Discuss January 2014

discuss@lists.centos.org

194 participants
172 discussions

sudo (+ldap+kerberos) not accepting password
by Mauricio Tavares 20 Jan '14

20 Jan '14

So I have this centos 5.10 box which authenticates network users against ldap(authorizing)+kerberos(authentication). And I now would like to have sudo be able to allow admins (netgroup chinbeards) to sudo about. I am not using sssd though (yet). Here is the output of me trying sudo (debug on): [raub@centos5-x64 ~]$ sudo pwd LDAP Config Summary =================== uri ldap://idir1.internal.domain.com/ ldap://idir2.internal.domain.com/ ldap_version 3 sudoers_base ou=SUDOers,dc=domain,dc=com binddn (anonymous) bindpw (anonymous) bind_timelimit 120000 timelimit 120 ssl start_tls tls_cacertdir /etc/openldap/cacerts =================== sudo: ldap_initialize(ld, ldap://idir1.internal.domain.com/ ldap://idir2.internal.domain.com/) sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_set_option: tls_cacertdir -> /etc/openldap/cacerts sudo: ldap_set_option: timelimit -> 120 sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 120) sudo: ldap_start_tls_s() ok sudo: ldap_sasl_bind_s() ok sudo: found:cn=defaults,ou=SUDOers,dc=domain,dc=com sudo: ldap sudoOption: 'env_keep+=SSH_AGENT_PID' sudo: ldap sudoOption: 'env_keep+=SSH_AUTH_SOCK' sudo: ldap sudoOption: 'env_keep+=SVN_SSH' sudo: ldap sudoOption: 'env_reset' sudo: ldap sudoOption: 'ignore_local_sudoers' sudo: ldap search '(|(sudoUser=raub)(sudoUser=%raub)(sudoUser=%chinbeards)(sudoUser=ALL))' sudo: ldap search 'sudoUser=+*' sudo: found:cn=defaults,ou=SUDOers,dc=domain,dc=com sudo: ldap sudoUser netgroup '+chinbeards' ... MATCH! sudo: ldap sudoHost 'ALL' ... MATCH! sudo: ldap sudoCommand 'ALL' ... MATCH! sudo: Command allowed sudo: ldap sudoOption: 'env_keep+=SSH_AGENT_PID' sudo: ldap sudoOption: 'env_keep+=SSH_AUTH_SOCK' sudo: ldap sudoOption: 'env_keep+=SVN_SSH' sudo: ldap sudoOption: 'env_reset' sudo: ldap sudoOption: 'ignore_local_sudoers' sudo: user_matches=1 sudo: host_matches=1 sudo: sudo_ldap_lookup(0)=0x02 [sudo] password for raub: It seems to me that it had no issues finding that I belong to the netgroup chinbeards (allowed to sudo), and realizing I can do a command. So, to me the sudo+ldap part of the transaction (authorization, kinda of what is mentioned in http://www.sudo.ws/sudoers.ldap.man.html and http://www.gratisoft.us/sudo/readme_ldap.html) seem to be fine. But, in the next step -- it asks for password -- is when things get interesting. At this point I would expect it to pass that to pam, which would then autenticate me with kerberos (I wonder if it would work by checking if I have a valid kerberos ticket. That is what happens when I, say, do ldapsearch. but I digress). But, according to /var/log/secure, Jan 17 10:07:13 centos5-x64 sudo: pam_unix(sudo:auth): authentication failure; logname=raub uid=0 euid=0 tty=/dev/pts/0 ruser= rhost= user=raub It seems to have failed to authenticate me. Would it be due to pam not knowing about kerberos? Reading http://www.centos.org/docs/5/html/5.2/Deployment_Guide/s1-kerberos-pam.html, should I be able to get pam_krb5 in, say, /etc/pam.d/system-auth like this: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_krb5.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_krb5.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_krb5.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_krb5.so

1 1

Re: [CentOS] updated certificate, but certwatch still reporting it needs to be renewed
by Jobst Schmalenbach 20 Jan '14

20 Jan '14

Thanks for the reply. I put all the different certs into different subdirectories, so I know it's that one, e.g.: /apachepath/conf.d/cert1 /apachepath/conf.d/cert2 /apachepath/conf.d/cert3 It, too, complains about the "/apachepath/conf.d/cert3/domain.crt" file, which comes from the provider anyway. I know it's the correct/new/latest one (date,size and from tests). Jobst On Mon, Jan 20, 2014 at 03:01:20AM +0100, Reindl Harald (h.reindl(a)thelounge.net) wrote: > > > Am 20.01.2014 02:23, schrieb Jobst Schmalenbach: > > I updapted the ssl certificate on the 15th of Jan using the providers update facility. > > Then I downloaded the new certificate, installed it and restarted httpd. > > > > Then I checked with the providers "ssl installation diagnostic tool" whether everything is fine - and it is, all reported good. > > > > Then I opened a browser, loaded the https website, checked the certificate and it's valid until 8/02/2017, which was reported by above, as well. > > > > I know I could turn certwatch off, but I like the warning as I have a few certs on different websites, domains and machines. > > > > How come certwatch is still complaining? > > look about *what* certificate it complains > certwatch looks at *all* certificates and you have changed *one* > -- If proof denies faith, and uncertainty denies proof, then uncertainty is proof of God's existence. | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

1 0

updated certificate, but certwatch still reporting it needs to be renewed
by Jobst Schmalenbach 20 Jan '14

20 Jan '14

Hi I updapted the ssl certificate on the 15th of Jan using the providers update facility. Then I downloaded the new certificate, installed it and restarted httpd. Then I checked with the providers "ssl installation diagnostic tool" whether everything is fine - and it is, all reported good. Then I opened a browser, loaded the https website, checked the certificate and it's valid until 8/02/2017, which was reported by above, as well. I know I could turn certwatch off, but I like the warning as I have a few certs on different websites, domains and machines. How come certwatch is still complaining? Jobst -- Why do overlook and oversee mean opposite things? | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

1 0

Network card throwing messages I dont understand
by Jason T. Slack-Moehrle 19 Jan '14

19 Jan '14

I am having an issue where eth1 is throwing some messages and stops responding. Restarting networking doesn't work and also just bringing down eth1 with 'ifdown' doesn't fix it. I have never seen anything like these messages: eth1: no IPv6 routers present r8169 0000:03:00.0: eth1: rtl_counters_cond == 1 (loop: 1000, delay: 10). r8169 0000:03:00.0: eth1: rtl_chipcmd_cond == 1 (loop: 100, delay: 100). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phy_reset_cond == 1 (loop: 100, delay: 1). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: rtl_phyar_cond == 1 (loop: 20, delay: 25). r8169 0000:03:00.0: eth1: link up [root@mail jtsm]# lspci | grep -i net 02:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection 03:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 01) DEVICE=eth1 HWADDR=00:0A:CD:17:07:7E TYPE=Ethernet UUID=800623a1-adc6-401a-a3fa-c6d1348056c8 ONBOOT=yes NM_CONTROLLED=yes BOOTPROTO=none IPADDR=10.0.254.11 PREFIX=24 #GATEWAY=10.0.254.1 DNS1=8.8.8.8 DNS2=8.8.4.4 Does anyone have any ideas or have experienced this before. Jason

1 0

gui email clients available centos 6.5
by Edward M 19 Jan '14

19 Jan '14

Hi I decided to also use Centos, when RedHat took ownership. so I'm learning the ropes. :-) I have a question, are Thunderbird and evolution the only gui based email clients available for centos yum repos? Thanks

4 6

CentOS Bug Tracker - Merge with Upstream?
by Jorge Fábregas 18 Jan '14

18 Jan '14

Hi, Is the CentOS Bug Tracker going to be replaced by the upstream one (bugzilla.redhat.com)? I think it would make sense to have just one place to report bugs against RHEL, Fedora & CentOS. Regards, Jorge

1 0

rkhunter
by m.roth＠5-cent.us 17 Jan '14

17 Jan '14

I updated java-1.7.0-openjdk a few hours ago - it *was* listed as a critical security update, and I don't want yelling from rkhunter. The man page tells me I can tell it rkhunter --propupd <package name>... but it doesn't know the name above as a package. Been googling a bit, and cannot find a good example of a package (other than the manpage's coreutil). Anyone got an example, and/or why it doesn't know this package? mark

2 2

Re: [CentOS] [CentOS-announce] CentOS Project joins forces with Red Hat
by Digimer 17 Jan '14

17 Jan '14

Fantastic news! CentOS and RHEL have been mutually beneficial projects for years. As a user of both, I am extremely happy to see the ties grow between the communities. digimer On 07/01/14 04:09 PM, Karanbir Singh wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > With great excitement I'd like to announce that we are joining the Red > Hat family. The CentOS Project ( http://www.centos.org ) is joining > forces with Red Hat. Working as part of the Open Source and Standards > team ( http://community.redhat.com/ ) to foster rapid innovation > beyond the platform into the next generation of emerging technologies. > Working alongside the Fedora and RHEL ecosystems, we hope to further > expand on the community offerings by providing a platform that is > easily consumed, by other projects to promote their code while we > maintain the established base. > > We are also launching the new CentOS.org website ( > http://www.centos.org ). > > - ------------- > The new initiative is going to be overseen by the new CentOS Governing > Board. The initial Board comprises of the existing CentOS Core team > members : > > - - Ralph Angenent > - - Tru Hyunh > - - Johnny Hughes JR > - - Jim Perrin > - - Karanbir Singh > > and also sees new members: > - - Fabian Arrotin, who comes to the board nominated from the community > - - Carl Trieloff, Karsten Wade, and Mike McLean join us, nominated by > Red Hat. > > Please join me in welcoming the new members to the Board. > > The key operating points of the Board are going to be: Public, Open, > and Inclusive. You can find more information about the governance > model, the board, and the operating policies we are proposing at > http://www.centos.org/about/governance/ > > Furthermore, some of the existing CentOS Core members are moving to > take up roles at Red Hat, as a part of their sponsorship of the CentOS > Project, allowing these people to work on the Project as their primary > job function. This includes Johnny Hughes Jr, Jim Perrin, Fabian > Arrotin, and myself. We will be working with and operating out of the > Red Hat Open Source and Standards team in the CTO's Office. > > - ------------- > Some of the things that are not changing: > - - The CentOS Linux platform isn't changing. The process and methods > built up around the platform however are going to become more open, > more inclusive and transparent. > - - The sponsor driven content network that has been central to the > success of the CentOS efforts over the years stays intact. > - - The bugs, issues, and incident handling process stays as it has been > with more opportunities for community members to get involved at > various stages of the process. > - - The Red Hat Enterprise Linux to CentOS firewall will also remain. > Members and contributors to the CentOS efforts are still isolated from > the RHEL Groups inside Red Hat, with the only interface being srpm / > source path tracking, no sooner than is considered released. In > summary: we retain an upstream. > > Feel free to reach out if you have specific concerns about how this > change impacts your CentOS story. URLs mentioned at the bottom of this > email should be a good starting point. > > - ------------- > Some of the key things that are changing: > - - Some of us now work for Red Hat, but not RHEL. This should not have > any impact to our ability to do what we have done in the past, it > should facilitate a more rapid pace of development and evolution for > our work on the community platform. > > - - Red Hat is offering to sponsor some of the buildsystem and initial > content delivery resources - how we are able to consume these and when > we are able to make use of this is to be decided. > > - - Sources that we consume, in the platform, in the addons, or the > parallel stacks such as Xen4CentOS will become easier to consume with > a git.centos.org being setup, with the scripts and rpm metadata needed > to create binaries being published there. The Board also aims to put > together a plan to allow groups to come together within the CentOS > ecosystem as a Special Interest Group (SIG) and build CentOS Variants > on our resources, as officially endorsed. You can read about the > proposal at http://www.centos.org/variants/ > > - - Because we are now able to work with the Red Hat legal teams, some > of the contraints that resulted in efforts like CentOS-QA being behind > closed doors, now go away and we hope to have the entire build, test, > and delivery chain open to anyone who wishes to come and join the effort. > > The changes we make are going to be community inclusive, and promoted, > proposed, formalised, and actioned in an open community centric manner > on the centos-devel mailing list. And I highly encourage everyone to > come along and participate. > > - ------------- > Contacting us works best via the established community mechanisms. > - - Real time chats via IRC ( http://wiki.centos.org/irc ) ; To keep > conversation sanity intact, I recommend using the #centos-devel > channel to discuss project related activity while #centos is best used > for end user conversations. > > - - The Mailing lists are a great way to interface with the developers, > contributors and the community at large ( http://lists.centos.org ). > As with IRC, we recommend using the centos-devel list to talk about > project related issues while the general centos list is best used for > end user conversations. > > - - The CentOS Forums are another great way to engage in conversation > with other users ( http://www.centos.org/forums ), if you prefer that > mechanism. > > All the above mentioned venues are public and open to the community, > should you wish to discuss something privately, you can email us at > centosdev(a)centos.org. Press requests should be sent to > press(a)centos.org. Please note that it will take us much longer to > reply to private requests as compared to content on the public venues. > > - ------------- > In the coming days we are going to create opportunities for people to > come and get involved in more face to face interactions. Starting with > a regular scheduled office-hours format hangouts ( > http://wiki.centos.org/OfficeHours ) that start early next week. We > are trying to split the sessions into two different timezones so as to > maximise the number of people who are able to join. The sessions will > run live, with #centos-devel on irc.freenode.net being used for > conversations alongside. > > We are also running a CentOS Dojo on the 31st Jan 2014 at Belgium ( > http://wiki.centos.org/Events/Dojo/Brussels2014 ); The event will run > two tracks, with lots of opportunities for social interaction between > the talks; followed by CentOS in the Clouds Hack sessions. We are > limited in the number of people we can accomodate, so I encourage > everyone to register early. > > - ------------- > I want to take this opportunity to thank all the sponsors, the > contributors and the CentOS team members for all their help over the > years, the project is built completely upon those contributions - and > I look forward to seeing even more involvement from everyone as we > move forward. > > - ------------- > A Request: > > We are still sorting out content in various places and it might take a > day or two to get everything in place. In the mean time if you find > something stale and perhaps misleading in the new context ( or the old > one! ) please drop in on #centos-devel at irc.centos.org and let us know. > > - ------------- > Some URLS: > - - http://www.centos.org/ The CentOS Project > - - http://wiki.centos.org/ CentOS Community wiki > - - http://community.redhat.com/ RedHat OSAS > - - > http://www.redhat.com/about/news/press-archive/2014/1/red-hat-and-centos-jo… > - - Red Hat Press Release > - - http://community.redhat.com/centos-faq - Red Hat FAQ's about the > initiative > - - http://wiki.centos.org/FAQ - CentOS FAQ's about the initiative > > > Enjoy! and regards, > > Karanbir Singh and everyone from the CentOS team, > > > - -- > Karanbir Singh, Project Chair, The CentOS Project > +44-207-0999389 | http://www.centos.org/ | twitter.com/CentOS > GnuPG Key : http://www.karan.org/publickey.asc > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.14 (GNU/Linux) > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iEYEARECAAYFAlLMbQcACgkQMA29nj4Tz1sTnQCgj2fYxYpTjA0KwH7TpCWjE4gg > w2cAniQWb/nh6Zn/8daSQ3EAfLIzGNKg > =KJOk > -----END PGP SIGNATURE----- > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce > -- Digimer Papers and Projects: https://alteeve.ca/w/ What if the cure for cancer is trapped in the mind of a person without access to education?

8 8

Re: [CentOS] [CentOS-announce] CentOS Project joins forces with Red Hat
by Always Learning 17 Jan '14

17 Jan '14

On Tue, 2014-01-07 at 21:09 +0000, Karanbir Singh wrote: > With great excitement I'd like to announce that we are joining the Red > Hat family. The CentOS Project ( http://www.centos.org ) is joining > forces with Red Hat. Working as part of the Open Source and Standards > team ( http://community.redhat.com/ ) to foster rapid innovation > beyond the platform into the next generation of emerging technologies. > Working alongside the Fedora and RHEL ecosystems, we hope to further > expand on the community offerings by providing a platform that is > easily consumed, by other projects to promote their code while we > maintain the established base. Essentially Red Hat is slowly taking over and developing/assisting Centos to be a more regular and structure organisation. The fact that Red Hat now owns the Centos brand worries me but that's life. Absolutely nothing remains static. Centos was created by many ordinary people to whom I am very grateful. Its a really great operating system. I genuinely like it, hence I abandoned M$ completely about 5 years ago and have never regretted it. I just wish I had migrated to Centos many years earlier. Red Hat will gain commercially from their de facto take-over. One of the general beneficial effects will be bringing Linux into the vast mainstream of everyday computing and attracting (or should that be enticing?) M$ business users. Working as a single team with Red Hat will inevitably mean speedier updates for Centos users. I love Linux and want this merger to succeed. I'm patiently waiting for Centos on my Cube (Android) tablet. Happy New Year. -- Paul. England, EU. Our systems are exclusively Linux. No Micro$oft Windoze here. EXIM: chlothar.bnv-bamberg.de = 217.146.130.222 but HELO bnv-bamberg.de has no IP address

5 7

Re: [CentOS] [CentOS-announce] CentOS Project joins forces with Red Hat
by m.roth＠5-cent.us 17 Jan '14

17 Jan '14

John R. Dennison wrote: > On Fri, Jan 17, 2014 at 05:55:54PM +0100, Ljubomir Ljubojevic wrote: >> >> Ok, what ever, I am done wasting time on you. > > Excellent. Now if others would stop responding to the trolls it would > be even better. > Can't resist: I think he's trying to get our goat... and everyone knows what happens when a troll runs into a goat.... mark "your folks *did* tell you that story, right?"

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
18
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2014