Discuss August 2016

discuss@lists.centos.org

131 participants
135 discussions

centos 7 :: cannot update
by Adrian Sevcenco 13 Aug '16

13 Aug '16

Hi! I have a very strange problem with my centos 7 vm : i cannot update!! I have normal ingress/egress access but my yum update fills my screen with : [Errno 14] HTTP Error 404 - Not Found i already done "clean all" ... anyone seen this problem? any idea about the issue and workarounds? Thank you! Adrian

2 1

[CentOS6] Manually configured Firewall (WLAN-AP plus Router)
by Walter H. 13 Aug '16

13 Aug '16

Hello I've got this Mini-PC https://www.zotac.com/product/mini_pcs/zbox-ci323-nano everything is fine -> latest 6.8 kernel works; both Ethernet-Interfaces work and also the WLAN-Interface works; the two Ethernet-Interfaces are eth0 and eth1 the WLAN-Interface is wlan0 eth1 is connected on ISP side eth0 is connected on my LAN side to a switch; and wlan0 shall also be on my LAN side für wireless and work as an Access-Point (this works) I want both LAN interfaces (eth0 and wlan0) have the same IP subnet so I did this: http://www.microhowto.info/howto/persistently_bridge_traffic_between_two_or… also the DHCP works fine: both DHCP and DHCPv6; RADVd also works fine; in /etc/sysconfig/network-scripts/ I added ifcfg-sit1 with the configuration for my IPv6 tunnel at Hurricane Electric there is the following entry: IPV6TUNNELIPV4LOCAL=ipv4addr here the 1st question: does this have to be the IPv4 address of br0 (LAN) or the one of eth1 (WAN)? (before I had this on a virtual machine, there was only one interface, but here ...?) and now the bigger problem: here just the IP addresses for better troubleshooting; the ISP installed a box (NAT router), that is a medium converter (coaxial cable to ethernet twisted-pair cable), too; this box has on WAN side, my public IP an LAN side it has 192.168.0.1 this box which should be installed instead of my old NAT-router has the following IP addresses on device br0 192.168.1.100 (LAN) and on device eth1 (WAN) 192.168.0.127 the old router has on LAN side 192.168.1.254 and on WAN side 192.168.0.254 now both the new box and the old router are connected "parallel" which means, each is connected with its WAN interfaces to the built-in switch of ISP-box and with its LAN interfaces to my switch; on the old NAT-router I have defined the LAN-IP of the new box as DHCP relay; this works fine; (the new box is the only DHCP server in LAN) <begin /etc/sysconfig/iptables> # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] # ICMP: extra chain -N ALLOWED-ICMP -A ALLOWED-ICMP -p icmp -m limit --limit 1/sec --limit-burst 2 -j ACCEPT # Allow anything on the local link -A INPUT -i lo -j ACCEPT -A OUTPUT -o lo -j ACCEPT # Allow anything out on the localnet -A OUTPUT -o br0 -j ACCEPT # Allow established, related packets back in -A INPUT -i br0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Enable DHCP -A INPUT -p udp -i br0 --dport 67:68 --sport 67:68 -j ACCEPT # Enable IPv6 -A INPUT -p ipv6 -i eth1 -s 216.66.80.30 -j ACCEPT # Allow SSH from LAN and redirected from internet # from WLAN there should be no SSH possible, so I used eth0 -A INPUT -i eth0 -m tcp -p tcp --dport 22 -m state --state NEW -j ACCEPT -A INPUT -i eth1 -d 192.168.0.127 -m tcp -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 115 --hitcount 3 --name DEFAULT --rsource -j DROP -A INPUT -i eth1 -d 192.168.0.127 -m tcp -p tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource -A INPUT -i eth1 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # Allow anything out on the internet -A OUTPUT -o eth1 -j ACCEPT # Allow established, related packets back in -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow multicast -A INPUT -d 224.0.0.0/4 -j ACCEPT -A OUTPUT -d 224.0.0.0/4 -j ACCEPT # Allow Forwarding on LAN interfaces -A FORWARD -i br0 -o br0 -d 192.168.1.0/24 -j ACCEPT # Allow Forwarding to WAN interface -A FORWARD -i eth0 -o eth1 -s 192.168.1.0/24 -j ACCEPT -A FORWARD -i wlan0 -o eth1 -s 192.168.1.0/24 -j ACCEPT # Allow established, related packets back through -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT -A FORWARD -i eth1 -o wlan0 -m state --state ESTABLISHED,RELATED -j ACCEPT -A FORWARD -i eth1 -o eth0 -j LOG --log-prefix "IP[FWD-Reply]: " --log-level 7 -A FORWARD -i eth1 -o wlan0 -j LOG --log-prefix "IP[FWD-Reply]: " --log-level 7 # Only pings with restricted icmp are allowed -A INPUT -i eth1 -p icmp -j ALLOWED-ICMP # Enable TRACEroute to me -I INPUT -i eth1 -p udp -d 192.168.0.127 --sport 32769:65535 --dport 33434:33523 -j ACCEPT # Enable SSH to me -I INPUT -i eth1 -p tcp -d 192.168.0.127 --dport 22 -j ACCEPT # Log all other -A INPUT -j LOG --log-prefix "IP[IN]: " --log-level 7 -A FORWARD -j LOG --log-prefix "IP[FWD]: " --log-level 7 -A OUTPUT -j LOG --log-prefix "IP[OUT]: " --log-level 7 COMMIT <end /etc/sysconfig/iptables> I have several virtual machines which have configured the old NAT-router als gateway; they all work fine; one virtual machine (OS = Win7) has the new box configured as gateway with IP address 192.168.1.6 I have a old notebook (OS = WinXP) that is "connected" via WLAN to the new box and this has 192.168.1.4 as IP address; both can ping each other the VM and this notebook; here the questions: should I use eth0 and wlan0 or br0 in the iptables and ip6tables roules? why is it possible to ping the VM or the notebook from the new box, but not the other way? Thanks for any help; Greetings, Walter

1 0

Re: [CentOS] LSI SATA MegaRaid & Centos 7 build 1511
by Gordon Messmer 13 Aug '16

13 Aug '16

On 08/13/2016 02:15 AM, Fawzy Ibrhim wrote: > I have double checked again and yes it's Fakeraid from LSI. > Also it's not shown in "lspci -nn" output. In your original message, you indicated that this was a PCI card, but it looks like this is just a firmware component of your motherboard. I think you should assume that this firmware is unsupported. Set your SATA mode to AHCI in the BIOS, and then use "dmraid -r -E" to remove the RAID metadata from those disks: https://bugs.centos.org/view.php?id=9813 You should be able to install using Linux software RAID.

1 0

Re: [CentOS] Linux TCP flaw
by Andrew Dent 12 Aug '16

12 Aug '16

Would a successful attack on the IP address of a VPS in a Plesk environment expose the VPS, the Virtual Host or both (and all other VPSs)? ------ Original Message ------ From: "Johnny Hughes" <johnny(a)centos.org> To: centos(a)centos.org Sent: 12/08/2016 9:08:23 PM Subject: Re: [CentOS] Linux TCP flaw >On 08/12/2016 05:58 AM, Andrew Dent wrote: >> Thanks for the info Peter. >> The VPS is running on a Plesk environment. >> > >Right, and in a Plesk environment there is only one kernel on the main >machine, and all the VPS machines use it. So the hosting provider has >to make all kernel mods. > >

2 1

Firefox crashing
by ken 12 Aug '16

12 Aug '16

This morning, the Firefox (45.3.0) installed (upgrade) just a few days ago has crashed already a half dozen times. Anyone else having the same problem?

3 2

CentOS-announce Digest, Vol 138, Issue 5
by centos-announce-request＠centos.org 12 Aug '16

12 Aug '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Fw: i found the stuff (roland.leurs) 2. Re: Fw: i found the stuff (Johnny Hughes) 3. CESA-2016:1609 Moderate CentOS 6 php Security Update (Johnny Hughes) 4. CESA-2016:1602 Important CentOS 7 mariadb Security Update (Johnny Hughes) 5. CESA-2016:1613 Moderate CentOS 7 php Security Update (Johnny Hughes) 6. CESA-2016:1606 Moderate CentOS 7 qemu-kvm Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Aug 2016 23:47:37 +0300 From: roland.leurs <roland.leurs(a)cis-websolutions.nl> To: "centos-announce" <centos-announce(a)centos.org>, "administratie(a)informatique.nl" <administratie(a)informatique.nl>, "andhra.rampersad" <andhra.rampersad(a)kvk.nl>, "amateurtransfers" <amateurtransfers(a)knvb.nl>, "carata via Marktplaats" <a.1x7ir0ohzgk0i(a)mail.marktplaats.nl> Subject: [CentOS-announce] Fw: i found the stuff Message-ID: <00004af24458$dd2a2ed5$cda39432$(a)cis-websolutions.nl> Content-Type: text/plain; charset="us-ascii" Dear! I know you were looking for this, I found this stuff for you, take a look at <http://above.preparedness.net/e4hqic> roland.leurs

1 0

Re: [CentOS] Linux TCP flaw
by Andrew Dent 12 Aug '16

12 Aug '16

Thanks for the info Peter. The VPS is running on a Plesk environment. ------ Original Message ------ From: "Peter" <peter(a)pajamian.dhs.org> To: centos(a)centos.org Sent: 12/08/2016 3:36:32 PM Subject: Re: [CentOS] Linux TCP flaw >On 12/08/16 17:33, Andrew Dent wrote: >> So after reading this, felt I should apply the fix to a CentOS6 VPS >>that >> I have. >> >>http://www.zdnet.com/article/linux-tcp-flaw-lets-anyone-hijack-internet-tra… >> >> [root@vps ~]# uname -r >> 2.6.32-042stab108.7 > >That's not a CentOS kernel, it's an openvz kernel that is not provided >by CentOS. The fixes and workarounds shown on the internet will not >work with that kernel. > >I suggest you find a better VPS provider, what you have is essentially >a >glorified chroot, not a real VPS and there are many aspects of CentOS >that are simply broken in that model. > > >Peter >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >https://lists.centos.org/mailman/listinfo/centos

2 1

script to make webpage snapshot
by Valeri Galtsev 12 Aug '16

12 Aug '16

Dear Experts, Could someone recommend a script or utility one can run from command line on Linux or UNIX machine to make a snapshot of webpage? We have a signage (xibo) and whoever creates/changes content, likes to add URLs of some webpages there. All works well if these are webpages on our servers (which are pretty fast), but some external servers often take time to respond and take time to assemble the page, in addition these servers sometimes get really busy, and when response is longer than time devoted for that content in signage window, this window hangs forever with blank white field until you restart client. Trivial workaround: just to get snapshot (as, say daily cron job), and point signage client to that snapshot definitely will solve it, and simultaneously we will stop bugging other people servers often without much need for it. But when I tried to search for some utility or script that makes webpage snapshot, I discovered that my ability to search degraded somehow... Thanks for all your pointers! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

6 10

Linux TCP flaw
by Andrew Dent 12 Aug '16

12 Aug '16

Hi So after reading this, felt I should apply the fix to a CentOS6 VPS that I have. http://www.zdnet.com/article/linux-tcp-flaw-lets-anyone-hijack-internet-tra… The article doesn't talk about CentOS or Redhat, but I assume the problem is the same, and hoping the solution is the same. However that doesn't seem to be the case. [root@vps ~]# uname -r 2.6.32-042stab108.7 [root@vps ~]# sysctl -a | grep ack_limit net.ipv4.tcp_challenge_ack_limit = 100 [root@vps ~]# vi /etc/sysctl.conf > Append > net.ipv4.tcp_challenge_ack_limit = 999999999 > to end of file [root@vps ~]# sysctl -p net.ipv4.ip_forward = 0 net.ipv4.tcp_syncookies = 1 error: permission denied on key 'net.bridge.bridge-nf-call-ip6tables' error: permission denied on key 'net.bridge.bridge-nf-call-iptables' error: permission denied on key 'net.bridge.bridge-nf-call-arptables' error: permission denied on key 'net.ipv4.tcp_challenge_ack_limit' [root@vps ~]# sysctl -a | grep ack_limit net.ipv4.tcp_challenge_ack_limit = 100 Am I getting a permission denied because of there is a different solution, or the problem doesn't apply to our VPS or some other reason? Regards Andrew Dent

4 6

how to install opencl on centos 6.7
by qw 12 Aug '16

12 Aug '16

Hi, I'm building x264, and want to use opencl acceleration function. How to install opencl on centos 6.7 to support intel integrated GPUs for 'Intel(R) Xeon(R) CPU E5-2640 v3'? Thanks! Regards andrew

1 0

← Newer
1
...
6
7
8
9
10
11
12
13
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2016