Discuss October 2015

discuss@lists.centos.org

140 participants
114 discussions

[Fwd: Re: Can one construct an IPTables rule to block on NS records?]
by James B. Byrne 07 Oct '15

07 Oct '15

Hit reply instead of reply all. This is for the list. -------------------------- Original Message -------------------------- Subject: Re: [CentOS] Can one construct an IPTables rule to block on NS records? From: "James B. Byrne" <byrnejb(a)harte-lyne.ca> Date: Wed, October 7, 2015 08:52 To: "John R Pierce" <pierce(a)hogranch.com> ---------------------------------------------------------------------- On Tue, October 6, 2015 13:36, John R Pierce wrote: > On 10/6/2015 6:34 AM, Leon Fauster wrote: >> --On Monday, October 05, 2015 10:46 AM -0400 "James B. >> Byrne"<byrnejb(a)harte-lyne.ca> wrote: >> >>> >So, is there any convenient way to construct an IPTables rule to >>> block >>> >all IPs associated with a given Domain Name server? >> IPs have the reversed lookup "assosiated" with a NS. >> >> What do you mean with "associated"? >> >> Do mean all IPs that this DNS server resolves to >> (A-Records in zone) (how do know for what zone >> the NS gives authoritative answers)? >> >> Or just the domain name server IPs of a given >> domain name (NS records)? >> >> What are you trying to solve? > > I wondered much the same. most NS servers won't allow you to do a > zone transfer to find all the A/AAAA records in a given domain. doing > a > reverse DNS lookup on every incoming/outgoing socket connection would > be > beyond painful, it would bring your network to its knees as the > reverse > DNS zones are often broken. > > > I am well aware of the costs of dns lookups which is why I worded the question as broadly as I did. In the end whois provided the necessary information. Thanks to all who replied and provided advice. Regards -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

OpenLDAP on Centos/RHEL 6 still without openssl support?
by Götz Reinicke - IT Koordinator 07 Oct '15

07 Oct '15

Hi, I heard that the RHEL/Centos rpm packages of OpenLDAP 2.4 should support openssl and file pathes to the certs/keys in the online config too. But from the RHEL Documentation it is stated, that still ONLY Mozilla NSS DB Files are supported. Can anyone comment on that? Is that true? Thanks and Regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 82420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

1 0

Can one construct an IPTables rule to block on NS records?
by James B. Byrne 06 Oct '15

06 Oct '15

This is the same origin that I reported on earlier. Apparently asking for an explanation of why they were probing our sites only encouraged them to make additional attempts. sshd: Authentication Failures: unknown (ip-173-201-178-18.ip.secureserver.net) 2 Time(s) unknown (ip-97-74-196-33.ip.secureserver.net) 2 Time(s) unknown (ip-97-74-202-95.ip.secureserver.net) 2 Time(s) root (ip-173-201-252-24.ip.secureserver.net) 1 Time(s) root (ip-72-167-249-196.ip.secureserver.net) 1 Time(s) root (ip-72-167-251-87.ip.secureserver.net) 1 Time(s) root (ip-97-74-121-108.ip.secureserver.net) 1 Time(s) root (ip-97-74-193-219.ip.secureserver.net) 1 Time(s) root (ip-97-74-206-13.ip.secureserver.net) 1 Time(s) unknown (ip-173-201-252-24.ip.secureserver.net) 1 Time(s) unknown (ip-72-167-249-196.ip.secureserver.net) 1 Time(s) unknown (ip-72-167-251-87.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-121-108.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-193-219.ip.secureserver.net) 1 Time(s) unknown (ip-97-74-206-13.ip.secureserver.net) 1 Time(s) Invalid Users: Unknown Account: 12 Time(s) So, is there any convenient way to construct an IPTables rule to block all IPs associated with a given Domain Name server? dig -x 173.201.178.18 ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4 <<>> -x 173.201.178.18 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1357 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4 ;; QUESTION SECTION: ;18.178.201.173.in-addr.arpa. IN PTR ;; ANSWER SECTION: 18.178.201.173.in-addr.arpa. 3600 IN PTR ip-173-201-178-18.ip.secureserver.net. ;; AUTHORITY SECTION: 201.173.in-addr.arpa. 66199 IN NS cns2.secureserver.net. 201.173.in-addr.arpa. 66199 IN NS cns1.secureserver.net. ;; ADDITIONAL SECTION: cns2.secureserver.net. 172800 IN A 216.69.185.100 cns2.secureserver.net. 172800 IN AAAA 2607:f208:303::64 cns1.secureserver.net. 172800 IN A 208.109.255.100 cns1.secureserver.net. 172800 IN AAAA 2607:f208:207::64 Like say, cns{1,2}.secureserver.net. Or an entire domain? Say secureserver.net. ? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

5 5

Off Topic - SSL reverse proxy and Mixed Content
by Clint Dilks 06 Oct '15

06 Oct '15

Hi, Not a CentOS specific issue, but I am a bit stuck as where I might ask for help so if anyone has any ideas please share :) I have a site that I want to work behind a reverse proxy (httpd) if using http:// everything works as expected. If using https:// some content is displayed but some content is blocked because of stylesheets and etc being requested via http rather https. I know that the long term solution should be to get all code changed so that it references //myserver/resource or /resource rather than http://myserver/resource but is there anything I can do with httpd to get this working until these changes are made ? Thanks for any suggestions. Below is my current VirtualHost config ProxyRequests On ProxyPreserveHost On ProxyTimeout 300 <Proxy *> Order allow,deny Allow from all </Proxy> ProxyPass / http://myserver/ ProxyPassReverse / http://myserver/

2 2

python setup.py ssl error
by Tim Dunphy 06 Oct '15

06 Oct '15

Hey guys, I'm trying to do a source install of s3cmd onto a centos 6.5 host. Because the version in the repo is a little old. So when I go to run the installer app with the command python2.7 setup.py install, I'm getting the following error: Installed /usr/local/lib/python2.7/site-packages/s3cmd-1.6.0-py2.7.egg Processing dependencies for s3cmd==1.6.0 Searching for six>=1.5 Reading https://pypi.python.org/simple/six/ Download error on https://pypi.python.org/simple/six/: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found! Couldn't find index page for 'six' (maybe misspelled?) Scanning index of all packages (this may take a while) Reading https://pypi.python.org/simple/ Download error on https://pypi.python.org/simple/: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found! No local packages or download links found for six>=1.5 error: Could not find suitable distribution for Requirement.parse('six>=1.5') I thought this might be a proxy issue of some kind, but I have several proxy values set in my environment: [root@ushapld00050 s3cmd-1.6.0]# env | grep -i proxy http_proxy=http://proxy.mycompany.com:80 https_proxy=http://proxy.mycompany.com:80 HTTPS_PROXY=http://proxy.mycompany.com:80 no_proxy=usushaplp461.mycompany.ge.com HTTP_PROXY=http://proxy.mycompany.com:80 Can someone please give me a heads up as to how to resolve this issue? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

1 0

CentOS 7 & dhclient hooks
by Tero M 06 Oct '15

06 Oct '15

Hi, I have CentOS 7 and I am trying to get dhclient hooks working. I have 1) created file /etc/dhcp/dhclient-enp4s0.conf, 2) created directories /etc/dhcp/{dhclient-enter-hooks.d, dhclient-exit-hooks.d}, 3) added line 'DHCLIENTARGS="-nc"' into file ifcfg-enp4s0 and 4) added file /etc/dhcp/dhclient-enter-hooks.d/test with line echo "executed enter-hook", 5) but I was not getting any output after executing ifdown enp4s0 && ifup enp4s0. However, I was able to do this with NetworkManagers dispather scripts, but I prefer old school dhclient hooks. :-) sincerely Tero M

2 1

Unable to install Chinese encoding package GBK
by Eric Dong 05 Oct '15

05 Oct '15

Hello, I found it in CentOS 7, the "yum install "Chinese support" is not available. And I need the Chinese simplified encoding with GBK support. Could please suggest how should I install this package in Centos 7? Thanks a lot. Regards, Eric

2 1

COMPILATION ERROR dev_t, into_t , no_tetc
by Samson 05 Oct '15

05 Oct '15

Hi, I have software in CentOS6, it is compiling very well. I decided to put the same software into CentOS7 but i am having this compilation errors below: In file included from /opt/TAFC/R14.1/include/jsystem.h:106:0, from BASIC_2.c:6: /opt/TAFC/R14.1/include/jedi.h:534:2: error: unknown type name ‘ino_t’ ino_t ino; // The i-node number of a file ^ /opt/TAFC/R14.1/include/jedi.h:535:2: error: unknown type name ‘dev_t’ dev_t dev; // The device number of a file ^ /opt/TAFC/R14.1/include/jedi.h:537:2: error: unknown type name ‘ino_t’ ino_t lockid1; In file included from /opt/TAFC/R14.1/include/jsystem.h:106:0, from BASIC_2.c:6: /opt/TAFC/R14.1/include/jedi.h:729:1: error: unknown type name ‘ino_t’ ino_t JRunFileIOGetIno(DPSTRUCT dp, struct jfd fdinfo ); ^ /opt/TAFC/R14.1/include/jedi.h:730:1: error: unknown type name ‘dev_t’ dev_t JRunFileIOGetDevice(DPSTRUCT dp, struct jfd fdinfo ); ^ /opt/TAFC/R14.1/include/jedi.h:732:1: error: unknown type name ‘ino_t’ ino_t JRunFileIOGetLock1(DPSTRUCT dp, struct jfd fdinfo ); Kindly Help. Thanks

1 0

CentOS-6.7 Kernel Panic
by James B. Byrne 05 Oct '15

05 Oct '15

This is likely (almost certainly) a hardware issue. However, I would like any guidance available on diagnosing the exact cause and remedy. We have a warm standby server then went off line over the weekend. The problem manifests itself as a kernel panic during the centos boot process. The issue appears to be with auto-mounting a number of pci devices. Unfortunately the error messages scroll off the monitor that I attached to it. This is some of the residue text that I though might have some use in diagnosing the problem. Kernel panic not syncing: Fatal exception Comm pciehpd Tainted: G DW -- ------- . . . drm_k,s_helper panic occurred switching back to text mode. At which point the system is non-responsive. Any ideas as to what is going on? Any other information I should be looking for? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

ExecShield in C6 or C7 kernels?
by Fred Smith 05 Oct '15

05 Oct '15

I'm trying to figure out if the stock kernels for Centos-6 and/or Centos-7 have ExecShield compiled in, and if so, if it is turned on by default. On my local C7 box I've been looking at/for indicators without a lot of success: /usr/lib/sysctl.d/00-system.conf. does not mention ExecShield at all. /proc/sys/kernel has no entries for exec_shield no mention of execshield in any of the files in /etc/grub.d So, as far as I can see, there are no settings that I would expect to force ExecShield to an ON setting. I DO see, in /proc/sys/kernel, a file named randomize_va_space, and it contains a value of "2". I've been googling (well, actually DuckDuckGo-ing) and most of the articles I find regarding ExecShield are 3-10 years old. I'd appreciate pointers/guides/info on ExecShield in C6 or C7. thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "And he will be called Wonderful Counselor, Mighty God, Everlasting Father, Prince of Peace. Of the increase of his government there will be no end. He will reign on David's throne and over his kingdom, establishing and upholding it with justice and righteousness from that time on and forever." ------------------------------- Isaiah 9:7 (niv) ------------------------------

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2015