Discuss January 2014

discuss@lists.centos.org

194 participants
172 discussions

Re: [CentOS] Can we trust RedHAt encryption tools?
by James B. Byrne 10 Jan '14

10 Jan '14

On Thu, January 9, 2014 17:52, m.roth(a)5-cent.us wrote: > Robert Moskowitz wrote: >> >> On 01/09/2014 05:28 PM, John R Pierce wrote: >>> On 1/9/2014 2:20 PM, Eero Volotinen wrote: >>>> It might be easier to compromise security of commercial products as >>>> source code is not available. they seem to have succeeded in compromising >>>>> STANDARDS and ALGORITHMS, to heck with implementations. >> >> Only algorithm they compromised was an RNG that got pretty strong thumbs >> down from the real cryptographers. They have not compromised any IETF >> standard; maybe kept quite about a problem, but have not put holes in >> any. Most of our problems with TLS is implementations and backwards >> compatiblity options. > > Not quite - anyone mandated to POSIX standards are effectively mandated to > use the compromised algorithms, as I understand it. > > mark Well, regardless of my thoughts on the ethics of this situation and my opinion about those who do these sorts of things, I have continued to research this issue. I have discovered that there is a great deal of literature respecting the weakness of the RNG and PRNG processes implemented on headless hosts, in particular headless hosts that are virtualised. Given the essential nature of true random number generation to cryptographically secure key creation this represents a significant weak point on such hosts. I am not going to reiterate or summarize any of this here because you can find these discussions easily enough via Google. However, I have developed a small script to alleviate the problem to some degree based on the writings and works of others. This requires the epel repository be enabled: #!/bin/bash cat /proc/sys/kernel/random/entropy_avail yum install dieharder haveged rng-tools -q -y cat /etc/sysconfig/rngd sed -i 's:EXTRAOPTIONS="":EXTRAOPTIONS="-r /dev/urandom":' /etc/sysconfig/rngd cat /etc/sysconfig/rngd chkconfig --level 2345 haveged on ; chkconfig --level 2345 rngd on service haveged start ; service rngd start cat /proc/sys/kernel/random/entropy_avail This increased the mean amount of entropy present in /dev/random on the systems I installed these packages on from ~176 bits to ~2048 bits. I continue to look into other related matters. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Why does 'mysql' user has /bin/bash shell?
by Mihamina Rakotomandimby 10 Jan '14

10 Jan '14

Hello, Default MySQL installation on CentOS sets /bin/bash as shell. I'm on a user cleanup task where I want reduce unneeded privileges to users. What is the "mysql" user shell for? (What will happen if I change it to /bin/false or whatever would disable it's shell?) It's not only a matter of SSH (I'm aware I can AllowUsers in sshd_config for example).

5 7

Re: [CentOS] Why does 'mysql' user has /bin/bash shell?
by Warren Young 10 Jan '14

10 Jan '14

On 1/10/2014 13:09, Reindl Harald wrote: > > > i know that but the question is still WHY I don't think there is a good reason. Someone made a mistake. File a bug report upstream. I've now downloaded and examined the .src.rpm for every 6.x point release plus that for 5.10, and they all do this. On skimming the changelog section of the spec file, I can't see an entry that explains why this was done. However, I might have more success if I knew the first version where this changed -- if indeed it ever did behave differently -- but I haven't found that version yet. I don't think I'm going to spend any more time looking, though, since 6.0 takes me back 3 years. This behavior has been in there for quite a long time.

1 0

Re: [CentOS] Why does 'mysql' user has /bin/bash shell?
by Warren Young 10 Jan '14

10 Jan '14

On 1/10/2014 12:14, Reindl Harald wrote: > > Am 10.01.2014 20:11, schrieb Warren Young: >> >> I just tested here on an EL6 VM that didn't have mysql-server on it before: >> >> # grep mysql /etc/shadow >> mysql:!!:16079:::::: > > in the config file where the users shell is defined you may find more :-) > > grep mysql /etc/passwd You've misunderstood the point of that test. It is proof that John Doe's guess is right: the mysql user's account is locked (!!). This means that only way you can "log in as mysql" and thus make use of the /bin/bash setting is to first be root, then "su - mysql". You can't su to mysql from a non-root account since that would require a password. That's why I guess this is a symptom of a wooly-headed change to the spec file, rather than some nefarious security breach. By the way, vault.centos.org is back. Here's what we find in the spec file: /usr/sbin/useradd -M -N -g mysql -o -r -d /var/lib/mysql -s /bin/bash \ -c "MySQL Server" -u 27 mysql >/dev/null 2>&1 || :

1 0

CentOS on HP DL360e with B120i
by tony＠softins.co.uk 10 Jan '14

10 Jan '14

I am trying to install CentOS5 on a new HP DL360e G8 with B120i disk controller. It appears that a proprietary HP driver is needed for it. I found a useful description at http://www.linuxhelp.in/2013/08/Installing-centos-on-HP-Proliant-DL360e-Gen… I have a pair of hard drives to use as a RAID1 mirror. My question to people who may have been this way already is: is it worth my fiddling around with that procedure to get the RAID controller working, performance-wise, or might I just as well use AHCI mode with kernel mdraid? I normally use Supermicro with AHCI and mdraid quite happily, but the customer wanted HP :( Cheers Tony -- Tony Mountifield Work: tony(a)softins.co.uk - http://www.softins.co.uk Play: tony(a)mountifield.org - http://tony.mountifield.org

6 8

Recomended Virtual Host setup
by Veljko 10 Jan '14

10 Jan '14

Hello, I want to ditch cPanel I currently have on my server, so I'm thinking of the way to implement virtual hosts with software provided by CentOS/RadHat. I know I can use additional repos to get mod_fastcgi for example, but what is the method recommended by RadHat? I want every virtual host php process to run as owner of that php file. I see that mod_suphp and mod_fastcgi are available on rpmforge, but how to achieve what I want using only RedHat provided software? Regards, Veljko

1 0

FYI: an selinux hack
by m.roth＠5-cent.us 10 Jan '14

10 Jan '14

We've got a website that was written years ago, and maintained by various people since. For some unknown reason, the original person or persons hard-coded, in a number of scripts, for these perl CGI scripts to write to a logfile... in the websites cgi-bin directory. *DUH* And the guy who was more-or-less maintaining it fixed one or two (I don't know how, he probably hardcoded), but the rest still wrote to the same log. No, I can't go in and fix it all. So, to shut up selinux, I moved the logs to /var/log/httpd/website/, and made a symlink from the cgi-bin location to there... and it worked. No garbage from selinux. Of *course* it's a hack, but I figured there are others out there in the same position - aren't allowed to go fix it *right* (as in, they should read a config file in /etc...), have to have selinux at least permissive, and want to cut down the noise in the logs. mark

1 0

Who deletes/edits my resolv.com ?
by Timothy Murphy 10 Jan '14

10 Jan '14

Every now and again the nameservers in /etc/resolv.conf on my CentOS-6.5 server are commented out. I used to think this was the fault of NetworkManager, but I've stopped running that on the server (using the network service instead) and the nameserver removal still occurs. I'm baffled by the motivation for this, as I can't think of any situation where it would be of advantage to have no nameservers listed. -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland

4 7

CentOS-announce Digest, Vol 107, Issue 6
by centos-announce-request＠centos.org 10 Jan '14

10 Jan '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:0018 Important CentOS 5 libXfont Update (Johnny Hughes) 2. CESA-2014:0018 Important CentOS 6 libXfont Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 10 Jan 2014 10:35:58 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0018 Important CentOS 5 libXfont Update To: centos-announce(a)centos.org Message-ID: <20140110103558.GA18473(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0018 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0018.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5d177ebe7d19a7515f179bf06b534b16be5c3017b51dc32cef13f1ef45c94676 libXfont-1.2.2-1.0.5.el5_10.i386.rpm 886882bec7855542d19dc9d23dff86809c6227e489be81ee8e428927e182201b libXfont-devel-1.2.2-1.0.5.el5_10.i386.rpm x86_64: 5d177ebe7d19a7515f179bf06b534b16be5c3017b51dc32cef13f1ef45c94676 libXfont-1.2.2-1.0.5.el5_10.i386.rpm 5ebf2a472661f5af2c720370b0847c1141df925545734ed9ae34a7cac275a1f7 libXfont-1.2.2-1.0.5.el5_10.x86_64.rpm 886882bec7855542d19dc9d23dff86809c6227e489be81ee8e428927e182201b libXfont-devel-1.2.2-1.0.5.el5_10.i386.rpm 59e82118a3ada995a44556fa572406d940585c1d7eadc0ff5b490f641024d4ab libXfont-devel-1.2.2-1.0.5.el5_10.x86_64.rpm Source: b77f78e870fc6f349b6a4d311aa6358abad773837bfcf95394797043a91ae036 libXfont-1.2.2-1.0.5.el5_10.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Fri, 10 Jan 2014 10:51:23 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0018 Important CentOS 6 libXfont Update To: centos-announce(a)centos.org Message-ID: <20140110105123.GA5239(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0018 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0018.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: e197f6ba7f88663d651ff7fece36f0ab4439063d7267738c9bbdc86d0c39ae5e libXfont-1.4.5-3.el6_5.i686.rpm 4838c266aa9e6d61b1d3fe78e8f25c02e7756f10eb06cf353d69fd1cb0478f9f libXfont-devel-1.4.5-3.el6_5.i686.rpm x86_64: e197f6ba7f88663d651ff7fece36f0ab4439063d7267738c9bbdc86d0c39ae5e libXfont-1.4.5-3.el6_5.i686.rpm b1073ecac121832b57872541d0d97e959ba7b6bc93891287aec9abc51ccf7ab1 libXfont-1.4.5-3.el6_5.x86_64.rpm 4838c266aa9e6d61b1d3fe78e8f25c02e7756f10eb06cf353d69fd1cb0478f9f libXfont-devel-1.4.5-3.el6_5.i686.rpm 3cbb119e041bf283f131ba94b139c60eea701127384778219e7347c71255a0e0 libXfont-devel-1.4.5-3.el6_5.x86_64.rpm Source: 70cc14ededa4d1187f2f7245fddb63b72e0b26f49e908987984de2d4b2af71e4 libXfont-1.4.5-3.el6_5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 107, Issue 6 ***********************************************

1 0

CentOS-announce Digest, Vol 107, Issue 5
by centos-announce-request＠centos.org 09 Jan '14

09 Jan '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:0016 Moderate CentOS 5 gnupg Update (Johnny Hughes) 2. CESA-2014:0015 Important CentOS 6 openssl Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 8 Jan 2014 22:53:33 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0016 Moderate CentOS 5 gnupg Update To: centos-announce(a)centos.org Message-ID: <20140108225333.GA12978(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0016 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0016.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: b437a73ead41717600b76842fd0da7de391dccf5b9551bfc237b0cc3939dd2c3 gnupg-1.4.5-18.el5_10.1.i386.rpm x86_64: dee49e4148424a1f17167cfa19a5b94d8ff6c1f86c32cd09f760b003bdcc3efa gnupg-1.4.5-18.el5_10.1.x86_64.rpm Source: 4e87d564f1537f4cd195ad5b8ba4e433e538d3b1c91af7d843439de1acefb65f gnupg-1.4.5-18.el5_10.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Wed, 8 Jan 2014 22:59:22 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0015 Important CentOS 6 openssl Update To: centos-announce(a)centos.org Message-ID: <20140108225922.GA45394(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0015 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0015.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: dade1d156bd3ea872b6622e0c8f2eab5453424cbaadd475a49e6d77455169752 openssl-1.0.1e-16.el6_5.4.i686.rpm 912c2d239dddafcb49255b27a0cbbb2aedde20ebe3bc606230c5c135a005ae5f openssl-devel-1.0.1e-16.el6_5.4.i686.rpm 4f8ba92ca400d35e3a559194d74b826b4492c931f23ee194ccd9fcebe326c55c openssl-perl-1.0.1e-16.el6_5.4.i686.rpm dc0b3e752f6f08c0961dec57cc42435b1eefe0330c91192fb1ea339a3bfffab7 openssl-static-1.0.1e-16.el6_5.4.i686.rpm x86_64: dade1d156bd3ea872b6622e0c8f2eab5453424cbaadd475a49e6d77455169752 openssl-1.0.1e-16.el6_5.4.i686.rpm 4bc35140201b7e0c4dff6ec71ceafbe745167b1bcd22223a92048777068c2f5c openssl-1.0.1e-16.el6_5.4.x86_64.rpm 912c2d239dddafcb49255b27a0cbbb2aedde20ebe3bc606230c5c135a005ae5f openssl-devel-1.0.1e-16.el6_5.4.i686.rpm cfbf11165d15b23cd9afc03777d78b635d6cb6fce2379f0841ff637c427ae2fb openssl-devel-1.0.1e-16.el6_5.4.x86_64.rpm f10d64a8469aa74af9115df8cb48b07821e09976a42c182558ddf8ef7612582a openssl-perl-1.0.1e-16.el6_5.4.x86_64.rpm 20be3d7839df3f8358d8f7c52eb4f3cef2ba8663bb70e604bd52a538a37de2b7 openssl-static-1.0.1e-16.el6_5.4.x86_64.rpm Source: 14b9dccbc10c333bff4c90ae99b7d381cc3e6f187bc884def31e3ec5ba105d9d openssl-1.0.1e-16.el6_5.4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 107, Issue 5 ***********************************************

1 0

← Newer
1
...
11
12
13
14
15
16
17
18
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2014