Discuss March 2013

discuss@lists.centos.org

206 participants
228 discussions

Re: [CentOS] preventing apache from being a mail relay
by Robert Moskowitz 03 Mar '13

03 Mar '13

On 03/03/2013 04:33 PM, Reindl Harald wrote: > > Am 03.03.2013 22:30, schrieb Robert Moskowitz: >> I am trying to recall back at least 2 years, and my notes are poor, and >> my searching appears to be worst... >> >> Seems I recall that last when I set up my apache server, the spammers >> were posting to it so it would send out the spam on port 25. There was >> some conf that I did to block this, but I did not document it, and I >> can't find any reference to this > what are you speaking about? > apache is a WEBSERVER and has NOTHING to do with email There was an attack, and if you search you will find references to it, where the spammers post to your web server in such a way that they relay out port 25. They send to your port 80, but you send out port 25. For example: http://forums.fedoraforum.org/archive/index.php/t-173601.html My old server has been running smoothly for over two years, but it is time to bring the software current. I did all the work on this back then, or maybe before and copied from my earlier server. This time I am trying to build everything clean and document every change I make.

4 5

Strange behavior from software RAID
by Harold Pritchett 03 Mar '13

03 Mar '13

Somewhere, mdadm is cacheing information. Here is my /etc/mdadm.conf file: more /etc/mdadm.conf # mdadm.conf written out by anaconda DEVICE partitions MAILADDR root ARRAY /dev/md0 level=raid1 num-devices=4 metadata=0.90 UUID=55ff58b2:0abb5bad:42911890:5950dfce ARRAY /dev/md1 level=raid1 num-devices=2 metadata=0.90 UUID=315eaf5c:776c85bd:5fa8189c:68a99382 ARRAY /dev/md2 level=raid1 num-devices=2 metadata=0.90 UUID=5b017f95:b7e266cc:f17a7611:8b752a02 ARRAY /dev/md3 level=raid1 num-devices=2 metadata=0.90 UUID=4cc310ee:60201e16:c7017bd4:9feea350 ARRAY /dev/md4 level=raid1 num-devices=2 metadata=0.90 UUID=ea205046:3c6e78c6:ab84faa4:0da53c7c After a system re-boot, here is the contents of /proc/mdstat # cat /proc/mdstat Personalities : [raid1] md125 : active raid1 sdc3[0] 455482816 blocks [2/1] [U_] md0 : active raid1 sdd1[3] sdc1[0] sdb1[1] sda1[2] 1000320 blocks [4/4] [UUUU] md127 : active raid1 sdd3[1] sdb3[0] 971747648 blocks [2/2] [UU] md3 : active raid1 sdf1[1] sde1[0] 1003904 blocks [2/2] [UU] md4 : active raid1 sdf3[1] sde3[0] 1948491648 blocks [2/2] [UU] md1 : active raid1 sda3[1] 455482816 blocks [2/1] [_U] unused devices: <none> There are six physical disks in this system: Disk /dev/sda: 500.1 GB, 500107862016 bytes Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes Disk /dev/sdc: 500.1 GB, 500107862016 bytes Disk /dev/sdd: 1000.2 GB, 1000204886016 bytes Disk /dev/sde: 2000.3 GB, 2000398934016 bytes Disk /dev/sdf: 2000.3 GB, 2000398934016 bytes I used mdadm --examine /dev/sda1 to find the internal UUID for each of the physical volumes making up these volume groups /dev/sda1: Magic : a92b4efc Version : 0.90.00 UUID : 55ff58b2:0abb5bad:42911890:5950dfce /dev/sdb1: Magic : a92b4efc Version : 0.90.00 UUID : 55ff58b2:0abb5bad:42911890:5950dfce /dev/sdc1: Magic : a92b4efc Version : 0.90.00 UUID : 55ff58b2:0abb5bad:42911890:5950dfce /dev/sdd1: Magic : a92b4efc Version : 0.90.00 UUID : 55ff58b2:0abb5bad:42911890:5950dfce /dev/sda3: Magic : a92b4efc Version : 0.90.00 UUID : 315eaf5c:776c85bd:5fa8189c:68a99382 /dev/sdc3: Magic : a92b4efc Version : 0.90.00 UUID : 315eaf5c:776c85bd:5fa8189c:68a99382 /dev/sdb3: Magic : a92b4efc Version : 0.90.00 UUID : 5b017f95:b7e266cc:f17a7611:8b752a02 /dev/sdd3: Magic : a92b4efc Version : 0.90.00 UUID : 5b017f95:b7e266cc:f17a7611:8b752a02 /dev/sde1: Magic : a92b4efc Version : 0.90.00 UUID : 4cc310ee:60201e16:c7017bd4:9feea350 /dev/sdf1: Magic : a92b4efc Version : 0.90.00 UUID : 4cc310ee:60201e16:c7017bd4:9feea350 /dev/sde3: Magic : a92b4efc Version : 0.90.00 UUID : ea205046:3c6e78c6:ab84faa4:0da53c7c /dev/sdf3: Magic : a92b4efc Version : 0.90.00 UUID : ea205046:3c6e78c6:ab84faa4:0da53c7c As you can see, the UUID on the various PVs match the values in the /etc/mdadm.conf file. My question is What the heck is going on. When I boot the system, I end up with two unexpected, unconfigured volume groups. Where the heck are /dev/md125 and /dev/md127 coming from? They don't appear in /etc/mdadm.conf and if I re-boot they keep coming back. It appears that somewhere mdadm is keeping information. How can I get rid of it so the mdadm.conf file is used. Harold

3 2

Not installing avahi in a kickstart install
by Robert Moskowitz 03 Mar '13

03 Mar '13

In the packages section of my kickstart I have: -avahi and I am still getting avahi and all of its rpms installed. I don't want avahi on my servers, how do I specify in a kickstart to NOT install it?

1 0

Re: [CentOS] Strange behavior from software RAID
by Harold Pritchett 02 Mar '13

02 Mar '13

Here I am following up on my own post... It occurred to me that all of this stuff must be magic. How does it work when the mdadm.conf file is on a raid/LVM volume which is not available at boot time? I looked in the /boot filesystem, the only one which is available at boot time and there is nothing there, unless this data is actually saved in one of the kernel modules or other binary files... Harold

2 1

EDNS support
by Robert Moskowitz 02 Mar '13

02 Mar '13

I am having problems with EDNS support on a few Centos 6.3 bind servers. I am trying to determine if the problem is my Juniper SSG5 firewall of Centos. All the servers have firewall enabled, though I have tested with stopping iptables and ip6tables. I am using tests from: https://www.dns-oarc.net/oarc/services/replysizetest dig @localhost +short rs.dns-oarc.net txt gets: ;; Truncated, retrying in TCP mode. Is anyone here running bind on their server and can run this command from the server? If you are not getting this truncation, then my problem is the firewall. If you are, then either you have figured out the majic for Centos or something like that...

3 5

installaing CentOS 6.3
by Daniel Robinson 02 Mar '13

02 Mar '13

I have a question about which ISO to use to install CentOS 6.3. I have installed it before from a USB stick, and when I did, I got a installation package selection menu. I overwrote that USB with something else, and I work out which ISO is the with that configuration option. When I installed it before, I had the opportunity to select from among the options listed here. http://unix.stackexchange.com/questions/20379/centos-6-default-installation… Yes, I know that I can just use yum to get the things I want, but I would like to set up a USB stick like the one I had before that can be used for multiple installations. One thing that changed is that when I installed it before, I set it up on a 350 GB partition, and I have it now on a 100 GB partition. I don't know if the install script is looking at partition size to decide the options available. I would think not. Any help would be appreciated. Thanks, Dan -- ----------------------- daniel g. robinson www.bornlivelovedie.com bornlivelovedie.tumblr.com @daguro

2 1

Please help: Any way to query host membership in nested ldap groups?
by Gelen James 02 Mar '13

02 Mar '13

Hi all, I have a openldap server setup with netsted netgruops,. Say the netgroups are: ngA: (host1, -, - ), (host2, -, - ) ngB: ngA, (host3, - - ) ngc: ngB, (host4, -, -) Is there a way to find host1's membership? so that I can return: ngA, ngB, ngC? Thanks a lot. --Rob

2 1

LDAP users/groups not showing up with nis, pam, & ldap
by Wes Modes 02 Mar '13

02 Mar '13

I am trying to configure NIS, PAM, & LDAP on a CentOS 6.2 host. I've previously installed a similar configuration on RHEL4, but CentOS now uses nss-pam-ldapd and nslcd instead of nss_ldap, so the configurations are a little different. Currently, local users and groups are showing up but not LDAP users. When I do a /getent passwd/ and/getent group/ I don't get LDAP users. When I do a listing of a share directory that should have user and group ownership determined by LDAP, I get the uidNumbers and gidNumbers rather than the UIDs and GIDs. [root@edgar2 openldap]# ls -l /data/home | tail drwx------. 2 30634 30080 4096 Mar 18 2009 userdir1 drwx------. 33 30548 30075 4096 Jan 29 15:20 userdir2 drwx------. 3 30554 30075 4096 Jan 26 2009 userdir3 drwx------. 12 30467 30075 4096 Jun 21 2012 userdir4 drwx------. 4 30543 30075 4096 Oct 21 2008 userdir5 drwx------. 8 30555 30075 4096 Oct 31 10:36 userdir5 Other details: centos 6.2, smbldap-tools 0.9.6, openldap 2.4.23 I've fussed with /etc/nsswitch.conf, /etc/pam_ldap.conf, /etc/nslcd.conf, /etc/pam.d/system-auth, and /etc/sysconfig/authconfig. And selinux is off. I know the machine is successfully connecting to LDAP. An ldapsearch works from this machine, and I can even connect to a samba share with an ldap login through smbclient. Relevant parts of /etc/nsswitch: passwd: files ldap shadow: files ldap group: files ldap #hosts: db files nisplus nis dns hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files ldap rpc: files services: files ldap netgroup: nisplus ldap #netgroup: ldap publickey: nisplus automount: files nisplus ldap #automount: files ldap aliases: files nisplus Relevant parts of /etc/pam_ldap.conf (everything else is commented out): host dir1.ourdomain.com base dc=.ourdomain,dc=com #uri ldaps://dir1.ourdomain.com uri ldap://dir1.ourdomain.com # basic auth config binddn cn=admin,dc=ourdomain,dc=com rootbinddn cn=admin,dc=ourdomain,dc=com # random stuff #timelimit 120 #bind_timelimit 120 #bind_policy hard # brought these times down wmodes Aug 11, 2008 timelimit 30 bind_timelimit 30 bind_policy soft idle_timelimit 3600 nss_initgroups_ignoreusers root,ldap # pam config #pam_password md5 pam_password md5 # config for nss nss_base_passwd ou=people,dc=ourdomain,dc=com?one nss_base_shadow ou=people,dc=ourdomain,dc=com?one nss_base_group ou=group,dc=ourdomain,dc=com?one # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 ssl no # OpenLDAP SSL options # Require and verify server certificate (yes/no) #tls_checkpeer yes # CA certificates for server certificate verification tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts # Client certificate and key tls_cert /etc/openldap/cacerts/servercert.pem tls_key /etc/openldap/cacerts/serverkey.pem Relevant parts of /etc/pam.d/system-auth: auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session optional pam_mkhomedir.so skel=/etc/skel umask=077 And the only line in /etc/sysconfig/authconfig I changed was: USELDAP=yes Any thoughts? For those who are experienced with nis and pam, I'm sure this is a no brainer, but I could sure use the little bit of your brain that knows how to fix this. Wes -- Wes Modes Systems Designer, Developer, and Administrator University Library ITS University of California, Santa Cruz

4 4

running yum update on remote servers
by Robert Moskowitz 02 Mar '13

02 Mar '13

I have read a couple old threads here on updates for servers, and I am looking for some mechanics to getting the actual updates done. I don't want automatic updates; I want to control when and what gets updated. First I have to determine that a particular server needs updates. I suppose a daily script that would run "yum check-updates' and emails me the results could work, but then I would only want the email IF there was something to update, at my limited use of this option does not show anything to trigger a notify on changes. Does anyone know of a script that would do this? Then there is the actual update. I learned long ago NOT to run yum over an SSH connection, as WHEN that connection breaks in the middle of an update, you can have quite a problem to clean up. All I have done todate is to start vncserver and connect via vnc to then run yum. I can even drop the vnc connection and come back later to check results. I have considered running yum disconnected (? when you end a command with &) and log the results to a file that you check later. What are practical approaches to this? I only have a few servers here to manage.

13 24

can not login to server (use ssh)
by mcclnx mcc 01 Mar '13

01 Mar '13

we have CENTOS 5.6 on DELL server. I tried to use ssh login to server and failed: ssh oracle@ora10 oracle@ora10's password: Read from remote host ora10: Connection reset by peer Connection to ora10 closed. I have not problem login as "root" or other users. Is it possible too many processes run by "oracle" and don't allow me login. I check server current have 2000 oracle processes running. $ ps -ef|grep oracle|wc -l 2000 anyone know how to fix this issue? Thanks.

4 5

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2013