Discuss May 2012

discuss@lists.centos.org

193 participants
201 discussions

SELinux prevents my PHP script from sending mail
by Alan M. Evans 03 May '12

03 May '12

Hello all... I maintain an amateurish email list for my wife's website on my CentOS 6 server. Once-a-month, she sends mail to "mylistaddr(a)mydomain.com" and the /etc/aliases file redirects that to my script: mylistaddr: "| /usr/bin/php-cgi /var/www/html/mydomain/email-cgi.php" The script, in turn, reads the recipient addresses out of a DB and composes and sends the mails. This all worked great until this month's mailing. Now sendmail just bounces the mail back "554 5.3.0 unknown mailer error 255". When I see programs complaining about "unknown" conditions, I usually suspect SELinux first, and sure enough... setenforce 0 then everything works like a charm. I wonder what changed between last month and this month? Anyway, I checked the audit.log file and found the relevant AVC denials. I created a local policy (audit2allow) to circumvent the denials, which helpfully prevented the denial messages in audit.log. But the maillist script still fails identically as long as SELinux is enforcing. And now nothing shows up in audit.log. So SELinux is preventing sendmail from calling my maillist script and not reporting the reason. How do I go about figuring out what's broken and how to fix it? -Alan

4 8

OpenLDAP migration from Centos 5 to 6
by Timothy Murphy 03 May '12

03 May '12

I'm moving my home network server from a Dell server, which has been having some mysterious problems, to an HP MicroServer. Everything - MySQL, OpenVPN, email (dovecot), httpd, etc - except for openLDAP, which is taking more time than everything else put together. I haven't found any straightforward instructions on this anywhere. The official RedHat document <http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html /Deployment_Guide/ch-Directory_Servers.html> doesn't really tell you what to do. Basically, I've saved the data on the old server with slapcat > /tmp/ldif and moved ldif to the new server . But when I run slapadd -l /tmp/ldif on the new server I get the response -------------------------------------- [root@grover ldap]# slapadd -l /tmp/ldif The first database does not allow slapadd; using the first available one (2) bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=my-domain,dc=com". slapadd: line 1: database #2 (dc=my-domain,dc=com) not configured to hold "dc=www,dc=gayleard,dc=com"; no database configured for that naming context _ 0.29% eta none elapsed none spd 1.1 M/s Closing DB... -------------------------------------- So I have copied /etc/openldap/slapd.conf from the old server to the new and also copied the old DB_CONFIG to /var/lib/ldap (these files are not used under CentOS-6, as far as I can see), and run -------------------------------------- [root@grover ldap]# slapadd -f /tmp/slapd.conf -l /tmp/ldif bdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 26s spd 4.8 k/s Closing DB... [root@grover slapd.d]# /var/lib [root@grover lib]# chown -R ldap.ldap ldap [root@grover lib]# service slapd restart -------------------------------------- Now I can access <http://www.gayleard.com/phpLDAPadmin>. There is an icon named "Login" on the left, but I am unable to login with any username/password I can think of, eg root/<root-password>. However, if I click on Anonymous in the login page, I do seem to enter an LDAP database, but with Base dc=my-domain,dc=com If anyone has successfully navigated this journey I should be very grateful to learn where I am going wrong. -- Timothy Murphy e-mail: gayleard /at/ eircom.net tel: +353-86-2336090, +353-1-2842366 s-mail: School of Mathematics, Trinity College Dublin

3 3

Libreoffice.org "official" RPMs in yum friendly format
by Nux! 03 May '12

03 May '12

I thought I "spammed" here as well last night when I sent to the SL list, but appears not. Sorry for the noise. Anyway, for those of you interested to run the RPMs from the libreoffice.org tarball instead of the stock packages, I put them all in a repo. More on this here http://www.nux.ro/archive/2012/04/LibreOffice_org_RPMs_in_a_yum_friendly_fo… Thanks to Ljubomir, Philippe, Jake and all the other persons who came with suggestions and ideas on this list. -- Sent from the Delta quadrant using Borg technology! Nux! www.nux.ro

3 5

mysql-bin files - filling up the space.
by Prabhpal S. Mavi 03 May '12

03 May '12

Dear All Greetings, i am seeking help from guys with mysql knowledge. i can see lot of these files in mysql directory. And they are eventually filling up the space on the server. what these files are? some exists with very old time stamps. such as February 2012. can these be deleted? This Number Starts From -----------------------mysql-bin.000001 -rw-rw---- 1 mysql mysql 159M Apr 25 12:24 mysql-bin.000197 -rw-rw---- 1 mysql mysql 5M Apr 26 00:00 mysql-bin.000198 -rw-rw---- 1 mysql mysql 8.1M Apr 27 00:00 mysql-bin.000200 -rw-rw---- 1 mysql mysql 125M MAY 27 20:29 mysql-bin.000230 Prabh S. Mavi

2 1

Firefox10-stuck with sync
by Johan Vermeulen 03 May '12

03 May '12

Dear All, Since RHEL/Centos went to Firefox10, I have about 50 users who have sync-pop-ups. Does anyone knows a quick and very dirty way to get rid of sync all together? I searched the Mozilla Forum, but found no clean Linux-solution, without me having to log in to every account and run about:config. I was thinking like adding something to prefs.js I cannot believe Firefox included this kind of feature without a very big OFF-button. The world is twisted. Is nobody thinking of sysadmins these days? ( not that I consider myself a true sysadmin ) Thanks very much for any advise. greetings, J. -- Johan Vermeulen IT-medewerker Caw De Kempen johan.vermeulen(a)cawdekempen.be 0479.82.01.41 Opensource Software is the future.

1 0

Strange situation with openssl and kernel
by Nikolaos Milas 03 May '12

03 May '12

Hello, On a VM guest (running under KVM) with CentOS 5.8, I yesterday strangely got the following (see below). The server runs apache/php/squirrelmail/postfix/dovecot/openldap and it is a production server. Do you advise to do some particular file system checks or other settings? Any other advice? Such errors have not appeared in the past. Thanks, Nick System info: ============================================================= [root@vmail log]# parted -l Error: Unable to open /dev/md0 - unrecognised disk label. Model: Unknown (unknown) Disk /dev/vda: 623GB Sector size (logical/physical): 512B/512B Partition Table: msdos Number Start End Size Type File system Flags 1 32.3kB 107MB 107MB primary ext3 boot 2 107MB 85.9GB 85.8GB primary lvm 3 85.9GB 623GB 537GB primary lvm [root@vmail log]# [root@vmail log]# df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/VolGroup00-LogVol00 560G 72G 460G 14% / /dev/vda1 99M 20M 75M 21% /boot tmpfs 1.5G 0 1.5G 0% /dev/shm [root@vmail log]# [root@vmail log]# [root@vmail log]# uname -a Linux vmail.noa.gr 2.6.18-308.4.1.el5 #1 SMP Tue Apr 17 17:08:00 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux [root@vmail log]# [root@vmail log]# [root@vmail log]# vgdisplay --- Volume group --- VG Name VolGroup00 System ID Format lvm2 Metadata Areas 2 Metadata Sequence No 5 VG Access read/write VG Status resizable MAX LV 0 Cur LV 2 Open LV 2 Max PV 0 Cur PV 2 Act PV 2 VG Size 579.84 GB PE Size 32.00 MB Total PE 18555 Alloc PE / Size 18555 / 579.84 GB Free PE / Size 0 / 0 VG UUID fDg7W8-xe04-7OpQ-tFLe-Sioh-G2jb-dOuLGa [root@vmail log]# lvdisplay --- Logical volume --- LV Name /dev/VolGroup00/LogVol00 VG Name VolGroup00 LV UUID 2Q26xO-HIdJ-UXAR-0zAM-yYFq-ysqu-bEs8J8 LV Write Access read/write LV Status available # open 1 LV Size 577.88 GB Current LE 18492 Segments 2 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 252:0 --- Logical volume --- LV Name /dev/VolGroup00/LogVol01 VG Name VolGroup00 LV UUID Ceb2Qe-tnNk-te6R-cxdm-p0cK-SieL-0mqhHW LV Write Access read/write LV Status available # open 1 LV Size 1.97 GB Current LE 63 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 252:1 ============================================================= /var/log/messages: May 2 20:48:24 vmail nrpe[25864]: Error: Could not complete SSL handshake. 5 May 2 20:48:24 vmail nrpe[25866]: Error: Could not complete SSL handshake. 5 May 2 21:00:31 vmail nrpe[26106]: Error: Could not complete SSL handshake. 5 May 2 21:20:34 vmail nrpe[26666]: Error: Could not complete SSL handshake. 5 May 2 21:21:32 vmail nrpe[26686]: Could not read request from client, bailing out... May 2 21:21:32 vmail nrpe[26686]: INFO: SSL Socket Shutdown. May 2 21:43:11 vmail kernel: INFO: task fail2ban-server:2589 blocked for more than 120 seconds. May 2 21:45:32 vmail kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. May 2 21:45:32 vmail kernel: fail2ban-serv D 0000000000000000 0 2589 1 2590 2585 (NOTLB) May 2 21:47:25 vmail kernel: ffff8100a6625ea8 0000000000000082 00002aaaaacbd000 0000000000001000 May 2 21:47:53 vmail kernel: ffffff9ca6854280 0000000000000009 ffff8100a65f8040 ffff8100581f20c0 May 2 21:47:54 vmail kernel: 000017f236120882 0000000000000465 ffff8100a65f8228 0000000000000000 May 2 21:47:54 vmail kernel: Call Trace: May 2 21:47:55 vmail kernel: [<ffffffff80063c63>] __mutex_lock_slowpath+0x60/0x9b May 2 21:47:55 vmail kernel: [<ffffffff80063cad>] .text.lock.mutex+0xf/0x14 May 2 21:47:55 vmail kernel: [<ffffffff80013ed6>] generic_file_llseek+0x2a/0x8b May 2 21:47:55 vmail kernel: [<ffffffff8002563b>] sys_lseek+0x40/0x60 May 2 21:47:58 vmail kernel: [<ffffffff8005d229>] tracesys+0x71/0xe0 May 2 21:47:58 vmail kernel: [<ffffffff8005d28d>] tracesys+0xd5/0xe0 May 2 21:47:58 vmail kernel: May 2 22:42:53 vmail nrpe[29199]: Could not read request from client, bailing out... May 2 22:42:53 vmail nrpe[29199]: INFO: SSL Socket Shutdown. May 2 22:42:53 vmail nrpe[29201]: Could not read request from client, bailing out... May 2 22:42:53 vmail nrpe[29201]: INFO: SSL Socket Shutdown. May 2 22:42:53 vmail nrpe[29203]: Could not read request from client, bailing out... May 2 22:42:53 vmail nrpe[29203]: INFO: SSL Socket Shutdown. May 2 22:48:14 vmail kernel: INFO: task kjournald:382 blocked for more than 120 seconds. May 2 22:48:20 vmail kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. May 2 22:48:20 vmail kernel: kjournald D ffff8100b78fc0c0 0 382 31 407 371 (L-TLB) May 2 22:48:20 vmail kernel: ffff8100b8dbbcf0 0000000000000046 ffff8100bff965c0 ffff8100a732c940 May 2 22:48:20 vmail kernel: ffff810002d941a0 000000000000000a ffff810037f5f820 ffff8100b78fc0c0 May 2 22:48:20 vmail kernel: 00001b85cd09baa4 0000000000001325 ffff810037f5fa08 000000008006e665 May 2 22:48:20 vmail kernel: Call Trace: May 2 22:48:20 vmail kernel: [<ffffffff8006ecd9>] do_gettimeofday+0x40/0x90 May 2 22:48:20 vmail kernel: [<ffffffff8005a412>] getnstimeofday+0x10/0x29 May 2 22:48:20 vmail kernel: [<ffffffff8001558e>] sync_buffer+0x0/0x3f May 2 22:48:20 vmail kernel: [<ffffffff800637de>] io_schedule+0x3f/0x67 May 2 22:48:20 vmail kernel: [<ffffffff800155c9>] sync_buffer+0x3b/0x3f May 2 22:48:20 vmail kernel: [<ffffffff80063a0a>] __wait_on_bit+0x40/0x6e May 2 22:48:20 vmail kernel: [<ffffffff8001558e>] sync_buffer+0x0/0x3f May 2 22:48:20 vmail kernel: [<ffffffff80063aa4>] out_of_line_wait_on_bit+0x6c/0x78 May 2 22:48:20 vmail kernel: [<ffffffff800a34d5>] wake_bit_function+0x0/0x23 May 2 22:48:20 vmail kernel: [<ffffffff88033a47>] :jbd:journal_commit_transaction+0x559/0x10c2 May 2 22:48:20 vmail kernel: [<ffffffff8003d7be>] lock_timer_base+0x1b/0x3c May 2 22:48:20 vmail kernel: [<ffffffff8004ad59>] try_to_del_timer_sync+0x7f/0x88 May 2 22:48:20 vmail kernel: [<ffffffff880376a3>] :jbd:kjournald+0xc1/0x213 May 2 22:48:20 vmail kernel: [<ffffffff800a34a7>] autoremove_wake_function+0x0/0x2e May 2 22:48:20 vmail kernel: [<ffffffff800a328f>] keventd_create_kthread+0x0/0xc4 May 2 22:48:20 vmail kernel: [<ffffffff880375e2>] :jbd:kjournald+0x0/0x213 May 2 22:48:20 vmail kernel: [<ffffffff800a328f>] keventd_create_kthread+0x0/0xc4 May 2 22:48:20 vmail kernel: [<ffffffff80032632>] kthread+0xfe/0x132 May 2 22:48:20 vmail kernel: [<ffffffff8005dfb1>] child_rip+0xa/0x11 May 2 22:48:20 vmail kernel: [<ffffffff800a328f>] keventd_create_kthread+0x0/0xc4 May 2 22:48:20 vmail kernel: [<ffffffff80032534>] kthread+0x0/0x132 May 2 22:48:20 vmail kernel: [<ffffffff8005dfa7>] child_rip+0x0/0x11 May 2 22:48:20 vmail kernel: May 2 22:48:20 vmail kernel: INFO: task httpd:2775 blocked for more than 120 seconds. May 2 22:48:20 vmail kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. May 2 22:48:20 vmail kernel: httpd D ffff8100a9323040 0 2775 2541 2776 2774 (NOTLB) May 2 22:48:20 vmail kernel: ffff8100a4b19aa8 0000000000000082 ffff8100b999e9d0 ffff8100a4b19b38 May 2 22:48:20 vmail kernel: 7ffffffffffffcd8 000000000000000a ffff8100a65837a0 ffff8100a9323040 May 2 22:48:20 vmail kernel: 00001b85cd33ccf5 00000000000354bc ffff8100a6583988 000000008006e665 May 2 22:48:20 vmail kernel: Call Trace: May 2 22:48:20 vmail kernel: [<ffffffff8006ecd9>] do_gettimeofday+0x40/0x90 May 2 22:48:20 vmail kernel: [<ffffffff80062ffd>] thread_return+0x5d/0xfe May 2 22:48:20 vmail kernel: [<ffffffff8005a412>] getnstimeofday+0x10/0x29 May 2 22:48:20 vmail kernel: [<ffffffff8001558e>] sync_buffer+0x0/0x3f May 2 22:48:20 vmail kernel: [<ffffffff800637de>] io_schedule+0x3f/0x67 May 2 22:48:20 vmail kernel: [<ffffffff800155c9>] sync_buffer+0x3b/0x3f May 2 22:48:20 vmail kernel: [<ffffffff80063922>] __wait_on_bit_lock+0x36/0x66 May 2 22:48:20 vmail kernel: [<ffffffff8001558e>] sync_buffer+0x0/0x3f May 2 22:48:20 vmail kernel: [<ffffffff800639be>] out_of_line_wait_on_bit_lock+0x6c/0x78 May 2 22:48:20 vmail kernel: [<ffffffff800a34d5>] wake_bit_function+0x0/0x23 May 2 22:48:20 vmail kernel: [<ffffffff8803181e>] :jbd:do_get_write_access+0x54/0x522 May 2 22:48:20 vmail kernel: [<ffffffff80019d4f>] __getblk+0x25/0x22c May 2 22:48:20 vmail kernel: [<ffffffff88031d0e>] :jbd:journal_get_write_access+0x22/0x33 May 2 22:48:20 vmail kernel: [<ffffffff8804dd3b>] :ext3:ext3_reserve_inode_write+0x38/0x90 May 2 22:48:20 vmail kernel: [<ffffffff8804ddb4>] :ext3:ext3_mark_inode_dirty+0x21/0x3c May 2 22:48:20 vmail kernel: [<ffffffff88050d39>] :ext3:ext3_dirty_inode+0x63/0x7b May 2 22:48:20 vmail kernel: [<ffffffff80013d53>] __mark_inode_dirty+0x29/0x16e May 2 22:48:20 vmail kernel: [<ffffffff80016642>] __generic_file_aio_write_nolock+0x28a/0x3b6 May 2 22:48:20 vmail kernel: [<ffffffff80021872>] generic_file_aio_write+0x67/0xc3 May 2 22:48:20 vmail kernel: [<ffffffff8804c1c2>] :ext3:ext3_file_write+0x16/0x91 May 2 22:48:20 vmail kernel: [<ffffffff800183ac>] do_sync_write+0xc7/0x104 May 2 22:48:20 vmail kernel: [<ffffffff800e403c>] do_readv_writev+0x26e/0x291 May 2 22:48:20 vmail kernel: [<ffffffff800a34a7>] autoremove_wake_function+0x0/0x2e May 2 22:48:20 vmail kernel: [<ffffffff80033902>] do_setitimer+0x5b4/0x689 May 2 22:48:20 vmail kernel: [<ffffffff80016b29>] vfs_write+0xce/0x174 May 2 22:48:20 vmail kernel: [<ffffffff800173f2>] sys_write+0x45/0x6e May 2 22:48:20 vmail kernel: [<ffffffff8005d28d>] tracesys+0xd5/0xe0 May 2 22:48:20 vmail kernel: May 2 22:51:10 vmail nrpe[29461]: Error: Could not complete SSL handshake. 5 May 2 23:46:10 vmail nrpe[31317]: Error: Could not complete SSL handshake. 5 May 3 00:08:50 vmail nrpe[32073]: Error: Could not complete SSL handshake. 5 May 3 00:08:50 vmail nrpe[32069]: Error: Could not complete SSL handshake. 5 =============================================================

1 0

Re: [CentOS] editing bind (DNS) configuration under CentOS 6
by We Are Here 02 May '12

02 May '12

At 13:58 02/05/2012, you wrote: >It appears that system-config-bind has been phased out. Whatever the >reasoning was behind that decision - what are we expected to do now? Edit >it manually? That is doable, of course, but kind of cumbersome. Does >anybody know if there is a tool we are expected to use for that purpose? Welcome to the command line!! Unleash the power people. God if there is one thing I love about linux it is the command line. 4am in a DC, MD screaming about SLA, enter the penguin! Karanbir your an inspiration, keep up the excellent work, same goes for the rest of the CentOS team. Tim D'Cruz _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

down to the nitty gritty, mysql replication
by Bob Hoffman 02 May '12

02 May '12

Almost done with my centos handbook project on my server. Last two things are related, backups. Looking for anyone who feels like chiming in on mysql backups...this is what I am thinking at this point. Mysql backup system for all websites ---------------------------------------------------- Each website is on a separate server, each running mysql, no site is related to the others. A server will be built (VM) that will host mysql. I believe the way to do this is as follows... 1- make a separate instance of mysql on the backup server equal to the number of websites I am going to backup 2- set up each website's mysql to be a Master 3- set up each instance of mysql on the backup to be a slave to its website Master 4- run them all at the same time, replication from master to slave 5- on the backup / slave mysql instances run logs, back up by day, dump daily I believe, not sure, this will work. Not sure if a better way. The replication allows for a full and almost up to the second copy should a corruption happen on the Master. The daily log files and dumps on the backup server allow for rebuild due to hacker attack. The backup server handling the dumps prevents any issue with the website mysql and the web application. From there, amanda will grab those backup log and dumps to add to each site's file backups. And that is the logic of what I think I can do with this. Trying to back up multiple websites files, logs, and mysql. Amanda will do all but the mysql. sound right? This is the last big step before I start writing the chapters out for the book. Hope to get it done within a month or two after the backup system is done. any thoughts appreciated.

1 0

Re: [CentOS] editing bind (DNS) configuration under CentOS 6
by James B. Byrne 02 May '12

02 May '12

On Wed, May 2, 2012 09:15, Karanbir Singh wrote: > On 05/02/2012 02:09 PM, Nux! wrote: >>> it manually? That is doable, of course, but kind of cumbersome. >>> Does >>> anybody know if there is a tool we are expected to use for that >>> purpose? >> >> If you're afraid of "vi", I can recommend webmin. >> http://dl.nux.ro/rpm/webmin.repo >> > > and then you have 2 problems, one of which is a security hole. > > I've mostly just gone to using nsupdate from the cli for all zone > edits in bind zones. if you ever need the clear zone file, its > easily dumped out with rndc - works, and you can do some fairly > complex things in a clear and simple transaction manner ( plus, > easily automated from other scripts / code for more win ) > For those of us not blessed with either the depth of experience or the time required to master every single idiosyncratic cli for each one of the the very many system daemons we are required to administer Webmin is an excellent alternative to daily trips into the arcane. Any security issue respecting access to Webmin is handled simply and efficiently in three steps: 1. Set IPTables, or whatever firewall you employ, to block all access to webmin's listening port (default 10000) from addresses outside your local lan or from any but a specific host address. Do this first and reload the firewall rules. 2. Install and immediately configure Webmin to use https only. This can be done from the command line using any convenient editor by editing the following three lines in /etc/webmin/miniserv.conf: keyfile=/etc/webmin/miniserv.pem ssl=1 ssl_redirect=1 3. Create a secure tunnel to an address inside your firewall that is permitted access to webmin using whatever means you find convenient. I use SOCKS via "ssh -D 2001 user@host" with RSA certs and Firefox configured to use the SOCKS proxy on my local host. VPN or other techniques will work as well, if not better. But SOCKS over ssh works well enough for my purposes. This will get you up and going without ever having to pass credentials to webmin over the wire enclair. Webmin has the virtue of being remarkably easy to setup and simplifies most abuse configuration issues on a wide variety of services. For one, it usually handles which files require which configuration options. It does not, and cannot, cover every eventuality. But, for basic setup and ongoing control of the main system services running on most mainline Linux distros Webmin works most admirably in my experience. It certainly saves me a great deal of time and frustration. I would not give access to Webmin to anyone that did not already have root access to that server. But, if they already have root then I see no reason to make their work any harder than it needsbe. One caution. Webmin is a powerful tool. If you do not know what you are doing then you can hurt yourself very badly with it. On the other hand I have made serious configuration errors with an editor some of which were just spelling mistakes; a problem that Webmin mostly avoids. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

Upgrading PHP and PHP53 on CentOS5 - P.S - Instructions
by Max Pyziur 02 May '12

02 May '12

Greetings, IUS has a set of instructions here; they seem to be fairly detailed: http://iuscommunity.org/Docs/ClientUsageGuide fyi, MP pyz(a)brama.com

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2012