Discuss October 2015

discuss@lists.centos.org

140 participants
112 discussions

CentOS-6 SSHD chroot SELinux problem
by James B. Byrne 09 Oct '15

09 Oct '15

I run a sshd host solely to allow employees to tunnel secure connections to our internal hosts. Some of which do not support encrypted protocols. These connections are chroot'ed via the following in /etc/ssh/sshd_config Match Group !wheel,!xxxxxx,yyyyy AllowTcpForwarding yes ChrootDirectory /home/yyyyy X11Forwarding yes Where external users belong to group yyyyy (primary). We have a problem with SELinux in that chrooted users cannot tunnel https requests unless SELinux is set to permissive (or turned off altogether). This problem does not evidence itself unless the account is chrooted. The output from audit2allow is this: sudo audit2allow -l -a #============= chroot_user_t ============== allow chroot_user_t cyphesis_port_t:tcp_socket name_connect; allow chroot_user_t user_home_t:chr_file open; #============= syslogd_t ============== #!!!! The source type 'syslogd_t' can write to a 'dir' of the following types: # var_log_t, var_run_t, syslogd_tmp_t, syslogd_var_lib_t, syslogd_var_run_t, innd_log_t, device_t, tmp_t, logfile, cluster_var_lib_t, cluster_var_run_t, root_t, krb5_host_rcache_t, cluster_conf_t, tmp_t allow syslogd_t user_home_t:dir write; My questions are: Do SE booleans settings exist that permit chrooted ssh access to forward https and log the activity? If so then what are they? If not, then have I made a configuration error in sshd_config? What is it? If not, then is this a defect in the SELinux policy? If not, then What are the implications of creating a custom policy to handle this using the output given above? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

recommended methods/software for videocasting
by ken 08 Oct '15

08 Oct '15

An acquaintance is considering videocasting speakers at a conference and using a Twitter product called Periscope. I'd like to recommend an open source solution. While I've never offered videos over the web, I have made audios available, and all it entailed was placing the file on the website and putting its url on a visible webpage. I wouldn't think any more than that is required for video. True? "Live" videocasting is likely a different animal. How is this accomplished? Also, which video formats are recommended-- FOSS of course preferred, but a FOSS format for which there are readily available client apps on the major platforms (MS, Android, OSX, Linux). Thanks for your expertise.

3 2

CentOS-announce Digest, Vol 128, Issue 2
by centos-announce-request＠centos.org 08 Oct '15

08 Oct '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEEA-2015:1863 CentOS 6 tzdata Enhancement Update (Johnny Hughes) 2. CEEA-2015:1863 CentOS 5 tzdata Enhancement Update (Johnny Hughes) 3. CEEA-2015:1863 CentOS 7 tzdata Enhancement Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 7 Oct 2015 22:45:04 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:1863 CentOS 6 tzdata Enhancement Update Message-ID: <20151007224504.GA44671(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:1863 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-1863.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: c9849a36e4b041658f626ddda0523574e8b5ccd19e777744d4257dc8947b8e29 tzdata-2015g-2.el6.noarch.rpm 659c9b6daca8804606cf246b800fed7321d0de88e61e4288ede85a12b6a0f03c tzdata-java-2015g-2.el6.noarch.rpm x86_64: c9849a36e4b041658f626ddda0523574e8b5ccd19e777744d4257dc8947b8e29 tzdata-2015g-2.el6.noarch.rpm 659c9b6daca8804606cf246b800fed7321d0de88e61e4288ede85a12b6a0f03c tzdata-java-2015g-2.el6.noarch.rpm Source: 3abae3f896ffbfddf60eb19aad3302b16f1bd4084ac98d4fcd34857017e00aa1 tzdata-2015g-2.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Wed, 7 Oct 2015 22:54:46 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:1863 CentOS 5 tzdata Enhancement Update Message-ID: <20151007225446.GA2883(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:1863 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-1863.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 1ab030200a4b8326ce536add751e0d62130a0cf0d5ceb3c55d5bbdb69dd1360f tzdata-2015g-1.el5.i386.rpm 3916a63973161e1baab95eca4f91c528df0ff30e3e65f5a665b72057d2fea6f8 tzdata-java-2015g-1.el5.i386.rpm x86_64: 9724fd4da7d4e606d0587d46d1c6abf9db51361d601f5b06379307039e7a3edc tzdata-2015g-1.el5.x86_64.rpm 55e0dd8e80657249398935bd9627703287eeb17f65e647e5b8a5b1242a320a5a tzdata-java-2015g-1.el5.x86_64.rpm Source: 2f675dd8beb518fe30acfb829784726758d322b195867ee095b060d1d8777fc8 tzdata-2015g-1.el5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Wed, 7 Oct 2015 23:00:27 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:1863 CentOS 7 tzdata Enhancement Update Message-ID: <20151007230027.GA52070(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:1863 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-1863.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3e234c5f002772a1602e41dd68b76797aee91dae4a0cec017b2ceab0f13dbba6 tzdata-2015g-1.el7.noarch.rpm 3a0cade89122a3ba3dfeb243a4be7428d6843012d2d813821f1cc8a89774e3d7 tzdata-java-2015g-1.el7.noarch.rpm Source: 2c267de5ffb17f1edf2f34f5ad568221ddbea335c6552ec63b7962d0786f9cae tzdata-2015g-1.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 128, Issue 2 ***********************************************

1 0

Software RAID1 Drives
by Matt 08 Oct '15

08 Oct '15

I have 3 4TB WD drives I want to put in a RAID1 array. Two WD4000FYYZ and One WD4000F9YZ All enterprise class but two are WD Re and one is WD Se. I ordered the first two thinking 2 drives in the raid array would be sufficient but later decided its a long drive to the server so I would rather have 3 drives and ordered a third in accidentally did not get EXACT same thing. Would there be ANY issues mixing these?

4 4

OT hardware issue: HP controller to 3rd party RAID
by m.roth＠5-cent.us 07 Oct '15

07 Oct '15

Hi, folks, Got an old HP box with a P800 Smart Array controller. The HP RAID box plugged into it's failing, and we got a new JetStor. Anyone know if we can just plug the JetStor in and set it to passthrough, or if we have to use the P800's firmware to set up the RAID, or other gotchas? I *think* we could use the RAID boxes firmware to build the RAID, but last resort would be passthrough, and Linux RAID. mark

3 13

ssmtp config for gmail
by Jerry Geis 07 Oct '15

07 Oct '15

I have tried to setup ssmtp to relay through gmail. root=my gmail address AuthUser=my gmail address AuthPass=my password FromLineOverride=YES mailhub=smtp.gmail.com:587 UseSTARTTLS=YES TLS_CA_FILE=/etc/pki/tls/certs/ca-bundle.crt I get this error: Authorization failed (534 5.7.14 https://support.google.com/mail/answer/78754 145sm16287775qhb.20 - gsmtp) I am not using two step verification at this time. I can sign into my account just fine. Am I missing a step? Thanks Jerry

2 2

Re: [CentOS] ssmtp config for gmail
by Richard 07 Oct '15

07 Oct '15

> Date: Wednesday, October 07, 2015 10:39:00 -0400 > From: Jerry Geis <geisj(a)pagestation.com> > > I have tried to setup ssmtp to relay through gmail. > > root=my gmail address > AuthUser=my gmail address > AuthPass=my password > FromLineOverride=YES > mailhub=smtp.gmail.com:587 > UseSTARTTLS=YES > TLS_CA_FILE=/etc/pki/tls/certs/ca-bundle.crt > > I get this error: > > Authorization failed (534 5.7.14 > https://support.google.com/mail/answer/78754 145sm16287775qhb.20 - > gsmtp) > > I am not using two step verification at this time. I can sign into > my account just fine. > > Am I missing a step? > > Thanks > > Jerry I believe that your issue is the fourth bullet point in on the support page they link to: -- Your mail app might not support the latest security standards. Learn how to allow less secure apps access to your account. If you aren't using OAuth 2.0 (which you aren't in your context): <https://developers.google.com/gmail/oauth_overview?hl=en> you need to set your gmail account to accept connections from "less secure apps". <https://support.google.com/accounts/answer/6010255?hl=en>

1 0

Systemd spends 6 min. to startup a host
by C.L. Martinez 07 Oct '15

07 Oct '15

Hi all, I have a strange behavior with a CentOS7 host (fully patched). I have configured nics as old style format: ifcfg- ... due to I need to use openvswitch for my vms. All works well, except when I reboot this server. Systemd spends 6 min. to startup this host!!! .. It stops with: "A start job is running for LSB: Raise network ...". Are not supposed that systemd startups hosts more faster?? ok, is it possible to fix this?? Thanks.

8 17

[Fwd: Re: Can one construct an IPTables rule to block on NS records?]
by James B. Byrne 07 Oct '15

07 Oct '15

Hit reply instead of reply all. This is for the list. -------------------------- Original Message -------------------------- Subject: Re: [CentOS] Can one construct an IPTables rule to block on NS records? From: "James B. Byrne" <byrnejb(a)harte-lyne.ca> Date: Wed, October 7, 2015 08:52 To: "John R Pierce" <pierce(a)hogranch.com> ---------------------------------------------------------------------- On Tue, October 6, 2015 13:36, John R Pierce wrote: > On 10/6/2015 6:34 AM, Leon Fauster wrote: >> --On Monday, October 05, 2015 10:46 AM -0400 "James B. >> Byrne"<byrnejb(a)harte-lyne.ca> wrote: >> >>> >So, is there any convenient way to construct an IPTables rule to >>> block >>> >all IPs associated with a given Domain Name server? >> IPs have the reversed lookup "assosiated" with a NS. >> >> What do you mean with "associated"? >> >> Do mean all IPs that this DNS server resolves to >> (A-Records in zone) (how do know for what zone >> the NS gives authoritative answers)? >> >> Or just the domain name server IPs of a given >> domain name (NS records)? >> >> What are you trying to solve? > > I wondered much the same. most NS servers won't allow you to do a > zone transfer to find all the A/AAAA records in a given domain. doing > a > reverse DNS lookup on every incoming/outgoing socket connection would > be > beyond painful, it would bring your network to its knees as the > reverse > DNS zones are often broken. > > > I am well aware of the costs of dns lookups which is why I worded the question as broadly as I did. In the end whois provided the necessary information. Thanks to all who replied and provided advice. Regards -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

OpenLDAP on Centos/RHEL 6 still without openssl support?
by Götz Reinicke - IT Koordinator 07 Oct '15

07 Oct '15

Hi, I heard that the RHEL/Centos rpm packages of OpenLDAP 2.4 should support openssl and file pathes to the certs/keys in the online config too. But from the RHEL Documentation it is stated, that still ONLY Mozilla NSS DB Files are supported. Can anyone comment on that? Is that true? Thanks and Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2015