Discuss February 2013

discuss@lists.centos.org

203 participants
198 discussions

CentOS 6.3 - fail2ban not working properly + workaround
by SilverTip257 12 Mar '13

12 Mar '13

I recall others on this list are using fail2ban to block brute force login attempts. Packages are from the EPEL repo, so I'm just sharing some knowledge here. For about two months now I've had a CentOS 6.3 box (web host) in production that occasionally is ftp brute forced. Oddly enough fail2ban wasn't nabbing the perpetrators. I found that the iptables chain for VSFTP isn't created for one. I have finally come to find [0] that indicates there's a problem with the inotify backend. Setting backend=gamin in /etc/fail2ban/jail.conf gives me the iptables chain I expect to find and one blocked host. Hope this is helpful to somebody until a new version is commited to EPEL. <quote> yarikoptic: ok -- that point was not yet good ;) now (0.8.6-95-gc0c1232) that branch seems to work just perfect. If I hear no complaints or do not see problem with my instance -- I will merge it into master tomorrow, thus closing this issue </quote> [0] https://github.com/fail2ban/fail2ban/issues/44 ---~~.~~--- Mike // SilverTip257 //

3 5

CentOS 6 early panic on ESXi 4.1.0 build 800380
by Tilman Schmidt 12 Mar '13

12 Mar '13

I run VMware vSphere 4 Essentials with three almost identically configured ESXi 4.1 hosts and a mix of 32 and 64 bit guests including Windows 2003 and 2008 as well as CentOS 5 and 6. Recently I updated one of the hosts to build 800380. The new build runs Windows and CentOS 5 VMs fine, but CentOS 6 guests won't come up. I tried two different CentOS 6 VMs. Both have the latest standard kernel (2.6.32-279.5.2.el6.x86_64). Both run perfectly fine on one of the other VMware hosts still running ESXi 4.1.0 build 702113. On build 800380, both display the GRUB menu alright but freeze immediately afterwards, emitting the message PANIC: early exception 0d rip 10:ffffffff81038879 error 0 cr2 0 on the bottom of the virtual console. Both run perfectly fine again once I move them back to the host with the older ESXi build. From one of the failed boot attempts, I captured a VMware debug log which shows: Sep 11 17:21:19.628: vcpu-0| RDMSR: unknown MSR[0x1a0] (read as zero): rip=0xffffffff810388db count=1 Sep 11 17:21:19.628: vcpu-0| RDMSR: unknown MSR[0x1a0] (read as zero): rip=0xffffffff810388db count=2 Sep 11 17:21:19.629: vcpu-0| X86Fault_Warning: vmcore/vmm64/cpu/interp.c:427: cs:eip=0x10:0xffffffff81038879 fault=13 Sep 11 17:21:19.632: vcpu-0| Vix: [1125838 vmxCommands.c:9609]: VMAutomation_HandleCLIHLTEvent. Do nothing. Sep 11 17:21:19.632: vcpu-0| MsgHint: msg.monitorevent.halt (sent) Sep 11 17:21:19.632: vcpu-0| The CPU has been disabled by the guest operating system. Power off or reset the virtual machine. Ideas? aTdHvAaNnKcSe, Tilman

3 10

selinux + kvm virtualization + smartd problem
by Ilyas -- 11 Mar '13

11 Mar '13

Hello, I'm using HP homeserver where host system run CentOS 6.3 with KVM virtualization with SELinux enabled, guests too run the same OS (but without SELinux, but this does not matter). Host system installed on mirrors based on sda and sdb physical disks. sd{c..f} disks attached to KVM guest (whole disks, not partitions; needed to use zfs (zfsonlinux) benefit features). Problem is that disks (files in /dev) which attached to KVM guest has SELinux context which inaccessible from context of smartd process. [root(a)srv-1.home ~]# ls -laZ /dev/sd{a..f} brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sda brw-rw----. root disk system_u:object_r:fixed_disk_device_t:s0 /dev/sdb brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdc brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdd brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sde brw-rw----. qemu qemu system_u:object_r:svirt_image_t:s0:c281,c675 /dev/sdf [root(a)srv-1.home ~]# ps axwZ | grep smart[d] system_u:system_r:fsdaemon_t:s0 1762 ? S 0:00 /usr/sbin/smartd -q never When I restarts smartd next messages appears in audit.log: [root(a)srv-1.home ~]# tail -F /var/log/audit/audit.log | grep type=AVC type=AVC msg=audit(1357993548.964:8529): avc: denied { getattr } for pid=21321 comm="smartd" path="/dev/sdc" dev=devtmpfs ino=6327 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993548.965:8530): avc: denied { getattr } for pid=21321 comm="smartd" path="/dev/sdd" dev=devtmpfs ino=6321 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993548.966:8531): avc: denied { getattr } for pid=21321 comm="smartd" path="/dev/sde" dev=devtmpfs ino=6324 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993548.966:8532): avc: denied { getattr } for pid=21321 comm="smartd" path="/dev/sdf" dev=devtmpfs ino=6330 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993549.198:8533): avc: denied { read } for pid=21321 comm="smartd" name="sdc" dev=devtmpfs ino=6327 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993549.198:8534): avc: denied { read } for pid=21321 comm="smartd" name="sdd" dev=devtmpfs ino=6321 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993549.198:8535): avc: denied { read } for pid=21321 comm="smartd" name="sde" dev=devtmpfs ino=6324 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file type=AVC msg=audit(1357993549.198:8536): avc: denied { read } for pid=21321 comm="smartd" name="sdf" dev=devtmpfs ino=6330 scontext=unconfined_u:system_r:fsdaemon_t:s0 tcontext=system_u:object_r:svirt_image_t:s0:c281,c675 tclass=blk_file I tried to create SELinux policy using audit2allow: [root(a)srv-1.home ~]# cat /var/log/audit/audit.log | grep smartd | audit2allow -M smartd_svirt_image [root(a)srv-1.home ~]# semodule -i smartd_svirt_image.pp but it not helped to solve problem. How I can create permissive rule for selinux in my case? Thank you. -- GPG Key ID: 6EC5EB27

3 11

GUI volume control/mixer in C6??
by Fred 04 Mar '13

04 Mar '13

Just bringing up a Centos-6 (x86_64, FWIW) and I can't find the mixer app... on my C5 box(es), double click on the speaker icon in the top panel and I get a mixer app appears on the screen. My new C6 box doesn't do that. I've installed all the PULSEAUDIO RPMS I can find, but still nothing. what am I missing here? thanks! Fred

8 15

Centos6.4 via CR-repo; boot problems
by jvermeulen 04 Mar '13

04 Mar '13

Dear All, after updating to Centos6.4 via cr-repo, my laptop hangs on: starting crond : ok I booted in single user mode but I'm not sure what to change .... The laptop is an older MSI, hardware details attached. what could be the issue here? greetings, J.

7 13

LDAP users/groups not showing up with nis, pam, & ldap
by Wes Modes 02 Mar '13

02 Mar '13

I am trying to configure NIS, PAM, & LDAP on a CentOS 6.2 host. I've previously installed a similar configuration on RHEL4, but CentOS now uses nss-pam-ldapd and nslcd instead of nss_ldap, so the configurations are a little different. Currently, local users and groups are showing up but not LDAP users. When I do a /getent passwd/ and/getent group/ I don't get LDAP users. When I do a listing of a share directory that should have user and group ownership determined by LDAP, I get the uidNumbers and gidNumbers rather than the UIDs and GIDs. [root@edgar2 openldap]# ls -l /data/home | tail drwx------. 2 30634 30080 4096 Mar 18 2009 userdir1 drwx------. 33 30548 30075 4096 Jan 29 15:20 userdir2 drwx------. 3 30554 30075 4096 Jan 26 2009 userdir3 drwx------. 12 30467 30075 4096 Jun 21 2012 userdir4 drwx------. 4 30543 30075 4096 Oct 21 2008 userdir5 drwx------. 8 30555 30075 4096 Oct 31 10:36 userdir5 Other details: centos 6.2, smbldap-tools 0.9.6, openldap 2.4.23 I've fussed with /etc/nsswitch.conf, /etc/pam_ldap.conf, /etc/nslcd.conf, /etc/pam.d/system-auth, and /etc/sysconfig/authconfig. And selinux is off. I know the machine is successfully connecting to LDAP. An ldapsearch works from this machine, and I can even connect to a samba share with an ldap login through smbclient. Relevant parts of /etc/nsswitch: passwd: files ldap shadow: files ldap group: files ldap #hosts: db files nisplus nis dns hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: nisplus ldap #netgroup: ldap publickey: nisplus automount: files nisplus ldap #automount: files ldap aliases: files nisplus Relevant parts of /etc/pam_ldap.conf (everything else is commented out): host dir1.ourdomain.com base dc=.ourdomain,dc=com #uri ldaps://dir1.ourdomain.com uri ldap://dir1.ourdomain.com # basic auth config binddn cn=admin,dc=ourdomain,dc=com rootbinddn cn=admin,dc=ourdomain,dc=com # random stuff #timelimit 120 #bind_timelimit 120 #bind_policy hard # brought these times down wmodes Aug 11, 2008 timelimit 30 bind_timelimit 30 bind_policy soft idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap # pam config #pam_password md5 pam_password md5 # config for nss nss_base_passwd ou=people,dc=ourdomain,dc=com?one nss_base_shadow ou=people,dc=ourdomain,dc=com?one nss_base_group ou=group,dc=ourdomain,dc=com?one # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl no # OpenLDAP SSL options # Require and verify server certificate (yes/no) #tls_checkpeer yes # CA certificates for server certificate verification tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts # Client certificate and key tls_cert /etc/openldap/cacerts/servercert.pem tls_key /etc/openldap/cacerts/serverkey.pem Relevant parts of /etc/pam.d/system-auth: auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session optional pam_mkhomedir.so skel=/etc/skel umask=077 And the only line in /etc/sysconfig/authconfig I changed was: USELDAP=yes Any thoughts? For those who are experienced with nis and pam, I'm sure this is a no brainer, but I could sure use the little bit of your brain that knows how to fix this. Wes -- Wes Modes Systems Designer, Developer, and Administrator University Library ITS University of California, Santa Cruz

4 4

running yum update on remote servers
by Robert Moskowitz 02 Mar '13

02 Mar '13

I have read a couple old threads here on updates for servers, and I am looking for some mechanics to getting the actual updates done. I don't want automatic updates; I want to control when and what gets updated. First I have to determine that a particular server needs updates. I suppose a daily script that would run "yum check-updates' and emails me the results could work, but then I would only want the email IF there was something to update, at my limited use of this option does not show anything to trigger a notify on changes. Does anyone know of a script that would do this? Then there is the actual update. I learned long ago NOT to run yum over an SSH connection, as WHEN that connection breaks in the middle of an update, you can have quite a problem to clean up. All I have done todate is to start vncserver and connect via vnc to then run yum. I can even drop the vnc connection and come back later to check results. I have considered running yum disconnected (? when you end a command with &) and log the results to a file that you check later. What are practical approaches to this? I only have a few servers here to manage.

13 24

can not login to server (use ssh)
by mcclnx mcc 02 Mar '13

02 Mar '13

we have CENTOS 5.6 on DELL server. I tried to use ssh login to server and failed: ssh oracle@ora10 oracle@ora10's password: Read from remote host ora10: Connection reset by peer Connection to ora10 closed. I have not problem login as "root" or other users. Is it possible too many processes run by "oracle" and don't allow me login. I check server current have 2000 oracle processes running. $ ps -ef|grep oracle|wc -l 2000 anyone know how to fix this issue? Thanks.

4 5

What can I do to UNDERSTAND why I can't reach centos.org (but everyone else can)?
by Rock 02 Mar '13

02 Mar '13

What can I do to UNDERSTAND why, periodically, I can't reach www.centos.org (but everyone else can)? Every few months, http://www.centos.org just drops off for me and for me only. It's not the web site, because I can reach it via a proxy (e.g., TOR browser bundle) and other tests show it to be alive (e.g., http://www.downforeveryoneorjustme.com/centos.org or http://traceroute.monitis.com) But, for me, I just can't reach it by any means. Mike Easter kindly determined "centos.org does not echo ICMP or UDP pings, only TCP, and its associated netblock level3 doesn't echo UDP, but does echo ICMP and TCP." But, for me, this is what a traceroute returned just now on Centos: $ traceroute www.centos.org ... early hops removed ... 16 ae-6-6.ebr2.LosAngeles1.Level3.net (4.69.148.201) 211.850 ms ae-3-3.ebr3.Dallas1.Level3.net (4.69.132.78) 205.221 ms ae-6-6.ebr2.LosAngeles1.Level3.net (4.69.148.201) 207.392 ms 17 ae-3-3.ebr3.Dallas1.Level3.net (4.69.132.78) 128.453 ms ae-73-73.csw2.Dallas1.Level3.net (4.69.151.145) 160.451 ms ae-93-93.csw4.Dallas1.Level3.net (4.69.151.169) 160.437 ms 18 ae-83-83.csw3.Dallas1.Level3.net (4.69.151.157) 165.923 ms ae-1-60.edge3.Dallas1.Level3.net (4.69.145.8) 165.920 ms 178.414 ms 19 LAYERED-TEC.edge3.Dallas1.Level3.net (4.71.170.6) 241.537 ms 244.324 ms ae-3-80.edge3.Dallas1.Level3.net (4.69.145.136) 244.318 ms 20 * LAYERED-TEC.edge3.Dallas1.Level3.net (4.71.170.6) 244.291 ms 244.250 ms 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * Here is a screenshot (modified to remove early hops) using mtr: $ mtr www.centos.org http://www2.picturepush.com/photo/a/12303130/img/12303130.png My related questions are: 1. What can I do (on Centos) to UNDERSTAND this problem? 2. Why does this problem happen every few months to me (and to just me)? 3. How can the net be this arbitrary and still work?

9 28

Re: [CentOS] CentOS 6.4 in the making perhaps?
by Johnny Hughes 01 Mar '13

01 Mar '13

On 02/28/2013 02:31 AM, Sorin Srbu wrote: > I see Johnny Hughes has released CR-updates for CentOS 6. > > Is CentOS 6.4 brewing yet then? 8-) Eventually, yes ... thats how it goes, right? We are working on the consolidated tree, spinning isos, QA'ing those, etc. CR is for access now, for those what want it ... the tree should be along soon. Not exactly sure when soon will be yet :)

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2013