Discuss May 2015

discuss@lists.centos.org

140 participants
130 discussions

KVM Questions
by Paul R. Ganci 11 May '15

11 May '15

I have a system with two CentOS 7.1 guests. When I created the VMs I did not have enough storage space in the default location /var/lib/libvirt/images so I moved the default location to a directory /home/vmimages. While this configuration is functional I regret creating a new storage pool in /home. I would like to create a separate partition to place the VM images removing them from their present /home/images location. The /home partition is presently empty other than the VM images directory so I can easily steal space from it (using only ~4% of 500GB). However, I have a problem. Namely /home is an XFS file system so I cannot shrink the partition in order to make space for the desired new VM images partition. I was wondering if this procedure might work to do what I desire: 1.) Shutdown the VMs 2.) Archive the VM image directory /home/vmimages to a network drive (don't have space locally other than on /home) 3.) Use parted or fdisk to delete present /home partition 4.) Use parted or fdisk to re-create smaller/home partition and new /vm-images partition 5.) Create XFS file system on /home and /vm-images 6.) Extact VM image directory archive into /vm-images 7.) Use virt-manager to change default location of images to /vm-images Is there any chance that after all this the VMs would actually start up again especially after a re-boot? Thanks. -- Paul (ganci(a)nurdog.com) (303)257-5208

4 7

mariadb fails to start under C7
by Tim Dunphy 11 May '15

11 May '15

Hey all, I just unstalled MariaDB version 10 from the mariadb repositories under a CentOS 7 host. The install went fine! [root@nfsdb1 ~]# rpm -qa | grep -i mariadb MariaDB-common-10.0.19-1.el7.centos.x86_64 MariaDB-server-10.0.19-1.el7.centos.x86_64 MariaDB-client-10.0.19-1.el7.centos.x86_64 MariaDB-shared-10.0.19-1.el7.centos.x86_64 However, when I go to start up the service, I'm getting this error: [root@nfsdb1 ~]# systemctl start mariadb.service Failed to issue method call: Unit mariadb.service failed to load: No such file or directory. Can someone please let me know how to start this up? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

7 14

Re: [CentOS] openvpn and firewalld
by James B. Byrne 09 May '15

09 May '15

On Fri, May 8, 2015 12:06, Bowie Bailey wrote: > > Replying to myself here, I finally figured out how to do it with > direct rules. Firewalld on CentOS 7 defaults to a drop rule for > the FORWARD chain which my previous server didn't have. So I > needed to put the rules in the FORWARD chain rather than the > INPUT chain. > This does not make sense to me. The INPUT, OUTPUT and FORWARD chains are swimlanes. A packet starts out, following PREROUTING, in exactly one of these three and never leaves it. It can JUMP to shared chains but it will always return to its original chain until ACCEPTed, DROPped or REJECTed. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Centos 7 and qemu-kvm
by Jerry Geis 09 May '15

09 May '15

Still trying to migrate to CentOS 7. I used to use qemu-kvm on centos 6. tried to compile on centos 7 and get error about undefined reference to timer_gettime searching for that says basically use virt-manager so I installed virt-manager - I have file images and those work. some times I do directly to a USB connected disk. I do not see how to do that in virt-manager ??? How do I use a device like /dev/sdh as my disk??? Thanks, Jerry

4 3

Re: [CentOS] Q: respecting .ssh/id_rsa
by James B. Byrne 09 May '15

09 May '15

On Fri, May 8, 2015 13:23, m.roth(a)5-cent.us wrote: > Devin Reade wrote: >> --On Friday, May 08, 2015 09:58:32 AM -0400 "James B. Byrne" >> <byrnejb(a)harte-lyne.ca> wrote: >> >>> While attempting to debug something else I ran across this: >>> >>> ssh -vvv somehost >>> . . . >>> debug1: Connection established. >>> debug1: permanently_set_uid: 0/0 >>> debug1: identity file /root/.ssh/identity type -1 >>> debug1: identity file /root/.ssh/identity-cert type -1 >>> debug3: Not a RSA1 key file /root/.ssh/id_rsa. >>> debug2: key_type_from_name: unknown key type '-----BEGIN' >>> debug3: key_read: missing keytype >>> debug3: key_read: missing whitespace >>> >>> [snip] >>> >>> The password-less connections complete in any case but I am >>> perplexed >>> as to what is the problem with the root identity key that ssh is >>> reporting. >>> >>> Can anyone explain to me what this means? >> >> IIRC there was a time when id_rsa could refer to either an >> RSA1 key or RSA2 key. I believe ssh is first trying to read >> the file as an RSA1 key, finding problems, and then opening it >> as an RSA2 key. In fact, if you scroll down from there you probably >> see a line like the following: >> >> debug1: identity file /home/somebody/.ssh/id_rsa type 1 >> >> which is a successful read (note the type is 1 and not -1). >> >> In other words, it's nothing to worry about. The messages are >> a bit different under CentOS 7 (I suspect you're running CentOS 6 >> on the client), but they say about the same thing. > <snip> > I would *strongly* recommend editing your /etc/ssh/sshd_config, and > comment or delete the fallback, and replace it, like: > #Protocol 2,1 > Protocol 2 > > That way, it won't even try. > > mark > If the problem is indeed a lookup on id_rsa for an rsa1 type key then the setting you suggest does not prevent it. All of the sshd_conf files in our CentOS-6 systems already have that set and I believe that it is the default setting for the distro. # Disable legacy (protocol version 1) support in the server for new # installations. In future the default will change to require explicit # activation of protocol 1 Protocol 2 However, your suggestion causes me to consider whether or not there is a similar setting for ssh_config. The problematic key lookup occurs on the client side of the connection. It seems unlikely that sshd server settings on client host would have much of an effect. Indeed there is no reason to suppose that sshd is even present. Respecting the other recommendations offered in various messages: These are, insofar as I can determine, already in effect. There are no AVCs reported, the ssh connections complete as expected, and there are no odd messages in /var/log/secure or /var/log/messages. The user in this case is root. The problem being debugged was automated internal network rsync transfers over ssh. All permissions, contexts and ownerships of the associated files and directories are as they were originally created by ssh-keygen. It seems to me likely that these messages are the result of code in the client application which simply reports and ploughs on when it runs into a file format it is not expecting leaving the final determination of whether or not the encounter is an error condition to somewhere later in the program. Thank you for the guidance. P.S. Also thanks for the info on SYN in ACK, . . ., SYN. Due to the problems some on the list are having with my emails I now find myself avoiding simple acknowledgements of help given. But it is gratefully received nonetheless. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Re: [CentOS] Backup PC or other solution
by James B. Byrne 08 May '15

08 May '15

On Fri, May 8, 2015 07:59, Timothy Murphy wrote: > Sorin Srbu wrote: >> Yeah, well, but it's free. >> I'm not sure you can complain too much in that case. 8-) > > I find this comment, often made, completely unacceptable. > The implication is that inferior code is OK > if the developer is not being paid. > > (Actually, the premise is probably nonsense, > as most Linux developers _are_ paid, even if formally > their pay is not specifically for Linux development. > But presumably the company that pays them believes that > it is of value to the company to have a Linux developer on board.) > > But is Linux code in fact inferior to code produced by Microsoft, say? > I don't think so. > And I don't think Linux developers are less keen to improve their > code. > Just the opposite. > > The difference is that a large portion of the FOSS corpus, if not a preponderant majority, is ultimately dependent upon the interest of the people responsible for its existance and not the people using it. Once a project's core team either loses enthusiasm for something, or have otherwise moved on in life, their project oft-times is left without any meaningful support. If a project is backed/picked up by a corporation, say Redhat or Oracle, or a foundation, say Apache or LibreOffice, then it may have a future more or less independent of any single individual or group. Otherwise it does not. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 4

Best way to integrate CentOS in Windows AD environment
by Alfred von Campe 08 May '15

08 May '15

We currently use a combination of Kerberos and NIS to manage users on our CentOS 6 systems in a Windows AD environment. NIS is provided by Windows Services for UNIX (or something named similarly), which has some issues, and is also not going to be supported by Microsoft in the future. NIS supplies the passed file as well as the auto mount map for home directories as shown by this excerpt from our /etc/nsswitch.conf file: passwd: files nis shadow: files nis group: files nis Our systems are configured using something similar to the following in our Kickstart config file: authconfig --enablemd5 --passalgo=sha512 --enablenis —nisdomain=XXX \ --nisserver=nis.XXX.com,nis2.XXX.com --useshadow --enablekrb5 \ --krb5realm=XXX.COM --krb5kdc=ldap.XXX.com --krb5adminserver=ldap.XXX.com <http://ldap.xxx.com/> where nis1 and nis2 are the local AD domain controllers. With this configuration, any user can log into any CentOS system, and their home directory is automatically mounted over NFS with autofs. This works great, except for when the network is down and/or the home directory NFS server is not available, when the systems pretty much just hang. It’s also only good for workstations and servers, but not laptops that may not be on the network. I would like to move to CentOS 7 and a model where we don’t use NIS at all, the users and (local) home directories are automatically created on login using the UID stored on the LDAP server. Before I re-invent the wheel, has somebody done this already? If so, can you share the authconfig line from your Kickstart file? To summarize, I’d like to: Use LDAP/Kerberos provided by Windows AD servers to authenticate users Automatically create accounts/home directories upon first login Not require the system to be on the network (provided the user has logged in at least once to create the account locally) Thanks in advance for any suggestions/examples. Alfred

3 2

openvpn and firewalld
by Bowie Bailey 08 May '15

08 May '15

I am trying to build a new openvpn server based on CentOS7. Everything is working fine as long as I disable firewalld. With firewalld enabled, I can connect to the vpn and ping the machines on the network, but I am unable to ssh to them. What I had on my old server with iptables was two simple rules: -A RH-Firewall-1-INPUT -s <localnet>/255.255.0.0 -d <vpnnet>/255.255.0.0 -j ACCEPT -A RH-Firewall-1-INPUT -s <vpnnet>/255.255.0.0 -d <localnet>/255.255.0.0 -j ACCEPT This allowed all traffic to flow between my vpn subnet and the local network. How can I duplicate this behavior with firewalld? I even tried using the --direct option to put in these same rules without success. Although I may not have done it quite right -- firewalld seems to have added 20 extra chains to the rule structure and I'm not sure exactly where I should put these rules. Unfortunately, I cannot easily debug this while I'm at the office, but if you can give me any suggestions, I can try them out when I get home tonight. Thanks! -- Bowie

1 1

Re: [CentOS] Apache 2.2 itk - 404 not found
by Richard 08 May '15

08 May '15

More specifically -- when you get the "not found" in the browser there should be an entry logged in the error log. E.g., tail the error log, issue a request, and see what you see. The error log entry will show the details of what is being requested and generally gives strong hints as to why it can't be found (pathing, access, etc.). If you don't get an entry in the error log that you are looking at then double check your configuration to make certain you are are looking at the one for the apache instance in question. You don't need to change the debug level for what you need for this. ------------ Original Message ------------ > Date: Friday, May 08, 2015 08:12:02 AM -0400 > From: John <tuxfed(a)gmail.com> > > On 15-05-07 04:52 PM, Richard wrote: >> What is showing in the apache error log? >> >> >> ------------ Original Message ------------ >>> Date: Thursday, May 07, 2015 04:28:16 PM -0400 >>> From: John <tuxfed(a)gmail.com> >>> >>> Directories permissions: 755 Files permissions: 644 >>> >>> On 15-05-07 04:21 PM, John wrote: >>>> I forgot to mention it. All the files under /var/html are owned >>>> by apache:apache >>>> >>>> On 15-05-07 04:07 PM, Eric Lehmann wrote: >>>>> Have you checked the file rights under your document root ? >>>>> Your apache group need reading right. >>>>> Am 07.05.2015 21:42 schrieb "John" <tuxfed(a)gmail.com>: >>>>> >>>>>> Hi all, Freshly installed apache 2.2 with httpd-itk (from >>>>>> epel). When I try to access apache's document root from a >>>>>> browser on local network, it >>>>>> always serve me the Apache welcome page, even if I have a >>>>>> index.html and a >>>>>> phpinfo.php file in the /var/www/html folder. If point the >>>>>> browser specifically to http://server/index.html, I get a '404 >>>>>> Not found error'. >>>>>> I'm running CentOS 6.6 x86_64. I've been googling this for a >>>>>> couple of days >>>>>> and found nothing. Here's a few output that might be useful: >> >> ------------ End Original Message ------------ >> >> >> _______________________________________________ >> CentOS mailing list >> CentOS(a)centos.org >> http://lists.centos.org/mailman/listinfo/centos >> > I've set log level to debug so there is a lot of info but no major > error: > [Thu May 07 15:09:37 2015] [info] Init: Seeding PRNG with 256 > bytes of entropy > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(253): > shmcb_init allocated 512000 bytes of shared memory > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(272): for > 511920 bytes (512000 including header), recommending 32 subcaches, > 133 indexes each > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(306): > shmcb_init_memory choices follow > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(308): > subcache_num = 32 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(310): > subcache_size = 15992 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(312): > subcache_data_offset = 3208 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(314): > subcache_data_size = 12784 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(316): > index_num = 133 > [Thu May 07 15:09:37 2015] [info] Shared memory session cache > initialised > [Thu May 07 15:09:37 2015] [info] Init: Initializing (virtual) > servers for SSL > [Thu May 07 15:09:37 2015] [info] mod_ssl/2.2.15 compiled against > Server: Apache/2.2.15, Library: OpenSSL/1.0.1e-fips > [Thu May 07 15:09:37 2015] [notice] Digest: generating secret for > digest authentication ... > [Thu May 07 15:09:37 2015] [notice] Digest: done > [Thu May 07 15:09:37 2015] [debug] util_ldap.c(2089): LDAP merging > Shared Cache conf: shm=0x7fd669f49f98 rmm=0x7fd669f49ff0 for > VHOST: backuppc.localdomain > [Thu May 07 15:09:37 2015] [debug] util_ldap.c(2089): LDAP merging > Shared Cache conf: shm=0x7fd669f49f98 rmm=0x7fd669f49ff0 for > VHOST: webERP > [Thu May 07 15:09:37 2015] [debug] util_ldap.c(2089): LDAP merging > Shared Cache conf: shm=0x7fd669f49f98 rmm=0x7fd669f49ff0 for > VHOST: localhost > [Thu May 07 15:09:37 2015] [info] APR LDAP: Built with OpenLDAP > LDAP SDK > [Thu May 07 15:09:37 2015] [info] LDAP: SSL support available > [Thu May 07 15:09:37 2015] [info] Init: Seeding PRNG with 256 > bytes of entropy > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(253): > shmcb_init allocated 512000 bytes of shared memory > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(272): for > 511920 bytes (512000 including header), recommending 32 subcaches, > 133 indexes each > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(306): > shmcb_init_memory choices follow > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(308): > subcache_num = 32 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(310): > subcache_size = 15992 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(312): > subcache_data_offset = 3208 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(314): > subcache_data_size = 12784 > [Thu May 07 15:09:37 2015] [debug] ssl_scache_shmcb.c(316): > index_num = 133 > [Thu May 07 15:09:37 2015] [info] Shared memory session cache > initialised > [Thu May 07 15:09:37 2015] [info] Init: Initializing (virtual) > servers for SSL > [Thu May 07 15:09:37 2015] [info] mod_ssl/2.2.15 compiled against > Server: Apache/2.2.15, Library: OpenSSL/1.0.1e-fips > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24112 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24112 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24113 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24113 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24114 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24114 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24115 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24115 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24116 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24116 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24117 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24117 for (*) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24118 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24118 for (*) > [Thu May 07 15:09:37 2015] [notice] Apache/2.2.22 (Unix) DAV/2 > PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips configured -- > resuming normal operations > [Thu May 07 15:09:37 2015] [info] Server built: Aug 18 2014 > 14:54:53 > [Thu May 07 15:09:37 2015] [debug] itk.c(1105): AcceptMutex: > sysvsem (default: sysvsem) > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1833): proxy: > grabbed scoreboard slot 0 in child 24119 for worker proxy:reverse > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1852): proxy: > worker proxy:reverse already initialized > [Thu May 07 15:09:37 2015] [debug] proxy_util.c(1949): proxy: > initialized single connection worker 0 in child 24119 for (*) > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos ------------ End Original Message ------------

3 2

Re: [CentOS] Apache 2.2 itk - 404 not found
by Richard 08 May '15

08 May '15

What is showing in the apache error log? ------------ Original Message ------------ > Date: Thursday, May 07, 2015 04:28:16 PM -0400 > From: John <tuxfed(a)gmail.com> > > Directories permissions: 755 Files permissions: 644 > > On 15-05-07 04:21 PM, John wrote: >> I forgot to mention it. All the files under /var/html are owned >> by apache:apache >> >> On 15-05-07 04:07 PM, Eric Lehmann wrote: >>> Have you checked the file rights under your document root ? >>> Your apache group need reading right. >>> Am 07.05.2015 21:42 schrieb "John" <tuxfed(a)gmail.com>: >>> >>>> Hi all, Freshly installed apache 2.2 with httpd-itk (from >>>> epel). When I try to access apache's document root from a >>>> browser on local network, it >>>> always serve me the Apache welcome page, even if I have a >>>> index.html and a >>>> phpinfo.php file in the /var/www/html folder. If point the >>>> browser specifically to http://server/index.html, I get a '404 >>>> Not found error'. >>>> I'm running CentOS 6.6 x86_64. I've been googling this for a >>>> couple of days >>>> and found nothing. Here's a few output that might be useful: ------------ End Original Message ------------

2 1

← Newer
1
...
7
8
9
10
11
12
13
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss May 2015