Discuss April 2016

discuss@lists.centos.org

150 participants
130 discussions

DNSSEC / Security stats (forked from php thread)
by Alice Wonder 27 Apr '16

27 Apr '16

I don't have a source, I'd have to dig through my browser history, but I looked at some of these stats just last month. Roughly 2% of the top 1000 domains in the United States had deployed DNSSEC - which I *think* is double what it was a year ago. Roughly 7% of ISP recursive DNS servers enforce DNSSEC. Comcast does and Google's public DNS does. Those are the big ones that enforce DNSSEC on their recursive servers. I do not see any statistics for DANE adoption, either on port 443 or port … [View More]25 (the two where it is most common currently) Roughly 20% of all e-mail traffic in the United States was not encrypted. Of the e-mail traffic that was not even encrypted, a large percentage of it was spam. What wasn't spam was often sent by scripting languages (e.g. php) running blogs or other web services. Only a small percentage of e-mail sent by clients through a SMTP server was not encrypted in the MTA to MTA transfer. -=-=- What we can do as sysadmins, we can run unbound on our local machines, it defaults to DNSSEC enforcing. That way we don't have to worry if the recursive resolver our ISP uses is part of the 7%. Linode enforced last time I checked, but I don't know about other hosting services. Still safer to just run unbound listening only on the localhost, and configure /etc/resolv.conf to point to ::1 (or 127.0.0.1) If at all possible, deploy DNSSEC on any zones you have control over. Even without DANE, DNSSEC greatly improves security for the 7% (and growing) recursive resolvers that enforce DNSSEC. Before deploying DNSSEC do a lot of reading on it, because if you screw it up, those 7% enforcing recursive resolvers won't resolve your zone. I personally use a 2048-bit KSK and a 1024-bit ZSK. The KSK is what you have to get the DS record for uploaded to your TLS, and it should be rotated once a year. The ZSK is just in your zone, best practice says to rotate once a month but I rotate once a week, every Sunday. It should be automated, so it doesn't hurt to do it more often than the once a month. Doing it once a week means if my zone signing server is down or under DDoS when the signing happens, it isn't a big deal, because it happens 4X the best practices recommended anyway. With our web applications that send e-mail, don't use the SMTP services of the scripting language. Yes it is cool that you can play SMTP server with PHP etc. and yes, if PHP is built against a TLS library it can encrypt, but don't use PHP to play SMTP. Run postfix on the web server and have your web applications connect to the SMTP on the local host. This isn't just for the benefit of encrypting, it also lets you do things like sign the message with DKIM and if your postfix is new enough, check the DANE records of the MX record the message is being sent to. I don't know why so many web applications try to play SMTP themselves, it is a very bad habit and usually results in mail being sent without TLS and sometimes rejected by spam filters if the domain it allegedly comes from uses DKIM but the web application doesn't. -=-=- Hope I didn't bore too many people, or offend anyone, these are just my opinions and this is a topic I am passionate about. I think system administrators need to do a better job at securing Internet infrastructure. [View Less]

1 0

CentOS-announce Digest, Vol 134, Issue 14
by centos-announce-request＠centos.org 27 Apr '16

27 Apr '16

1 0

Storage cluster advise, anybody?
by Valeri Galtsev 27 Apr '16

27 Apr '16

Dear Experts, I would like to ask everybody: what would you advise to use as a storage cluster, or as a distributed filesystem. I made my own research of what I can do, but I hit a snag with my seemingly best choice, so I decided to stay away from it finally, and ask clever people what they would use. My requirements are: 1. I would like to have one big (say, comparable to petabyte) filesystem, accessible on more than one machine, composed of disk space leftovers on a bunch of machines … [View More]having 1 gigabit per second ethernet connections 2. It can be a bit slow, as filesystem one would need for backups onto it (say, using bacula or bareos), and/or for long term storage of large datasets, portions of which can be copied over to faster storage for processing if necessary. I would be thinking in 1-2 TB of data written to it daily. 3. It would be great to have it single machine failure/reboot resilient 4. metadata machines should be redundant (or at least backup medatada host should be manually convertible into master metadata host if fatal failure to master or corruption of its data happens) What I would like to avoid/exclude: 1. Proprietary commercial solutions, as: a. I would like to stay on as minimal budget as possible b. I want to be able to predict that it will exist for long time, and I have better experience with my predictions of this sort about open source projects as opposed to proprietary ones 2. Open source solutions using portions of proprietary closed source binaries/libraries (e.g., I would like to stay away from google proprietary code/binaries/libraries/modules) 3. Kernel level modifications. I really would like to have this independent of OS as much as I can, or rather available on multiple OSes (though I do not like Java based things - just my personal experience with some of them). I have a bunch of Linux boxes and a bunch of FreeBSD boxes, and I do not want to exclude neither of them if possible. Also, the need to have custom Linux kernel specifically scares me: Linux kernels get critical updates often, and having customizations lagging behind the need of critical update is as unpleasant as rebooting the machine because of kernel update is. I'm not too scared of a "split nature" projects: proprietary projects having open source satellite. I have mixed experience with those, using open source satellite I mean. Some of them are indeed not neglected, and even though you may be missing some features commercial counterpart has, some are really great ones: they are just missing commercial support, and maybe having a bit sparse documentation, thus making you to invest more effort into making it work, which I don't mind: I can earn my sysadmin's salary here. I would say I more often had good experience with those than bad one (and I have a list of early indications of potential bad outcome, so I can more or less predict my future with this kind of projects). <rant> I really didn't mean to write this, but I figure it probably will surface once I start getting your advices, so here it is. I did my research having my requirements in mind and came up with the solution: moosefs. It is not reviewed much, no reviews with criticism at all, and not much you can ("I could" I should say) find howtos about customizations, performance tuning etc. It installs without a hitch. It runs well, until you start stress writing a lot to it in parallel, then it started performing exponentially badly for me. Here is where extensive attempts to find performance tuning documentation faces lack of success. What made my decision to never ever use it in a future was the following. I started migrating data back from moosefs to local UFS (that is FreeBSD box) filesystem using rsync command. What I observed was: source files after they have been touched by rsync changed their timestamps. As if instead of creation timestamp it is an access timestamp on moosefs. This renders rsync from moosefs useless, as you can not re-run failed rsync, and you obliterate some of metadata of the source ("creation" timestamp). I wrote e-mail to sourceforge moosefs mail list, mentioning all this and the fact that I am using open source moosefs. Next day they replied asking whether I use version 3."this" or version 3."that", as they want to know in which of them they have a bug. Whereas latest open source version they have everywhere, including sourceforge is older version: 2.0.88. Basically, my decision was made. Sorry for venting it out here, but I figured, it will happen some moment when I will get your advises. </rant> Thanks a lot for all your advises! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++ [View Less]

6 7

username.pem
by m.roth＠5-cent.us 26 Apr '16

26 Apr '16

Hi, folks, Our system gets/creates /var/lib/ssh-x509-auth/<username>,pem, then deletes it when the log out. selinux (in permissive mode) complains. First, I changed the context to cert_t, and *now* it complains that ksh93 wants write, etc access on the directory. grep ssh-x509-auth /var/log/audit/audit.log | audit2allow offers me this: #============= sshd_t ============== allow sshd_t cert_t:dir write; allow sshd_t var_lib_t:file { write getattr create open ioctl }; So: first, is … [View More]

2 1

cron
by Marcin Trendota 26 Apr '16

26 Apr '16

What the heck is wrong with cron? */1 * * * * nobody /usr/bin/php /var/www/html/osticket/api/cron.php in /etc/cron.d doesn't get executed at all (ran from console works of course!). But the SAME file in /tmp runs flawlessly: */1 * * * * nobody /usr/bin/php /tmp/cron.php It's CentOS7 on VPS with no SELinux. I've noticed similiar behavior before (on bare metal server with SELinux). -- Over And Out MoonWolf

13 23

evolution libsoup and samba bug 765106
by Andreas Benzler 26 Apr '16

26 Apr '16

Hello everyone, while i was play around with winhq install winbind-clients. After this I never can open evolution with exchange ews connector. https://bugzilla.gnome.org/show_bug.cgi?id=765106 I patches libsoup by my self diff -up ./libsoup/soup-auth-ntlm.c.prev ./libsoup/soup-auth-ntlm.c --- ./libsoup/soup-auth-ntlm.c.prev 2016-04-15 14:18:02.680276592 +0200 +++ ./libsoup/soup-auth-ntlm.c 2016-04-15 15:20:00.337116508 +0200 @@ -359,6 +359,7 @@ soup_auth_ntlm_update_connection (SoupCo … [View More]

1 0

CentOS-announce Digest, Vol 134, Issue 13
by centos-announce-request＠centos.org 26 Apr '16

26 Apr '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." … [View More]Today's Topics: 1. CESA-2016:0684 Moderate CentOS 5 nspr Security Update (Johnny Hughes) 2. CESA-2016:0684 Moderate CentOS 5 nss Security Update (Johnny Hughes) 3. CESA-2016:0685 Moderate CentOS 7 nspr Security Update (Johnny Hughes) 4. CESA-2016:0685 Moderate CentOS 7 nss-util Security Update (Johnny Hughes) 5. CESA-2016:0685 Moderate CentOS 7 nss-softokn Security Update (Johnny Hughes) 6. CESA-2016:0685 Moderate CentOS 7 nss Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 25 Apr 2016 13:19:01 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0684 Moderate CentOS 5 nspr Security Update Message-ID: <20160425131901.GA13582(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0684 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0684.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 2542e599e93d78a8b51ee1e9ad58b24edf8d70029defc49f8b032e4b5782c6bf nspr-4.11.0-1.el5_11.i386.rpm 5dedec41a954bc0562095cd6d5c43165056c256a66cf1389df0d8414e7c96105 nspr-devel-4.11.0-1.el5_11.i386.rpm x86_64: 2542e599e93d78a8b51ee1e9ad58b24edf8d70029defc49f8b032e4b5782c6bf nspr-4.11.0-1.el5_11.i386.rpm f54f893419cc8223d491056a96e33c327a1a6b3e6585c9d91edcaf227a546dc3 nspr-4.11.0-1.el5_11.x86_64.rpm 5dedec41a954bc0562095cd6d5c43165056c256a66cf1389df0d8414e7c96105 nspr-devel-4.11.0-1.el5_11.i386.rpm d0bc78381c24c31a38ea4297e6ec8f6b2dceb676fa83be84d07d8213f9b1c441 nspr-devel-4.11.0-1.el5_11.x86_64.rpm Source: 27c20b9b8a0d828b87cf67ca091669580d1506904edac211c643a8ab5f2fcaa6 nspr-4.11.0-1.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 2 Date: Mon, 25 Apr 2016 13:20:12 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0684 Moderate CentOS 5 nss Security Update Message-ID: <20160425132012.GA13713(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0684 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0684.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 22a25171db9d8a514be909e7a8eef944e73b3194d6dc51c1e4e351adfb62035e nss-3.21.0-6.el5_11.i386.rpm 28ae63c316cc4f13f29e8cb0dfcf13b004dd591386eeed974b5721adf1b62f5d nss-devel-3.21.0-6.el5_11.i386.rpm bd69e9a3c779a8fc3a9c5f1d2db5cecc2c30b92fbb7a3d1f65cdc86f4cf04339 nss-pkcs11-devel-3.21.0-6.el5_11.i386.rpm d70335c291e0b4b34b7e7e4294a284b59d26617edb92d601b2e281c3e48995aa nss-tools-3.21.0-6.el5_11.i386.rpm x86_64: 22a25171db9d8a514be909e7a8eef944e73b3194d6dc51c1e4e351adfb62035e nss-3.21.0-6.el5_11.i386.rpm 891293a24f0e8664504d9bf777844c333efb8f77d7bed69163857dea240e0425 nss-3.21.0-6.el5_11.x86_64.rpm 28ae63c316cc4f13f29e8cb0dfcf13b004dd591386eeed974b5721adf1b62f5d nss-devel-3.21.0-6.el5_11.i386.rpm c442280aab2f2064a0ef4b0794ac1f926422eb44a1e8c0759a54f6f0f71e9cce nss-devel-3.21.0-6.el5_11.x86_64.rpm bd69e9a3c779a8fc3a9c5f1d2db5cecc2c30b92fbb7a3d1f65cdc86f4cf04339 nss-pkcs11-devel-3.21.0-6.el5_11.i386.rpm f412a80e0611d89981d883653a2bb309afbd20dd825770d45ef0d267e6ee18e7 nss-pkcs11-devel-3.21.0-6.el5_11.x86_64.rpm ae5698473b4847dc48f6e13ed0747c092487843889f88df8741692076fd6ff25 nss-tools-3.21.0-6.el5_11.x86_64.rpm Source: 4813046342f6562e761c0d1f6c782de5cebaa62fa06523482498dcd1b2c2e8ea nss-3.21.0-6.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 3 Date: Mon, 25 Apr 2016 17:49:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0685 Moderate CentOS 7 nspr Security Update Message-ID: <20160425174911.GA16668(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0685 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0685.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: daf7526f2f1ccc56ec97e57940cde39049a4a111951b01197b2c18b4bc7ec1cb nspr-4.11.0-1.el7_2.i686.rpm d784f223e384f756a5c594925512c5fd6d46aaad66f85936b51453a0dc2dbd8a nspr-4.11.0-1.el7_2.x86_64.rpm 56037499e8d01dd812e5ff3a2752c9aa108dd45fd816269abae28fd6eaa751b1 nspr-devel-4.11.0-1.el7_2.i686.rpm 5b3fbd8326f1249e287423a753d2b249e4d7281c669943c367a62d6f839dfde5 nspr-devel-4.11.0-1.el7_2.x86_64.rpm Source: 6520f99cd5afa95d605bcc653f47c828e2fb491a548e057d0c99e91a57a1dac3 nspr-4.11.0-1.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Mon, 25 Apr 2016 17:49:24 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0685 Moderate CentOS 7 nss-util Security Update Message-ID: <20160425174924.GA16739(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0685 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0685.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 73472239f7a39dfce534c7a7d354a0c47c56d4164bd751e9709285dc52526a52 nss-util-3.21.0-2.2.el7_2.i686.rpm ebe0bba24d7b4477830fe4dbb025e91ca30a619e5806241a84c7e4c420bab53c nss-util-3.21.0-2.2.el7_2.x86_64.rpm e512d5a51c14dca89b2207be8a6aa792cf3e5e549f4f525f5d26800b705b8a72 nss-util-devel-3.21.0-2.2.el7_2.i686.rpm 2013f4efb5ccdee9431259c717c2f473dff61f0b26f39a2e46012764f7a127c5 nss-util-devel-3.21.0-2.2.el7_2.x86_64.rpm Source: e90e5e5834289fae968dd2d04f9d563d7a67e3c733ebc2291b7ab131f93c5e14 nss-util-3.21.0-2.2.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 5 Date: Mon, 25 Apr 2016 17:49:35 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0685 Moderate CentOS 7 nss-softokn Security Update Message-ID: <20160425174935.GA16820(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0685 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0685.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3119ce33b30bd2aee2e386f0a3f2f01c90c9869ae2cb39a685f913e7a4d0e14a nss-softokn-3.16.2.3-14.2.el7_2.i686.rpm d207816db9a598d15c0856a925b28221f4166968fba76d09aa01aa9ea6c44170 nss-softokn-3.16.2.3-14.2.el7_2.x86_64.rpm e544515243939f744d849b645cfb308bf0d4f73e57c29d52d4023fb264b61298 nss-softokn-devel-3.16.2.3-14.2.el7_2.i686.rpm 5e8c6639e808aaa869b50e9c1c5b827ab6960c5dcc371c1ba42b4dddbae6888e nss-softokn-devel-3.16.2.3-14.2.el7_2.x86_64.rpm c579edfa53c72797701474fbbbc1c19d90ed7c407046d7718e25234b0887acb7 nss-softokn-freebl-3.16.2.3-14.2.el7_2.i686.rpm 9253b359efea3686548eeb043ed0e0bf5e859a677c98452e1bec39d500756e94 nss-softokn-freebl-3.16.2.3-14.2.el7_2.x86_64.rpm 871ddd52d4894f9a515683607b009e206dd7c181158f5a7bb1f88349236fbbc8 nss-softokn-freebl-devel-3.16.2.3-14.2.el7_2.i686.rpm bccc6cb31656273c92f1288717bcc7f8578b3c42670433812f68e9164dd326f2 nss-softokn-freebl-devel-3.16.2.3-14.2.el7_2.x86_64.rpm Source: 698e112d5ce13a9e9703bac655fe9d2a75fa85bc828af64a965bbc0e880c62d2 nss-softokn-3.16.2.3-14.2.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 6 Date: Mon, 25 Apr 2016 17:49:47 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:0685 Moderate CentOS 7 nss Security Update Message-ID: <20160425174947.GA16905(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:0685 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-0685.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: acc0e05d8f247791db76ab9b21359abc7908c1ab9ead506964b52955287fe25b nss-3.21.0-9.el7_2.i686.rpm 33e2a1aa657f809c53449627200616b683de444300a5b2c2a79510e3e5912b00 nss-3.21.0-9.el7_2.x86_64.rpm bce90a8604496832d35d0cfefa05a552f9f3e1d866d5f6dfb0c1763d5ad34009 nss-devel-3.21.0-9.el7_2.i686.rpm ab4370a426efcdbf15bc1730f3a077150a597edb103ebbabaceb39d84f0fb96c nss-devel-3.21.0-9.el7_2.x86_64.rpm 87f7e4956ae9aeff3821b2b28b9f3500b94b0037d9280b10149833b3e4a65902 nss-pkcs11-devel-3.21.0-9.el7_2.i686.rpm e1ac83844836b6605c439bb5fa70be50163b9154d27ffcb45fc01c183fdc9c29 nss-pkcs11-devel-3.21.0-9.el7_2.x86_64.rpm 2a0881f7703e23a95aa8db53858285793eb30ceb198a7a20fa816c60e472a15d nss-sysinit-3.21.0-9.el7_2.x86_64.rpm abb98d8a2a2737ab4031c145c1503cf31bb3b2b54983547e2675b0b08805eaf6 nss-tools-3.21.0-9.el7_2.x86_64.rpm Source: 7b8295c752cbd420b5ae52a8b4aa8fa9b6979c57f9caa8279c14e3865ce62883 nss-3.21.0-9.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 134, Issue 13 ************************************************ [View Less]

1 0

what does firefox have against sans-serif
by Michael Hennebry 24 Apr '16

24 Apr '16

I've been struggling to get Firefox to render text in a sans-serif font. So far, I've only been able to do that by setting the default font as sans-serif. DejaVu Sans Mono and DajaVu Sans are the only other listed fonts that I'm reasonalbly sure are sans-serif. Helvetica and Arial are not there. sans-serif does work on Konqueror. Does anyone know how to affect the font-family on Firefox 38.7.0 ? -- Michael hennebry(a)web.cs.ndsu.NoDak.edu "Sorry but your password must contain an uppercase … [View More]

2 2

CentOS-announce Digest, Vol 134, Issue 12
by centos-announce-request＠centos.org 23 Apr '16

23 Apr '16

1 0

FirewallD issue
by Marcin Trendota 23 Apr '16

23 Apr '16

Hello everybody. Recently i moved external interface to zone "external" on my home server/router. And something strange is hapening. From my router (chamber, CentOS7) everything is fine: [root@chamber ~]# firewall-cmd --list-all home (default, active) interfaces: enp3s0 tun0 virbr0 sources: services: dhcp dhcpv6-client dns http https imaps ipp-client mdns nfs samba samba-client vnc-server ports: 143/tcp 26666/tcp masquerade: no forward-ports: icmp-blocks: rich rules: [root@… [View More]

3 6

← Newer
1
2
3
4
5
6
7
8
...
13
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2016