Discuss July 2015

discuss@lists.centos.org

116 participants
114 discussions

Re: [CentOS] Prompt for chrooted users
by James B. Byrne 07 Jul '15

07 Jul '15

On Mon, July 6, 2015 15:47, m.roth(a)5-cent.us wrote: > James B. Byrne wrote: >> We have a requirement to allow ssh access to a server in order to >> provide a secure link to one of our legacy systems. I would like to >> chroot these accounts. >> >> I have this working except for one small detail, the user's prompt >> in >> the ssh session. Each user has their shell set to /bin/bash in >> /etc/passwd. However, instead of getting the prompt defined in >> their >> .bash_profiles we see this: >> >> -bash-4.1$ >> >> when we are expecting this: >> >> [username@hostname dir]$ >> >> So, before I go messing around moving files I would some information >> from you as tio what I have overlooked. Do I need to move something >> like etc/passwd and /etc/group into the chroot/etc? > > When ssh'ing into the chrooted directories, where's their > /home/<user>? > I'd set the prompt in ~/.bash_profile. > > mark > > It appears that the user profile .bash_profile is not being called at all which no doubt is the root problem. Any ideas as to why this is not happening? Is the -l switch for bash not being used for some reason? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

USB stick query
by Timothy Murphy 07 Jul '15

07 Jul '15

I have a working CentOS-7 machine. I want to install grub2 on a USB stick (without altering my present system in any way) so that I can boot the present system from the USB stick. Could some kind (and expert) soul explain precisely what to do. If it were possible to boot other systems on the computer as well that would be an added bonus. I did google for this, but all the sites I saw wanted to do more than I am asking. I also tried "sudo grub2-install /dev/sdb" but for some reason this did not do the trick. -- Timothy Murphy gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin

3 7

CentOS-announce Digest, Vol 125, Issue 2
by centos-announce-request＠centos.org 07 Jul '15

07 Jul '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2015:1207 Critical CentOS 5 firefox Security Update (Johnny Hughes) 2. CESA-2015:1207 Critical CentOS 6 firefox Security Update (Johnny Hughes) 3. CESA-2015:1207 Critical CentOS 7 firefox Security Update (Johnny Hughes) 4. CentOS Linux for AArch64 Beta2 (Jim Perrin) ---------------------------------------------------------------------- Message: 1 Date: Mon, 6 Jul 2015 14:50:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1207 Critical CentOS 5 firefox Security Update Message-ID: <20150706145033.GA20774(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1207 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1207.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 45f2fad91b980fd2cc21a9752193b8dbee248a1e0436ccd0eb7d8d4b297f476a firefox-38.1.0-1.el5.centos.i386.rpm x86_64: 45f2fad91b980fd2cc21a9752193b8dbee248a1e0436ccd0eb7d8d4b297f476a firefox-38.1.0-1.el5.centos.i386.rpm dc491eab91a8cad5f0678902bad27f9e2b3966892ea79151ac0ee50b77f972fa firefox-38.1.0-1.el5.centos.x86_64.rpm Source: 03dd6f3a55de8b5349cc18ca8887da8e527190591eadcb80f688b30ca11f1f56 firefox-38.1.0-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Mon, 6 Jul 2015 16:47:20 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1207 Critical CentOS 6 firefox Security Update Message-ID: <20150706164720.GA49622(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1207 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1207.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: b5882e3695d34f9318074874468b2c427eade13ad481866ae314f6edcadfb7db firefox-38.1.0-1.el6.centos.i686.rpm x86_64: b5882e3695d34f9318074874468b2c427eade13ad481866ae314f6edcadfb7db firefox-38.1.0-1.el6.centos.i686.rpm b7f8d8f7fe4dde69f71355177bd859e08551a11513e7f293ef7bb6beb094eb13 firefox-38.1.0-1.el6.centos.x86_64.rpm Source: 05d27d1ca3378334c19eeb53bc8b5a6a7a64dbae179a17da7841753d596bd430 firefox-38.1.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Mon, 6 Jul 2015 17:16:58 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2015:1207 Critical CentOS 7 firefox Security Update Message-ID: <20150706171658.GA50235(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2015:1207 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-1207.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f61ea750633f5b444eaae0e52cbc430febc0a68534166659d7ac8fcfac2c89e1 firefox-38.1.0-1.el7.centos.i686.rpm 2a8f94561cb77d12c8b02adcb7c689a36cd36b4b9f9e91328a5e4d287491049c firefox-38.1.0-1.el7.centos.x86_64.rpm Source: 1b7b07cf869c0b06c2b23f919d6ea9bab648c270f56ceea33da8c7453c80ab69 firefox-38.1.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Mon, 06 Jul 2015 12:29:17 -0500 From: Jim Perrin <jperrin(a)centos.org> To: centos-announce(a)centos.org, arm-dev(a)centos.org Subject: [CentOS-announce] CentOS Linux for AArch64 Beta2 Message-ID: <559ABAED.7030105(a)centos.org> Content-Type: text/plain; charset=utf-8 We are pleased to announce the second public beta release of CentOS Linux 7 for the AArch64 platform. This release contains fixes and code updates provided in the RHELSA source code recently published to git.centos.org as well as rolling previous updates into the installer. We intend to have a 'Gold' release very soon unless a blocker bugs are reported, so please test this release. Improvements since the initial Beta =================================== The 4.1rc kernel has been removed in favor of the 3.19 kernel as it contains some additional functionality by default. The 4.x kernel will be available later as a -plus kernel. Installation/Everything ISO is now available. We're currently offering an Everything ISO that can be used for usb based installation if desired. This iso is currently too large for standard DVD media, and so is best used via usb media. Many updated packages, including core packages likebzip2, dbus, grub2, libaio, and more. Download ======== The full (unsigned) install tree is available at http://buildlogs.centos.org/centos/7/os/aarch64/ Everything-ISO is available at http://buildlogs.centos.org/centos/7/isos/aarch64/CentOS-7-aarch64-Everythi… Installation ============ Installation guides and documentation will be provided via the CentOS wiki, at http://wiki.centos.org/SpecialInterestGroup/AltArch/AArch64 Update procedures for existing installations ============================================ Because the kernel version has been rolled back from 4.x to 3.19, you will need to take some additional steps to update. 1. yum -y update 2. yum distro-sync # This will roll back the installed kernel packages 3. yum remove kernel-core kernel-modules # cleans up kernel leftovers. 4. reboot to new kernel ============ Contributing The AArch64 effort is meant to be a community effort as part of the AltArch SIG (http://wiki.centos.org/SpecialInterestGroup/AltArch), and we welcome enthusiasts and vendors to contribute patches, fixes, documentation, etc. In the AArch64 Extras repository, we have provided the mock package and dependencies so that community members can more easily contribute, as well as testing their own builds locally. Please submit patches, fixes, etc to the Arm-Dev list (http://lists.centos.org/mailman/listinfo/arm-dev) for discussion and acceptance. We encourage vendors to come and join this effort, we have a loose organization focused on the alternative architectures build process and welcome interaction at the group level. Please get in touch with me (jperrin(a)centos.org) or K Singh ( kbsingh(a)centos.org ) to find out more details. The wider CentOS Ecosystem is also welcome to engage with us, both at the project and code level. If you are working with a project that interfaces, manages or develops on top of CentOS, specially in the virtualization, cloud, container and infrastructure management areas - we would love to have you guys get involved. While we don't have a lot of resources, we are working with a few vendors to build up a community resource pool that we would encourage other projects to share their development, testing and delivery around CentOS Linux for aarch64. -- Jim Perrin The CentOS Project | http://www.centos.org twitter: @BitIntegrity | GPG Key: FA09AD77 ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 125, Issue 2 ***********************************************

1 0

Re: [CentOS] Replacing cpu
by g 07 Jul '15

07 Jul '15

On 07/06/15 22:22, jd1008 wrote: <<>> > I plan to do both :) > This is why I use AmEx. > They fully refund for merchandise that does not work. > They are able to extract that from the merchant. > Don't ask me how :) They have done it for me before. it is in the 'toa', 'terms of agreement'. credit card companies require signing agreement before they will do any funds transactions. cyoa. > But B 4 I resort to AmEX, I will first try Ebay problem > resolution. Failing that, I will talk to AmEx. go back to ebay page that you ordered from to see if there is ability to make comment about seller. -- peace out. -+- If Bill Gates got a dime for every time Windows crashes... ...oh, wait. He does. THAT explains it! -+- in a world with out fences, who needs gates. -+- CentOS GNU/Linux 6.6 tc,hago. g .

1 1

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 07 Jul '15

07 Jul '15

On 07/06/15, g wrote: you might try verifying that system you are getting error message on has a good cd/dvd drive. burn another dvd at at least 4 speeds slower. if runs ok, bad drive. if still fails, bad drive. another way you can check is to pull iso on system you are having problem with and burn dvd. if you get error, get a new drive. -------- Above quoted -------- When I md5sum the DVD on the system I burned it on, it matches. When I md5sum it on another system, it matches. When I md5sum it on the system I am trying to install, it comes up with a different answer. I'm getting a new DVD drive.

3 2

ntpd new version
by Vijendra Agarwal (vijagarw) 07 Jul '15

07 Jul '15

Hi All, Currently CentOS site contains the below version of ntpd. ntp-4.2.6p5-3.el6.centos.x86_64.rpm<http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/ntp-4.2.6p5-3.e…> :- 16 mar 2015. Does anybody have any information about when the new version of ntpd is expected to release containing new vulnerabilities fixes? Thanks Vijendra.

4 4

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 06 Jul '15

06 Jul '15

On 07/05/15, Gordon Messmer wrote: That's not the same as checking the media for corruption. You may be able to read all of the files, but if the data is corrupt, rpm may throw and IOError. So, the next thing to do is check your media. The DVD should offer to do that first when you boot from it. ------ Above quoted -------- Booted the DVD again, took the default. It got to 76.2% then told me: The media check is complete. The result is: FAIL. It is not recommended to use this media. [FAILED] Failed to start media check on /dev/sr0. See 'systemctl status checkisomd5(a)-dev-sr0.service' for details. dracut-initqueue[681]: Job for checkisomd5(a)-dev-sr0.service failed. See 'systemctl status checkisomd5(a)-dev-sr0.service' and 'journalctl -xn' for details. [ 243.972119] dracut: FATAL: CD check failed! [ 243.972141] dracut: Refusing to continue Could not unmount /run/install/repo: Device or resource busy [ 245.127417] System halted. Ran the check again, same thing. Took that DVD back to the machine I burned it on, downloaded the MD5SUM from one of the mirrors and checked the file I downloaded. That checks. Used cmp to compare the .iso file to the image on the DVD, they match, the DVD is good. Hmm, what gives. Burned another DVD and verified the burned image matches the .iso file. Took the new DVD to the machine I'm doing the install on and ran the check again. OMG, it did the same thing at 76.2%. Now I'm thinking, wait, it says "Failed to start media check" is that a poorly worded message or does it really mean what it says?

3 2

ssh -X versus -Y
by Stuart Barkley 06 Jul '15

06 Jul '15

On Fri, 26 Jun 2015 at 03:16 -0000, Alexandru Chiscan wrote: > On 06/25/2015 11:51 PM, Stuart Barkley wrote: > > Then from your desktop (assuming Linux already running X) in a > > local xterm do something like: > > > > ssh -Y remote-system > > Do not use that because any user logged on the server can connect to > your X server display and snoop what you are doing, open windows > etc. > > -Y disables all the X server authentication mechanisms > (http://www.x.org/wiki/Development/Documentation/Security/) I believe this is incorrect. The authentication protocols are still used (thus the need for the xorg-x11-xauth package on CentOS). This is not the same as 'xhost +' which should never be used. Both -X and -Y require read access to the ~/.Xauthority file on the remote system in order to connect back to the X server. You can see this by using the 'xauth remove' command to remove the authentication token for the display and clients can no longer connect. > > Note about -X versus -Y with ssh: > > > > -X enables basic X forwarding, It disables some X functionality > > making it "safer" to allow. -X also stops working after about 20 > > minutes (this is by design but not well documented). I only > > recently learned why it would stop working after pulling out the > > last of my hair. > > I have been using ssh X forwarding for current work use (local > betwork) for more than 15 years and never got into this kind of > problem from RH 7 to Centos 7, AIX and Solaris. Likewise, I've used ssh/X for 20+ years on a variety of systems. In most cases -X is sufficient, but some applications seem to require -Y and I have not dug into all of the reasons. > Maybe it is some other issue that is closing your ssh connection > (maybe you should use the KeepAlive options on the ssh > server/client); just guessing. On Debian and FreeBSD 'man ssh_config' now shows: ForwardX11Timeout Specify a timeout for untrusted X11 forwarding using the format described in the TIME FORMATS section of sshd_config(5). X11 connections received by ssh(1) after this time will be refused. The default is to disable untrusted X11 forwarding after twenty minutes has elapsed. This option seems to have appeared in OpenSSH 6.0 [See more at the end of this email]. > > -Y allows the full X protocol which might be a security risk. > > Some applications will only work with -Y. With this, remote X > > applications can grab keyboard interactions, grab passwords, put > > windows on top of other windows (obscuring security messages), > > etc. > > > > For my own choice I use -Y (although I only enable it occasionally > > to specific systems). This is a recent behaviour change on my part with limited use to system I trust. Now that I know about the timeout I can probably just live with -X and will consider moving back to -X for my occasional use, The documentation of the practical differences between -X and -Y is pretty obscure (mostly defering to the X Security extension documentation). I would like to see better clarification of the differences. ...some additional research looking at the source code and revision history... The ForwardX11Timeout change was 5 years ago in OpenSSH 6.0. CentOS 6 still has OpenSSH 5.3 without this change (or if a patch was applied the documentation was not also patched). CentOS 7 has OpenSSH 6.6 which includes this change. http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?… Prior to that there was an intended hard coded 20 minute timeout since at least 2005: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?… Based upon the comments in the June 2010 revision it appears that the timeout was not working correctly and perhaps was falling back to trusted authentication after 20 minutes: Add X11ForwardTimeout option to specify timeout for untrusted X11 authentication cookies to avoid fallback in X11 code to fully-trusted implicit authentication using SO_PEERCRED described at: http://lists.x.org/archives/xorg-devel/2010-May/008636.html After the X11ForwardTimeout has expired the client will now refuse incoming X11 channel opens. I will need to see it this is an unpatched security issue on CentOS/RedHat 6. If so, I claim credit for observing it as a possibility. Stuart -- I've never been lost; I was once bewildered for three days, but never lost! -- Daniel Boone

5 6

Centos 7 Server Forgets IPv6 Address On Reboot
by Dave Cross 06 Jul '15

06 Jul '15

My Centos 7 server has started to forget its IPv6 address on a reboot. This causes problems with services being unable to start up. It's easy enough to fix each time (ip addr add ...), but it would be nice to be able to convince it to retain that information. Presumably, there's a file somewhere under /etc/sysconfig that should contain this information - does anyone know where it should be stored? Thanks, Dave... -- Dave Cross :: dave(a)dave.org.uk http://dave.org.uk/ @davorg

3 2

IPMI/BMC/BIOS
by Chris Olson 06 Jul '15

06 Jul '15

We have recently been asked to evaluate some computing machinery for a new project. This particular end user has very limited experience with the stated security requirements in a lights-out environment. Their primary work (as well as mine) in the past has been with very small, simple networks of desktop machines and a few servers with extremely limited access. For the most part, their admins haverefused to use any maintenance connectivity to servers other thanthe primary serial ports. There is a concern about system security primarily driven by recent information searches performed by end user admins and included below. IPMI/BMC Security Issues ------------------------ https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface http://www.google.com Search: IPMI "Security Holes" -- Hits: 14,500 http://www.google.com Search: IPMI BMC "Security Holes" -- Hits: 4950 BIOS Security Issues -------------------- https://en.wikipedia.org/wiki/BIOS http://www.google.com Search: BIOS "Security Holes" -- Hits: 342,000 My initial recommendation was to use a totally separate network for any service processors within the servers that implement IPMI/BMC capabilities. This has been standard practice in most systems I have worked on in the past, and has allowed certification with essentially no problems. The BIOS concern seems to be another issue to be addressed separately. Any connectivity and access to a system brings security issues. The list from these searches is huge. Are there specific things that must always be addressed for system security besides keeping junior admins off the server supporting the maintenance network? Thanks in advance for any feedback and best regards.

5 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2015