Discuss October 2015

discuss@lists.centos.org

140 participants
112 discussions

Can one construct an IPTables rule to block on NS records?
by James B. Byrne 06 Oct '15

06 Oct '15

This is the same origin that I reported on earlier. Apparently asking for an explanation of why they were probing our sites only encouraged them to make additional attempts. sshd: Authentication Failures: unknown (ip-173-201-178-18.ip.secureserver.net) 2 Time(s) unknown (ip-97-74-196-33.ip.secureserver.net) 2 Time(s) unknown (ip-97-74-202-95.ip.secureserver.net) 2 Time(s) root (ip-173-201-252-24.ip.secureserver.net) 1 Time(s) root (ip-72-167-249-196.ip.secureserver.net) 1 Time(s) root (ip-72-167-251-87.ip.secureserver.net) 1 Time(s) root (ip-97-74-121-108.ip.secureserver.net) 1 Time(s) root (ip-97-74-193-219.ip.secureserver.net) 1 Time(s) root (ip-97-74-206-13.ip.secureserver.net) 1 Time(s) unknown (ip-173-201-252-24.ip.secureserver.net) 1 Time(s) unknown (ip-72-167-249-196.ip.secureserver.net) 1 Time(s) unknown (ip-72-167-251-87.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-121-108.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-193-219.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-206-13.ip.secureserver.net) 1 Time(s) Invalid Users: Unknown Account: 12 Time(s) So, is there any convenient way to construct an IPTables rule to block all IPs associated with a given Domain Name server? dig -x 173.201.178.18 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4 <<>> -x 173.201.178.18 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1357 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4 ;; QUESTION SECTION: ;18.178.201.173.in-addr.arpa. IN PTR ;; ANSWER SECTION: 18.178.201.173.in-addr.arpa. 3600 IN PTR ip-173-201-178-18.ip.secureserver.net. ;; AUTHORITY SECTION: 201.173.in-addr.arpa. 66199 IN NS cns2.secureserver.net. 201.173.in-addr.arpa. 66199 IN NS cns1.secureserver.net. ;; ADDITIONAL SECTION: cns2.secureserver.net. 172800 IN A 216.69.185.100 cns2.secureserver.net. 172800 IN AAAA 2607:f208:303::64 cns1.secureserver.net. 172800 IN A 208.109.255.100 cns1.secureserver.net. 172800 IN AAAA 2607:f208:207::64 Like say, cns{1,2}.secureserver.net. Or an entire domain? Say secureserver.net. ? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

5 5

Off Topic - SSL reverse proxy and Mixed Content
by Clint Dilks 06 Oct '15

06 Oct '15

Hi, Not a CentOS specific issue, but I am a bit stuck as where I might ask for help so if anyone has any ideas please share :) I have a site that I want to work behind a reverse proxy (httpd) if using http:// everything works as expected. If using https:// some content is displayed but some content is blocked because of stylesheets and etc being requested via http rather https. I know that the long term solution should be to get all code changed so that it references //myserver/resource or /resource rather than http://myserver/resource but is there anything I can do with httpd to get this working until these changes are made ? Thanks for any suggestions. Below is my current VirtualHost config ProxyRequests On ProxyPreserveHost On ProxyTimeout 300 <Proxy *> Order allow,deny Allow from all </Proxy> ProxyPass / http://myserver/ ProxyPassReverse / http://myserver/

2 2

python setup.py ssl error
by Tim Dunphy 06 Oct '15

06 Oct '15

Hey guys, I'm trying to do a source install of s3cmd onto a centos 6.5 host. Because the version in the repo is a little old. So when I go to run the installer app with the command python2.7 setup.py install, I'm getting the following error: Installed /usr/local/lib/python2.7/site-packages/s3cmd-1.6.0-py2.7.egg Processing dependencies for s3cmd==1.6.0 Searching for six>=1.5 Reading https://pypi.python.org/simple/six/ Download error on https://pypi.python.org/simple/six/: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found! Couldn't find index page for 'six' (maybe misspelled?) Scanning index of all packages (this may take a while) Reading https://pypi.python.org/simple/ Download error on https://pypi.python.org/simple/: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found! No local packages or download links found for six>=1.5 error: Could not find suitable distribution for Requirement.parse('six>=1.5') I thought this might be a proxy issue of some kind, but I have several proxy values set in my environment: [root@ushapld00050 s3cmd-1.6.0]# env | grep -i proxy http_proxy=http://proxy.mycompany.com:80 https_proxy=http://proxy.mycompany.com:80 HTTPS_PROXY=http://proxy.mycompany.com:80 no_proxy=usushaplp461.mycompany.ge.com HTTP_PROXY=http://proxy.mycompany.com:80 Can someone please give me a heads up as to how to resolve this issue? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

1 0

CentOS 7 & dhclient hooks
by Tero M 06 Oct '15

06 Oct '15

Hi, I have CentOS 7 and I am trying to get dhclient hooks working. I have 1) created file /etc/dhcp/dhclient-enp4s0.conf, 2) created directories /etc/dhcp/{dhclient-enter-hooks.d, dhclient-exit-hooks.d}, 3) added line 'DHCLIENTARGS="-nc"' into file ifcfg-enp4s0 and 4) added file /etc/dhcp/dhclient-enter-hooks.d/test with line echo "executed enter-hook", 5) but I was not getting any output after executing ifdown enp4s0 && ifup enp4s0. However, I was able to do this with NetworkManagers dispather scripts, but I prefer old school dhclient hooks. :-) sincerely Tero M

2 1

Unable to install Chinese encoding package GBK
by Eric Dong 05 Oct '15

05 Oct '15

Hello, I found it in CentOS 7, the "yum install "Chinese support" is not available. And I need the Chinese simplified encoding with GBK support. Could please suggest how should I install this package in Centos 7? Thanks a lot. Regards, Eric

2 1

COMPILATION ERROR dev_t, into_t , no_tetc
by Samson 05 Oct '15

05 Oct '15

Hi, I have software in CentOS6, it is compiling very well. I decided to put the same software into CentOS7 but i am having this compilation errors below: In file included from /opt/TAFC/R14.1/include/jsystem.h:106:0, from BASIC_2.c:6: /opt/TAFC/R14.1/include/jedi.h:534:2: error: unknown type name ‘ino_t’ ino_t ino; // The i-node number of a file ^ /opt/TAFC/R14.1/include/jedi.h:535:2: error: unknown type name ‘dev_t’ dev_t dev; // The device number of a file ^ /opt/TAFC/R14.1/include/jedi.h:537:2: error: unknown type name ‘ino_t’ ino_t lockid1; In file included from /opt/TAFC/R14.1/include/jsystem.h:106:0, from BASIC_2.c:6: /opt/TAFC/R14.1/include/jedi.h:729:1: error: unknown type name ‘ino_t’ ino_t JRunFileIOGetIno(DPSTRUCT dp, struct jfd fdinfo ); ^ /opt/TAFC/R14.1/include/jedi.h:730:1: error: unknown type name ‘dev_t’ dev_t JRunFileIOGetDevice(DPSTRUCT dp, struct jfd fdinfo ); ^ /opt/TAFC/R14.1/include/jedi.h:732:1: error: unknown type name ‘ino_t’ ino_t JRunFileIOGetLock1(DPSTRUCT dp, struct jfd fdinfo ); Kindly Help. Thanks

1 0

CentOS-6.7 Kernel Panic
by James B. Byrne 05 Oct '15

05 Oct '15

This is likely (almost certainly) a hardware issue. However, I would like any guidance available on diagnosing the exact cause and remedy. We have a warm standby server then went off line over the weekend. The problem manifests itself as a kernel panic during the centos boot process. The issue appears to be with auto-mounting a number of pci devices. Unfortunately the error messages scroll off the monitor that I attached to it. This is some of the residue text that I though might have some use in diagnosing the problem. Kernel panic not syncing: Fatal exception Comm pciehpd Tainted: G DW -- ------- . . . drm_k,s_helper panic occurred switching back to text mode. At which point the system is non-responsive. Any ideas as to what is going on? Any other information I should be looking for? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

ExecShield in C6 or C7 kernels?
by Fred Smith 05 Oct '15

05 Oct '15

I'm trying to figure out if the stock kernels for Centos-6 and/or Centos-7 have ExecShield compiled in, and if so, if it is turned on by default. On my local C7 box I've been looking at/for indicators without a lot of success: /usr/lib/sysctl.d/00-system.conf. does not mention ExecShield at all. /proc/sys/kernel has no entries for exec_shield no mention of execshield in any of the files in /etc/grub.d So, as far as I can see, there are no settings that I would expect to force ExecShield to an ON setting. I DO see, in /proc/sys/kernel, a file named randomize_va_space, and it contains a value of "2". I've been googling (well, actually DuckDuckGo-ing) and most of the articles I find regarding ExecShield are 3-10 years old. I'd appreciate pointers/guides/info on ExecShield in C6 or C7. thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "And he will be called Wonderful Counselor, Mighty God, Everlasting Father, Prince of Peace. Of the increase of his government there will be no end. He will reign on David's throne and over his kingdom, establishing and upholding it with justice and righteousness from that time on and forever." ------------------------------- Isaiah 9:7 (niv) ------------------------------

3 3

ERROR Installing Cisco AnyConnect on Centos 6x
by CS DBA 02 Oct '15

02 Oct '15

Hi All; I've downloaded the Cisco AnyConnect tar.gz file for one of our clients, when I untar it and then run the vpn_install script in the vpnclient directory I get the below error. Thanks in advance for any help... / //# ./vpn_install// //Cisco Systems VPN Client Version 4.8.02 (0030) Linux Installer// //Copyright (C) 1998-2006 Cisco Systems, Inc. All Rights Reserved.// // //By installing this product you agree that you have read the// //license.txt file (The VPN Client license) and will comply with// //its terms.// // // //Directory where binaries will be installed [/usr/local/bin]// // //Automatically start the VPN service at boot time [yes]// // //In order to build the VPN kernel module, you must have the// //kernel headers for the version of the kernel you are running.// // // //Directory containing linux kernel source code [/lib/modules/2.6.32-573.7.1.el6.x86_64/build]// // //* Binaries will be installed in "/usr/local/bin".// //* Modules will be installed in "/lib/modules/2.6.32-573.7.1.el6.x86_64/CiscoVPN".// //* The VPN service will be started AUTOMATICALLY at boot time.// //* Kernel source from "/lib/modules/2.6.32-573.7.1.el6.x86_64/build" will be used to build the module.// // //Is the above correct [y]// // //Making module// //make -C /lib/modules/2.6.32-573.7.1.el6.x86_64/build SUBDIRS=/root/vpnclient modules// //make[1]: Entering directory `/usr/src/kernels/2.6.32-573.7.1.el6.x86_64'// //scripts/Makefile.build:49: *** CFLAGS was changed in "/root/vpnclient/Makefile". Fix it to use EXTRA_CFLAGS. Stop.// //make[1]: *** [_module_/root/vpnclient] Error 2// //make[1]: Leaving directory `/usr/src/kernels/2.6.32-573.7.1.el6.x86_64'// //make: *** [default] Error 2// //Failed to make module "cisco_ipsec.ko".// /

4 5

CentOS-announce Digest, Vol 128, Issue 1
by centos-announce-request＠centos.org 02 Oct '15

02 Oct '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2015:1852 Important CentOS 6 thunderbird Security Update (Johnny Hughes) 2. CESA-2015:1852 Important CentOS 5 thunderbird Security Update (Johnny Hughes) 3. CESA-2015:1852 Important CentOS 7 thunderbird Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 1 Oct 2015 21:36:10 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1852 Important CentOS 6 thunderbird Security Update Message-ID: <20151001213610.GA26999(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1852 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1852.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: bbc9d04f7fc104601d6e8569f62926c1fa3758de03a5045340649abb4105ef84 thunderbird-38.3.0-1.el6.centos.i686.rpm x86_64: 9b7cf38f1e8ef9f0d9f85e862186bb776d139a9db4e68e9022c876f22494c985 thunderbird-38.3.0-1.el6.centos.x86_64.rpm Source: 8bbf151af3c1aa1271db16833017c2dce3c0e990a7d6015c4d06d31ef15dca55 thunderbird-38.3.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 1 Oct 2015 21:53:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1852 Important CentOS 5 thunderbird Security Update Message-ID: <20151001215342.GA5214(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1852 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1852.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 2693fc3a1b9a426c07972e32662ce315cf9b46a15651b0ae03227e4abced099e thunderbird-38.3.0-1.el5.centos.i386.rpm x86_64: 5168eccb0987020d33f80af85f407501c723a399e6e457ca47066813635fbe54 thunderbird-38.3.0-1.el5.centos.x86_64.rpm Source: 6003067c8e410916dcfbee384502a1cc44230c0d984669eac0bf3536551e590f thunderbird-38.3.0-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Thu, 1 Oct 2015 21:53:20 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1852 Important CentOS 7 thunderbird Security Update Message-ID: <20151001215320.GA34305(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1852 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1852.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 6b68d2bb04d8846ddc2d6a2dbfd01945c8444c222c98bf2cdb7cfd43cc24d874 thunderbird-38.3.0-1.el7.centos.x86_64.rpm Source: de2c73cc73604af6f7b8a389b5f2f3b4ce3fc7e122427b67f2bb55d279333337 thunderbird-38.3.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 128, Issue 1 ***********************************************

1 0

Kickstarting bonded interfaces
by isdtor 02 Oct '15

02 Oct '15

Since CentOS 6.4, anaconda supports kickstarting from bonded interfaces. Has anyone managed to get this working? Bonding modes 1, 5, 6 work fine, and they do not need any particular support on the switch. But modes 0, 2-4 are a different story, no luck here. network --onboot yes --device bond0 --activate --bootproto static --bondslaves=eth0,eth1 --bondopts=mode=balance-rr,miimon=100 --ip 1.2.3.4 --netmask 255.255.255.0 --gateway 1.2.3.1 --nameserver 1.2.3.99 --hostname server network --onboot yes --device eth0 --activate No interactive shell becomes available on vc 2, all I see logged on vc 3 is that eth0 becomes active. Then bond0 becomes active, and eth0 is de-activated, and the machine stops pinging. When a network eth1 line is added, eth1 is also tried and then deactivated. I've had a little bit more success with 802.3ad. The machine remains pingable and I assume bond0 is online, but the install media cannot be mounted. To get there, the network ... eth0 line had to appear before the bond0 line in the kickstart file. Any advice?

1 0

yum does not update package list
by Kommander Mighty Aura 01 Oct '15

01 Oct '15

Hello. I have been trying to add rpmforge as a repository, but yum does not seem to be updating the package lists. I tried $ yum check-updates [...] Loading mirror speeds from cached hostfile * base: <mirror> * epel: <mirror> * extras: <mirror> * rpmforge: mirror.ate.info * updates: <mirror> and searched for any package available there, like i3 and mpv. It is still like the repository was never added. I imported the GPG key mentioned in the wiki, and installed <http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.…>, checked /etc/yum.repos.d/rpmforge.repo and it is enabled. Tried enabling rpmforge-extras and rpmforge-testing, but i noticed no difference. I am using CentOS 7.

4 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2015