Discuss July 2015

discuss@lists.centos.org

116 participants
115 discussions

IPMI/BMC/BIOS
by Chris Olson 06 Jul '15

06 Jul '15

We have recently been asked to evaluate some computing machinery for a new project. This particular end user has very limited experience with the stated security requirements in a lights-out environment. Their primary work (as well as mine) in the past has been with very small, simple networks of desktop machines and a few servers with extremely limited access. For the most part, their admins haverefused to use any maintenance connectivity to servers other thanthe primary serial ports. There is a concern about system security primarily driven by recent information searches performed by end user admins and included below. IPMI/BMC Security Issues ------------------------ https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface http://www.google.com Search: IPMI "Security Holes" -- Hits: 14,500 http://www.google.com Search: IPMI BMC "Security Holes" -- Hits: 4950 BIOS Security Issues -------------------- https://en.wikipedia.org/wiki/BIOS http://www.google.com Search: BIOS "Security Holes" -- Hits: 342,000 My initial recommendation was to use a totally separate network for any service processors within the servers that implement IPMI/BMC capabilities. This has been standard practice in most systems I have worked on in the past, and has allowed certification with essentially no problems. The BIOS concern seems to be another issue to be addressed separately. Any connectivity and access to a system brings security issues. The list from these searches is huge. Are there specific things that must always be addressed for system security besides keeping junior admins off the server supporting the maintenance network? Thanks in advance for any feedback and best regards.

5 4

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 06 Jul '15

06 Jul '15

On 07/05/15, Gordon Messmer wrote: anaconda will try to delete an rpm file if it gets an IOError. Your media may be corrupt. Check that first. ----- Above quoted ----- No such luck. On the system where I'm doing the install, I used dd to read the entire DVD and also copied every .rpm to /dev/null and didn't get any I/O errors. What next?

3 2

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 05 Jul '15

05 Jul '15

On 07/05/2015 09:17 AM, linush(a)verizon.net wrote: > Someone please tell me what I did to screw this thing up so badly. On 07/05/15, Gordon Messmer<gordon.messmer(a)gmail.com> wrote: Have you looked at the log files in /mnt/sysimage/root/? ------------- Quoting broken in this mailer ------------ So I looked in /mnt/sysimage/var/log/anaconda and found this in anaconda.packaging.log: --------- cut --------- 02:40:53,109 DEBUG packaging: Installing abrt-dbus (684/1349) 02:40:53,125 DEBUG packaging: Installing flite (685/1349) 02:40:54,291 DEBUG packaging: Traceback (most recent call last): 02:40:54,291 DEBUG packaging: File "/usr/libexec/anaconda/anaconda-yum", line 220, in callback 02:40:54,292 DEBUG packaging: return func(amount, total, key, data) 02:40:54,292 DEBUG packaging: File "/usr/libexec/anaconda/anaconda-yum", line 342, in inst_open_file 02:40:54,292 DEBUG packaging: os.unlink(txmbr.po.localPkg()) 02:40:54,292 DEBUG packaging: OSError: [Errno 30] Read-only file system: '/run/install/repo/Packages/flite-1.3-22.el7.x86_64.rpm' 02:40:54,292 DEBUG packaging: FATAL ERROR: python callback <bound method RPMCallback.callback of <__main__.RPMCallback object at 0x7fa4569d1a10>> failed, aborting! 02:40:54,393 INFO packaging: ==== start rpm scriptlet logs ==== 02:40:54,393 INFO packaging: warning: filesystem-3.2-18.el7.x86_64: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY 02:40:54,393 INFO packaging: libgcc-4.8.3-9.el7.x86_64 (1/1349) 02:40:54,393 INFO packaging: fontpackages-filesystem-1.44-8.el7.noarch (2/1349) 02:40:54,393 INFO packaging: 1:control-center-filesystem-3.8.6-18.el7.x86_64 (3/1349) --------- cut --------- The path it is complaining is a read-only filesystem is the installation DVD. If my interpretation is correct, it appears to be attempting to delete a file on the DVD. Is there some issue with installing flite or is something else going on? When I searched there was a bug opened on a similar issue, but the person had a RAID array failure and the only error I see in the anaconda.storage.log is this: ------ cut -------- 02:24:19,798 DEBUG blivet: parsing /mnt/sysimage/etc/blkid/blkid.tab 02:24:19,799 INFO blivet: IGNORED: Caught exception, continuing. 02:24:19,799 INFO blivet: IGNORED: Problem description: error parsing blkid.tab 02:24:19,800 INFO blivet: IGNORED: Begin exception details. 02:24:19,800 INFO blivet: IGNORED: Traceback (most recent call last): 02:24:19,800 INFO blivet: IGNORED: File "/usr/lib/python2.7/site-packages/blivet/__init__.py", line 3227, in parseFSTab 02:24:19,800 INFO blivet: IGNORED: blkidTab.parse() 02:24:19,800 INFO blivet: IGNORED: File "/usr/lib/python2.7/site-packages/blivet/__init__.py", line 2282, in parse 02:24:19,800 INFO blivet: IGNORED: with open(path) as f: 02:24:19,800 INFO blivet: IGNORED: IOError: [Errno 2] No such file or directory: '/mnt/sysimage/etc/blkid/blkid.tab' 02:24:19,800 INFO blivet: IGNORED: End exception details. ---------- cut --------- Which doesn't appear to be fatal.

2 1

7.1 install with Areca arc-1224
by linush＠verizon.net 05 Jul '15

05 Jul '15

I must be doing something horribly wrong and I hope somebody can help. The Areca arc-1224 is not supported by the Areca driver included driver in 7.1 so I have to supply that when starting the install. Documentation provided by Areca and in the Red Hat install guide say the same thing, put the driver on an accessible medium then append inst.dd on the boot command, choose the driver and now the drives show up. So far so good. There's already a possible glitch, however. The USB memory stick is mounted as sda1, shifting the hard drives off by one letter. So I break into the shell and partition the drives the way I want them, go back to the GUI installer and select the drives I want to use, assign mount points and formatting options. Done with that, configure the network and disable kdump. Start the installation. Give it a root password. Install completes, reboot. Only it won't boot. Boot the DVD again, use troubleshooting with rescue option, again providing the new Areca driver. Tell it to mount my install under /mnt/sysimage. Look around a bit, there's almost nothing I expect to see in /boot, there's no kernel image. Do chroot /mnt/sysimage and query the RPM database, I see kernel-devel, kernel-headers and kernel-tools-libs. Hmmm, I'll bet that's a problem. What the heck?? I actually did try copying the kernel and a few other required RPMs into a directory inside the chroot jail, install them and that worked fine, so I know those bits on the DVD are good. Someone please tell me what I did to screw this thing up so badly. Linus

2 1

OT Advantage of running DNS server?
by Timothy Murphy 05 Jul '15

05 Jul '15

What is the advantage, if any, of running one's own DNS server? Surely the link between domain name and IP address must already have been established? -- Timothy Murphy gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin

7 6

Gracefully powering off system in case of power failure
by Jatin Davey 04 Jul '15

04 Jul '15

Hi I am using the system as shown below. ********************************* [root@localhost sbin]# cat /etc/*release LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphi cs-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch Red Hat Enterprise Linux Server release 6.5 (Santiago) Red Hat Enterprise Linux Server release 6.5 (Santiago) [root@localhost sbin]# uname -a Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Sun Nov 10 22:19:54 EST 2013 x86_64 x86_64 x86_64 GNU/Linux [root@localhost sbin]# ********************************** In case of power failure on this server , how can i make the system to shutdown gracefully so that it unmounts the file-system and cleans up the required buffers. My server does have a battery backup so it will help in shutting down the system more gracefully. I tried looking at this link: https://www.olimex.com/forum/index.php?topic=3326.0 But it did not help. Appreciate if someone can help me in this regard. Thanks Jatin

4 10

sendmail tls and oppenssl
by Gregory P. Ennis 04 Jul '15

04 Jul '15

Everyone, Looks like the new version of oppenssl has broken my sendmail's use of tls. Has anyone else had this problem or seen a fix? Greg Ennis

2 3

get ride of initial screen on CentOS 7
by Jerry Geis 03 Jul '15

03 Jul '15

Through kickstart I setup everything I need. On CentOS 7 I still get the "welcome" screen followed by a couple more then your ready to start using centos how do I get Rid of those series of screens ? Thanks Jerry

3 2

installing Cents os server 7.0
by Michael Wright 03 Jul '15

03 Jul '15

Hi all I have downloaded centos and burn the iso file every time I install centos it deletes my windows 7 what am I doing wrong mike

11 30

What causes phantom update nags?
by Kay Schenk 03 Jul '15

03 Jul '15

My Update Applet keeps giving me messages to install an update to a package I do not have installed. To make matters more confusing, when I actually try to install the package it wants to update, there is a problem with the installation. Any tips on how to resolve this? Is this somehow caused by the repositories I have enabled? -- -------------------------------------------- MzK "We can all sleep easy at night knowing that somewhere at any given time, the Foo Fighters are out there fighting Foo." -- David Letterman

4 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2015