Discuss February 2017

discuss@lists.centos.org

118 participants
122 discussions

CentOS-announce Digest, Vol 144, Issue 4
by centos-announce-request＠centos.org 14 Feb '17

14 Feb '17

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2017:0269 Critical CentOS 6 java-1.7.0-openjdk Security Update (Johnny Hughes) 2. CESA-2017:0269 Critical CentOS 5 java-1.7.0-openjdk Security Update (Johnny Hughes) 3. CESA-2017:0269 Critical CentOS 7 java-1.7.0-openjdk Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 Feb 2017 17:16:15 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 6 java-1.7.0-openjdk Security Update Message-ID: <20170213171615.GA22675(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5e812e4583b71107b72779cfc77f78c7fdc1a147a56126136f87d14cc3b4efb8 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.i686.rpm ce382ede1a4eac4ffdba9aa870cc9c06a083749fb40b4d9ca342b17354836553 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el6_8.i686.rpm 4ad8906f9df3db8a1812a2b3b326762a9c2a694d6a494eb0e5220b9596d0718c java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el6_8.i686.rpm 191ff23c7449d819ca45243beb432c700c66476597fd08c57c39ae8ceda8ffd2 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el6_8.noarch.rpm 800b7ed498f4b4fd6d0e024652ad05eef8682237fe2349f82a69106a4ca09d54 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el6_8.i686.rpm x86_64: d9381ac7f354a3d066efe9ef1160264309f46c9373c5b28e26365ca3d81dad1a java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 0057a0bbfe965f73222b4806b7be62f4b79507a1c9903ccc5c4daeb65cd1addf java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 7872f4fef9d877d2e9de8d9e1c11cd64e6afaf3620266997706fcdad9d9b196d java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 191ff23c7449d819ca45243beb432c700c66476597fd08c57c39ae8ceda8ffd2 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el6_8.noarch.rpm 3c2b900af1a17e21b63aab28f034e6026d983cf96e1ffd7231a677e1ada30623 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm Source: bf4fbc5136e1640ade4a455baa073d802fc25f099af1075fd636d3d1484ee9cb java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Mon, 13 Feb 2017 17:21:05 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 5 java-1.7.0-openjdk Security Update Message-ID: <20170213172105.GA27499(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f2fb7e8343760a6cc3535a6124bd71411b20795da0ac056b8361c8826ce9a69e java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.i386.rpm 72c2fee994a496787fe7a8080b0871b0d015c63fc57cf5f2457107620bbb9ac1 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el5_11.i386.rpm 2563c40d3b9b9d9ce7787284a8f8808491d4adb7af5ee3a6f9a1daeba47e8012 java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el5_11.i386.rpm d4ca35c4e689c276e1f746664e9d9f7fd46a44df643bc7e42a87183473870530 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el5_11.i386.rpm c9e4741823aec2cfc8674f0c0bf52d87eca0fb31c5ea682a7d4208d1d2f29928 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el5_11.i386.rpm x86_64: b277770918246adb9966adbdcc06306e0863392d4cbf327bdfb570d4ade8bf73 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm e0ce4d7487d50528ea6fffb32c47f5e2405f3863a91b7ca85025b5b86e07ae99 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm f18a46c869e0fe0bda885e6876f117e3a35604ef23a3c7cdc6c71df754d59ab1 java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm 4a16817c9069a4f5f7d176df443a30e6309bb3551244bfe057054c058b329b70 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm 1d7b5898fd46ae5a447d7b8116919e8e7e16179b40ea3551c0f2ed62b5d1e22f java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm Source: 41d3efcc5b6cccbb9ea0af1bde1b2fc4aab16274d55d26db3e64924068128bc8 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 3 Date: Mon, 13 Feb 2017 18:45:43 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 7 java-1.7.0-openjdk Security Update Message-ID: <20170213184543.GA36647(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: afcc43329737c25752cc4e38a34c8ea0430ab0be696d4cfd2c50f9ac82184984 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 57c42d32708e71c1778811b6201f189f0d9682ef1ee64ac4f5ca221725ecf41f java-1.7.0-openjdk-accessibility-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 962b228787c68649003f8a1e5df6875958fdda37866a9d55dc451643ebf1b865 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm c68e9ed21e04c0ab6d86cbb445f692eb277346a3a51ffc735ba0893d295a109a java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 629a4dc16c4fb283a3be2b19070cc97ea864018f3b2a18f7a5383eb483154bee java-1.7.0-openjdk-headless-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 087c956bb48670bd96f861a5996b8535c89b3c83b7f1472af81fbacd7946d754 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el7_3.noarch.rpm a8237710facd516d1d6eda6d749a5fb724746172d866b93168c261933569192f java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm Source: 1edbdfcdfacb9daec6390aed4fdad4fe38dbf36023f1a095fff518d29e585594 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 144, Issue 4 ***********************************************

1 0

dhcpcd.conf
by Alice Wonder 14 Feb '17

14 Feb '17

Hi, ran into a problem w/ linode hosted VM where IPv6 address changed after they migrated it to a different host. They claim I can fix it with sed -i 's/slaac private/slaac hwaddr/' /etc/dhcpcd.conf However there appears to be no dhcpcd.conf on any of my CentOS 7 systems. What is the CentOS 7 equivalent?

2 1

A question on networking (CentOS 6)
by KM 13 Feb '17

13 Feb '17

Hi AllThis is NOT specifically related to CentOS per se. I have 2 servers that are on two networks. I did NOT set this up. The NIC went bad and it has been replaced. I knew enough to update the HW address in the ifcfg-* files. The network service restarts successfully without errors. However I cannot connect via ping or ssh with the pt2pt network setup on 192.168.x.*. When I use our internal network ip addresses it is fine. I am not sure how to troubleshoot this separate connection. What can I provide here that will allow someone to help? Thanks in advance. I tried searching a bit but didn't find anything of use so far. KM

2 4

Re: [CentOS] Wich web browser on CentOS6 ?
by James B. Byrne 13 Feb '17

13 Feb '17

On Fri, February 10, 2017 15:44, Alice Wonder wrote: > On 02/10/2017 12:34 PM, James B. Byrne wrote: >> >> On Fri, February 10, 2017 06:26, Patrick Begou wrote: >>> Hello >>> >>> I have more and more troubles using firefox in professional >>> environment with >>> CentOS6. The latest version is 45.7.0 But I can't use it anymore to >>> access some >>> old server hardware (IDRAC7 of DELL C6100) because of >>> "/SSL_ERROR_WEAK_SERVER_CERT_KEY/". I had to install an old >>> Firefox32 >>> version >>> to administrate these servers. >>> >>> Today I upgrade the firmware of 2 DELL switch and now Firefox >>> cannot >>> connect to them anymore saying: /An error occurred during a >>> connection to xxx.xxx.xxx.xxx. The server rejected >>> the handshake because the client downgraded to a lower TLS version >>> than the server supports// //SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT >>> >>> /Is there a CentOS6 recommended web browser allowing continuous >>> connections to olds and new base level (and local) system >>> administration services ? >>> >> >> This situation arises because older, dare I say old, equipment >> released with embedded software and using http/https as the >> administrative front end were shipped with minimally compliant x-509 >> certificates. Often self-signed with 1kb keys and md5 signature >> hashes. Not to mention many are past their expiry dates. >> >> However, given the revelations of state sanctioned snooping on >> network >> traffic browsers are being pushed to implement increased compliance >> checking for the overall security of users. Firefox is simply >> implementing what various 'authorities' are recommending as secure >> practices with respect to authentication using pki and x-509 >> certificates. >> >> The present situation is a PIA. It could be a lot more >> user-friendly >> if FF so chose. They could have easily allowed one to turn off these >> advanced compliance checks for specific IP and DNS addresses so that >> the intended benefit remained but the interference with existing >> infrastructure was minimised. >> >> But, FF is on its own chosen path to oblivion and the idea of >> compromise is totally absent from their project plan. >> >> > > IMHO FireFox is doing the right thing. Compromises in policy is how > system compromises often happen. > > If you can change the setting to be more forgiving of certain bad > vendors, then so can malware. > > What we really need to do is demand better from the manufacturers of > products we use in a "professional environment" - and it is extremely > important we demand better from them now, during the dawn of IoT. > > It is a bit difficult for an end user to insist that a vendor improve a ten year old piece of equipment. Sure, that might be as simple as a firmware update. But why not insist that people buy new product instead and thereby add to the bottom line? Which way do see most commercial firms going? FF is a consumer item that is being shipped with a supposedly Enterprise Linux distribution. This leads to problems that are created by the divergence between the target audience and Enterprise users. Enterprises tend to have a much more robustly secured gateware to the wider Internet than consumers. Which for that audience makes a lot of the more esoteric security enhancements rather useless. If an intruder can carry out a MTM attack on your internal LAN then nothing FF can do is going to have much of an effect. A professional organisation would not simply cut administrators off from the devices that they are required to manage. Nor would it dictate how a company spends its money on hardware. A bunch of self-righteous zealots might. Which may account for the fact that FF (all versions) market share is now less than 10%.[1] [1] https://www.netmarketshare.com/browser-market-share.aspx?qprid=2&qpcustomd=… -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Alsa pulseaudio & procmail
by Adrian van Bloois 13 Feb '17

13 Feb '17

Hi, I'm using a program called morse to generate morse code signals when mail is received. This is done by calling this program depending on de subject or from of the incoming mail. THis worked fine on CentOS 6 but since I'm using CentOS 7 it does nt work anymore. In my procmail logging I get: ALSA lib pulse.c:243:(pulse_connect) PulseAudio: Unable to connect: Connection refused Can't access speaker. Normal listening to streams on the Internet works fine, the program morse itself works fine, but runningit from procmail fails. Any ideas? Adrian -- Adri P. van Bloois Antonlaan 104 email: adrian(a)pa0rda.nl 3701 VG Zeist voice: +31-(0)-30-6912741 The Netherlands fax: NONE 52 05'15.77"N 5 4'44.56"E QTH-locater JO 22 OC "Elegance is not a dispensable luxury but a factor that decides between success and failure." Edsger W. Dijkstra

1 0

Manual Install fail in first steps
by Andreas Benzler 13 Feb '17

13 Feb '17

Hello everyone, while I wanne try out very special partition, i walk through https://wiki.centos.org/HowTos/ManualInstall but fail allready at "INSTALL setup basesystem filesystem" This is very clear to me, because rpm don't know the full path (real version) or is there some thing wrong ?? Anaconda it self works with groups like @base etc... Very wired. Doesn't looks like up to date. Sincerely Andy

1 0

Re: [CentOS] Automounting a USB drive
by tdukes＠palmettoshopper.com 13 Feb '17

13 Feb '17

-------- Original Message -------- Subject: Re: [CentOS] Automounting a USB drive From: Fred Smith <fredex(a)fcshome.stoneham.ma.us> Date: Sun, February 12, 2017 9:52 pm To: centos(a)centos.org On Sun, Feb 12, 2017 at 06:19:34PM -0700, tdukes(a)palmettoshopper.com wrote: > > Hello, > > Been try to use autofs to mount and unmount a usb flashdrive. I've never had to do anything at all to make this work,... I insert the USB device, wait a few seconds, and voila! are you trying this because you can't get it to work the "normal" way, or is this simply an educational experience? Fred Its not mounting on its own as it did in 6.8. If I click on it in gnome, it mounts but REAR won't backup to it. If i manually mount it from a terminal, I have read/write access. Haven't been able to get a backup since I upgraded back in mid-January.

3 2

pam_tally2 after unlock time
by Naveen Kumar 13 Feb '17

13 Feb '17

Hi All, I prepared a Centos 6.8 Minimal server, as part of hardening i added PAM rules under system-auth and password-auth to lock the user account for 30 minutes after 3 failed login attempts. ############system-auth############### auth required pam_tally2.so deny=3 unlock_time=1800 auth required pam_env.so auth sufficient pam_unix.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account required pam_tally2.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so ###################password-auth######### auth required pam_tally2.so deny=3 unlock_time=1800 auth required pam_env.so auth sufficient pam_unix.so auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so account required pam_tally2.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so sha512 shadow nullok use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so ################################################################# Now, *after 3 failed attempts user locked successfully but after 30mins when i tried with wrong password for first attempt it again got locked. It should wait for 3 more attempts after unlock, but got locked after first time,* after unlock. Anyway to correct the logic.

1 0

Automounting a USB drive
by tdukes＠palmettoshopper.com 13 Feb '17

13 Feb '17

Hello, Been try to use autofs to mount and unmount a usb flashdrive. The mount point is /media When the drive is NOT inserted, /media is empty. When Iinsert the drive, I see directories in /media that are on the usb drive but nocontent. So, its kind working. /etc/auto,master: # # Sample auto.master file # This is a 'master' automounter map and it has thefollowing format: # mount-point [map-type[,format]:]map [options] # For details of the format look at auto.master(5). # /misc /etc/auto.misc # # NOTE: mounts done from a hosts map will be mounted withthe # "nosuid"and "nodev" options unless the "suid" and "dev" # optionsare explicitly given. # /net -hosts # # Include /etc/auto.master.d/*.autofs # The included files must conform to the format of thisfile. # +dir:/etc/auto.master.d # # Include central master map if it can be found using # nsswitch sources. # # Note that if there are entries for /net or /misc (as # above) in the included master map any keys that are the # same will not be seen as the first read key seen takes # precedence. # +auto.master /media /etc/auto.usb /etc/auto.usb: usb -fstype=auto :/dev/sdb1 The particular usb drive is a REAR backup drive but Iused -fstype=auto in case it may be something different. TIA

2 1

Licence text questions
by Walter Dnes 12 Feb '17

12 Feb '17

I'm running a CentOS 6.5 chroot to build Pale Moon (a Firefox fork) for older machines running distros like Puppy linux. Before anyone asks... * Yes, even though the older machines are using "ancient" glibc, etc, they do have security patches back-ported, e.g. http://www.murga-linux.com/puppy/viewtopic.php?t=90461 "Lucid Puppy Revitalized as 5.2.8.7 - December, 2016" * I realize that CentOS 6.5 is "not safe for surfing". It starts at the commandline, and the only network activity is pulling down source code with git, and scp to send the compiled package to the host, i.e. my desktop PC. If necessary, that could be done by the host OS. It's used for building, and nothing else. Currently just Pale Moon, but other software could also be built. Other people are interested in doing the same. My choices are... * explain how to install CentOS 6.5, which options to choose, turn off boot-to-gui, and how to download and build newer gcc, yasm, and python-2.7 to duplicate my build environment, etc, etc. * or send out a 1.3 gigabyte centos65.tar.xz and give simple instructions to extract the archive, copy over /etc/resolv.conf, bind-mount /dev and /proc, chroot into the directory, and get going right away. I'm not charging money, but the 2nd choice literally involves re-distributing CentOS, and additional Open Source software. I believe that I'm required to provide at least the location from which it can be obtained. Here's a first draft of my "licences.txt". Any problems, suggestions? ======================================================================== The tarball is a collection of various Open Source software, assembled and bundled together by Walter Dnes <waltdnes(a)waltdnes.org>. It's based on a 32-bit CentOS 6.5 install. Additional components necessary for the building of Pale Moon 27 were built from source. It was originally installed in a QEMU VM (Virtual Machine), and then rsync'd to a directory on the host machine for use as a chroot environment. The tarballed directory is intended to run as a chroot environment. The various softwares remain subject to their original licences. As required by many Open Source licences, here is a list of where the original software can be obtained. * The CentOS 6.5 distro can be obtained at http://vault.centos.org/6.5/isos/i386/CentOS-6.5-i386-bin-DVD1.iso http://vault.centos.org/6.5/isos/i386/CentOS-6.5-i386-bin-DVD2.iso DVD1 is approx 3.6 gigabytes and DVD2 is approx 1 gigabyte The following additional source code was downloaded and used to build additional infrastructure required for building Pale Moon. * Python 2.7.13 can be otained at https://www.python.org/ftp/python/2.7.13/Python-2.7.13.tgz * gcc 4.9.4 can be obtained at http://gcc.parentingamerica.com/releases/gcc-4.9.4/gcc-4.9.4.tar.bz2 * gcc 5.4.0 can be obtained at http://gcc.parentingamerica.com/releases/gcc-5.4.0/gcc-5.4.0.tar.bz2 * YASM 1.3.0 can be obtained at http://www.tortall.net/projects/yasm/releases/yasm-1.3.0.tar.gz ======================================================================== -- Walter Dnes <waltdnes(a)waltdnes.org>

2 5

← Newer
1
...
5
6
7
8
9
10
11
12
13
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2017