Discuss April 2015

discuss@lists.centos.org

168 participants
187 discussions

Re: [CentOS] ClamAV reports a trojan
by James B. Byrne 19 Apr '15

19 Apr '15

On Sat, April 18, 2015 11:16, Jake Shipton wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 16/04/15 16:01, James B. Byrne wrote: >> This morning I discovered this in my clamav report from one of our >> imap servers: >> >> /usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: >> Unix.Trojan.MSShellcode-21 FOUND >> >> >> I have looked at this script and it appears to be part of the nmap >> distribution. It actually tests for irc backdoors. IRC is not >> used here and its ports are blocked by default both at the gateway >> and on all internal hosts. >> >> However, I none-the-less copied that file, removed namp, >> re-installed nmap from base, and diffed the file of the same name >> installed with nmap against the copy. They are identical. >> >> The question is: Do I have a problem here or a false positive? >> >> I am not sure why nmap is on that host but evidently I had some >> reason last October to use it from that server. In any case I am >> going to remove it for good, or at least until the reason I had it >> there reoccurs or is recalled to mind. >> > > Hi, > > I believe this is definitely a false positive. > > Our mail server (CentOS 6.6) is reporting the very same "Trojan" on > the very same file. I've already done our investigation and came to > the conclusion it is a false positive based on a verification of files > from RPMDB and also our intrusion detection system has not detected > any changed files in /usr/share/ since before and after said "trojan" > appeared. > > Top that with two people seeing the same thing at the same time in two > completely different machines/companies chances are high its a false > positive. > > Hope this helps set your mind at ease :-). > > Kind Regards, > Jake Shipton (JakeMS) > Twitter: @CrazyLinuxNerd > GPG Key: 0xE3C31D8F > GPG Fingerprint: 7515 CC63 19BD 06F9 400A DE8A 1D0B A5CF E3C3 1D8F > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.22 (GNU/Linux) > > iQEcBAEBAgAGBQJVMnVaAAoJEB0Lpc/jwx2P7s4H/2V++W499w2fAZPM8kjnKi9b > EBS0vl/oYAOVgzc3lo4y0CbY9GQtQ3258tISCeMGGOR/OjPYl3BqINsS1Qf0FGSw > FzNHWrlgas/bZO/HbTAzWbtxknRKIJiiYfBHqLL6s/r9WpOMsBvA2eVpkXsEZZoz > AWC0CFcrVsh7+Agqk46GyIsDn8ZpT+IymwMp+gKiqBv8e4uG5WjE8YRGBybscJgk > DAPZ9ZaSJpJNFkJ0tpAAgNkPO96lFv6l43nnm/IyTfKtd/1rWJ9ejb0ZjtZnP6Dr > xWdNyTjK39euHiVBP3pZ6ex8VKthph6b9FeferoQaGFxGvixk7epIihPbeEYqbg= > =lowP > -----END PGP SIGNATURE----- > > Thank you. We run aide on that box and it did not report any recent changes to that file. RPM and yum history corroborated the install date as being last October. We have concluded this is a false positive following a recent ClamAV update. We have none-the-less removed nmap from that host. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Re: [CentOS] yum install failiure - CentOS-7 - Base
by Richard 19 Apr '15

19 Apr '15

------------ Original Message ------------ > Date: Sunday, April 19, 2015 18:44:43 +0000 > From: Sarogahtyp <sarogahtyp(a)web.de> > To: centos(a)centos.org > Subject: [CentOS] yum install failiure - CentOS-7 - Base > > I have a running CentOS 6.5 64-bit system running and i like to > have a CentOS 7 chrooted system inside. > Ive done that chroot environment as described in > http://www.jefftk.com/p/32-bit-chroot-on-centos > > Now my problem ist that yum is not working as i suggested: > > bash-4.2# yum install sudo > Geladene Plugins: fastestmirror > http://mirror.centos.org/centos/7/os/i386/repodata/repomd.xml: > [Errno 14] HTTP Error 404 - Not Found > Anderer Spiegelserver wird versucht. > Yum is working fine, and gave the correct response "HTTP Error 404 - Not Found". If you look with a browser you'll see that there's no i386 directory under .../7/os/. I haven't been following this closely, but I don't believe that there was an RH 32-bit release of 7. A Centos group was looking into building one, but I'm not certain of its status.

2 2

yum install failiure - CentOS-7 - Base
by Sarogahtyp 19 Apr '15

19 Apr '15

I have a running CentOS 6.5 64-bit system running and i like to have a CentOS 7 chrooted system inside. Ive done that chroot environment as described in http://www.jefftk.com/p/32-bit-chroot-on-centos Now my problem ist that yum is not working as i suggested: bash-4.2# yum install sudo Geladene Plugins: fastestmirror http://mirror.centos.org/centos/7/os/i386/repodata/repomd.xml: [Errno 14] HTTP Error 404 - Not Found Anderer Spiegelserver wird versucht. One of the configured repositories failed (CentOS-7 - Base), and yum doesn't have enough cached data to continue. At this point the only safe thing yum can do is fail. There are a few ways to work "fix" this: 1. Contact the upstream for the repository and get them to fix the problem. 2. Reconfigure the baseurl/etc. for the repository, to point to a working upstream. This is most often useful if you are using a newer distribution release than is supported by the repository (and the packages for the previous distribution release still work). 3. Disable the repository, so yum won't use it by default. Yum will then just ignore the repository until you permanently enable it again or use --enablerepo for temporary usage: yum-config-manager --disable base 4. Configure the failing repository to be skipped, if it is unavailable. Note that yum will try to contact the repo. when it runs most commands, so will have to try and fail each time (and thus. yum will be be much slower). If it is a very temporary problem though, this is often a nice compromise: yum-config-manager --save --setopt=base.skip_if_unavailable=true failure: repodata/repomd.xml from base: [Errno 256] No more mirrors to try. http://mirror.centos.org/centos/7/os/i386/repodata/repomd.xml: [Errno 14] HTTP Error 404 - Not Found bash-4.2# any ideas ?

1 0

Custom named logwatch script
by Todor Petkov 19 Apr '15

19 Apr '15

Hello, I am using multiple files for logging activities for named daemon. The files are in /var/named/chroot/var/log/named/, for example /var/named/chroot/var/log/named/general.log. I am trying to make logwatch look into them. I have created /usr/share/logwatch/default.conf/logfiles/named.conf like this: LogFile = /var/named/chroot/var/log/named/general.log *ExpandRepeats *OnlyHost *ApplyStdDate Then I have changed /usr/share/logwatch/default.conf/services/named.conf like this: Title = "Named" LogFile = named $named_ip_lookup = No *RemoveHeaders When I run "logwatch --detail High --debug High --print --range All", I can see the log file is proceeded, but I don't see any reports. Can anyone point me to where my mistake is? Regards,

3 3

NFS4 automount and IPA (sssd) ?
by Günther J. Niederwimmer 19 Apr '15

19 Apr '15

hello, CentOS 7.1 IPA 4.1 sssd 1.2 om my system it is not possible to automount with a IPA config,, when I mount this on a command line it is working I have this Error in the logs automount[1718]: lookup_read_map: lookup(sss): getautomntent_r: No such file or directory. Is this from a broken sssd? have any a working configuration? The mount points are created but inside the mount points I have no files and Directories. thanks for a answer -- mit freundlichen Grüßen / best regards, Günther J. Niederwimmer

1 0

EBtables Problem
by Mehmet Allar 19 Apr '15

19 Apr '15

Hello , I have recently downloaded and setup Centos 7 1503 on a device and encountered a remote connection problem which I was only able to solve via removing ebtables package . After setup , I wanted go forward with IPtables instead of Firewalld , so remove firewalld and install iptables. After configuration and tests , I installed Fail2Ban ,(which brought ebtables with it ) and after reboot I was not able to connect to the device. After every reboot, I had to logon to the device locally , restarted iptables service and then I was able to connect remotely. I traced my steps backwards and figured ebtables was the problem. After removing it , I could connect remotely after reboots. IPtables service is running just fine. I want to use fail2ban , but I need to solve ebtables problem first. So, where sould I start? I couldn't locate ebtables logs . Thanks in advance.

3 4

Slow Printing HP-2025dn
by Mark LaPierre 19 Apr '15

19 Apr '15

Hey All, You know how sometimes you have a problem but you just live with it? Well I've got one of those problems. I have an HP-2025dn printer connected to my home network. When I print a plain text document containing the text, "this is a test", from my wife's Windows 7 machine using the text editor the print job finishes in less than 15 seconds. If I print two copies the second copy comes out so quickly after the first that the first one hasn't time enough to settle in the output tray before the next copy is already exiting the printer output slot. When I try to print from either my 32 bit or 64 bit Centos 6.6 machines it takes two minutes and 30 seconds, 2:30, to print the first copy and 2:15 to print the second copy. Again this is just a plain text message containing the words, "this is a test", printed from gedit. I've just been living with this for a while now but tonight I got out the stop watch and tried to fix this issue. [mlapier@peach ~]$ rpm -qa | grep ^hp hplip-common-3.12.4-6.el6.x86_64 hpijs-3.12.4-6.el6.x86_64 hplip-libs-3.12.4-6.el6.x86_64 [mlapier@peach ~]$ [mlapier@peach ~]$ rpm -qa | grep ^cup cups-pk-helper-0.0.4-12.el6.x86_64 cups-1.4.2-67.el6.x86_64 cups-libs-1.4.2-67.el6.i686 cups-libs-1.4.2-67.el6.x86_64 [mlapier@peach ~]$ When I select the option to combine multiple copies into one print job when printing from LibreOffice I always get multiple print jobs. I'm not offered that option when printing multiple copies from gedit so I can't speak to that. I do get multiple print jobs from gedit too. I did some googling but found nothing Linux related but I did find a couple of Windows references to slow printing with this printer on the HP site. They pretty much said that this is not the speediest printer on the face of the earth so stop whining. I don't remember when this problem first appeared but I do remember that I used to be able to print a document from LibreOffice before in less than one minute but now it takes several minutes to print the same document. I know, I'm rambling again. I would be more specific if I had any idea what the problem is. Does anyone out there have any idea how I can even determine where the problem is? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

2 1

ksoftirqd / centos7
by Johan Kooijman 18 Apr '15

18 Apr '15

Hi, Today I migrated a server form C6 to C7. The machine is dedicated for a couple of redis daemons. given the traffic etc, we see cpu0 being 100% in use immediately. No problem, had the same thing on the C6 server. So I pinned certain processes/irq's to other CPU's and made irqbalance was monitoring things. That did solve the issue in C6, but not this time. The links below contain the output of /proc/interrupts. As you can see CPU0 doesn't seem that busy http://pastebin.centos.org/23361/ http://pastebin.centos.org/23366/ The 2nd paste was about 60 seconds after the first one. Am I missing something here? This is a brand new C7 installation: [root@redis1 ~]# uname -a Linux redis1.gamebasics.lan 3.10.0-229.1.2.el7.x86_64 #1 SMP Fri Mar 27 03:04:26 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux Hardware is a brand new supermicro X9DRW board with onboard igb NIC's in use. Hope someone can help me! -- KR, Johan Kooijman

2 1

ClamAV reports a trojan
by James B. Byrne 18 Apr '15

18 Apr '15

This morning I discovered this in my clamav report from one of our imap servers: /usr/share/nmap/scripts/irc-unrealircd-backdoor.nse: Unix.Trojan.MSShellcode-21 FOUND I have looked at this script and it appears to be part of the nmap distribution. It actually tests for irc backdoors. IRC is not used here and its ports are blocked by default both at the gateway and on all internal hosts. However, I none-the-less copied that file, removed namp, re-installed nmap from base, and diffed the file of the same name installed with nmap against the copy. They are identical. The question is: Do I have a problem here or a false positive? I am not sure why nmap is on that host but evidently I had some reason last October to use it from that server. In any case I am going to remove it for good, or at least until the reason I had it there reoccurs or is recalled to mind. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

9 14

CentOS-announce Digest, Vol 122, Issue 10
by centos-announce-request＠centos.org 18 Apr '15

18 Apr '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEEA-2015:0855 CentOS 6 tzdata Enhancement Update (Johnny Hughes) 2. CEEA-2015:0855 CentOS 7 tzdata Enhancement Update (Johnny Hughes) 3. CEEA-2015:0855 CentOS 5 tzdata Enhancement Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 17 Apr 2015 20:58:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:0855 CentOS 6 tzdata Enhancement Update Message-ID: <20150417205811.GA52082(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:0855 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-0855.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: bb11ad2b0d763dc63ba347692f80597749c2e5d609c0a220773281cc646165d2 tzdata-2015c-2.el6.noarch.rpm 1cd31efa0e7c701059f2788a919edebffad88712cf14daa04b53ce5b181d77cf tzdata-java-2015c-2.el6.noarch.rpm x86_64: bb11ad2b0d763dc63ba347692f80597749c2e5d609c0a220773281cc646165d2 tzdata-2015c-2.el6.noarch.rpm 1cd31efa0e7c701059f2788a919edebffad88712cf14daa04b53ce5b181d77cf tzdata-java-2015c-2.el6.noarch.rpm Source: a8a236e0677ee108c9d3179b4358a3694c587e7904b44853a4ee9ef047b712a1 tzdata-2015c-2.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Fri, 17 Apr 2015 21:09:04 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:0855 CentOS 7 tzdata Enhancement Update Message-ID: <20150417210904.GA2569(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:0855 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-0855.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 1bf3cd5dd8aee374357aa15a820aa14dfd5c23a5de3e33c48387cbddb8d15085 tzdata-2015c-1.el7.noarch.rpm f14b8c39cce479da2d529cc4e32499184ff1b9fe894389952599f18b83c6c84f tzdata-java-2015c-1.el7.noarch.rpm Source: 151b89b427d7db50d39c1bb038a680305e9c0ec3789e0c8931e2942cffb8255c tzdata-2015c-1.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Fri, 17 Apr 2015 21:12:26 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2015:0855 CentOS 5 tzdata Enhancement Update Message-ID: <20150417211226.GA25683(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2015:0855 Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-0855.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 977bbb795cbd1777d0ac5dd68558905896f5c31a7717ab1737cdcf36408fcfc3 tzdata-2015c-1.el5.i386.rpm fae2f0b57d69a7974240b07974ccdb5336856d8d827a02f72c9dd71e17875d31 tzdata-java-2015c-1.el5.i386.rpm x86_64: d20ddd1890d3df6be0192c86b67a46684e32835f7a15b2200e03a44fd169a9d4 tzdata-2015c-1.el5.x86_64.rpm f4703acadb371aac5fc0a189c0c3c396fb12ace5b7ced929851a4a725b4b48ab tzdata-java-2015c-1.el5.x86_64.rpm Source: d791ea449383c825d38bc327e1fa60cd5c4a351fe5ae1e895f42682a5dadcfdc tzdata-2015c-1.el5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 122, Issue 10 ************************************************

1 0

← Newer
1
...
5
6
7
8
9
10
11
...
19
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2015