Discuss January 2017

discuss@lists.centos.org

125 participants
116 discussions

Network Storage
by TE Dukes 13 Jan '17

13 Jan '17

Hello, I have looked into the various network attached storage devices and software based solutions. Can't really find one I like. Would it be possible to add a couple HDs to my existing 6.8 server and set them up as RAID drives? If so, how would I keep it from mirroring the system drive? Just spent$2500 on a transmission for my truck, so I broke right know and need to go the cheapest route. TIA

3 4

Strange sefault with ping and route
by Andreas Benzler 12 Jan '17

12 Jan '17

Hallo Guys, something went wrong and I didn't know from where. - uninstall vmware (removed to virtual adapter) - reinstall package with route and ping and glibc - test with original kernel and own vanilla nothing helps. Laptop by my side has same software stand no problem at all gdb --args ping benzler.me GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /home/andy/ping...Missing separate debuginfo for /home/andy/ping Try: yum --enablerepo='*debug*' install /usr/lib/debug/.build-id/cf/6d0aa0f86229ec76a471ce1ca25d39af234e43.debug Reading symbols from /home/andy/ping...(no debugging symbols found)...done. (no debugging symbols found)...done. (gdb) run Starting program: /home/andy/ping benzler.me Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: File "/usr/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir: $datadir/auto-load:/usr/bin/mono-gdb.py". To enable execution of this file add add-auto-load-safe-path /usr/lib64/libthread_db-1.0.so line to your configuration file "/home/andy/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/home/andy/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff088c915 in __pthread_initialize_minimal_internal ( argc=<optimized out>, argv=0x7fffffffe0f8, envp=0x7fffffffe110) at nptl-init.c:324 324 THREAD_SETMEM (pd, cpuclock_offset, GL(dl_cpuclock_offset)); (gdb) quit A debugging session is active. Inferior 1 [process 4358] will be killed. gdb --args route GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/route...Reading symbols from /usr/sbin/route...(no debugging symbols found)...done. (no debugging symbols found)...done. Missing separate debuginfos, use: debuginfo-install net-tools-2.0-0.17.20131004git.el7.x86_64 (gdb) run Starting program: /usr/sbin/route Kernel IP Routentabelle Ziel Router Genmask Flags Metric Ref Use Iface Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: File "/usr/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir: $datadir/auto-load:/usr/bin/mono-gdb.py". To enable execution of this file add add-auto-load-safe-path /usr/lib64/libthread_db-1.0.so line to your configuration file "/home/andy/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/home/andy/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff0cc6915 in __pthread_initialize_minimal_internal (argc=<optimized out>, argv=0x7fffffffe118, envp=0x7fffffffe128) at nptl-init.c:324 324 THREAD_SETMEM (pd, cpuclock_offset, GL(dl_cpuclock_offset)); Quit anyway? (y or n) y both end up in nptl-init.c:324 324 THREAD_SETMEM (pd, cpuclock_offset, GL(dl_cpuclock_offset)); All other commands with ftp sftp ssh nslookup works. Any ideas? Sincerely Andy Machine cpu i3770 cpu. Laptop cpu 7500 i5 (works)

1 1

Re: [CentOS] [Security Advisory] RHSA-2017:0036 Important: kernel security and bug fix update
by Phelps, Matthew 12 Jan '17

12 Jan '17

Any word on this update for CentOS 6? This one seems pretty bad if it's a remote exploit. -- Matt Phelps System Administrator, Computation Facility Harvard - Smithsonian Center for Astrophysics mphelps(a)cfa.harvard.edu, http://www.cfa.harvard.edu ---------- Forwarded message ---------- From: Red Hat Errata Notifications <errata(a)redhat.com> Date: Tue, Jan 10, 2017 at 5:19 PM Subject: [Security Advisory] RHSA-2017:0036 Important: kernel security and bug fix update To: mphelps(a)cfa.harvard.edu The following Red Hat Security Advisory has been published which may affect subscriptions which you have purchased. RHSA-2017:0036 Important: kernel security and bug fix update Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * A use-after-free vulnerability was found in the kernels socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within __sys_recvmmsg() function. (CVE-2016-7117, Important) * An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments. (CVE-2016-4998, Moderate) * A use-after-free vulnerability was found in tcp_xmit_retransmit_queue and other tcp_* functions. This condition could allow an attacker to send an incorrect selective acknowledgment to existing connections, possibly resetting a connection. (CVE-2016-6828, Moderate) Bug Fix(es): * When parallel NFS returned a file layout, a kernel crash sometimes occurred. This update removes the call to the BUG_ON() function from a code path of a client that returns the file layout. As a result, the kernel no longer crashes in the described situation. (BZ#1385480) * When a guest virtual machine (VM) on Microsoft Hyper-V was set to crash on a Nonmaskable Interrupt (NMI) that was injected from the host, this VM became unresponsive and did not create the vmcore dump file. This update applies a set of patches to the Virtual Machine Bus kernel driver (hv_vmbus) that fix this bug. As a result, the VM now first creates and saves the vmcore dump file and then reboots. (BZ#1385482) * From Red Hat Enterprise Linux 6.6 to 6.8, the IPv6 routing cache occasionally showed incorrect values. This update fixes the DST_NOCOUNT mechanism, and the IPv6 routing cache now shows correct values. (BZ#1391974) * When using the ixgbe driver and the software Fibre Channel over Ethernet (FCoE) stack, suboptimal performance in some cases occurred on systems with a large number of CPUs. This update fixes the fc_exch_alloc() function to try all the available exchange managers in the list for an available exchange ID. This change avoids failing allocations, which previously led to the host busy status. (BZ#1392818) * When the vmwgfx kernel module loads, it overrides the boot resolution automatically. Consequently, users were not able to change the resolution by manual setting of the kernel's 'vga=' parameter in the /boot/grub/grub.conf file. This update adds the 'nomodeset' parameter, which can be set in the /boot/grub/grub.conf file. The 'nomodeset' parameter allows the users to prevent the vmwgfx driver from loading. As a result, the setting of the 'vga=' parameter works as expected, in case that vmwgfx does not load. (BZ#1392875) * When Red Hat Enterprise Linux 6.8 was booted on SMBIOS 3.0 based systems, Desktop Management Interface (DMI) information, which is referenced by several applications, such as NEC server's memory RAS utility, was missing entries in the sysfs virtual file system. This update fixes the underlying source code, and sysfs now shows the DMI information as expected. (BZ#1393464) * Previously, bonding mode active backup and the propagation of the media access control (MAC) address to a VLAN interface did not work in Red Hat Enterprise Linux 6.8, when the fail_over_mac bonding parameter was set to fail_over_mac=active. With this update, the underlying source code has been fixed so that the VLANs continue inheriting the MAC address of the active physical interface until the VLAN MAC address is explicitly set to any value. As a result, IPv6 EUI64 addresses for the VLAN can reflect any changes to the MAC address of the physical interface, and Duplicate Address Detection (DAD) behaves as expected. (BZ#1396479) Full details and references: https://access.redhat.com/errata/RHSA-2017:0036?sc_cid=701600000006NHXAA2 CVE Names: CVE-2016-4998 CVE-2016-6828 CVE-2016-7117 Revision History: Issue Date: 2017-01-10 Updated: 2017-01-10 ------------------------------------------------------------ ---------------------------------- Manage Errata Notifications ------------------------------------------------------------ ---------------------------------- You are receiving this email because you have elected to receive errata notifications from Red Hat. This message is being sent to: Red Hat login: mphelps2013 Email address on file: <mphelps(a)cfa.harvard.edu> Update your preferences at https://www.redhat.com/wapps/ ugc/protected/notif.html ------------------------------------------------------------ ---------------------------------- Contact ------------------------------------------------------------ ---------------------------------- The Red Hat security contact is secalert(a)redhat.com. More contact details at https://access.redhat.com/security/team/contact/ This is an automated message. Please do not reply. If you have further questions or concerns, please contact Red Hat Technical Support https://access.redhat.com/ support/contact/technicalSupport/ or open a support case via the Red Hat Customer Portal https://access.redhat.com/support/cases/#/case/new/ Copyright 2017 Red Hat, Inc.

1 1

How to avoid "firstboot" in CentOS 7 kickstart
by Valeri Galtsev 12 Jan '17

12 Jan '17

Dear Experts, Sorry about taking shortcut and asking everybody... My question is: how do you avoid "firstboot" screen in latest CentOS 7.3 kickstart. I have installed about a dozen of CentOS 7 (none of which was 7.3) with that kickstart file. None of them ever went to firstboot screen on first boot. Now after kickstart installation of CentOS 7.3 it goes into firstboot screen showing two configuration options: 1. [x] License information (license accepted) 2. [ ] User creation (no user will be created Please, make your choice from the above { quit, continue or refresh } Here are relevant lines from my kickstart that I assume should have taken care of everything (in the order of their appearance, I dropped irrelevant lines): firstboot --disable eula --agreed (I always were creating one regular user in a post install section, which I do have in this KS file, and that user is successfully created) Thanks for all your help! Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

5 6

Re: [CentOS] Ghostscript update?
by m.roth＠5-cent.us 12 Jan '17

12 Jan '17

Leonard's summary of the fix (and I note this is just for CentOS 6) is diff -up /usr/share/ghostscript/8.70/Resource/Init/gs_init.ps.new.bad /usr/share/ghostscript/8.70/Resource/Init/gs_init.ps --- /usr/share/ghostscript/8.70/Resource/Init/gs_init.ps.new.bad 2017-01-04 11:20:37.000000000 +0100 +++ /usr/share/ghostscript/8.70/Resource/Init/gs_init.ps 2015-07-24 00:00:19.000000000 +0200 @@ -2025,7 +2025,6 @@ readonly def /LockFilePermissions true >> setuserparams } - systemdict /getenv {pop //false} put if % setpagedevice has the side effect of clearing the page, but % we will just document that. Using setpagedevice keeps the device Which, if I understand what I'm reading, just has added the systemdict line. I added that, and tried to run evince, which did not crash, but did give me invalidaccess -7 invalidaccess -7 invalidaccess -7 Have I misunderstood the fix? mark

3 2

Centos 7 force reverse dns lookup for none registered addr
by Itschak Mugzach 12 Jan '17

12 Jan '17

I have an application running on a home network. the client is windows and the server is Centos 7. I can access the application from a browser, but when I try a HTTP POST from another Centos 7 box (CLI) I get 54 ECONNRESET Connection reset by peer RECV. after reviewing TCPDUMP i see that Centos drops the connection after trying to do a reverse DNS lookup. The problem is that I am not using DNS but direct IP addresses. How can I force Centos not to do a reverse DNS lookup? Best, ITschak

2 1

Allow execution of commands via ssh but not to login
by Bernard Fay 12 Jan '17

12 Jan '17

Hi, Is there a way to allow a user to execute commands via ssh, for example: "ssh user@server ls", but disallow the same user to login on this server with "ssh user@server" ? Thanks, Bernard

4 4

Re: [CentOS] Firefox Issue
by James B. Byrne 12 Jan '17

12 Jan '17

On Thu, January 5, 2017 17:23, Always Learning wrote: > > > Cyber attacks are gradually replacing armed conflicts. > Better fight with bits than blood. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

8 13

Trouble removing files in chrooted sftp
by Myyrä, Timo 12 Jan '17

12 Jan '17

Hi, I have trouble setting up chrooted SFTP for our user. I got the basic SFTP chroot working, user is chrooted to its home directory, I've added /home/userb/etc directory with dummy passwd, group and localtime files. The problem is that instead of only accessing its own files, I need the user to be able to remove another users files. I have web application which runs as different user, the sftp user is member of the web users group. I then setup bind mounts from web users data dir to chrooted users home directory. The chrooted user can't remove any files in the directory owned by another user. The directory permissions are 0775 so they should allow the access. If I don't use chroot I can remove the file just fine so it seems to be something on the chroot that limits the access. I tried to add simple directory, checked the permissions and tried to delete file and it failed as well so the bind mount should be the issue. Here's sample output: # cat etc/{passwd,group} webapp-user:x:5020:5020::/home/webapp-user:/sbin/nologin chroot-user:x:5029:10000::/home/chroot-user:/sbin/nologin root:x:0:0:not really root::: sftp-chroot:x:10000:chroot-user webapp-user:x:5020:chroot-user # ls -lR .: total 0 drwx--x--- 2 root sftp-chroot 61 Jan 5 07:34 etc drwxr-x--- 2 chroot-user sftp-chroot 6 Nov 20 2015 failed drwxr-x--- 2 chroot-user sftp-chroot 16 Jan 5 07:46 input drwxrwxr-x 2 webapp-user webapp-user 98 Jan 5 07:18 intranet ./etc: total 16 -rw-r--r-- 1 root root 55 Jan 5 07:34 group -rw-r----- 1 root root 1883 Jan 5 06:45 localtime -rw-r--r-- 1 root root 172 Jan 5 06:51 passwd -rw-r--r-- 1 root root 105 Jan 5 06:46 passwd~ ./failed: total 0 ./input: total 0 ./intranet: total 72 -rw-rw-r-- 1 chroot-user sftp-chroot 0 Jan 5 07:02 test1.txt -rw-rw-r-- 1 webapp-user webapp-user 0 Jan 5 07:02 test2.txt So why can't I remove the intranet/test* files inside sftp chroot even if the chroot-user is member of webapp-user group and the directory itself has group permissions? Br, Timo M

2 3

Re: [CentOS] Firefox Issue
by m.roth＠5-cent.us 12 Jan '17

12 Jan '17

Always Learning wrote: > On Fri, 2017-01-06 at 12:54 -0500, m.roth(a)5-cent.us wrote: >> James B. Byrne wrote: >> > On Thu, January 5, 2017 17:23, Always Learning wrote: >> >> >> >> Cyber attacks are gradually replacing armed conflicts. >> > >> > Better fight with bits than blood. >> >> Yes, but... attacks on the friggin' IoT could result in lots of blood. Or, less so, what do you mean all the rail lines have been knocked out of commission for a week, and we can't get food to the eastern half of the country? Or power? <snip> > Query: How did the Reds get into the Democrats computer systems ? Hope it wasn't a Redhat/Centos system but an 'open Windoze' set-up. In at least one of the several, it was a phishing attack. In another case, someone responded slowly to a query... and had a typo saying the *reverse* of what they meant to say. mark

2 1

← Newer
1
...
5
6
7
8
9
10
11
12
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2017