Discuss February 2016

discuss@lists.centos.org

126 participants
101 discussions

strange behavior of firewalld and port-forwarding
by Django 03 Feb '16

03 Feb '16

HI, me and firewalld won't have a good start, but I hope we'll be good friends. One of my hosts must rerote traffic from one to another host. It isn't a big problem. I've a host witch must do: 1) forwarding port 25 tcp to a second host Here I've a special mail-relay. My external.xml look like this one: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> </zone> Every thing works expected, incomming traffic on port 25 is forwarded to 10.0.0.87 port 25. 2) traffic from 80.80.80.80 and destination-port 25 should be forwarded to port 22 tcp on 10.0.0.17 and not to 10.0.0.87 on port 25 So I made a new rule with: firewall-cmd --zone=external --add-rich-rule='rule forward-port port="25" to-port="22" to-addr="10.0.0.17" protocol="tcp" family="ipv4" source address="80.80.80.80"' If I try to connect on host 80.80.80.80 my system with: "telnet 10.0.0.17 25" I can connect the final host 10.0.0.17 on port 22 and open-ssh will greet me "SSH-2.0-oPENssh_6.6.1". It is working like I've expected. If I made my new firewall-rule permanent I use: "firewall-cmd --runtime-to-permanent" an the zone-file has now this content: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> <rule family="ipv4"> <source address="80.80.80.80"/> <forward-port to-addr="10.0.0.17" to-port="22" protocol="tcp" port="25"/> </rule> </zone> O.K. That isn't a miracle. BUT, every is working right till I restart the server or reload the firewalld with: "firewall-cmd --reload" Now I can't access my host 10.0.0.17 via ssh over my transit-host! I'll reach destination-host 10.0.0.87 on port 25. It looks like, my rich rule were'nt definied. :/ Any idea, how to make it reboot-save? Thanx for help ttyl, Django -- "Bonnie & Clyde der Postmaster-Szene!" approved by Postfix-God http://wetterstation-pliening.info http://dokuwiki.nausch.org http://wiki.piratenpartei.de/Benutzer:Django

1 0

CentOS 7 - DNAT with firewalld
by Django 03 Feb '16

03 Feb '16

HI, here I have an eMail with connected to a DMZ 10.0.0.0/24 network. This server holds 10.0.0.87 There are two firewall-hosts one with CentOS 6 10.0.0.10 and one with CentOS 7 10.0.0.17 The CentOS 6 has the following iptables-rule (extract): ----------------------8<----------------------8<----------------------8< *nat -A POSTROUTING -o eth1 -j MASQUERADE -A PREROUTING -i eth1 -d 217.91.103.190/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.87:25 *filter -A FORWARD -d 10.0.0.87/32 -i ppp0 -o eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT ----------------------8<----------------------8<----------------------8< If a external mailserver access the firewall, the traffic is routed to 10.0.0.87 port 25. As IP-adress from the external server I see hois public-IP. Here's the part of maillog: Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: CONNECT from [88.198.212.215]:36131 to [10.0.0.87]:25 Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: PASS OLD [88.198.212.215]:36131 Jan 26 13:03:20 vml000087 postfix/smtpd[10268]: connect from mx1.piratenpartei-bayern.de[88.198.212.215] Jan 26 13:03:31 vml000087 postfix/smtpd[10268]: disconnect from mx1.piratenpartei-bayern.de[88.198.212.215] so far so good, this work'ed fine the last 5 years ... Now I've a second network with a CentOS 7 base firewall. I've tried to adapt the roules I've mad on the old firewall. ----------------------8<----------------------8<----------------------8< # cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> </zone> # cat /etc/firewalld/zones/private.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Private</short> <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth0"/> <service name="ssh"/> <masquerade/> </zone> # cat /etc/firewalld/direct.xml <?xml version="1.0" encoding="utf-8"?> <direct> <rule priority="0" table="nat" ipv="ipv4" chain="POSTROUTING">-o eth1 -j MASQUERADE</rule> <rule priority="0" table="nat" ipv="ipv4" chain="PREROUTING">-i eth1 -d 192.168.0.17/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.87:25</rule> <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i eth1 -d 10.0.0.87/32 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT</rule> </direct> ----------------------8<----------------------8<----------------------8< The traffic over this firewall is routed to my mailserver, too. BUT I did'nt see the external customer-IP, I only can see the IP-address of my own firewall. Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: CONNECT from [10.0.0.17]:33803 to [10.0.0.87]:25 Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: WHITELISTED [10.0.0.17]:33803 Jan 26 13:04:52 vml000087 postfix/smtpd[10268]: connect from vml000017.dmz.nausch.org[10.0.0.17] Jan 26 13:04:53 vml000087 postfix/smtpd[11397]: disconnect from vml000017.dmz.nausch.org[10.0.0.17] So I think destination NAT (DNAT) isn't working on my CentOS 7 host. As I seaid on my CentOS6 host DNAT is working very well. So where's my error? in my configuration or in my head? ;) Thanx 4 help! ttyl Django -- "Bonnie & Clyde der Postmaster-Szene!" approved by Postfix-God http://wetterstation-pliening.info http://dokuwiki.nausch.org http://wiki.piratenpartei.de/Benutzer:Django

1 1

Python hashlib and ripemd160
by Alice Wonder 03 Feb '16

03 Feb '16

Hi - I think the patent monster has struck again. rmd = hashlib.new('ripemd160',binascii.unhexlify(someString)).hexdigest() That fails - ValueError: unsupported hash type From some googling, it appears that the supported hash types are from OpenSSL and that means the OpenSSL in CentOS doesn't support ripemd160. I've worked around other stuff missing from CentOS OpenSSL by building LibreSSL and linking against that but python is central to the operation of CentOS and I do not want to mess with replacing the CentOS packaging of python. Is there an alternate way to get a ripemd160 hash in python on CentOS ?

2 3

In A UEFI World, "rm -rf /" Can Brick Your System
by m.roth＠5-cent.us 02 Feb '16

02 Feb '16

Excerpt: Running rm -rf / on any UEFI Linux distribution can potentially perma-brick your system. As a public service announcement, recursively removing all of your files from / is no longer recommended. On UEFI distributions by default where EFI variables are accessible via /sys, this can now mean trashing your UEFI implementation. There is this systemd bug report requesting that UEFI variables be mounted as read-only by default. Lennart Poettering had initially responded and simply said, "Well, there are tools that actually want to write it. We also expose /dev/sda accessible for root, even though it can be used to hose your system. The ability to hose a system is certainly reason enought to make sure it's well protected and only writable to root. But beyond that: root can do anything really." He then closed the ticket. --- end excerpt --- <http://www.phoronix.com/scan.php?page=news_item&px=UEFI-rm-root-directory> "And they closed the ticket"? That tuxedo on the cockroach is so elegent! Ok, *now* tell me why we shouldn't hate systemd? mark

10 22

Re: [CentOS] NICs order
by m.roth＠5-cent.us 02 Feb '16

02 Feb '16

Gordon Messmer wrote: > On 02/01/2016 07:00 AM, Leroy Tennison wrote: >> The issue here may be systemd > ... >> Web documentation at freedesktop.org says net.ifnames needs to be set to zero, I found just the opposite but if it doesn't work for you try both before giving up. > > Just to clarify: net.ifnames=0 disables the systemd/udev interface renaming feature. biosdevname=0 disables the biosdevname interface renaming feature, which is completely separate. If you want the traditional, non-deterministic Linux interface naming, you must specify both. You call it "deterministic". I will note that it is, in fact, straight from Sun - 20 years ago, that was the naming on the Sparc Server that I first picked up sysadmin work. Which was fine... FOR SUN HARDWARE. For admins and users, it's *really* NOT a great idea, given that the system could have a m/b from any OEM, and even trying to set up a std. kickstart is a pain with that, much less anything more arcane. Why ethx, with the option of adding the firmware MAC address, is such a bad idea, I have no clue. > > Also, if you add rules to /etc/udev/rules.d, you should rebuild your initrd. ?!?!?!?! THAT I had never considered, nor done, and I'm sure that in CentOS 6, I've changed things there, and just rebooted. Oh, great, I'm getting flashes of WinDoze. Thanks for that info, though. I need to remember that. mark

3 2

Folding At Home
by Mark LaPierre 02 Feb '16

02 Feb '16

Hey Y'all, I have the Stanford University Folding At Home project running on three of my machines. I had them all set up so that I could control them all from my main machine, 192.168.15.101, but some time ago something changed so that I can no longer connect to the FAH clients on the other two machines. I figured it wasn't really important so I would look into it later. Well time has passed and my Christmas break is almost passed too to I guess this is the time to figure it out. I can still SSH onto both machines. I can ping both machines. When I open the FAH Control on my machine connection to clients running on 192.168.15.105 and 192.168.15.107 fails. I'm assuming that there would be an entry in a log on those two machines detailing the failed connection attempt. What log file should I be looking at? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

2 5

NICs order
by Daniel Ruiz Molina 01 Feb '16

01 Feb '16

Hi, After installing CentOS 7 in a server with 2 NICs, system detects eth0 and eth1 in reserve order. I would like to have eth1 as eth0 and eth0 as eth1. I have forced HWADDR attribute in /etc/sysconfig/network-scripts/ifcfg-etc{0,1}, but after rebooting, order is the same... How can I solve it? Thanks.

2 1

CentOS 7 and network printers: FYI
by m.roth＠5-cent.us 01 Feb '16

01 Feb '16

I got an email from a user that I'd just handed a new CentOS 7 workstation to, wondering where all the printers were. It took some investigation to find /etc/cups/cups-browsed.conf, and see, in it, at the very bottom of the file: # NOTE: This file is not part of CUPS. You need to start & enable cups-browsed service. Which appears to be brand new with 7, and I have not seen any mention of it. Enabled and started, and the network printers are visible on the cups localhost web page->printers. mark

2 3

Re: [CentOS] NICs order
by Ricardo J. Barberis 01 Feb '16

01 Feb '16

El Lunes 01/02/2016, Daniel Ruiz Molina escribió: > Hi, > > After installing CentOS 7 in a server with 2 NICs, system detects eth0 > and eth1 in reserve order. I would like to have eth1 as eth0 and eth0 as > eth1. I have forced HWADDR attribute in > /etc/sysconfig/network-scripts/ifcfg-etc{0,1}, but after rebooting, > order is the same... > > How can I solve it? > > Thanks. You could put the MAC addresses in /etc/udev/rules.d/60-net.rules, e.g.: SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="11:22:33:aa:bb:cc", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0" SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="44:55:66:dd:ee:ff", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1" But that never worked reliably for me, no matter what I tried. In the end I had to use different names instead of eth0 and eth1, like: SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="11:22:33:aa:bb:cc", ATTR{type}=="1", KERNEL=="eth*", NAME="nic0" SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="44:55:66:dd:ee:ff", ATTR{type}=="1", KERNEL=="eth*", NAME="nic1" And also rename /etc/sysconfig/network-scripts/ifcfg-ethX to ifcfg-nicX and modify them accordingly. HTH, -- Ricardo J. Barberis Usuario Linux Nº 250625: http://counter.li.org/ Usuario LFS Nº 5121: http://www.linuxfromscratch.org/ Senior SysAdmin / IT Architect - www.DonWeb.com

4 5

LUSTRE Install Guide
by Ben Archuleta 01 Feb '16

01 Feb '16

Hi All, I am in the process of trying to install Lustre on CentOS 7 and I was wondering if anyone could point me to any good documentation. I found https://wiki.hpdd.intel.com/pages/viewpage.action?pageId=8126821 but this really doesn’t help. I am trying to install version 2.7.1. Regards, Ben

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2016