September 2015 - Discuss - lists.centos.org

sshd key exchange security
by Alice Wonder 11 Sep '15

11 Sep '15

I was reading https://weakdh.org/sysadmin.html They also have a very interesting paper as a PDF. Anyway it appears that most ssh servers, when using DHE key exchange, use the 1024-bit Oakley Group 2 and there is suspicion the NSA has done the pre-computations needed to passively decrypt any tls communication using DHE with that particular prime group. They recommend setting the following: KexAlgorithms curve25519-sha256(a)libssh.org I don't even see that directive in my sshd config to set it, I suppose it may be one that is manually added when needed but I want to verify it actually means something in CentOS 7 ssh. Also I'm a little worried that maybe curve25519 is one of the curves that Red Hat (and thus CentOS 7) doesn't support due to patent concerns. If it is, is there a suggestion on what curve should be used instead?

3 3

Cannot open: No space left on device
by reynierpm＠gmail.com 11 Sep '15

11 Sep '15

I have a VBox VM running CentOS 6.7 and I want to extract the content of a 14G tar file. I'm doing as: *tar -xvf www.tar.gz* But I am getting a lot of errors like the ones shown below: html/elclarinweb.dev/wp-content/uploads/2015/03/12-Aura-Ávila-400x320.jpg tar: html/elclarinweb.dev/wp-content/uploads/2015/03/12-Aura-Ávila-400x320.jpg: Cannot open: No space left on device html/elclarinweb.dev/wp-content/uploads/2015/03/Julianne-Moore-11-585x378.jpg tar: html/elclarinweb.dev/wp-content/uploads/2015/03/Julianne-Moore-11-585x378.jpg: Cannot open: No space left on device So, trying to find why the VHDD (Virtual HDD) has left out of space I ran the following command: *df -h* Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_server-lv_root 26G 24G 869M 97% / tmpfs 2.0G 0 2.0G 0% /dev/shm /dev/sda1 477M 80M 373M 18% /boot And then I've tried to find the conflictive files by running: *du -hsx * | sort -rh | head -10* du: cannot access `proc/3662/task/3662/fd/4': No such file or directory du: cannot access `proc/3662/task/3662/fdinfo/4': No such file or directory du: cannot access `proc/3662/fd/4': No such file or directory du: cannot access `proc/3662/fdinfo/4': No such file or directory 14G var 1.8G usr 278M lib 77M boot 31M etc 27M lib64 15M sbin 7.8M bin 188K dev 112K root Why *df -h* is reporting 24G used? Where the space did go? How I can fix this?

5 9

CPU Scheduling allocates more time for few threads
by Radha krishna 11 Sep '15

11 Sep '15

Hi I have a Virtual Machine with CentOS 7 64-bit having 6 CPUs (intel). I have a process with 10 threads. two threads of the process pinned to two CPU's using affinity. These threads processes lot of network messages via Sockets. Other threads wait for other events using pthread condition wait. When two threads CPU reaches 75 to 80% then the schedular, schedules most of the time for those two threads, even though remaining 4 CPU's are ideal. Due to this other threads event processing is delayed a lot. Is it mostly do to more signal's from kernel space to user space tor those threads ? Is there a way to avoid this issue? RegardsRadha

2 1

Re: [CentOS] rsync question
by C Linus Hicks 11 Sep '15

11 Sep '15

On 09/10/15, Robert Moskowitz wrote: --------------- Quoted text ------------------ SSh is not parsing the port the way http does, it seems: $ rsync -ah --stats root@192.168.129.2:613:/etc/dhcp/ /home/rgm/data/htt/httnet/homebase/new/dhcp ssh: connect to host 192.168.129.2 port 22: No route to host rsync: connection unexpectedly closed (0 bytes received so far) [Receiver] rsync error: unexplained error (code 255) at io.c(226) [Receiver=3.1.1] The reason why I change my SSH port is a simple way to keep port knocker robots away. Different hosts use different ports... ------------------ End quote -------------------- Oh, right, so you either need to put that in your .ssh/config file or use -e 'ssh -p 613' on the rsync command. The config file should look like this: Host 192.168.129.2 Port 613

3 3

Rebuilding a Centos 6.2 netinstall initrd with an updated driver?
by Rory Falloon 11 Sep '15

11 Sep '15

Hi all, It seems that with the release of the X99 motherboards, a lot of vendors are shifting away from using Realtek ethernet on board NICs and using Intel. Our main distro. on the floor is Centos 6.2 for numerous reasons. Efforts are being made toward 7.1, but not there yet. Anyway, the new Intel NICs are recognised by Centos 6.6 netinstall ISO when booting, but not Centos 6.2. I have had the idea of unpacking the initrd and using the e1000/e1000e drivers from 6.6, and updating the 6.2 initrd. This has not worked so far, but I'm hoping I've missed a step. I have: 1) unpacked both initrd's 2) updated modules.* from the 6.2 initrd to match 6.6 for the relevant modules/dependent modules 3) updated the pci.ids file 4) chrooted, run `depmod -a -v` 5) rebuilt the initrd 6.2 still fails to see the NIC. Is there a step I've missed here? Do I have to concern myself with the kernel(vmlinuz) file too?

3 3

CentOS 7.1.1503 + Dovecot + IPA
by Kanwar Ranbir Sandhu 11 Sep '15

11 Sep '15

Hi Everyone, I'm running an IPA server on CentOS 7 successfully and now I want to change my Dovecot setup to use GSSAPI for IMAP authentication instead of a flat "userdb" file. I've already joined the Dovecot box to the IPA domain - ssh and ipa policies and all that are working properly. I read a number of articles on how to configure Dovecot for GSSAPI auth and they all said the same thing (even Red Hat's official how to on it agreed). But, when I set up Evolution on my Fedora 22 system to use GSSAPI, Dovecot's log records this: Sep 8 13:49:55 mailman02 dovecot: auth: Panic: file auth-request.c: line 733 (auth_request_is_disabled_master_user): assertion failed: (request->requested_login_user != NULL) Sep 8 13:49:55 mailman02 dovecot: auth: Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x6a02e) [0x7f27af22202e] -> /usr/lib64/dovecot/libdovecot.so.0(+0x6a10e) [0x7f27af22210e] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f27af1da52c] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](+0x15922) [0x7f27af6c7922] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](auth_request_lookup_credentials+0x32) [0x7f27af6c9332] -> /usr/lib64/dovecot/auth/libmech_gssapi.so(+0x2134) [0x7f27ad615134] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](auth_request_handler_auth_continue+0xe5) [0x7f27af6caf15] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](+0x109da) [0x7f27af6c29da] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x27) [0x7f27af232a47] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xff) [0x7f27af2338cf] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f27af232598] -> /usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f27af1df9e3] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](main+0x391) [0x7f27af6c07f1] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f27ae7ceaf5] -> dovecot/auth [1 wait, 0 passdb, 0 userdb](+0xe9e1) [0x7f27af6c09e1] Sep 8 13:49:55 mailman02 dovecot: auth: Fatal: master: service(auth): child 23185 killed with signal 6 (core dumps disabled) I've already asked on the Dovecot list about my GSSAPI auth problems and was told that this is a bug in Dovecot which does not exist in the latest release (I don't know when the problem was actually fixed). My question is simply this: does anyone else have dovecot-2.2.10-4.el7_0.1.x86_64 working with GSSAPI auth against an IPA server? IPA is also running on CentOS 7.1.1503. Regards, Ranbir -- Kanwar R.S. Sandhu

3 7

Re: [CentOS] rsync question
by C Linus Hicks 11 Sep '15

11 Sep '15

On 09/10/15, C Linus Hicks wrote: On 09/10/15, Robert Moskowitz wrote: ---------------- Quoted text ------------------------ Try this: rsync -ah --stats 192.168.192.2:/root/samba.PDC/ /home/rgm/data/htt/httnet/homebase/new/root/ --------------------- End Quote ---------------------------------- Sorry, I was too fast, not paying attention, you want this I believe: rsync -ah --stats root@192.168.192.2:/root/samba.PDC/ /home/rgm/data/htt/httnet/homebase/new/root/ That will use the default port on the remote host, you can override that without specifying the -e if required using -p <port>.

4 5

SAMBA as AD DC
by Sergio Belkin 11 Sep '15

11 Sep '15

Hi folks, Is able SAMBA on CentOS 7 to work as Active Directory Domain Controller? If it's not, what is the recommended way of doing? Compiling from sources? Install packages from SerNet? Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com LPIC-2 Certified - http://www.lpi.org

9 14

automounter with users home directories on centos 7.
by Jason Welsh 11 Sep '15

11 Sep '15

Has anyone gotten this to work? Im studing for my rhce and was trying to get this to work and its just not working like it shows in the book im going by. So basically I have two centos 7 servers running under kvm.. One is the nfs server, one is the nfs client.. I have been mounting up other NFS shares on the client and they work fine.. The automounter also seems to mount direct mounts fine as well.. But when I try to do home directories, it just doesnt work.. on my server (named server1), Im exporting /home as /home server2(rw,sync,no_root_squash) on my client, ive got [root@server2 ~]# grep home /etc/auto.master /home /etc/auto.home --timeout=120 and [root@server2 ~]# cat /etc/auto.home * -rw,soft,intr server1:/home/& [root@server2 ~]# and on server1, ive got the selinux enabled, but have the following booleans set. [root@server1 ~]# getsebool -a | grep nfs_ nfs_export_all_ro --> on nfs_export_all_rw --> on use_nfs_home_dirs --> on [root@server1 ~]# so when I try to switch to my user on server2 (client), I get [root@server2 ~]# su - user1 Last login: Wed Sep 9 16:25:27 EDT 2015 on pts/0 su: warning: cannot change directory to /home/user1: No such file or directory -bash-4.2$ and theres nothing in the logs that I can find as to why the automount isnt working.. [root@server2 ~]# showmount -e server1 Export list for server1: /home server2 I generated a log (on both server) with sealert, but it shows found 0 alerts in /var/log/audit/audit.log any ideas? -- Jason

4 10

Remote auth against Active Directory
by Chris Adams 11 Sep '15

11 Sep '15

I've got a new CentOS 7 server going into a remote location. I have local servers that authenticate against Active Directory (2012 if it matters) using winbindd. I'd like to have some method of using AD on the remote server, but I need to be able to access it if the network path to the AD servers is down. sssd caching won't do AFAIK (since that's just a cache that times out). This server is going to have out-of-band network access for remote management in case of network failure, so having access to it when it can't reach AD is its primary purpose. I'd like to use our existing AD setup (rather than manage local users) to make it easier to manage users/passwords. Is there a relatively simple method to replicate a chunk of the AD users/passwords to a remote CentOS server (I don't care about the SSO side of things)? Or is there some other way to solve this problem? -- Chris Adams <linux(a)cmadams.net>

2 1

Centos 7 Adding KDE as extra option
by david 11 Sep '15

11 Sep '15

Folks While trying to add a second desktop to my Centos7 installation (I had GNOME3, wanted to add KDE as an alternate), the install failed: >yum groupinstall "KDE Plasma Workspaces" <snip> >--> Finished Dependency Resolution >Error: Package: systemd-python-208-20.el7.x86_64 (base) > Requires: systemd = 208-20.el7 > Installed: systemd-208-20.el7_1.5.x86_64 (@updates) > systemd = 208-20.el7_1.5 > Available: systemd-208-20.el7.x86_64 (base) > systemd = 208-20.el7 >Error: Package: 32:bind-libs-9.9.4-18.el7.x86_64 (base) > Requires: bind-license = 32:9.9.4-18.el7 > Installed: 32:bind-license-9.9.4-18.el7_1.1.noarch (@updates) > bind-license = 32:9.9.4-18.el7_1.1 > Available: 32:bind-license-9.9.4-18.el7.noarch (base) > bind-license = 32:9.9.4-18.el7 >Error: Package: libreport-2.1.11-21.el7.centos.0.4.x86_64 (base) > Requires: libreport-filesystem = 2.1.11-21.el7.centos.0.4 > Installed: > libreport-filesystem-2.1.11-23.el7.centos.0.1.x86_64 (@updates) > libreport-filesystem = 2.1.11-23.el7.centos.0.1 > Available: > libreport-filesystem-2.1.11-21.el7.centos.0.4.x86_64 (base) > libreport-filesystem = 2.1.11-21.el7.centos.0.4 >Error: Package: 1:cups-client-1.6.3-17.el7.x86_64 (base) > Requires: cups-libs(x86-64) = 1:1.6.3-17.el7 > Installed: 1:cups-libs-1.6.3-17.el7_1.1.x86_64 (@updates) > cups-libs(x86-64) = 1:1.6.3-17.el7_1.1 > Available: 1:cups-libs-1.6.3-17.el7.x86_64 (base) > cups-libs(x86-64) = 1:1.6.3-17.el7 >Error: Package: 1:cups-1.6.3-17.el7.x86_64 (base) > Requires: cups-libs(x86-64) = 1:1.6.3-17.el7 > Installed: 1:cups-libs-1.6.3-17.el7_1.1.x86_64 (@updates) > cups-libs(x86-64) = 1:1.6.3-17.el7_1.1 > Available: 1:cups-libs-1.6.3-17.el7.x86_64 (base) > cups-libs(x86-64) = 1:1.6.3-17.el7 > You could try using --skip-broken to work around the problem > You could try running: rpm -Va --nofiles --nodigest Trying the --skip-broken option gave a large set of protected multilib version errors, so it didn't work either. The following is the repo list: >[root@xxxxx ~]# yum repolist >Loaded plugins: fastestmirror, langpacks, priorities >Loading mirror speeds from cached hostfile > * base: mirror.pac-12.org > * centosplus: mirrors.unifiedlayer.com > * epel: mirror.sfo12.us.leaseweb.net > * extras: mirror.pac-12.org > * updates: mirrors.xmission.com >1452 packages excluded due to repository priority protections >repo id repo >name status >base/7/x86_64 CentOS-7 - >Base 8,652 >centosplus/7/x86_64 CentOS-7 - >Plus 40+13 >cr/7/x86_64 CentOS-7 - >cr 0 >*epel/x86_64 Extra Packages for >Enterprise Linux 7 - x86_64 8,411+66 >extras/7/x86_64 CentOS-7 - >Extras 128+53 >updates/7/x86_64 CentOS-7 - >Updates 2+1,320 >repolist: 17,233 >[root@goat ~]# I use priorities, as follows: 1: base 2: centosplus 3: updates 4: extras 5: cr 6: contrib 7: epel Can anyone explain this? or let me know how to get around it? Rebuilding the server from scratch is definitely possible since this is a test environment only. Thanks David

2 3

Install Xfce has package requirement error
by david 10 Sep '15

10 Sep '15

Folks Working in Centos 7, and with GNOME (three, I presume), installed, I tried to add the Xfce desktop and got a message: Error: Package: openssh-askpass-6.6.1p1-11.el7.x86_64 (base) Requires: openssh = 6.6.1p1-11.el7 Installed: openssh-6.6.1p1-12.el7_1.x86_64 (@updates) .... Should I try "-skip-broken", or wait until those packages are fixed? Shouldn't the repositories always be consistent? Thanks David

2 1

Re: [CentOS] rsync question
by C Linus Hicks 10 Sep '15

10 Sep '15

On 09/10/15, Robert Moskowitz wrote: ---------------- Quoted text ------------------------ I just tried the following: rsync -ah --stats "ssh -p613 -l root" 192.168.192.2:/root/samba.PDC/ /home/rgm/data/htt/httnet/homebase/new/root/ And it failed with: Unexpected remote arg: 192.168.192.2:/root/samba.PDC/ rsync error: syntax or usage error (code 1) at main.c(1330) [sender=3.1.1] I tried again with: rsync -ah --stats -e "ssh -p613 -l root" 192.168.192.2:/root/samba.PDC/ /home/rgm/data/htt/httnet/homebase/new/root/ and it worked. This is what I read from the manpage, that "-e" is needed for the ssh command. --------------------- End Quote ---------------------------------- Try this: rsync -ah --stats 192.168.192.2:/root/samba.PDC/ /home/rgm/data/htt/httnet/homebase/new/root/

2 1

setting up solr/tomcat gives 404 page
by Tim Dunphy 10 Sep '15

10 Sep '15

Hey all, I tried following a few guides and I'm struggling with trying to setup apache solr 4.10 under apache tomcat 7.0.64 along with the drupal config necessary to get that this working with drupal. The latest guide I followed was this one which seemed like it might work: http://duntuk.com/how-install-apache-solr-46-apache-tomcat-7-use-drupal I followed everything to the letter and ended up with a 404 status page when I hit http://ipaddress:8080/solr I think the answer lies in putting the renaming the 'collection1' core to the right location under the name 'drupal'. But how to do that seems to be left out of that tutorial. In the tomcat logs I just see the following: 100.116.32.93 - - [09/Sep/2015:16:52:56 -0400] "GET /solr HTTP/1.1" 404 959 Which isn't very informative!! Any chance I can get some help in getting this working? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 1

Re: [CentOS] rsync question
by Carl E. Hartung 10 Sep '15

10 Sep '15

On Wed, 9 Sep 2015 05:51:38 -0700 (PDT) Mark Milhollan wrote: > On Tue, 8 Sep 2015, Carl E. Hartung wrote: > >On Tue, 8 Sep 2015 10:25:33 -0700 (PDT) Mark Milhollan wrote: > > >> -e specifies the *local* transport command to use > > > >What?! Straight from the documentation: > > > >" -e, --rsh=COMMAND specify the remote shell to use" > > If only one can properly interpret the meaning... COMMAND is the > local command to run to obtain a remote (non-interactive) shell, so > it isn't that the remote shell program (invoked once the transport is > connected) is being specified, i.e., it is which `remsh' to use. The > -p and -l provided thereby may be necessary, since the one is not the > default and the other isn't known to us to be the same as the local > user, which you glossed over as if one never has a need to specify. > > Orthogonal to Robert's problem, the switch from default use of rsh to > ssh has made it a requirement for (good) automation to always supply > a -e to ensure the correct command is used to account for all > potential versions of rsync that may be used. > > >> , and in this case it also specifies the remote port (613) and user > >> (root). Granted one should probably use their ssh configuration to > >> do that but it isn't realy "wrong" (to be questioned) to do it via > >> options. > > > >I didn't explicitly state that it was "wrong," just implied > >(correctly) that it was unnecessary. > > Potentially unnecessary. Just because you might see putting the port > and user in the ssh config file as the right thing to do, and which I > also do whenever possible, doesn't mean Robert necessarily wants to > or can do so, and after all -e does exist. Your questioning its use > as you did implied using it is wrong, to which I object. Luckily you > decided to reply to the list quoting me so eventually Robert was > supplied with the clue you didn't provide, that it might be > pre-configured. > > > /mark Mark, I would prefer it if you would please send your replies to the list and not to me personally. I *do* get them if you send them to the list. All of these fine grained points you've made regarding options that are "required for (good) automation" are irrelevant. Robert's post concerned invoking rsync manually "for backup purposes" -- not for "automation" as you're envisioning. He wrote "This is not an automated system. It is typically a onetime thing ..." Moreover, my "Why '-e'?" query was paired with a second very specific question: "Are these systems running disparate operating systems?" The implication seems pretty clear to me -- not that '-e' was somehow "wrong" but simply likely unnecessary in his scenario. I stand by that somewhat informal (less strict than you) evaluation unless and until we learn that he's actually operating on truly disparate systems. regards, Carl

2 2

named Update Problem
by Günther J. Niederwimmer 10 Sep '15

10 Sep '15

Hello, I have enabled for a Domain DNSSEC and it working correct, after I change the rights for /var/named to root:named 0770 but after a update it is always change back to root:named 0750 after this, DNSSEC don't work any more? named have no right to write his secure files. Is there a way to fix this Thanks, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

2 4

(no subject)
by Jeremy Conklin 10 Sep '15

10 Sep '15

Jconklin7887(a)hotmail.com

1 0

How to rebuild logrotate.status
by Robert Moskowitz 10 Sep '15

10 Sep '15

I have a problem in that at first all my log files were dated 12-31-1969 and logrotate has: # more /var/lib/logrotate.status logrotate state -- version 2 "/var/log/yum.log" 1969-12-31-20:26:1 "/var/named/data/named.run" 1969-12-31-20:26:1 "/var/log/httpd/error_log" 2015-8-27-4:43:1 "/var/log/wtmp" 1969-12-31-20:26:1 "/var/log/chrony/*.log" 2015-8-19-22:0:0 "/var/log/spooler" 1969-12-31-20:26:1 "/var/log/btmp" 1969-12-31-20:26:1 "/var/log/maillog" 1969-12-31-20:26:1 "/var/log/wpa_supplicant.log" 2015-8-19-22:0:0 "/var/log/secure" 1969-12-31-20:26:1 "/var/log/ppp/connect-errors" 2015-8-19-22:0:0 "/var/log/messages" 1969-12-31-20:26:1 "/var/log/cron" 1969-12-31-20:26:1 "/var/log/httpd/access_log" 2015-8-27-4:43:1 How do I get this file rebuilt with the dates currently on the files listed?

2 1

NFS client kernel panic
by David Goudet 10 Sep '15

10 Sep '15

Hi everyone, I have an issue with NFS client when the NFS client loose connection with the NFS server. In certain conditions the NFS client freeze and the result is kernel panic. It seems that kernel panic occurs when the NFS client try to unmount the unreachable remote NFS partition. This case occurs about one time each two days. CentOS version: CentOS Linux release 7.1.1503 (Core) Kernel version: Linux foo.bar 3.10.0-229.4.2.el7.x86_64 #1 SMP Wed May 13 10:06:09 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux NFS packages: nfs-utils-1.3.0-0.8.el7.x86_64, libnfsidmap-0.25-11.el7.x86_64 This issue is present only on Centos7 NFS client (not present with Centos6). Any ideas? Is it known problem with Centos7 NFS client? Logs and stack trace here after: nfs: server foo.bar not responding, timed out nfs: server foo.bar not responding, timed out nfs: server foo.bar not responding, timed out nfs: server foo.bar not responding, timed out nfs: server foo.bar not responding, timed out BUG: Dentry ffff8800ca82f380{i=138c0,n=foo.png} still in use (2) [unmount of nfs4 0:41] ------------[ cut here ]------------ kernel BUG at fs/dcache.c:945! invalid opcode: 0000 [#1] SMP Modules linked in: ipt_REJECT rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache binfmt_misc xt_multiport iptable_filter ip_tables dm_crypt nfsd mgag200 auth_rpcgss syscopyarea nfs_acl sysfillrect lockd sysimgblt i2c_algo_bit ttm coretemp sunrpc drm_kms_helper iTCO_wdt iTCO_vendor_support i7core_edac ipmi_devintf lpc_ich kvm drm bnx2 ipmi_si dcdbas crc32c_intel serio_raw pcspkr i2c_core mfd_core edac_core ipmi_msghandler shpchp acpi_power_meter xfs libcrc32c sd_mod crc_t10dif crct10dif_common sr_mod cdrom ata_generic pata_acpi mptsas scsi_transport_sas ata_piix mptscsih libata mptbase dm_mirror dm_region_hash dm_log dm_mod CPU: 12 PID: 21364 Comm: umount.nfs4 Not tainted 3.10.0-229.4.2.el7.x86_64 #1 Hardware name: Dell Inc. PowerEdge R410/0N051F, BIOS 1.2.4 11/02/2009 task: ffff880075b3ad80 ti: ffff88007744c000 task.ti: ffff88007744c000 RIP: 0010:[<ffffffff811dddcc>] [<ffffffff811dddcc>] shrink_dcache_for_umount_subtree+0x1ac/0x1c0 RSP: 0018:ffff88007744fe10 EFLAGS: 00010246 RAX: 000000000000005e RBX: ffff8800ca82f380 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88022fccd488 RDI: 0000000000000246 RBP: ffff88007744fe28 R08: 0000000000000096 R09: 0000000000000627 R10: 0000000000000000 R11: ffff88007744fb26 R12: ffff8801ffb08780 R13: ffffffffa04f27a0 R14: ffff88021f3c0f40 R15: ffff88021f3c0f20 FS: 00007ff58b134880(0000) GS:ffff88022fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff58aad15a0 CR3: 00000001ffe7f000 CR4: 00000000000007e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffff880036a9fb20 ffff880036a9f800 ffff880036a9a000 ffff88007744fe40 ffffffff811df969 ffff880036a9f800 ffff88007744fe68 ffffffff811c8fe1 0000000000000029 ffff880036a9a000 ffff88021f3c0f20 ffff88007744fe80 Call Trace: [<ffffffff811df969>] shrink_dcache_for_umount+0x49/0x60 [<ffffffff811c8fe1>] generic_shutdown_super+0x21/0xe0 [<ffffffff811c9282>] kill_anon_super+0x12/0x20 [<ffffffffa041827b>] nfs_kill_super+0x1b/0x30 [nfs] [<ffffffff811c962d>] deactivate_locked_super+0x3d/0x60 [<ffffffff811c9c36>] deactivate_super+0x46/0x60 [<ffffffff811e6ac5>] mntput_no_expire+0xc5/0x120 SELinux: initialized (dev 0:40, type nfs4), uses genfs_contexts [<ffffffff811e7bff>] SyS_umount+0x9f/0x3c0 [<ffffffff81614de9>] system_call_fastpath+0x16/0x1b Code: 00 00 48 8b 40 28 4c 8b 08 48 8b 43 30 48 85 c0 74 1b 48 8b 50 40 48 89 34 24 48 c7 c7 20 f1 83 81 48 89 de 31 c0 e8 f0 0a 42 00 <0f> 0b 31 d2 eb e5 0f 0b 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 RIP [<ffffffff811dddcc>] shrink_dcache_for_umount_subtree+0x1ac/0x1c0 RSP <ffff88007744fe10> ---[ end trace ae487f589c43fd74 ]--- Kernel panic - not syncing: Fatal exception Thank you for you attention

1 0

bind chroot, bind mounts and selinux
by Tom Robinson 10 Sep '15

10 Sep '15

Hi All, I'm migrating a CentOS 6 bind instance (chrooted) to a CentOS 7 box and am curious of people's opinions on chrooting vs selinux as a way of securing bind. The bind-chroot on CentOS 7 also comes with a script (/usr/libexec/setup-named-chroot.sh) that sets up the much maligned systemd and, through bind mounts, creates and extra level of chroot hierarchy giving: /var/named/chroot/var/named/chroot/var/named which seems totally unnecessary. I'm sure that bind-chroot would be happy enough running without the bind mounts but would I be loosing anything in terms of security? Also, would I bother with chrooting at all if selinux can secure the environment for me? My own opinions aside what do others think and has anyone had experience with this? Kind regards, Tom -- Tom Robinson IT Manager/System Administrator MoTeC Pty Ltd 121 Merrindale Drive Croydon South 3136 Victoria Australia T: +61 3 9761 5050 F: +61 3 9761 5051 E: tom.robinson(a)motec.com.au

2 2

Re: [CentOS] CentOS 7 + Dell Latitude E6420 laptop = thermalshutdown
by deoren 10 Sep '15

10 Sep '15

> On 6/23/2015 7:22 AM, johan.vermeulen7 at telenet.be wrote: > > Hello All, > > > > installing these laptops went ok, but indeed, they shutdown on logon. > > When coming back up, I get a bios warning about temperature. > > On my first attempt on installing Nvidia driver, I wrecked the laptop. > > To be continued. > > > > greetings, Johan > > > Hi, > > Thanks for your feedback. I can't say I'm "happy" that someone else is > having the same problem, but I'm relieved that it's not just something > odd with the setup I am using. > > Any luck? I'm hoping to have a chance to look more into this myself in > the next few weeks once some other projects calm down. Ironically my > next step was going to be going after an updated video card driver. > > Hello Deoren, > > adding elrepo and installing kmod-nvidia seems to have solved the issue. > I hope this works for you as wel. > > greetings, Johan Thanks for the feedback. I'm a little late getting around to it, but I got a chance yesterday to look at this again and followed the steps to enable the ELRepo repository and installed the `kmod-nvidia` package. Once I did so, I was given a warning that there was a conflict with libglamoregl and to see the wiki page for more details. I looked on the site and found this page: http://elrepo.org/tiki/kmod-nvidia which covered not only that issue (basically run `yum remove xorg-x11-glamor`) but also emphasized that 'kmod-nvidia' might not work for some older chipsets and that the 'nvidia-detect' package should be installed and run to check for compatibility. I did so and got this output: kmod-nvidia Optimus hardware detected: An Intel display controller was detected Either disable the Intel display controller in the BIOS or use the bumblebee driver to suport Optimus hardware Now that the 'kmod-nvidia' driver was installed I rebooted the laptop to load it upon boot. Since I had rebooted, I checked my BIOS settings and sure enough I had the 'Enable Optimus' box selected. Figuring myself clever (ha), I disabled the option and attempted to boot the laptop. I got a blinking cursor against a black background and the password prompt to decrypt the disk and finish booting was never given. Since Ctrl+Alt+Del didn't appear to work, I held the power button and forced the laptop off. I then re-enabled the option and when the laptop next booted I got the password prompt to decrypt the disk and the laptop got to the point where Gnome should have loaded, but the system went no further. My notes are unclear at this point whether I was referring to the login window not displaying or whether it did and just logging into the desktop environment didn't work. I then installed the 'bumblebee' package and I was able to login without locking up the system. I then wiped the laptop, disabled the Optimus support in BIOS and did a clean installation making sure to use the same settings for the new installation as the old. The system booted up and I logged into KDE with no issues and the laptop remained powered on. Presumably the Optimus option was the issue all along. In summary: * If I have the Optimus option enabled I need to enable the ELRepo repository and install the kmod-nvidia (presumably) and bumblebee packages. * If I have the Optimus option disabled it appears that I don't need to do anything else other than install CentOS 7 normally and use it. Thanks again for your help with this.

1 0

yum list-sec CVE
by Raymond Durand 09 Sep '15

09 Sep '15

Hi, Is the command #yum list-sec cves still compatible with Centos7? Or are there alternatives to list all CVE applicable to a CentOS without the Satellite? Thanks

3 3

Working with PEM content
by Alice Wonder 09 Sep '15

09 Sep '15

Hi, If I need to script some management of text files with PEM content, are there already some tools that exist that do this safely? e.g. somecert.pem that might contain -----BEGIN CERTIFICATE----- blah blah -----END CERTIFICATE----- -----BEGIN DH PARAMETERS----- more blah -----END DH PARAMETERS----- What I would like is a utility that can read that file, remove the DH parameters, write new file, validate new file is valid PEM contents, and give exit status 0 on success. Could be done with standard scripting methods but I'm guessing a perl or python tool already exists that won't have me hitting myself when I make a stupid scripting mistake. Google and Bing lately though seem to be getting harder and harder for me to use to find that kind of stuff. Suggestions?

2 2

CUPS not generating a printcap file
by Vanhorn, Mike 09 Sep '15

09 Sep '15

According to all of the documentation I can find, an /etc/printcap file (or whatever filename is specified with the Printcap directive) is generated by cupsd ever time a printer is added or removed. On all of my CentOS 6.7 systems, this is NOT happening. I can restart cups and add or remove printers over and over and it still doesn't generate the printcap file. Is this a known issue, or is there some way that CentOS is blocking this from happening? --- Mike VanHorn Senior Computer Systems Administrator College of Engineering and Computer Science Wright State University 265 Russ Engineering Center 937-775-5157 michael.vanhorn(a)wright.edu http://www.cecs.wright.edu/~mvanhorn/

1 0

Saving session with terminal window open upon logout
by Gilbert Sebenste 09 Sep '15

09 Sep '15

Hello everyone, I tried Googling this, looking through admin notes...and I couldn't find this. And I know someone smart out here has the answer! When I log out of a user account, I want it to, when I log back in, have a terminal window pop up on my Gnome windows display, as I did before I logged out. How do I save a session before or as I log out? I am running Centos 6.7, 64-bit. Gilbert ******************************************************************************* Gilbert Sebenste ******** (My opinions only!) ****** *******************************************************************************

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2015