Discuss May 2012

discuss@lists.centos.org

193 participants
201 discussions

Repositories in CentOS 5.8
by Kaushal Shriyan 29 May '12

29 May '12

Hi, I am running Cent OS 5.8 in production. Can someone please explain me about various repositories available in CentOS 5.8 and which third party repos ( http://wiki.centos.org/AdditionalResources/Repositories) i should use it in Production environment. Help me understand the pros and cons. Regards Kaushal

12 35

CentOS-announce Digest, Vol 87, Issue 16
by centos-announce-request＠centos.org 29 May '12

29 May '12

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2012:0694 CentOS 6 lldpad Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 May 2012 12:35:23 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2012:0694 CentOS 6 lldpad Update To: centos-announce(a)centos.org Message-ID: <20120529123523.GA32413(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2012:0694 Upstream details at : https://rhn.redhat.com/errata/RHBA-2012-0694.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: a5ea19b5eee4d89a7ec80aab574d69d15977f6c68d0ee58fd4a6c35ed0238c14 lldpad-0.9.43-13.el6_2.i686.rpm 7d17a17678a42937c0e81ebd92bbfa816f1012417abbbac0f7b29c12ade5cac2 lldpad-devel-0.9.43-13.el6_2.i686.rpm x86_64: eec5116b989792aab442e339060dc3cb4d66ce6c96e2dc535e0052c0d702bb11 lldpad-0.9.43-13.el6_2.x86_64.rpm 7d17a17678a42937c0e81ebd92bbfa816f1012417abbbac0f7b29c12ade5cac2 lldpad-devel-0.9.43-13.el6_2.i686.rpm 0e10e160643015c5f5335811ceec1c0a2730b830b543c13303ecd45d14843a1a lldpad-devel-0.9.43-13.el6_2.x86_64.rpm Source: eaafc56b86c32eff0af7ecc16e0958aad75917a2ac39a72d5e415875f82fea53 lldpad-0.9.43-13.el6_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 87, Issue 16 ***********************************************

1 0

KVM and vnc together
by Jerry Geis 29 May '12

29 May '12

Ran into something weird. I have my machine CentOS 6.2 running KVM guest of Windows 7. This works fine while I'm in the office... Then when I remote in using VNC to my machine - the VNC always works fine. However, when I try to access the KVM session its like the mouse has lost its brain. Anyone ran into this? I startup with this command: qemu-system-x86_64 -net nic,model=rtl8139 -net user -hda win7.img -usb -m 4192 -vga std & Thanks, Jerry

4 3

anyone care to helop with a fail2ban problem on Centos 5.8?
by Dave Stevens 29 May '12

29 May '12

I've got an up-to-date Centos 5.8 and can't seem to get fail2ban to get rid of troublesome sshd login attempts. /etc/fail2ban/jail.conf has these sections: [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6 # Generic filter for pam. Has to be used with action which bans all ports # such as iptables-allports, shorewall [pam-generic] enabled = false # pam-generic filter can be customized to monitor specific subset of 'tty's filter = pam-generic # port actually must be irrelevant but lets leave it all for some possible uses port = all banaction = iptables-allports port = anyport logpath = /var/log/auth.log maxretry = 6 and an excerpt from a logwatch run just now is: --------------------- pam_unix Begin ------------------------ sshd: Authentication Failures: unknown (190.145.98.179): 2460 Time(s) root (58.51.95.75): 285 Time(s) unknown (122.70.128.5): 125 Time(s) postgres (190.145.98.179): 64 Time(s) mail (190.145.98.179): 40 Time(s) mysql (190.145.98.179): 40 Time(s) root (190.145.98.179): 36 Time(s) unknown (58.51.95.75): 26 Time(s) ftp (190.145.98.179): 17 Time(s) root (122.70.128.5): 15 Time(s) root (221.226.215.117): 13 Time(s) root (cloud-128-117.diagcomputing.org): 13 Time(s) adm (190.145.98.179): 12 Time(s) so advice? redirection? rtfm? Dave -- It is told that such are the aerodynamics and wing loading of the bumblebee that, in principle, it cannot fly...if all this be true...life among bumblebees must bear a remarkable resemblance to life in the United States. -- John Kenneth Galbraith, in American Capitalism: The Concept of Countervailing Power

2 1

How do downgrade mozilla ?
by Timothy Madden 29 May '12

29 May '12

Hello Sorry to say this to everyone, but since I installed CentOS 6 a month ago I found that both Mozilla Firefox and Mozilla Thunderbird crash big time (meaning every day and even more than once a day) with a large INBOX or newsgroup, or with many tabs open in the Firefox windows. I also keep my work computer running over night usually, maybe this is also a factor. Knode does not do a better job than Thunderbird with the newsgroups, either, it still crashes on large ones. Konqueror too consumes many gigabytes and becomes unresponsive if I have many tabs open and keep it running over night. I got pan newsreader though, and it is very nice with a 126000-articles a newsgroup (like on CentOS.general :)! And that reporting tool that pops up every time says it can not upload the crash report (because it does not have some valid URL or something)... Is there a nice way to downgrade Mozilla Firefox to say version 4 or 5 please ? And something similar for Thunderbird ? Thank you, Timothy Madden

5 4

openldap mmr + heartbeat hot standby
by Wessel van der Aart 29 May '12

29 May '12

Hi List, I've setup 2 openldap servers in n-way multimaster replication mode in a test environment, both run centos 6.2, this works well but now i'm trying to make these 2 servers failover using heartbeat. i've got no experience with heartbeat (or setting up clusters in general) however from what i understand heartbeat starts/stops the service if the server has the virtual IP assigned or not. this would be fine for httpd , but since replication doesn't work when slapd is stopped i was wondering if anyone knows if there is a way to setup heartbeat with a hot standby? so that the service keeps running but the ip does gets reassigned when one goes down. Thanks, Wessel

4 5

Re: [CentOS] NTP and virtual guests
by James B. Byrne 28 May '12

28 May '12

On Mon, May 28, 2012 10:10, Bob Hoffman wrote: > On 5/28/2012 9:59 AM, James B. Byrne wrote: >> On Mon, May 28, 2012 08:50, Reindl Harald wrote: >>> >>> Am 28.05.2012 14:41, schrieb James B. Byrne: >>>> when power returned all of the restored guests were immediately >>>> shutdown by ntp because the time differential between the >>>> restored systems and that of the ntpd sync servers exceeded >>>> the panic threshold. >>> how can ntpd shutdown a guest? >> I have no idea. Perhaps I misunderstood what the ntpd man page >> referred to as a panic. >> >> If it is not ntpd then I still need to discover some way of ensuring >> that all the KVM guests that were active at the time of a power >> failure automatically come back on line when the KVM host system >> starts up. I cannot find any reference to how this is done. >> >> Are there any recommended solutions? These systems are on UPS >> already >> but the power failure duration exceeded the endurance of the the >> UPS. >> > I know when ntp changes the time drastically (like ntpdate) my vsftpd > just commits suicide and dies.. > I imagine something like that is going on with the lvm software either > on the host or the kvm? > > I would suggest turning off ntp before long time shut downs...and > (ugh) manually going through the host and all vms upon turn on and > ntpdate them, then turn ntp on, then reboot to make it all come > back on? > > perhaps a script that turns off ntp, runs ntpdate on host, then on > each kvm upon reboot? this sounds rather scary. > > I cannot find anything in the logs that explain what is happening to me. The evidence I have indicates that when the host kvm system is powered off and restarted then the guests do not restart. This behaviour is at variance with a controlled shutdown wherein active guests are (usually) restarted when the host reboots. I infer from this observation that system scripts already handle this more or less correctly. I suppose that I could just create an init script that read a custom status file and restated every domain that it found therein using virsh. However, if such a beast already exists then I would rather not have to reinvent the wheel. Is anyone aware of such a script or where one might be found? I am not havig much luck with Google this morning. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

PCI/DSS compliance on CentOS
by Arun Khan 28 May '12

28 May '12

I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to be on different systems. In addition the auditor has also stipulated that there be a NTP server, a "patch" server, The Host OS on all of the above nodes will be CentOS 6.2. Below is a list of things that would be necessary. 1. Digital Certificates for each host on the PCI/DSS segment 2. SELinux on each Linux host in the PCI/DSS network segment 3. Tripwire/AIDE on each Linux host in the PCI/DSS segment 4. OS hardening scripts (e.g. Bastille Linux) 5. Firewall 6. IDS (Snort) 6. Central “syslog” server However, beyond this I would appreciate any comments/feedback / suggestion if you or your organization has undergone a PCI/DSS audit and what are the gotchas that you encountered, especially with respect to CentOS/ open source stack. I came across this which kind of brings out issues between the implementer and the PCI/DSS auditor. <http://webmasters.stackexchange.com/questions/15098/pci-dss-compliance-for-…> Thanks very much. -- Arun Khan

7 17

Another odd SELinux message
by James B. Byrne 28 May '12

28 May '12

Does anyone recognize this sort of message or have any idea what might cause it? May 28 11:00:06 inet09 setroubleshoot: [avc.ERROR] Plugin Exception catchall #012Traceback (most recent call last):#012 File "/usr/lib64/python2.6/site-packages/setroubleshoot/analyze.py", line 191, in analyze_avc#012 report = plugin.analyze(avc)#012 File "/usr/share/setroubleshoot/plugins/catchall.py", line 67, in analyze#012 summary = self.summary + " on " + avc.tpath + "."#012UnicodeDecodeError: 'utf8' codec can't decode byte 0x80 in position 1: invalid start byte SELinux is preventing /bin/ps from search access on the directory D�. For complete SELinux messages. run sealert -l b9c81815-0139-45f7-ae92-4f77dd21a6e7 sealert -l b9c81815-0139-45f7-ae92-4f77dd21a6e7 Entity: line 70: parser error : Input is not proper UTF-8, indicate encoding ! Bytes: 0x80 0x3C 0x2F 0x74 <tpath>D�</tpath> ^ failed to connect to server: xmlParseDoc() failed I am also seeing a lot of these sorts of messages on the same server: May 28 10:49:26 inet09 setroubleshoot: SELinux is preventing /bin/ps from getattr access on the directory /proc/<pid>. For complete SELinux messages. run sealert -l 14393839-4be4-448f-9c29-34b7a5d53b9d May 28 10:49:26 inet09 setroubleshoot: SELinux is preventing /bin/ps from search access on the directory 1169. For complete SELinux messages. run sealert -l b2e0a936-a6fe-4551-b463-28b587d4daed sealert -l b2e0a936-a6fe-4551-b463-28b587d4daed SELinux is preventing /bin/ps from search access on the directory 1169. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that ps should be allowed search access on the 1169 directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep ps /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp This particular server is running several Ruby-on-Rails (RoR) applications using Passenger (aka mod-rails). Passenger has a 'lot' of SELinux issues so this host is more or less a quarantine site for Rails apps. I am suspicious that Passenger is the cause because I see these reports as well: type=AVC msg=audit(1338217386.027:1839): avc: denied { read } for pid=4612 comm="ps" name="stat" dev=proc ino=11982 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:restorecond_t:s0 tclass=file Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. I wonder if Passenger is tracking system processes via ps to manage its user apps. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

mcelog SELinux errors
by James B. Byrne 28 May '12

28 May '12

Prowling around in the system logs this morning I discover the following entries: May 27 09:48:27 vhost01 mcelog: Cannot open logfile /var/log/mcelog: Permission denied May 27 09:48:27 vhost01 mcelog: failed to prefill DIMM database from DMI data May 27 09:48:27 vhost01 mcelog: Cannot bind to client unix socket `/var/run/mcel og-client': Permission denied and later: vhost01 setroubleshoot: SELinux is preventing /usr/sbin/mcelog from write access on the directory /var/run. For complete SELinux messages. run sealert -l 548d9d71-bac3-41eb-aa30-9b40e3f2a324 sealert -l 548d9d71-bac3-41eb-aa30-9b40e3f2a324 SELinux is preventing /usr/sbin/mcelog from write access on the directory /var/run. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that mcelog should be allowed write access on the run directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep mcelog /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp This seems to my mind a bug either with the distributed SELinux policies or the software itself or somehow something has become very, very misconfigured. However, an semodule -l does not reveal any local policies installed on this server, so whatever is wrong it does not seem likely that the cause was a local modification. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

← Newer
1
2
3
4
5
6
7
8
...
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2012