Discuss October 2014

discuss@lists.centos.org

199 participants
220 discussions

SSLv3 vunerability and Nautilus
by James B. Byrne 15 Oct '14

15 Oct '14

CentOS-6.5 Apache httpd-2.2.15 We have a webdav folder accessible only by https. In conformance with the advisory we removed SSLv3 from the SSLProtocol directive of the Apache server on that webdav host, so that it now looks like this: SSLProtocol +TLSv1 Now I cannot connect to the webdav service from my gnome desktop. When I open the webdav folder I get a window with the following error message instead of the folder: Could not display "davs://user@webdav.domain.tld/". Error: HTTP Error: Connection terminated unexpectedly Please select another viewer and try again. As I was using this folder today before the change in protocol on the server I am fairly confident that the removal of SSLv3 is the likely cause. Is there any way to configure the Nautilus browser in CentOS-6.5 to use TLSv1 instead? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

CentOS 7 for i386/32-bit?
by Boris Epstein 15 Oct '14

15 Oct '14

Hello listmates, I can't find the 32 bit version of Centos 7. Would it be because I am not looking in the right place or does it not exist at all? Thanks. Boris.

6 5

difficulties in compiling php-5.3.29 source from php.net using CentOS 7
by Kenneth Wolcott 15 Oct '14

15 Oct '14

Hello; I'm having difficulties in compiling php-5.3.29 source from php.net using CentOS 7. I need to bring my PHP development and production environment forward from PHP 5.3.3 which is using an abandoned php-template application from sourceforge. Since I need to do this in stages (it would be nice if I could just install the CentOS 7 php and apache versions with the "best" current php templates engines and make the developers change the php code to make it work, but that is not my option!) I need to get php-5.3.29 compiled on CentOS 7. I'm using the configure syntax derived from the output of "php -i" executed on the current development environment. I've had to install some additional "*-devel" packages and I make it further in the configure dance, but I've come to a point where I need additional help. My current problem: "configure: error: DBA: Could not find necessary header file(s)." I can provide the configure syntax I'm using if that will help you all help me. I've asked on one of the PHP mailing lists and have received good help up to this point, but I was wondering if there are some tips and hints that might come from those who are experts at this from the CentOS side rather than those who are experts from the PHP side. Thanks in advance, Ken Wolcott

2 1

OT: Would you purchase this hardware?
by Jason T. Slack-Moehrle 15 Oct '14

15 Oct '14

I have about $1200 to spend on 2 boxes and I'd like them to be identical. Very basic web serving, simple HTML5 video, light email serving. Looking around NewEgg, I come across: http://www.newegg.com/Product/Product.aspx?Item=9SIA65C1ZT3064 These use ECC unbuffered RAM which is expensive but I did find 8gb sticks for under $70 each: http://www.newegg.com/Product/Product.aspx?Item=N82E16820613386 I'd still have to add hard drives and more RAM and 2nd GB NICS. I also found out the power supply is non standard so if it goes in order to put in a standard power supply you need an adaptor: http://www.moddiy.com/products/IBM-Lenovo-PSU-Main-Power-24%252dPin-to-14%2… I haven't purchased hardware in 2 years. I could even use a desktop system versus this "server" class. I feel like by time I add more to each box to make it run perhaps there is a better machine to buy? Anyway if anyone has any advice I'd appreciate it. These are personal funds, I don't want to make a poor decision. Jason

3 5

Re: [CentOS] machine check exception
by Glenn Eychaner 15 Oct '14

15 Oct '14

You have (AFAIK) provided no details as to which version of CentOS you are running nor of your hardware, but I'll try to help as I can. (In fact, it is unclear whether the MCE crashed your system or not!) I had a set of systems that occasionally logged MCEs (memory partity errors, in my case), and spent a month tearing into them. First, make sure that "mcelog" is installed on your system. If you are running 64-bit CentOS 6, you should be able to "yum install mcelog". If you are running 32-bit CentOS 6 or CentOS 5, you'll have to download mcelog from the source (http://www.mcelog.org) and install it yourself, but if that is the case, let me know and I'll send further help. (I don't know about CentOS 7.) Second, make sure mcelogd is running at all times using system-config-services or chkconfig. Once you have done these two things, the next time you see an MCE, you should get an entry in /var/log/mcelog. This will tell you a LOT more about the MCE. Post the MCE here and/or Email it to me (I skim the digest and may miss a single post), and we can break it down further from there. [In my case, changing the memory had no effect on the MCEs, nor did any number of other suggested solutions; I eventually decided that since they were "corrected memory parity errors", and thus non-fatal to processes or the system, I would ignore them. And as of the last kernel update, I don't see them any more, though I have not dug more deeply to see if there was some causal connection.] -G. On Oct 15, 2014, at 9:00 AM, centos-request(a)centos.org wrote: > Unfortunately, No iLO Event Logs and IML Logs configured on the server. > > Can anybody suggest which tools on the server I can configure so next time > server will have all the log records. Its really hard to prove to the > peoples that the issue is at hardware level (When the Hardware vendor and > Application Owners are from different companies ). -- Glenn Eychaner (geychaner(a)lco.cl) Telescope Systems Programmer, Las Campanas Observatory

1 0

Firefox, Thunderbird crashing X Centos 5.11
by Negative 15 Oct '14

15 Oct '14

I cannot start Firefox or Thunderbird ever since I tried to put in a new graphics card. I had trouble with the configuration on this machine, which has two monitors. Once the new card was in I decided to change the configuration from cloned to spanning screens. I messed up and didn't save the old working configuration. Along the way, I wondered if the new card didn't have a problem and I put the old one back. At some time in all this, firefox began crashing on startup, but that wasn't the primary problem. The old card, now installed, is an nvidia Quadro fx580. I use El-Repo's kmod-nvidia and driver. It's up to date. The X error appended to the Xorg log on the last FF crash Is thus: Backtrace: 0: X(xf86SigHandler+0x71) [0x4868d1] 1: /lib64/libc.so.6 [0x39c4c30030] Fatal server error: Caught signal 11. Server aborting (II) Screen 0 shares mem & io resources (II) Screen 1 shares mem & io resources Any thoughts, suggestions? Thanks

1 0

CentOS-announce Digest, Vol 116, Issue 8
by centos-announce-request＠centos.org 15 Oct '14

15 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Koji/CBS infra and sslv3/Poodle important notification (Fabian Arrotin) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Oct 2014 12:32:37 +0200 From: Fabian Arrotin <arrfab(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] Koji/CBS infra and sslv3/Poodle important notification Message-ID: <543E4D45.8070708(a)centos.org> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, As most of you already know, there is an important SSLv3 vulnerability (CVE-2014-3566 - see https://access.redhat.com/articles/1232123) , known as Poodle. While it's easy to disable SSLv3 in the allowed Protocols at the server level (for example SSLProtocol All -SSLv2 -SSLv3 for apache), some clients are still defaulting to SSLv3, and Koji does that. We currently have disabled SSLv3 on our cbs.centos.org koji instance, so if you're a cbs/koji user, please adapt your local koji package (local fix !) At the moment, there is no available upstream package, but the following patch has been tested by Fedora people too (and credits go to https://lists.fedoraproject.org/pipermail/infrastructure/2014-October/01497…) ===================================================== - --- SSLCommon.py.orig 2014-10-15 11:42:54.747082029 +0200 +++ SSLCommon.py 2014-10-15 11:44:08.215257590 +0200 @@ -37,7 +37,8 @@ if f and not os.access(f, os.R_OK): raise StandardError, "%s does not exist or is not readable" % f - - ctx = SSL.Context(SSL.SSLv3_METHOD) # SSLv3 only + #ctx = SSL.Context(SSL.SSLv3_METHOD) # SSLv3 only + ctx = SSL.Context(SSL.TLSv1_METHOD) # TLSv1 only ctx.use_certificate_file(key_and_cert) ctx.use_privatekey_file(key_and_cert) ctx.load_client_ca(ca_cert) @@ -45,7 +46,8 @@ verify = SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT ctx.set_verify(verify, our_verify) ctx.set_verify_depth(10) - - ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1) + #ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1) + ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_TLSv1 | SSL.OP_NO_SSLv3) return ctx ===================================================== We'll keep you informed about possible upstream koji packages that would default to at least TLSv1 If you encounter a problem, feel free to drop into #centos-devel channel on irc.freenode.net and have a chat with us on behalf of the Infra team, - -- Fabian Arrotin The CentOS Project | http://www.centos.org gpg key: 56BEC54E | twitter: @arrfab -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlQ+TUUACgkQnVkHo1a+xU4JyQCfefp2h7yRdmljBqRc+M76jPTf z7wAn3dOkaNPNfEnV0pxWDFX7BDDqKuY =lxsg -----END PGP SIGNATURE----- ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 116, Issue 8 ***********************************************

1 0

[OT]] CentOS 7 docs, tutorials, etc...
by James B. Byrne 15 Oct '14

15 Oct '14

I apologize in advance for the subject and length of this reply. I debated just letting things pass without comment. But, security has many levels. And the first level is recognition of the threat. Whether we recognize it or not. Whether we agree of disagree with the politics that lie beneath this situation or not; Whether we consider this a non-technical issue or not; By virtue of our employment we are all involuntarily caught up in a global conflict between the agents of extremely powerful states versus the talents, minds and beliefs of principled individuals. For better or for worse the chosen battleground is the software we use and the hardware we run it upon. It is my belief that we as a community are not well served by individuals that decry every attempt to highlight the fundamentally terrible positions our governments have placed us in. On Fri, October 10, 2014 13:33, William Woods wrote: > So claim made, nothing to back it up. Got it. > > all I need to say isBASH , OpenSSL.. > > I am sure there are more. > > But really, if you are going to claim something, at least be willing to back > up what you claim is that asking to much ? > Of course, plausible deniably is the standard MO when a government does something that even their own subject populace would take exception to. That said one must give thought to the reality behind the following well documented controversy that goes back to 1999: https://en.wikipedia.org/wiki/NSAKEY But more recently we have: http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-us… and this: http://techcrunch.com/2014/05/13/nsa-docs-detail-efforts-to-collect-data-fr… This sort of publicity is sort of bad for business, which is really, really starting to bite the U.S. tech giants. So we now have these 'stand-up and be counted' responses like the following: http://www.cnn.com/2013/12/05/tech/web/microsoft-nsa-snooping/ http://www.wired.com/2013/12/microsoft-nsa/ Which are about as trustworthy as . . . well, I cannot think of anything off-hand that I would consider as untrustworthy as the public statements of a corporation gagged by a secret court and suffering economically from the public revelations of that fact. After, what we have in the U.S. (and the rest of the AABCNZ / 5-eyes network for that matter) at the moment is a totally out-of-control, irresponsible, and self-righteously belligerent security apparatus that is milking billions of dollars annually out of their populaces. Its leaders and employees have suborned the courts, committed perjury, and repeatedly and egregiously violated the very constitution (where such exist, the UK being a notable exception) that as public officials they are sworn to uphold. This consortium has accumulated a vast collection of private data on every present, past, and probably future elected official in the U.S.A.; and quite likely of the rest of the world as well. I am not sure that such capability in the hands of people shown to put institutional interests above the law bodes well for public oversight. Of course, maybe suggesting a tinfoil hat for everyone who ponders the implications of all in public this will make all of that unpleasant stuff just go away. When one cannot or will not address the central issue then attack the credibility of the opponent. Call for evidence and then dismiss it out of hand when confronted with it. Old news, shall we say. Never mind that dismissive response begs the question that these thing have happened and continue to happen. Personally, I am beginning to wonder just who employs "William Woods" <woods.w(a)gmail.com>. A nice nondescript name with no signature block from an anonymous email address. Maybe he is a tinfoil salesman? Anyone who attended the C3 Congress in Berlin this past December was exposed to an awful lot information and revelations from some highly respected privacy advocates. They were also made aware of the fact the various agencies actively monitor and participate in a range of online forums, including technical mailing lists and MMOGs. Given CentOS's importance to the information infrastructure of todays business and scientific communities (about twice as many servers run CentOS than RHEL http://constantmayhem.com/ty-stuff/linuxsurvey/2013.html) it would not be surprising to me to discover one or more of said individuals skulking about. And, one has to admit, casting doubt upon and disparaging lines of enquiry into things contrary to their employer's interest might be among their assigned jobs. Not that Mr. Woods is one of these mind you. He could very well be just be a mailing list troll of the everyday garden variety. Or, perhaps, he is a RedHat employee that takes any implied criticism of his employer a little too personally. Whatever the case may be it is interesting that: 1. W. Woods first posted to the mailing list (under that name) this past July. 2. He has an utter fascination with things to do with SystemD and its detractors. Indeed that was the subject of his first post. 3. He has never asked, answered or added to a question of a technical nature in such a fashion as to provide a proposed solution or elaborate on a constructive approach to a problem. 4. The vast majority of his postings can, with the most charitable interpretation, be considered as snide deprecation of people who express opinions that he evidently feels compelled to comment on. Usually having to do with security. And without actually contributing anything in the way of useful information. I am just saying, sometimes paranoia is induced by other people's behaviour, not by any internal mental defect. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

Systemd Adding Its Own Console To Linux Systems
by Steve Clark 14 Oct '14

14 Oct '14

Anybody see this article on /. -- Stephen Clark

21 92

URGENT! Shellshock fix DOES NOT fix the bug on CentOS 5.4
by Jessica Blank 14 Oct '14

14 Oct '14

Good afternoon! After applying the latest bash RPM listed at http://lists.centos.org/pipermail/centos-announce/2014-September/020594.html : The fixed RPM (bash-3.2-33.el5_10.4.x86_64.rpm) DOES work just fine on CentOS 5.10. However, it DOES NOT work on CentOS 5.4. That is, bash runs fine, but IS STILL VULNERABLE TO SHELLSHOCK! Scary screenie at: http://i.imgur.com/yR7sBjV.png It looks like the released RPM somehow behaves DIFFERENTLY on 5.4 as opposed to 5.10. This has been validated by one of my coworkers; it's apparently not just me. Best, Jessica

19 36

← Newer
1
...
9
10
11
12
13
14
15
...
22
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2014