Discuss August 2014

discuss@lists.centos.org

173 participants
168 discussions

restarting the CentOS office hours
by Karanbir Singh 18 Aug '14

18 Aug '14

Hi Guys, For a few weeks we ran the CentOS officehours, that were fairly well recieved. And now that CentOS-7 is out of the door, it would be good to restart those again, and perhaps focus on conversations wider than just about the Project and the SIG's process. We should do those too, but we should perhaps also consider including technical content and howto's etc. Would there be interest in something of this nature ? Also, I'm looking for some help to organise and run these office hours, so please get in touch if you are able to spare an hour or so every now and again to help with this effort. regards -- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc

1 0

Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide
by Adam King 18 Aug '14

18 Aug '14

Why are you assuming it's setup wrong? ;) Adam King IT Systems Administrator Skipton Girls High School 01756 707600 www.sghs.org.uk ----- Original Message ----- From: "Reindl Harald" <h.reindl(a)thelounge.net> To: "CentOS mailing list" <centos(a)centos.org>, kinga(a)sghs.org.uk Sent: Monday, August 18, 2014 12:27:12 PM Subject: Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide Am 18.08.2014 um 13:23 schrieb Adam King: > Good stuff, I've had a stable environment for around a year now, milter may > only bring on a performance increase, nothing else. the milter is for not going to jail if your server is for customers und you silentry drop an important false positive because your wrong setup don't reject it in a proper way a smart MTA would use blacklists with weight and postscreen (not with the CentOS6 base packages) to reject 90% of the noise before the content filters and then use spamd as milter to proper reject spam instead accept and drop > ----- Original Message ----- > From: "Alexander Farber" <alexander.farber(a)gmail.com> > To: "CentOS mailing list" <centos(a)centos.org> > Sent: Monday, August 18, 2014 12:18:54 PM > Subject: Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide > > Thanks Adam, it works for me now and I have summarized my setup at: > > > http://serverfault.com/questions/619537/use-postfix-and-spamassassin-packag… > > I don't see a reason to add a milter or amavis - because my server is > idling. > > On Thu, Aug 14, 2014 at 2:23 PM, Adam King <kinga(a)sghs.org.uk> wrote: > >> A message to the original poster.... do you still need help?

1 0

Use postfix and spamd on CentOS 6 - looking for a shortest guide
by Alexander Farber 18 Aug '14

18 Aug '14

Hello fellow CentOS-users, on the net there are lots of Spamassassin related HOWTOs - describing how to create a shell script for Postfix and how to install Spamassassin and start its spamd daemon - step by step. Additionally antivirus setups are described... But I have a strong feeling, that this is unneeded on CentOS 6 - because there are already preconfigured stock packages for postfix and spamassassin. So I have installed the both packages and I have configured postfix (it works fine). Also I have started the spamd (and can see it in "ps uawx") with: # chkconfig spamassassin on # service spamassassin start So I'm just missing the connection between postfix and spamd. Could anybody using these 2 programs on CentOS 6 please share it with me? Should I add something (involving spamc?) into /etc/postfix/master.cf? Thank you Alex P.S. Below is my "postconf -n". I accept mails (here I'd like to filter spam) for 6 virtual domains and then forward them to different GMail accounts: alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 header_checks = pcre:/etc/postfix/header_checks html_directory = no inet_interfaces = all inet_protocols = ipv4 mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost myhostname = www.afarber.de newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_destination_concurrency_limit = 2 smtp_destination_rate_delay = 40s smtp_generic_maps = hash:/etc/postfix/generic unknown_local_recipient_reject_code = 550 virtual_alias_domains = videoskat.de balkan-preferans.de simplex.ru larissa-farber.de bukvy.de slova.de virtual_alias_maps = hash:/etc/postfix/virtual

15 45

Re: [CentOS] Use postfix and spamd on CentOS 6 - looking for a shortest guide
by James B. Byrne 18 Aug '14

18 Aug '14

On Wed, August 13, 2014 12:32, Timothy Murphy wrote: > BC wrote: > >>> I've never seen a 1-page document that said, >>> "These are the changes I made after downloading packages X, Y and Z." > >> There is a large chasm between configuring a mail server and understanding >> the configuration of a mail server. Due to the many pitfalls and custom >> environments, it is very difficult to have a 1-page document that does >> much more than be an outbound MTA. > > Note what I asked for. > If you have installed postfix + spamassassin or whatever under CentOS > then presumably you downloaded certain packages > and then made certain changes in config files and perhaps elsewhere. > Therefore it is possible to write a short document just listing > the changes you have made. > It may be a waste of time in your view; > but in my experience this is exactly what I want to read > for my very basic home server needs. > >> Unlike apache, you can't just tweak the config after a failure >> and hit 'refresh'. > > I don't see why not. > That is exactly what I do, in both cases. > The difference in my experience is that apache documentation is much better. > >> The postfix documentation does detail a few sane defaults, >> but spamassassin is not part of postfix >> and therefore the defaults have to be modified right from the get-go, >> also unlike with apache where the defaults work for many people >> because they don't require any complexity from their httpd servers. > > MySQL, LDAP, PHP, etc, are not part of httpd, > but they all seem to me to work well together > without studying the matter in depth. > >> I would highly recommend getting a book on postfix. > > If I had to read a book in order to install and configure postfix > I would go back to sendmail. > > You sound as though you think it is meritorious > for software to be difficult to use. > The task of postfix seems to me fairly easy to understand, > so I don't see why implementing a solution should be that difficult. > The task of an SMTP service is what? To route messages from origin to destination based on the DNS information relating to the delivery address correct? But SMTP is not intended for message composition, submission, final delivery, display, content checking or any other ancillary operation. And it is these ancillary operations that are the source of much of the complexity and nearly all of the confusion and difficulty experienced with setting up Mail Transfer Agents (MTA). For example, a major problem discussed WRT MTAs is the proper setup of SpamAssassin (SA). People talk about setting up SA to filter mail. But SA does not do that. It simply scores messages as to the relative likelihood that the message contents are UCE/SPAM. Likewise, ClamAV does not filter for virus infection, it simply detects and reports. To filter one must configure the MTA to respond to the reports of SA and ClamAV. And there are many ways of configuring that response. Sendmail uses Milters for example whilst Postfix uses policy daemons. These are fundamentally different approaches to the problem. However, Postfix can also provide a Milter-like interface. Thus the configuration options can get quite extensive and it is difficult to anticipate and describe 'normal' configurations in such a case. Using Amavisd-New (http://www.amavis.org/) with Postfix to configure SA and ClamAv to filter mail worked best for me. Trying to get Postfix to work directly with either proved beyond my ability. Even with Sendmail I found that MailScanner was essential to get SA and ClamAV working together. Given that Amavis and MaiScanner exist for the sole purpose of bolting anti-spam and anti-virus filters into Postfix and Sendmail I infer that most people have experiences similar to mine. The Postfix mailing list at Cloud9 is a good place to get help WITH SPECIFIC POSTFIX PROBLEMS. However, I believe that it would be, shall we say, unwise to ask for hand-held guidance setting up a Postfix MTA on that list. RTFM is perhaps the mildest response one could expect. On the other hand, asking a very specific question about what TFM is trying to say in a particular section usually elicits helpful replies. I suggest that you look at Amavisd-New from EPEL and probably ClamAV from the same source (do not mix EPEL and Repoforge packages in this case) and go from there. I believe that you will find that much easier to work with than trying to use SA directly with Postfix. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Down-grading to an "obsoleted" package
by Toralf Lund 18 Aug '14

18 Aug '14

Hi, Does anyone know if there is a clean way to "downgrade" to the old rpm package when it was previously replaced by another that obsolete it? I mean, say that I have installed some rpm "A-1.0-1.x86_64.rpm", and along comes "B-1.0-1.x86_64.rpm", whose spec has Obsoletes: A Now, if I do "rpm -U B-1.0-1.x86_64.rpm" or "yum install B-1.0-1.x86_64.rpm" or (if B is available through an enabled repository) "yum update", what happens is that "A" gets removed and "B" is installed in its place. Then I decide I want to switch back to "A". So what do I do? I know that one answer is rpm -e B rpm -U A-1.0-1.x86_64.rpm - but what if A and B provide facilities required by other installed packages? I'll then have to pass "--nodeps" when removing B, but that's something that I really want to avoid as it means loosing control over whether all dependencies are satisfied. So is there an alternative? "rpm -U A-1.0-1.x86_64.rpm" alone seems to fail with file conflicts, assuming "B" replaces some of "A"'s files. In a real scenario I tried, there was no mention of the fact that something that was essentially a newer version of the same package, was already installed. "yum upgrade A" (when the package is available on a repository) fails in a similar manner. "yum localinstall A-1.0-1.x86_64.rpm" is a bit smarter - it exists with a message like "Cannot install package A. It is obsoleted by installed package B". "yum downgrade A" (via repository) says something like "No Match for available package: A-1.0-1.x86_64.rpm". "yum localdowngrade A-1.0-1.x86_64.rpm" would seem to have the highest probability of success based on the above, except that there is no such command :-/ Any other ideas? - Toralf This e-mail, including any attachments and response string, may contain proprietary information which is confidential and may be legally privileged. It is for the intended recipient only. If you are not the intended recipient or transmission error has misdirected this e-mail, please notify the author by return e-mail and delete this message and any attachment immediately. If you are not the intended recipient you must not use, disclose, distribute, forward, copy, print or rely on this e-mail in any way except as permitted by the author.

2 2

Centos 7 and Network/Bridges
by Oliver Schad 17 Aug '14

17 Aug '14

Hi all, I'm a little bit confused about networking in Centos 7: I've copied my bridge setup from a Centos 6 for KVM networking to Centos 7. I changed the interface name to the new schema and I had expect that it would work. But: The Bridges didn't came up with the following log message: "Error: Device 'br61' is waiting for slaves before proceeding with activation" Config: DEVICE=br61 ONBOOT=yes TYPE=Bridge BOOTPROTO=none DELAY=3 STP=yes NM_CONTROLLED="no" Some more messages from the same type for other bridges. Sounds like a dependency problem. The bridges were created but they all were in state "down". The physical vlan tagged interfaces were not created, which should be bridged to those bridges above. Playing with STP and Delay didn't help. Because I saw no error, I removed the NetworkManager and it worked. Now when I reboot the system doesn't exit the SSH daemon before removing network interface so you end up in a hanging SSH connection. Ok, minor problem. Does somebody have similar dependency problems? Best Regards Oli

1 1

Re: [CentOS] Instaling LAMP on CentOS 7.x
by James B. Byrne 17 Aug '14

17 Aug '14

On Thu, August 14, 2014 11:26, John Plemons wrote: > If you are looking for another method for mySQL management, then > webmin.com works too. Download the RPM package, ver. 1.700, it will > allow you to do a great number of tasks remotely via the web. > I would advise that if you choose to use Webmin (and I do) then you should consider having it listen only on one IP address where more than one virtual IP is available. Further, the IP address and port (default is 10000) used by Webmin should be blocked by firewall settings to prevent direct access from the Internet. Instead you should use some form of tunnelling to establish a secure link to your LAN or to the host system itself. Even then you should only permit connections from known addresses from within your LAN. You should also enable and require TLS (https) connections for Webmin as otherwise privileged user credentials are exposed. There are configuration choices available in Webmin to do this but these present a chicken and egg problem as the default setup uses plain http. If this is an issue then you can get around this by manually changing the following configuration settings in /etc/webmin/miniserv.conf using an editor over an ssh connection after installing but before using Webmin: ssl=1 ssl_redirect=1 certfile=/etc/webmin/miniserv.pem # default set up with webmin install keyfile=/etc/webmin/miniserv.pem # default set up with webmin install Or you can use a one-time set of credentials and change them immediately after setting Webmin to use https. Regardless of how you set up Webmin's https access you also require this Perl module to get Webmin over https to work: yum install perl-Net-SSLeay For remote access the simplest tunnel I have discovered employs ssh and Firefox proxied to use SOCKSV on localhost port 2001 (127.0.0.1:2001). Something like: ssh -p 22 \ -o ServerAliveInterval=30 \ -o ServerAliveCountMax=10 \ user-id(a)internal.host.domain.tld \ -D 2001; As a refinement I set up a specially configured sshd service that also listens on ports 80 and 443. This permits me to change the ssh port from 22 to 80 or 443 whenever a network provider decides that ssh is not part of their service (Hello Westin. . .) If you are using PuTTY as the ssh client then you can do the same thing in the /Connection/SSH configuration by adding 2001 as a source port and selecting Dynamic as the destination type. You specify the ssh connection port in the Basic Options for the Session set up. HTH -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

centos6 selinux-policy-targeted not getting installed properly from kickstart
by Andrew Lau 17 Aug '14

17 Aug '14

Hi, I'm using this kickstart to build a centos AMI, https://gist.github.com/andrewklau/9c354a43976d951bdedd For some reason, selinux isn't getting installed correctly, on first boot: $ semodule -B libsemanage.semanage_link_sandbox: Could not access sandbox base file /etc/selinux/targeted/modules/tmp/base.pp. (No such file or directory). semodule: Failed! Proceeding to do anything else selinux related fails as well. The only solution has so far been to yum reinstall selinux-policy-targeted Anyone know why this could be happening? Thanks, Andrew

1 0

LVM Configuration
by Günther J. Niederwimmer 17 Aug '14

17 Aug '14

Hello, I miss the system-config-lvm tool for CentOS 7 can I found this on a other place? -- mit freundlichen Grüßen / best Regards, Günther J. Niederwimmer

6 8

Bind config question, centos 5.10
by Chuck Campbell 16 Aug '14

16 Aug '14

I must have something mis-configured in my bond setup. Things are working, but I'm getting TONS of this sort of stuff in my log: +2001:502:ad09::4#53: 1 Time(s) network unreachable resolving 'kns1.kuwaitnet.net/A/IN': +2001:503:231d::2:30#53: 1 Time(s) network unreachable resolving 'kns1.kuwaitnet.net/A/IN': +2001:503:a83e::2:30#53: 1 Time(s) network unreachable resolving 'kns1.kuwaitnet.net/AAAA/IN': +2001:503:231d::2:30#53: 1 Time(s) network unreachable resolving 'kns1.kuwaitnet.net/AAAA/IN': +2001:503:a83e::2:30#53: 1 Time(s) network unreachable resolving 'kns2.kuwaitnet.net/A/IN': +2001:503:231d::2:30#53: 1 Time(s) network unreachable resolving 'kns2.kuwaitnet.net/A/IN': +2001:503:a83e::2:30#53: 1 Time(s) network unreachable resolving 'kns2.kuwaitnet.net/AAAA/IN': +2001:503:231d::2:30#53: 1 Time(s) network unreachable resolving 'kns2.kuwaitnet.net/AAAA/IN': +2001:503:a83e::2:30#53: 1 Time(s) network unreachable resolving 'kns3.kuwaitnet.net/A/IN': +2001:503:231d::2:30#53: 1 Time(s) network unreachable resolving 'kns3.kuwaitnet.net/A/IN': +2001:503:a83e::2:30#53: 1 Time(s) network unreachable resolving 'kns3.kuwaitnet.net/AAAA/IN': +2001:503:231d::2:30#53: 1 Time(s) I'm not sure where to look. it may be the "any" in the named.conf lines below, but I'm not sure. My named.conf looks like this: options { listen-on port 53 { 127.0.0.1; any; }; # listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; // Those options should be used carefully because they disable port // randomization // query-source port 53; // query-source-v6 port 53; allow-query { localhost; any; }; allow-query-cache { localhost; any; }; # allow-query { localhost; }; # allow-query-cache { localhost; }; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; view localhost_resolver { match-clients { localhost; any; }; match-destinations { localhost; any; }; # match-clients { localhost; }; # match-destinations { localhost; }; recursion yes; include "/etc/named.rfc1912.zones"; }; -- ACCEL Services, Inc.| Specialists in Gravity, Magnetics | (713)993-0671 ph. | and Integrated Interpretation | (713)993-0608 fax 448 W. 19th St. #325| Since 1992 | (713)306-5794 cell Houston, TX, 77008 | Chuck Campbell | campbell(a)accelinc.com | President & Senior Geoscientist | "Integration means more than having all the maps at the same scale!"

3 2

← Newer
1
...
7
8
9
10
11
12
13
...
17
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2014