ 36, node addr 78:2b:cb:67:3f:b6 [...] # modinfo /lib/modules/2.6.32-220.13.1.el6.x86_64/kernel/drivers/net/bnx2.ko filename: /lib/modules/2.6.32-220.13.1.el6.x86_64/kernel/drivers/net/bnx2.ko firmware: bnx2/bnx2-rv2p-09ax-6.0.17.fw firmware: bnx2/bnx2-rv2p-09-6.0.17.fw firmware: bnx2/bnx2-mips-09-6.2.1a.fw firmware: bnx2/bnx2-rv2p-06-6.0.15.fw firmware: bnx2/bnx2-mips-06-6.2.1.fw version: 2.1.11 license: GPL description: Broadcom NetXtreme II BCM5706/5708/5709/5716 Driver [...] # lspci -v -s 01:00.1 01:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5716 Gigabit Ethernet (rev 20) Subsystem: Dell PowerEdge R410 BCM5716 Gigabit Ethernet Flags: bus master, fast devsel, latency 0, IRQ 48 Memory at dc000000 (64-bit, non-prefetchable) [size=32M] Capabilities: [48] Power Management version 3 Capabilities: [50] Vital Product Data Capabilities: [58] MSI: Enable- Count=1/16 Maskable- 64bit+ Capabilities: [a0] MSI-X: Enable+ Count=9 Masked- Capabilities: [ac] Express Endpoint, MSI 00 Capabilities: [100] Device Serial Number 78-2b-cb-ff-fe-67-3f-b7 Capabilities: [110] Advanced Error Reporting Capabilities: [150] Power Budgeting <?> Capabilities: [160] Virtual Channel <?> Kernel driver in use: bnx2 Kernel modules: bnx2

4 13

ldap, 2.3 primary, 2.4 secondary
by aurfalien 25 Apr '12

25 Apr '12

Hi all, Is it possible to use a 2.3 OpenLDAP primary while having a 2.4 OpenLDAP secondary? Currently I have all at 2.3 (Centos 5) but am needing to up a remote facility to Centos 6 before doing the main facility to 6. Hoping I can mix and match but it looks like I may not be able to. My LDAP secondaries pull the DB over pretty frequently so I would be doing the same thing here. I would have asked the OpenLDAP list but you are much nicer to an order of magnitude, seriously. Thanks in advance, - aurf

2 2

strange partitioning problem
by Boris Epstein 25 Apr '12

25 Apr '12

Hello listmates, Here's I am, trying to install Centos 6.2 64-bit on a server with 24 TB of disk RAIDed as RAID 6. So I get this 18 TB disk (the RAID is recognized as one disk) where I am trying to put my OS. And I can create a couple of partitions - let us say I defiine a 150 GB swap, a 150 GB "/", a 100 GB "/var". So far so good. Then I try to define the next one, say, a 100 GB "/tmp" and get a message stating there is not enough disk space whereas I still have over 18 TB free and the installation interface reflects that accurately! I am at a loss. Is that something related to the sheer size of the disk? Why would this happen - especially at so basic a stage of the process? At any rate, any help or advice would be greatly appreciated. Regards, Boris.

9 28

Re: [CentOS] [CentOS-announce] CESA-2012:0465 Critical CentOS 5 samba Update
by James A. Peltier 24 Apr '12

24 Apr '12

Any idea about samba3x packages? Are they vulnerable? ----- Original Message ----- | | CentOS Errata and Security Advisory 2012:0465 Critical | | Upstream details at : | http://rhn.redhat.com/errata/RHSA-2012-0465.html | | The following updated files have been uploaded and are currently | syncing to the mirrors: ( sha256sum Filename ) | | i386: | 50fc234754d886f8147c22ed2b034d1f7be84dd78c10a8280699265a9c542cfa | libsmbclient-3.0.33-3.39.el5_8.i386.rpm | 62c20ba55a5213be09a2250454274f1fbf6aa854e84d78aaa1f75aec5d2a1920 | libsmbclient-devel-3.0.33-3.39.el5_8.i386.rpm | 294d346782344d32018a02ac25c9def811cbaced00ce19c0ca7c193d4f68d0c0 | samba-3.0.33-3.39.el5_8.i386.rpm | b792d801b4d57882b7c3f398d44b378446d6be48a07b12b265f07dc25564db13 | samba-client-3.0.33-3.39.el5_8.i386.rpm | 77a3666353bbc27ff71b1d4e34882459c5b440f783f21bb3c0adc3898ef501fb | samba-common-3.0.33-3.39.el5_8.i386.rpm | 1bea83056056c3da0dc568f13655c61c6b14f56957e7180aaaa4d6d8f26f7c82 | samba-swat-3.0.33-3.39.el5_8.i386.rpm | | x86_64: | 50fc234754d886f8147c22ed2b034d1f7be84dd78c10a8280699265a9c542cfa | libsmbclient-3.0.33-3.39.el5_8.i386.rpm | 61b5237a09f59a445730e994517ad565fb24da1e9bf07b5e6b7b8c80ac6ca588 | libsmbclient-3.0.33-3.39.el5_8.x86_64.rpm | 62c20ba55a5213be09a2250454274f1fbf6aa854e84d78aaa1f75aec5d2a1920 | libsmbclient-devel-3.0.33-3.39.el5_8.i386.rpm | 5c973b1c9c0a986989805afe6f600a48a76d9d6175e92896065591795516a157 | libsmbclient-devel-3.0.33-3.39.el5_8.x86_64.rpm | 55ee35ca8dc332e0bea6299ce2eed90d7b9460ae312a8abf42822cd0a737c555 | samba-3.0.33-3.39.el5_8.x86_64.rpm | 70200f37cfe741d94e9bb9060f9f2128d08a90ac6b6674f97a9adb474ea3f41b | samba-client-3.0.33-3.39.el5_8.x86_64.rpm | 77a3666353bbc27ff71b1d4e34882459c5b440f783f21bb3c0adc3898ef501fb | samba-common-3.0.33-3.39.el5_8.i386.rpm | 16e9165d7d3f3099d45f6389a58f7ebc87642856414506728e5d8f0466e343a3 | samba-common-3.0.33-3.39.el5_8.x86_64.rpm | e4f6f354d8a38ffb4f17af0be3736be3a9e055ba3e6ddff5f21a547fb8924d4f | samba-swat-3.0.33-3.39.el5_8.x86_64.rpm | | Source: | 4e4b6d761aed021020fe8ac82340ba78f835fc4610516ee8564da347ac735e22 | samba-3.0.33-3.39.el5_8.src.rpm | | | | -- | Johnny Hughes | CentOS Project { http://www.centos.org/ } | irc: hughesjr, #centos(a)irc.freenode.net | | _______________________________________________ | CentOS-announce mailing list | CentOS-announce(a)centos.org | http://lists.centos.org/mailman/listinfo/centos-announce | -- James A. Peltier Manager, IT Services - Research Computing Group Simon Fraser University - Burnaby Campus Phone : 778-782-6573 Fax : 778-782-3045 E-Mail : jpeltier(a)sfu.ca Website : http://www.sfu.ca/itservices http://blogs.sfu.ca/people/jpeltier Success is to be measured not so much by the position that one has reached in life but as by the obstacles they have overcome. - Booker T. Washington

3 2

"rename3" ethernet NIC?
by Boris Epstein 24 Apr '12

24 Apr '12

Hello listmates, Bizarrely enough, I ended up with what I intended to be called "eth1" being called "rename3". Would anybody have any idea what the cause could be of this? Thanks. Boris.

2 1

← Newer
1
2
3
4
5
6
7
8
...
18
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2012