Discuss February 2016

discuss@lists.centos.org

126 participants
102 discussions

Problems with ProxyPass to a local ip (using SSL)
by C. L. Martinez 03 Mar '16

03 Mar '16

Hi all, I am trying to setup an apache virtualhost under CentOS 6.7 that needs to redirects requests from port 444 to port 5100 in its local ip. But I am doing some mistakes because every time I'm receiving a loop error. My actual httpd's config for this virtualhost is: NameVirtualHost 192.168.1.5:444 <VirtualHost 192.168.1.5:444> ServerName myweb01.local.domain ErrorLog logs/ssl_error.log CustomLog logs/ssl_access.log combined CustomLog logs/ssl_request.log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" LogLevel info SSLEngine on SSLProxyEngine On SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!ADH:!EXPORT56:!EXP:!eNULL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2 SSLCertificateFile /etc/httpd/certs/server.crt SSLCertificateKeyFile /etc/httpd/certs/server.key ProxyRequests Off ProxyPreserveHost On ProxyPass / http://192.168.1.5:5100/ ProxyPassReverse / http://192.168.1.5:5100/ RequestHeader set X-Forwarded-Proto "https" RequestHeader set X-Forwarded-Port "444" RewriteEngine On RewriteRule ^/(.*) https://myweb01.local.domain:444/$1 [R,L] </VirtualHost> As you can see, I need to do a redirection to port 5100 from 444 port and protect it using ssl. I've configured iptables rules to drop connections to port 5100 directly: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 444 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT Any idea how to accomplish/resolve this? Thanks. -- Greetings, C. L. Martinez

3 6

CentOS 7.2, nouveau won't go away
by m.roth＠5-cent.us 03 Mar '16

03 Mar '16

Hi, folks, Fully updated 7.2 system. I installed the correct proprietary NVidia driver (the user's expensive proprietary visualization software won't run with nouveau), I've put nouveau.modeset=0 rd.driver.blacklist=nouveau on the kernel line for grub2, and even yum removed the nouveau driver and built a new initrd... which won't boot, it seems to start and than does nothing, with a black screen, and this is just while booting, before it goes to graphical mode. If I boot the as-built current initramfs, it loads nouveau, though one of the modules listed if I do lsmod | grep nou shows nvidia, in addition to nouveau. So, in 7, what do I have to do to make nouveau go away? Is it as simple as creating an /etc/X11/xorg.conf, or...? mark

4 6

RasPi 3.x and RH-based Distro (Slightly OT)
by Benjamin Smith 02 Mar '16

02 Mar '16

With the release of the Rasberry Pi 3.x, I think we have a platform I could jump on board with. Performance has just been lacking until now! But I really don't want to jump the "RH ship" - I'd rather stick with an environment I am comfortable in. Can anybody comment here on the best way to run RHEL/Fedora/CentOS on a RasPi, or if there's even a useful port? Thanks Ben S

6 7

ssh issues with centos 6
by William Warren 01 Mar '16

01 Mar '16

I have a new centos 6 install. Randomly i get out of memory messages and my ssh file transfer dies. I have tried this in filezilla as well as winscp. I have disabled motd in ssh and i also had entropy problems so i enacted rngd -r /dev/urandom -o /dev/random but did not stop the out of memory errors. I am seeing the below in the logs. It only occurs during ssh file transfers. Feb 28 17:18:19 web1 t of memory [13604]

3 2

Pi 2 Alternatives
by Chris Olson 01 Mar '16

01 Mar '16

We have a requirement for a new application that will be used fixed, portable, and mobile. The hardware requirements drive the need for networking as well as some general purpose and special purpose interfaces. The software requirements are quite simple in comparison to many of our much larger systems with similar hardware requirements. We are not significantly restricted in choice of storage peripherals or other devices that may be needed. We believe that a small, single board computer will meet all requirements as long as it can run Linux. We have identified the need for approximately six prototyping units to support the initial production of about 200 to 300 operational systems. Our development and deployment time frame does not drive the need for an extremely rapid product decision, and there are pre-planned upgrade cycles over the next five years. An internal group has achieved a significant head of steam in support of using the Pi 2 Model B. The support enthusiasm may be partly technical and partly the hype associated with jumping into the Pi community. The number of suppliers does appear to support our supply chain and sustainment requirements, however the Linux available for the Pi 2 does not appear to be optimal. It would be better if there were choices that include a standard Linux distribution such as CentOS. This certainly seems like one of those situations where a trade of single board computer products is appropriate and achievable. There are products similar to the Pi 2 capable of running a more standard Linux distribution that we might consider. Does anyone have an experience-based single board computer recommendation? Thanks in advance for any product recommendations.

4 3

Hung kernel task on CentOS 7.2, fprintd and libvirtd
by Warren Young 01 Mar '16

01 Mar '16

A CentOS 7 box here recently started being very slow to give the Password prompt when using sudo. (25 seconds!) I eventually tracked this down to the following complaint in the kernel message log: > Feb 26 12:55:05 badboy kernel: INFO: task fprintd:1932 blocked for more than 120 seconds. > Feb 26 12:55:05 badboy kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > Feb 26 12:55:05 badboy kernel: fprintd D ffff88021f7300f8 0 1932 1 0x00000080 > Feb 26 12:55:05 badboy kernel: ffff88022354bdc0 0000000000000086 ffff8800c54e8000 ffff88022354bfd8 > Feb 26 12:55:05 badboy kernel: ffff88022354bfd8 ffff88022354bfd8 ffff8800c54e8000 ffff88021f7300f0 > Feb 26 12:55:05 badboy kernel: ffff88021f7300f4 ffff8800c54e8000 00000000ffffffff ffff88021f7300f8 > Feb 26 12:55:05 badboy kernel: Call Trace: > Feb 26 12:55:05 badboy kernel: [<ffffffff8163b9e9>] schedule_preempt_disabled+0x29/0x70 > Feb 26 12:55:05 badboy kernel: [<ffffffff816396e5>] __mutex_lock_slowpath+0xc5/0x1c0 > Feb 26 12:55:05 badboy kernel: [<ffffffff81638b4f>] mutex_lock+0x1f/0x2f > Feb 26 12:55:05 badboy kernel: [<ffffffff81449729>] read_descriptors+0x39/0x110 > Feb 26 12:55:05 badboy kernel: [<ffffffff8125c28b>] ? read+0x6b/0x1f0 > Feb 26 12:55:05 badboy kernel: [<ffffffff8125c2fb>] read+0xdb/0x1f0 > Feb 26 12:55:05 badboy kernel: [<ffffffff811de43c>] vfs_read+0x9c/0x170 > Feb 26 12:55:05 badboy kernel: [<ffffffff811def8f>] SyS_read+0x7f/0xe0 > Feb 26 12:55:05 badboy kernel: [<ffffffff81645909>] system_call_fastpath+0x16/0x1b Since fprintd is the fingerprint reader daemon and this server doesn’t have such a peripheral, I removed the service. Now sudo is fast again. [*] Although that solves my immediate problem, while debugging all of this I noticed substantially the same error message also appearing for libvirtd: > Feb 26 12:57:05 badboy kernel: INFO: task libvirtd:1514 blocked for more than 120 seconds. > Feb 26 12:57:05 badboy kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. > Feb 26 12:57:05 badboy kernel: libvirtd D ffff88021f7300f8 0 1514 1 0x00000080 > Feb 26 12:57:05 badboy kernel: ffff8800c08ffde0 0000000000000086 ffff8800c550e780 ffff8800c08fffd8 > Feb 26 12:57:05 badboy kernel: ffff8800c08fffd8 ffff8800c08fffd8 ffff8800c550e780 ffff88021f7300f0 > Feb 26 12:57:05 badboy kernel: ffff88021f7300f4 ffff8800c550e780 00000000ffffffff ffff88021f7300f8 > Feb 26 12:57:05 badboy kernel: Call Trace: > Feb 26 12:57:05 badboy kernel: [<ffffffff8163b9e9>] schedule_preempt_disabled+0x29/0x70 > Feb 26 12:57:05 badboy kernel: [<ffffffff816396e5>] __mutex_lock_slowpath+0xc5/0x1c0 > Feb 26 12:57:05 badboy kernel: [<ffffffff81638b4f>] mutex_lock+0x1f/0x2f > Feb 26 12:57:05 badboy kernel: [<ffffffff81449100>] manufacturer_show+0x20/0x50 > Feb 26 12:57:05 badboy kernel: [<ffffffff813f1c20>] dev_attr_show+0x20/0x60 > Feb 26 12:57:05 badboy kernel: [<ffffffff8125928a>] sysfs_read_file+0x9a/0x1a0 > Feb 26 12:57:05 badboy kernel: [<ffffffff811de43c>] vfs_read+0x9c/0x170 > Feb 26 12:57:05 badboy kernel: [<ffffffff811def8f>] SyS_read+0x7f/0xe0 > Feb 26 12:57:05 badboy kernel: [<ffffffff81645909>] system_call_fastpath+0x16/0x1b I don’t want to employ the same solution in this case — i.e. disable libvirtd — because while I don’t yet use KVM on that server, I actually had plans to do so soon. I could host those VMs elsewhere, but that feels like sweeping the problem under the rug. I want to fix this, but I’m now stuck. I’ve ruled out several possible causes already: 1. It isn’t DNS. DNS responds quickly. 2. It isn’t a flaky OS drive. Swapping the spinning rust drive out for an SSD was already on the wish list for this system, so I took the opportunity to reinstall the OS fresh on a brand new SSD. The same problem occurred shortly after booting CentOS 7.2 for the first time, and it continues to happen periodically. The only thing I’ve copied over from the old spinning drive so far is /home and /usr/local, and I can’t see how that could affect the kernel. Besides, the problem still occurs while booted into single-user mode. 3. It isn’t the RAID card. A RAID verify pass completed successfully, as did smartctl -t long tests on all of the individual drives. I even disabled the RAID card’s OPROM and blacklisted its driver at one point, just to see if the driver or RAID BIOS were the cause of the problem. I haven’t actually pulled the card yet, but that seems unlikely to solve anything, given that the array seems to be storing data reliably. 4. It isn’t the RAM. It just passed a memtest86+ run. That probably exonerates the CPU and north bridge, too. (I used v4.20 from the CentOS 7.2 install ISO.) 5. It isn’t stale packages. The OS reinstall proves that. It’s currently running the tip of CentOS 7.2 and still showing the same symptoms. 6. It isn’t high-uptime kernel space cruft, since it’s been rebooted a bunch of times during all of this, including several hard reboots. Rebooting is especially painful at the moment because the system hangs on shutdown waiting for libvirtd to respond. While I had fprintd installed, that was causing 3-minute hangs on boot, too. Very frustrating! [*] In case it isn’t clear how fprintd could affect sudo, it’s because fprintd installs a PAM module, and sudo uses PAM for authentication. If fprintd is stuck, the PAM call stalls until it gives up and moves on. I tracked this down with strace. The 25 seconds above is the timeout value passed to poll(2); that timeout is hit while sudo (via PAM) is trying to talk to dbus, since apparently fprintd communicates via dbus. Because the problem is in PAM and not sudo, it also affected su. It did not affect console or ssh user logins for some reason. I’m posting these details in case this diagnosis helps someone. While chasing this, I found a bunch of postings on the net from people who have run into such problems before, but none of the threads mentioned this particular failure mode. For all I know, I’m the first person it’s ever happened to, so this needs to be in the archives.

2 2

Discarding empty lines in rsyslog
by Anand Buddhdev 29 Feb '16

29 Feb '16

Dear CentOS folk, I've been try to solve one issue with rsyslog on CentOS 6, but can't figure it out. I've searched through rsyslog documentation, and used Google but not found anything that matches my issue. I'm sending output of a program to rsyslog using "logger -t progname". I've got the following config snippet in /etc/rsyslog.d: $FileCreateMode 0644 if $programname == 'progname' then /var/log/prog.log & ~ This works. However, the program sometimes produces blank lines its output, and they get logged by rsyslog as well. I want to make rsyslog ignore empty lines. I am trying the following, but it doesn't work: if $programname == 'progname' and $msg != '\n' then /var/log/prog.log Does anyone know how to get this to work in rsyslog? This is rsyslog 5 on CentOS 6. Regards, Anand

1 1

Odd selinux complaints on new, fully updated CentOS 7
by m.roth＠5-cent.us 29 Feb '16

29 Feb '16

Just installed 7.2, and I'm seeing this - is this a bug in the policy? ************************** SELinux is preventing systemd-readahe from add_name access on the directory .readahead.new. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow systemd-readahe to have add_name access on the .readahead.new directory Then you need to change the label on .readahead.new Do # semanage fcontext -a -t FILE_TYPE '.readahead.new' where FILE_TYPE is one of the following: device_t, init_var_run_t, readahead_var_lib_t, readahead_var_run_t, root_t, var_run_t. Then execute: restorecon -v '.readahead.new' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that systemd-readahe should be allowed add_name access on the .readahead.new directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep systemd-readahe /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:readahead_t:s0 Target Context system_u:object_r:mnt_t:s0 Target Objects .readahead.new [ dir ] Source systemd-readahe Source Path systemd-readahe Port <Unknown> Host <hostname> Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-60.el7_2.3.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name <hostname> Platform Linux <hostname> 3.10.0-327.10.1.el7.x86_64 #1 SMP Tue Feb 16 17:03:50 UTC 2016 x86_64 x86_64 Alert Count 4 First Seen 2016-02-29 10:06:27 EST Last Seen 2016-02-29 16:50:22 EST Local ID 0ba32e6a-e502-45be-a2dc-cda4c380a2bb Raw Audit Messages type=AVC msg=audit(1456782622.230:435): avc: denied { add_name } for pid=410 comm="systemd-readahe" name=".readahead.new" scontext=system_u:system_r:readahead_t:s0 tcontext=system_u:object_r:mnt_t:s0 tclass=dir Hash: systemd-readahe,readahead_t,mnt_t,dir,add_name ***************************************** mark

1 0

Changing default file type in Centos 6
by H 28 Feb '16

28 Feb '16

It turns out my markdown files - extension .md - are of the "Genesis ROM" file type in Centos 6. Googling did not turn up any obvious places to change this in Gnome - neither in my local directory or in /etc/gnome. Where would I be able to change this default file type for files with the extension .md? I have already changed the default application to geany (with the markdown extension.) Thank you.

4 12

Restoring session status
by H 27 Feb '16

27 Feb '16

I am running CentOS 6.6 on both a couple of servers and on a laptop. When I let the laptop sleep, window states and positions are restored correctly when I awaken it. However, when I shut down the laptop, later turn it on and log in, none of the terminal windows and directory windows are restored correctly to e.g. minimized state, instead they are restored to when they last were in use. Naturally, this is a little bit annoying: have I missed a setting somewhere? Thanks.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2016