Discuss April 2014

discuss@lists.centos.org

172 participants
139 discussions

Re: [CentOS] [CentOS-announce] CVE-2014-0160 CentOS 6 openssl heartbleed workaround
by Always Learning 11 Apr '14

11 Apr '14

Thank you. What will the temporary packages be called ? -- Paul. England, EU. Our systems are exclusively Centos. No Micro$oft Windoze here.

8 13

Logrotate errors
by C. L. Martinez 11 Apr '14

11 Apr '14

Hi all, I have a problem with logrotate and I don't know why. In /var/log/messages appears these errors: Apr 8 15:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 16:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 17:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 18:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 19:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 20:01:02 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 21:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 22:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] Apr 8 23:01:01 plzfnsm02 logrotate: ALERT exited abnormally with [1] It seems the problem if with this logrotate.conf (executed every hour): create dateext /srv/www2/logs/viewer.log { size 512k create 0640 www www missingok rotate 7 compress delaycompress copytruncate notifempty } Doing a debug: [root@www02 ~]# logrotate /data/config/etc/logrotate.conf -dv reading config file /data/config/etc/logrotate.conf reading config info for /nsm/moloch/logs/viewer.log Handling 1 logs rotating pattern: /srv/www2/logs/viewer.log 524288 bytes (7 rotations) empty log files are not rotated, old logs are removed considering log /srv/www2/logs/viewer.log log needs rotating rotating log /srv/www2/logs/viewer.log, log->rotateCount is 7 dateext suffix '-20140409' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' glob finding logs to compress failed destination /srv/www2/logs/viewer.log-20140409 already exists, skipping rotation According to this kb from redhat's website: https://access.redhat.com/site/solutions/39006 problem could be selinux. But SElinux is disabled: [root@www02 ~]# sestatus SELinux status: disabled [root@www02 ~]# Any idea?? Could be a bug?? Host is a CentOS 6.5 x86_64 fully patched. Thanks.

4 4

Problem running yum update command
by H 11 Apr '14

11 Apr '14

I am running CentOS 6.5 in a VZ container and today when I wanted to run yum update command I receive the following error messages: rpmdb: unable to join the environment error: db3 error(11) from dbenv->open: Resource temporarily unavailable error: cannot open Packages index using db3 - Resource temporarily unavailable (11) error: cannot open Packages database in /var/lib/rpm CRITICAL:yum.main: Googling the message I find several-year old posts where it seems that the database has been corrupted (or similar.) Has anyone else seen this recently and is there a recommended fix? Thank you. Hakan

6 9

CentOS-announce Digest, Vol 110, Issue 6
by centos-announce-request＠centos.org 10 Apr '14

10 Apr '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:0383 Moderate CentOS 6 samba4 Update (Johnny Hughes) 2. CEBA-2014:0394 CentOS 5 cpuspeed Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 9 Apr 2014 19:17:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0383 Moderate CentOS 6 samba4 Update To: centos-announce(a)centos.org Message-ID: <20140409191737.GA9834(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0383 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0383.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 09d5d0dc4df4320a41f727e305e1aa16d4a5131242f1396bdd0b8d89fb1efde3 samba4-4.0.0-61.el6_5.rc4.i686.rpm 54c4259df7f650cba454e79c31ec89a5477c8569e5451a2da51e708821875f7d samba4-client-4.0.0-61.el6_5.rc4.i686.rpm a268f5734913b7222af65f90afa60ce7e5c347fb5e6ca6c1909abe50e978d34e samba4-common-4.0.0-61.el6_5.rc4.i686.rpm 8cd2d23a8e23df5e6db76ca06544e864e971e9a277d0c6782f765a801b77d551 samba4-dc-4.0.0-61.el6_5.rc4.i686.rpm a9f3bbd64f613913f9e48a017d0b4dbf4c3e36526d3b6521dc5eca8c005fd26f samba4-dc-libs-4.0.0-61.el6_5.rc4.i686.rpm 48f7cc83119b37134ba9324cd3ec6012406f326aff2dd4bf6bd7b09a18e0f642 samba4-devel-4.0.0-61.el6_5.rc4.i686.rpm 9617322e2d419b8738c416a3af5fcb9c4e346e9173fac90da019d02c7a031ecc samba4-libs-4.0.0-61.el6_5.rc4.i686.rpm e1fab54fe2f68a405a1d509660c670b82fd37bc70ab73493d02130fd0fd6d757 samba4-pidl-4.0.0-61.el6_5.rc4.i686.rpm eb03021db411972c419daf400fa926e962ac23fe2c8b1a55c5fa85e98b27ff1f samba4-python-4.0.0-61.el6_5.rc4.i686.rpm 583a0bd44d9e715a5512bcf5b12999db47fc26569bae8ce61f94dd0e0796b567 samba4-swat-4.0.0-61.el6_5.rc4.i686.rpm 4610205835d6671e8d618da6df7a86330eaa59e98d592a1b79cdc2d7f4b7458f samba4-test-4.0.0-61.el6_5.rc4.i686.rpm 7311777bf8bbd67619861255f9901c0c8077edd20d1e14aa6ad5bc243fd92d44 samba4-winbind-4.0.0-61.el6_5.rc4.i686.rpm 8a26b8141fdcc578e21e5e3a96d2c4c9212fb5a2badbd7d2afa10518ca83e5b7 samba4-winbind-clients-4.0.0-61.el6_5.rc4.i686.rpm 432bb287b022112db9fb8f7a57800de76ca23ee64a651af88c1bb5121da09f7a samba4-winbind-krb5-locator-4.0.0-61.el6_5.rc4.i686.rpm x86_64: aaa8bf64fba2998b5a628c0eb8472ff4392cb90b0ca836a5e1b3ce1c235bb037 samba4-4.0.0-61.el6_5.rc4.x86_64.rpm 5754b55657efee1f8b20ddd18aa5d5ea7f65daee4f6f09c6bef9730c2e4dd081 samba4-client-4.0.0-61.el6_5.rc4.x86_64.rpm ea20b0b5044b02284ea5eda6e7c8bef2de16139c7b4b7ce2847c27eeca33df85 samba4-common-4.0.0-61.el6_5.rc4.x86_64.rpm 5c1cb264ce453c0ecb068174b23bd490195c0063af83031b9271fdfe7d5de967 samba4-dc-4.0.0-61.el6_5.rc4.x86_64.rpm 6ff02415059864ddaea0a11599cf1199b8a780f2e76eba0b3aff07b6a2c80cc1 samba4-dc-libs-4.0.0-61.el6_5.rc4.x86_64.rpm 0347ecc46bbf6b88db2e0584ec17c20888ce83980776800a596a52b907761c4f samba4-devel-4.0.0-61.el6_5.rc4.x86_64.rpm 44a6780a4c72334c59b3ba7f063a85b131ff5480141cc0cf0bc8892a9f004519 samba4-libs-4.0.0-61.el6_5.rc4.x86_64.rpm 51c79c730fb3573167ab174908a46ea4ff0961e3c380f1d28c70a797c77c2012 samba4-pidl-4.0.0-61.el6_5.rc4.x86_64.rpm ae4466709a0d401326ee86c76f9c02c9473047124a523a96098fd28bdb63c4bd samba4-python-4.0.0-61.el6_5.rc4.x86_64.rpm 0fca87f790461090ccd42096eb91a65fc4751cef8debaffb1da7429e8b93e463 samba4-swat-4.0.0-61.el6_5.rc4.x86_64.rpm 380e42e20233e4cfef94f3f2faa7e0f36d6fc02436408864c60df465cdfc5184 samba4-test-4.0.0-61.el6_5.rc4.x86_64.rpm f238ab594487ca60976075dd96feaeb529f91c74ff309d9e3bebc1306f91dd88 samba4-winbind-4.0.0-61.el6_5.rc4.x86_64.rpm 96101baacc7b608dc17831d91fdd41162c09446b9a21003855ac32e89d5cf3de samba4-winbind-clients-4.0.0-61.el6_5.rc4.x86_64.rpm 4bce2a83fe2efd2ad7d91e99b7b937819e3bb2f06398fd0f5e7c7db9791484a8 samba4-winbind-krb5-locator-4.0.0-61.el6_5.rc4.x86_64.rpm Source: 644e1ef2027b79cf7e06ab60606ed008b47ec4e48c84dd4df0b9182bbc3d6bd8 samba4-4.0.0-61.el6_5.rc4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 10 Apr 2014 10:29:20 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0394 CentOS 5 cpuspeed Update To: centos-announce(a)centos.org Message-ID: <20140410102920.GA20749(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0394 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0394.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f0c3940d4d6d0e6130d7ffcdcadec39499adb412c8c0f42599d7090e35ac6dc0 cpuspeed-1.2.1-11.el5_10.i386.rpm x86_64: bcbbb788de9eb37ddb4f96b4bd21fe57feb8558392043d00497799bf056c2a19 cpuspeed-1.2.1-11.el5_10.x86_64.rpm Source: f148ba6d6c18817f938862b02790987fdc90e3dcae8b05a8314b2c8884d19d82 cpuspeed-1.2.1-11.el5_10.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 110, Issue 6 ***********************************************

1 0

FLASH NewsBites - Heartbleed Open SSL Vulnerability (fwd)
by Connie Sieh 10 Apr '14

10 Apr '14

For even more information about "Heartbleed". -Connie Sieh ---------- Forwarded message ---------- Date: Wed, 9 Apr 2014 12:27:54 -0500 From: The SANS Institute <NewsBites(a)sans.org> Subject: FLASH NewsBites - Heartbleed Open SSL Vulnerability FLASH NewsBites - Heartbleed Open SSL Vulnerability FLASH NewsBites are issued only when a security event demands global and immediate action. The HeartBleed Open SSL vulnerability fits that description. Proof: More than 200 students at SANS 2014 in Orlando this week spent 2 hours in a briefing on Heartbleed last night after full days of classes. This one matters. Tonight at 8:15 SANS faculty member Jake Williams will present a briefing explaining the HeartBleed vulnerability and what it means to you. Jake says: "Another 24 hours have passed since the initial presentation and we know more about what is vulnerable and what isn't. Even if you attended the short presentation last night at #SANS2014, this is a don't miss event." Jake will cover the actual structure of the vulnerability, methods for detection, and what you need to do (both as a systems admin and an end user). Jake will also perform live demos against a vulnerable server so you see first hand what can be exposed. Finally, we'll be releasing packet captures containing the exploit (suitable for testing your IDS rules). Register at: https://www.sans.org/webcasts/openssl-heartbleed-vulnerability-98105 Jake Williams, a principal consultant at CSRgroup Computer Security Consultants, has over a decade of experience in secure network design, penetration testing, incident response, forensics, and malware reverse engineering. Prior to joining CSRgroup, he worked with various government agencies in information security roles. Jake has twice won the annual DC3 Digital Forensics Challenge and has spoken at several regional ISSA meetings, Shmoocon, and the DC3 Conference, as well as numerous US government conferences. Jake is currently pursuing a PhD in Computer Science where he is researching new techniques for botnet detection. His research interests include protocol analysis, binary analysis, malware RE methods, subverting the security of cloud technologies, and methods for identifying malware Command and Control (C2) techniques.

2 1

cachefs
by Rita 10 Apr '14

10 Apr '14

has anyone been using cachefs with 6.x series? i have tried using it but i keep getting hung processes after 2 weeks. ATM, running 6.3 but was curious if its more stable on Centos 6.5? -- --- Get your facts first, then you can distort them as you please.--

6 11

How to save a Gnome screen layout on CentOS 6.5 after logging off?
by Gilbert Sebenste 09 Apr '14

09 Apr '14

Hello everyone, A quick Gnome question that has vexed me. In CentOS 5.10, if I have, say, an X terminal window up on my screen, the next time I log in, it's there when I log in as an unprivileged user. That's because I can save the layout the way I want to; there's a checkbox for it to save the layout upon exiting. I see none for CentOS 6.5. So, my X-terminal isn't there when I log in each time. Clue me in, oh people wiser than I... Gilbert ******************************************************************************* Gilbert Sebenste ******** (My opinions only!) ****** *******************************************************************************

3 5

Re: [CentOS] CVE-2014-0160 CentOS 6 openssl heartbleed workaround
by James B. Byrne 09 Apr '14

09 Apr '14

On Tue, April 8, 2014 18:55, Lars Hecking wrote: > Leon Fauster writes: >> Am 08.04.2014 um 23:08 schrieb Keith Keller >> <kkeller(a)wombat.san-francisco.ca.us>: >> > On 2014-04-08, Robert Arkiletian <robark(a)gmail.com> wrote: >> >> >> >> if you include libcrypto in the grep then sshd is affected. >> > >> > That's unfortunate. :( Is the bug in libssl, libcrypto, or both? >> >> >> looking inside - its seems that this issue (cve-2014-0160) is resolved >> in ssl/d1_both.c and ssl/t1_lib.c and not in files under crypto/ ... >> to say more i have to take a look into the build process. > > The OpenBSD note for the patch reads > (http://ftp.openbsd.org/pub/OpenBSD/patches/5.4/common/007_openssl.patch) > > | Only SSL/TLS services are affected. Software that uses libcrypto alone > | is not affected. In particular, ssh/sshd are not affected and there > | is no need to regenerate SSH host keys that have not otherwise been > | exposed. > > The patched code is the same everywhere, ssl subdirectory only. Code in > the crytpo subdirectory is not affected or patched. However, if one was running an affected service, say httpd/ mod_ssl, on a host that had sftp sessions connected to it then would not the ssh private keys of the host and local users be in memory and therefore readable by the exploit? If so then are not all these keys potentially compromised as we have no idea how long this exploit has been known to others prior to the community's own discovery? I have only a vague idea how all this stuff works but it seems to me that it is necessary that the private keys of all PKI implementations at some point have to be somewhere in memory in their usable, and therefore observable, state. As I understand the exploit it allows systematic transfer of every byte in memory which would include the unprotected keys would it not? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

Error occurs when build kernel 3.2.0
by 李欣 09 Apr '14

09 Apr '14

Hi all, Please let me know if this is not the right place to ask this question. I was trying to compile and build kernel 3.2.0, by following <Linux Administration - A Beginner's Guide> written by Wale Soyinka. Error occurs after running the following command: # new-kernel-pkg -v --mkinitrd --depmod --install 3.2.0-custom initrdfile is /boot/initrd-3.2.0-custom.img running depmod for 3.2.0-custom creating initrd: /sbin/mkinitrd --allow-missing -f /boot/initrd-3.2.0-custom.img 3.2.0-custom found /boot/initrd-3.2.0-custom.img and using it with grubby adding 3.2.0-custom to /boot/grub/grub.conf /etc/lilo.conf does not exist, not running grubby Does anyone ever run into this? How can I fix it? Here is the link that I downloaded kernel from: http://www.kernel.org/pub/linux/kernel/v3.x/linux-3.2.tar.bz2 # uname -a Linux test_server 2.6.32-431.11.2.el6.x86_64 #1 SMP Tue Mar 25 19:59:55 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux # cat /etc/redhat-release CentOS release 6.5 (Final) Please let me know if any other information is needed. Thanks. Xin Li

3 3

Re: [CentOS] CVE-2014-0160 CentOS 6 openssl heartbleed workaround
by Peter van Hooft 09 Apr '14

09 Apr '14

> Message: 23 > Date: Tue, 8 Apr 2014 07:08:30 -0400 > From: Steven Tardy <sjt5atra(a)gmail.com> > Subject: Re: [CentOS] CVE-2014-0160 CentOS 6 openssl heartbleed > workaround > To: CentOS mailing list <centos(a)centos.org> > Message-ID: > <CAG2k2x9udVEty0BRS+pEj0Hy3Mrt5N7NeCfZZC1r9qyv0M=rvA(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On Tue, Apr 8, 2014 at 2:56 AM, Keith Keller < > kkeller(a)wombat.san-francisco.ca.us> wrote: > > > On 2014-04-08, Karanbir Singh <kbsingh(a)centos.org> wrote: > > > > > > Earlier in the day today, we were made aware of a serious > > > issue in openssl as shipped in CentOS-6.5 ( including updates issued > > > since CentOS-6.5 was released ); This issue is addressed in detail at > > > http://heartbleed.com/ > > > > is there an easy way to know which services need to be kicked? > > > > > rpm -q --whatrequires openssl > That should work, in theory. On one of my machines: # rpm -q --whatrequires openssl postfix-2.6.6-2.2.el6_1.x86_64 openssl-devel-1.0.1e-16.el6_5.7.x86_64 # Then try: # yum remove openssl 2>&1 | grep 'will be erased' | wc -l 421 # I use this (crude) script to find what processes have files open from an rpm: ---------------------------------------------------------------------- #! /bin/bash -p if [[ "$(whoami)" != "root" ]]; then echo "$0: must be root" >&2 exit 1 fi if [[ -z "$1" ]]; then echo "usage: $0 rpm..." >&2 exit 1 fi tmpfile=$(mktemp) || { echo "$0: couldn't create temporary file" >&2 exit 1 } trap "rm -f $tmpfile" EXIT for rpm in $*; do if ! rpm -q "$rpm" >/dev/null 2>&1; then echo "$0: no such rpm $1" >&2 exit 1 fi rpm -ql "$rpm" >> $tmpfile done fgrep -f $tmpfile /proc/*/maps | awk -F/ '{print $3}' | sort -u | while read pid; do echo "$(ls -l /proc/$pid/exe | awk '{print $NF}') ($pid) ($(tr '\0' ' ' < /proc/$pid/cmdline))" done | sort -u ---------------------------------------------------------------------- # ./processes-that-use-files-from-an-rpm openssl /usr/bin/python (13146) (/usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x ) /usr/libexec/mysqld (1626) (/usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock ) /usr/sbin/certmonger (1776) (/usr/sbin/certmonger -S -p /var/run/certmonger.pid ) /usr/sbin/httpd (1709) (/usr/sbin/httpd ) /usr/sbin/httpd (20152) (/usr/sbin/httpd ) /usr/sbin/httpd (20153) (/usr/sbin/httpd ) /usr/sbin/httpd (20154) (/usr/sbin/httpd ) /usr/sbin/httpd (20155) (/usr/sbin/httpd ) /usr/sbin/httpd (20156) (/usr/sbin/httpd ) /usr/sbin/httpd (20157) (/usr/sbin/httpd ) /usr/sbin/httpd (20158) (/usr/sbin/httpd ) /usr/sbin/httpd (20159) (/usr/sbin/httpd ) /usr/sbin/httpd (20160) (/usr/sbin/httpd ) /usr/sbin/ntpd (1484) (ntpd -u ntp:ntp -p /var/run/ntpd.pid -g ) /usr/sbin/sendmail.sendmail (1667) (sendmail: accepting connections) /usr/sbin/sendmail.sendmail (1678) (sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue) /usr/sbin/sshd (1456) (/usr/sbin/sshd ) /usr/sbin/sshd (28396) (sshd: root@pts/0 ) # And depending on this output I restart the services mentioned, or if there are to many, reboot the box :-) Regards, Peter van Hooft Philips Research

2 1

← Newer
1
...
7
8
9
10
11
12
13
14
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2014