February 2017 - Discuss - lists.centos.org

Centos 7: .tons of messages logs (systemd-logind[663]: Got message type....)
by Dario Lesca 17 Feb '17

17 Feb '17

On my Centos 7 update, into "journalctl -f" I have tons of this kind of message > feb 17 23:52:09 s-ispc.local systemd-logind[663]: Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/php_2dfpm_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=17152 reply_cookie=0 error=n/a > feb 17 23:52:09 s-ispc.local systemd-logind[663]: Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/php_2dfpm_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=17153 reply_cookie=0 error=n/a > feb 17 23:52:11 s-ispc.local systemd-logind[663]: Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/httpd_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=17154 reply_cookie=0 error=n/a > feb 17 23:52:11 s-ispc.local systemd-logind[663]: Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/httpd_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=17155 reply_cookie=0 error=n/a And into /var/log/messages I have this warning message: > rsyslogd-2177: imjournal: begin to drop messages due to rate-limiting What is happening? It is possible to stop this message? Many thanks -- Dario Lesca (inviato dal mio Linux Fedora 25 Workstation)

1 0

Oracle support 12c
by Silva-Borrego, Mario, DPS 17 Feb '17

17 Feb '17

All, I know it might sound a repetitive question although I have not found anything to help me online. Anyone knows if Oracle support will support CentOS with Oracle 12c? I know RHEL 6 & 7 is listed as supported OS, but I want to double check if that includes CentOS 6 & 7. The reason I am asking is because I want to migrate all servers I am receiving from old management to CentOS, currently is a mixed between SLES and RHEL Any insight will be appreciated Thank you, ms Mario Silva IT Systems Administrator New Mexico Department of Public Safety Information Technology Division 4491 Cerrillos Road P.O. Box 1628 Santa Fe NM 87507-1628 Phone: (505) 827-3430 Cell: (505) 670-1824 Email: Mario.Silva(a)state.nm.us

3 2

Centos 7 httpd Permission problems with Postfixadmin
by Robert Moskowitz 17 Feb '17

17 Feb '17

More joy with Centos 7. I am having permission problems with Postfixadmin. I am installing as I have in my notes I did in Centos6 and it is not working. I untar Postfixadmin into /usr/share. The owner is root:root (I even tried root:apache). My postfixadmin.conf file has: alias /mailadmin /usr/share/postfixadmin <Directory "/usr/share/postfixadmin"> AllowOverride AuthConfig </Directory> And I get when I try fqdn/mailadmin You don't have permission to access /mailadmin on this server. When I google this message, I am getting that httpd is not allowing me access. I have even added: allow from all To the above .conf with no change. This is not a SELInux problem as I tried 'setenforce 0' and still get the error. It is as if there is some new security setting in httpd for files not in the www dir (default of /var/www/). Any ideas? thanks

6 17

current situation with flash plugins?
by Michael Hennebry 17 Feb '17

17 Feb '17

Is Adobe the only provider of flash plugins? Is it still a gaping security hole? Do the answers depend on the browser? -- Michael hennebry(a)web.cs.ndsu.NoDak.edu "Sorry but your password must contain an uppercase letter, a number, a haiku, a gang sign, a heiroglyph, and the blood of a virgin." -- someeecards

3 2

Working on installing mailgraph on Centos7-arm - challenges with rpms
by Robert Moskowitz 17 Feb '17

17 Feb '17

One of the joys with getting a little ahead of where epel-armv7hl is, is trying to install packages where not all the dependencies have been debugged. So I am trying to install mailgraph, that i get the noarch rpm from Centos7-x86_64. But it needs RRD which I actually got from the armv7hl building; it just did not make it to the repo. But it wants libpango and libpangocairo. I can't find what provides those. They are not anywhere available to my Fedora 24 notebook and I don't have any 'normal' Centos7 system these days. thanks

1 0

GCC 4.9 in CentOS 7 ??
by Alice Wonder 17 Feb '17

17 Feb '17

The following features of the C++11/C++14 standards are not supported by g++: * std::make_unique function (C++14) * digit separators (C++14) * binary literals (C++14) * generic lambdas (C++14) If you are using the GNU C compiler collection (gcc) then you need at least v4.9.x. configure: error: support for required C++11/C++14 features incomplete Is there by chance a compat package for gcc 4.9.x available? I didn't see it in a yum list. I'm trying to build the latest mkvtoolnix and it looks like CentOS 7 gcc is just barely too old :-/

9 20

About the flash-plugin
by m.roth＠5-cent.us 17 Feb '17

17 Feb '17

Y'all may remember I posted here weeks ago, that flash-plugin was crashing. There was an update this morning, which I did on my workstation... and it hasn't crashed all day on either of the two radio stations who I listen to via streaming media. mark

2 3

USB 2.0 device on a USB 3.0 plug
by Jerry Geis 17 Feb '17

17 Feb '17

When I plug in my device which is USB 2.0 into a 3.0 slot (cause that is all I have) [495042.943074] usb 5-2: new low-speed USB device number 6 using xhci_hcd [495043.100076] usb 5-2: device descriptor read/64, error -71 I receive the above error. Is there a flag or setting that tells the USB to in a 2.0 mode ? Thanks, Jerry

6 7

IPv6 broken on Linode
by Alice Wonder 17 Feb '17

17 Feb '17

https://forum.linode.com/viewtopic.php?f=19&t=14570&p=72785 I can not figure out what I need to do. Apparently according to linode support, the VM is trying to grab an IPv6 address with some privacy stuff enabled by default causing it to not grab the IPv6 address that is assigned to me. Nothing I have tried seems to work, and it seems that Linode support are far more familiar with Ubuntu than CentOS. I know CentOS follows Red Hat so I'm not suggesting this is CentOS's fault, but stuff like this really is why I am a much bigger fan of KISS with simple key=value configuration files that don't seem to exist anymore with Linux networking in the Red Hat world. Making things more complex to benefit "Cloud" servers it the worst thing Red Hat ever did. Sorry for the tone, I'm quite frustrated and as an epileptic who doesn't drive, driving down to the SF Bay Area for RHCE classes that won't even be applicable in a few years when they change stuff again isn't really an option. Been using Red Hat since MKLinux DR3 (based on Red Hat 5.1) and been through the training courses before and everything changes. Anyone know what might be going on? And how to get dhclient to grab the "right" IPv6 address, the same one this VM grabbed no problem for well over a year?

6 16

CentOS-announce Digest, Vol 144, Issue 5
by centos-announce-request＠centos.org 16 Feb '17

16 Feb '17

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2017:0274 CentOS 5 kernel BugFix Update (Johnny Hughes) 2. CESA-2017:0276 Moderate CentOS 7 bind Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Feb 2017 13:14:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2017:0274 CentOS 5 kernel BugFix Update Message-ID: <20170215131442.GA8449(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2017:0274 Upstream details at : https://rhn.redhat.com/errata/RHBA-2017-0274.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5eeff3ee579f570ec49233bf04caa335af2375ffacbc46dae45826e5f9b70748 kernel-2.6.18-418.el5.i686.rpm 9f674e2c212f4ed8b85452682f0d08814580eebb188cbc492e66932dde518338 kernel-debug-2.6.18-418.el5.i686.rpm bfa94e23b90d87f1241391d4354425000cb28fb71c516c6db43ad948d0f23400 kernel-debug-devel-2.6.18-418.el5.i686.rpm 181c671e7fb6fa4576b52c3a23c69222e8915fec78279ca7b0ca9b17e7fbf593 kernel-devel-2.6.18-418.el5.i686.rpm 03a9c5df55efc1a9fb0268e77b929fda5974661529bd12b3a76908ef9cbe1ca1 kernel-doc-2.6.18-418.el5.noarch.rpm b37bf6415c42abf09ecbb75c145090e175bc3494c41c0c32e91e637cbcd55e46 kernel-headers-2.6.18-418.el5.i386.rpm bd2c2051d500bf3a77d37eaf5bc3fd50945ea4729c0ce146052a8390bac2ba46 kernel-PAE-2.6.18-418.el5.i686.rpm f7d8ec73731cdbc7a45a408fcdec5a58ddb5ecacbc88c145ddd07a9bd7565eb2 kernel-PAE-devel-2.6.18-418.el5.i686.rpm 70969578c772dd985fd97721c208a2a4dc4ff7fa480fd95c7a233890730df58c kernel-xen-2.6.18-418.el5.i686.rpm 1479b4c750af9b2061997c76366ed7a45bfe6055174d4c880012f79d67e437a8 kernel-xen-devel-2.6.18-418.el5.i686.rpm x86_64: 583c518288691608947e8a769a31331bb1574065ccbe46ece4903ecdabf60aa6 kernel-2.6.18-418.el5.x86_64.rpm 466872dd2c61bb6dcffcbeb5839eb772c9f7272b552f7d8a8903cc95a6024f8a kernel-debug-2.6.18-418.el5.x86_64.rpm 353e4c5e338979dbb63fb415323e7d613c4b1be04626c6d39d27b03ac1a86a08 kernel-debug-devel-2.6.18-418.el5.x86_64.rpm cf2f965ca2219ad25a836261e28328d7c881204788f91ee2ff66389ac4ee9b2f kernel-devel-2.6.18-418.el5.x86_64.rpm 03a9c5df55efc1a9fb0268e77b929fda5974661529bd12b3a76908ef9cbe1ca1 kernel-doc-2.6.18-418.el5.noarch.rpm 358bbaf90801ad08686df5c6de9f4ce17338abea531a23a87a9c913319abc884 kernel-headers-2.6.18-418.el5.x86_64.rpm cc2836181bfd15f0d65406204d2323a3fd17a7ea6a43a8af889ef210256a7410 kernel-xen-2.6.18-418.el5.x86_64.rpm e35eeb4cd3d0ef2bfeec3e47735e2e7f1475f7597db9f8433531d1b8ea4e8478 kernel-xen-devel-2.6.18-418.el5.x86_64.rpm Source: 9785160c0ab76993df6bdc5ec04362df88ad98e8492d6bdd1107872c6e490a64 kernel-2.6.18-418.el5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 2 Date: Wed, 15 Feb 2017 14:49:31 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0276 Moderate CentOS 7 bind Security Update Message-ID: <20170215144931.GA63056(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0276 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0276.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 78da78be03829d07f7ddd5bf6fde8fb873ae21fda0ca931eb01e251351d0e0d4 bind-9.9.4-38.el7_3.2.x86_64.rpm 0a4048a4c3afc0656da2ea3d9f67467c3bb13aef795169a831e20be62973cb3b bind-chroot-9.9.4-38.el7_3.2.x86_64.rpm 3edf4863b3265a5ffb6f96e33e0b70cf00f63f632060de6946a98e1f5d6abd4f bind-devel-9.9.4-38.el7_3.2.i686.rpm db587a93bb81fc8471f85f852d6a5e1b68ccae8b1518dcd6aee0bb789ee39609 bind-devel-9.9.4-38.el7_3.2.x86_64.rpm 2f80f485510682611829cf0b00dbba5ed8858ea6862dc37278cc0df4dc965964 bind-libs-9.9.4-38.el7_3.2.i686.rpm 102cdd935e72edc2c3eb7f3997eb86b66bd88d0db7c3c67481d46be5e33d1032 bind-libs-9.9.4-38.el7_3.2.x86_64.rpm 93e1824c575495e0d95abbc23155f3039a0fd7af939583eefe8b027101d3c1ae bind-libs-lite-9.9.4-38.el7_3.2.i686.rpm fc482a8e502415088cec63af435d2b00d65176e0f02e78112ac0e110da5bbe7d bind-libs-lite-9.9.4-38.el7_3.2.x86_64.rpm 7dd2e52354a0b7bdeb26bcd4bebf4624838854e45a881b8cf9580a6d900aac62 bind-license-9.9.4-38.el7_3.2.noarch.rpm 28bddde638e4fd7aaaa64898a68e063c233600949c494762aa921210577817a7 bind-lite-devel-9.9.4-38.el7_3.2.i686.rpm 68a332bfa8510a68dfa69b86731587f3f6db9cb79f5c34ffd25f11a152779c05 bind-lite-devel-9.9.4-38.el7_3.2.x86_64.rpm a13703306d3e55cb528c20b4909b85a4d19347f62899d447c48fa3bee54a8887 bind-pkcs11-9.9.4-38.el7_3.2.x86_64.rpm 4d5a2adf1912a70d6e297fff2fdc682dc6713e3db3a1f5f06245c0a3f1afcd42 bind-pkcs11-devel-9.9.4-38.el7_3.2.i686.rpm afbb5eee280a6724d6e10389d6f11ba724667aed1b4b40cc34b834ab0e507827 bind-pkcs11-devel-9.9.4-38.el7_3.2.x86_64.rpm d6ecabde1ec8cba6ba35e2e8e83294123aa66783958858be2633448f42e20ca5 bind-pkcs11-libs-9.9.4-38.el7_3.2.i686.rpm 2df9618f5fff66583334bdff82397af1e745c7ab52b8c9d621d76a57a4842c96 bind-pkcs11-libs-9.9.4-38.el7_3.2.x86_64.rpm f2628830823d2e30d75a909f8ded4cd29de3e426b31055638a00a004a8406e06 bind-pkcs11-utils-9.9.4-38.el7_3.2.x86_64.rpm 14b3160ad029d2e17ef07078d7f5d83e4e9e153e759bb39fd0ef71986a6cb7a1 bind-sdb-9.9.4-38.el7_3.2.x86_64.rpm ddc9f4877c2e5a465f7075422210153b0aaf05c67e349598f7906d253462279b bind-sdb-chroot-9.9.4-38.el7_3.2.x86_64.rpm 36d4252c534f9af00a95892262eecae02aba51e6e1a70ccc6da1cf00d5da6985 bind-utils-9.9.4-38.el7_3.2.x86_64.rpm Source: cd2e4ab4b292f33e6ab2b04a63d95bd6b120d8b501194b803005fe8455b6b37b bind-9.9.4-38.el7_3.2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 144, Issue 5 ***********************************************

1 0

Centos7 GeoIP support with BIND
by Robert Moskowitz 16 Feb '17

16 Feb '17

In my new Centos7 BIND DNS server, I am seeing messages in logwatch about GeoIP. Something new for me to learn about, and it seems, configure. Checking to see what packages are available I find: GeoIP.armv7hl 1.5.0-11.el7 @centos-base_rbf GeoIP-data.noarch 1.5.0-11.el7 base GeoIP-devel.armv7hl 1.5.0-11.el7 base GeoIP-update.noarch 1.5.0-11.el7 base and GeoIP.armv7hl is already installed in my image (even before I installed BIND, it seems to be part of a base server?). I am not finding any help for GeoIP on Centos, but for debian/ubuntu they are saying to install geoip-database. Is GeoIP-data the same thing? What about GeoIP-update? Basically, I probably should get started on this, or disable it in my DNS server. Can someone point me to Centos specific help or help me out? thanks

2 1

Serious attack vector on pkcheck ignored by Red Hat
by Leonard den Ottolander 15 Feb '17

15 Feb '17

Based on an article that was mentioned on this list https://googleprojectzero.blogspot.nl/2014/08/the-poisoned-nul-byte-2014-ed… I found two attacker controlled memory leaks in the option parsing of pkcheck.c. These memory leaks allow a local attacker the ability to "spray the heap", i.e. initialize large parts of the heap before launching his attack. The original attack uses a setuid binary, because the author "is giving himself a break". However, the fact that the binary in the example is setuid is orthogonal to the fact that heap spraying is a very serious attack vector. Bug reports are filed but closed WONTFIX. I think this is a mistake so I would hope people could weigh in on this. https://bugs.freedesktop.org/show_bug.cgi?id=99626 https://bugzilla.redhat.com/show_bug.cgi?id=1418278 https://bugzilla.redhat.com/show_bug.cgi?id=1418287 Thanks for your interest. Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research

7 33

mach64 driver, latest update in CentOS 6.8, symbol lookup error
by Styma, Robert (Nokia - US) 15 Feb '17

15 Feb '17

I am loading a server from the CentOS 6.7 ISO and then upgrading. After loading at release 6.7, the machine behaves normally. After running yum update, the X server will not start. Attempts to start it manually result in one of the following messages depending upon which OS is loaded. I initially loaded it as 64 bit and when that did not work I tried the 32 bit version of the OS. The graphics card is part of the motherboard so swapping it out is not an option. This is a server and there is no AGP slot. X: symbol lookup error: /usr/lib64/xorg/modules/drivers/mach64_drv.so: undefined symbol: xf86LinearVidMem X: symbol lookup error: /usr/lib/xorg/modules/drivers/mach64_drv.so: undefined symbol: xf86LinearVidMem I yum grouperased the X Window System and Desktop and then groupinstalled it with no luck. I then changed my repos to point to the original ISO, but there were too many dependencies broken to get the system to groupinstall the X Window System and desktop. I tried forcing in just the driver, but it fails with a message about the driver being at a different release than the X server. I am planning to reload the OS and use the Yum Exclude to keep the Xorg pieces. Unfortunately, that will probably break a lot of dependencies. I downloaded the source for the driver from Xorg, but need to find a lot more stuff to get it to compile, and even then, it is likely not to work. Does anyone have any more things to try? Yes I know the mach64 is an old video card, but that is what is there. Since CentOS just follows the upstream source, I am not sure where to file a bug. Not that that is likely to help. I am batting 0 for 5 over the last decade and a half getting anything fixed. Bob Styma

4 10

Kickstart - part ignore onpart ??
by Andreas Benzler 15 Feb '17

15 Feb '17

Hello Guys, after hours of uncessfull create example before i forward special parition tests. part ignoe --onpart But Installation hang out for parition the harddisk. jump to another console partitions are ok ? Which line/lines is/are missing? Andy #version=DEVEL # System authorization information auth --enableshadow --passalgo=sha512 # Use CDROM installation media cdrom # Use graphical install graphical # Run the Setup Agent on first boot firstboot --enable ignoredisk --only-use=sda # Keyboard layouts keyboard --vckeymap=de-nodeadkeys --xlayouts='de (nodeadkeys)' # System language lang de_DE.UTF-8 # Network information network --bootproto=dhcp --device=enp0s3 --ipv6=auto --no-activate network --hostname=localhost.localdomain # Root password rootpw --iscrypted $6$ZzmFRmN6XqC0.Mc4 $LVrBwcqgnv5kIU5mM8e424PDPD7P1dq342lIZrB9gVFzv6EzSRPTGfLyH/M4yf88iwUpOK/XidvqWiYVl8xcG1 # System services services --enabled="chronyd" # System timezone timezone Europe/Berlin --isUtc user --groups=wheel --name=andy --password=$6$gpkn155QMucNw0DC $TUuSuPCe5NEdFyoF/e.bKzrEHvE7W5gyYqNMCmKbkdLIyUnq1qAD5A/.ax/r6DU1MspPnrUzpuWw7rEzOD9hM. --iscrypted --gecos="Andreas Benzler" # System bootloader configuration bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=sda # Disk partitioning information part /boot --onpart=/dev/sda1 part / --onpart=/dev/sda2 part swap --onpart=/dev/sda3 selinux --disabled %packages @^minimal @core chrony kexec-tools %end %pre # clear the MBR and partition table dd if=/dev/zero of=/dev/sda bs=512 count=1 parted -s /dev/sda mklabel msdos TOTAL=`parted -s /dev/sda unit mb print free | grep Free | awk '{print $3}' | cut -d "M" -f1` let SWAP_START=$TOTAL-820 let ROOT_END=$TOTAL-128-820 parted -s /dev/sda mkpart primary ext2 0 128 parted -s /dev/sda mkpart primary ext2 128 $ROOT_END parted -s /dev/sda mkpart primary linux-swap $SWAP_START $TOTAL mkfs.ext2 /dev/sda1 mkfs.ext2 /dev/sda2 mkswap /dev/sda3 %end %addon com_redhat_kdump --enable --reserve-mb='auto' %end %anaconda pwpolicy root --minlen=6 --minquality=50 --notstrict --nochanges --notempty pwpolicy user --minlen=6 --minquality=50 --notstrict --nochanges --notempty pwpolicy luks --minlen=6 --minquality=50 --notstrict --nochanges --notempty %end

2 3

Problems with latest Firefox update -- can't install new extensions
by Kay Schenk 15 Feb '17

15 Feb '17

Since the latest Firefox update to 45.7.0 on my CentOS 6.8 system, I can no longer install add-ons/extensions. Things LOOK like they're working but the extensions don't get stored in my normal area and they don't appear in my Add-Ons menu. Is anyone else having this issue? It has been a while since I added any new extensions so I can't say WHEN exactly this problem happened but .... :( -- ------------------------------------------------ MzK "Trust, but verify." -- Ronald Reagan

2 2

CentOS 7, systemd, NetworkMangler, oh, my
by m.roth＠5-cent.us 15 Feb '17

15 Feb '17

My manager tells me a system in the datacenter is down. I go down there, and plug in a monitor-on-a-stick and keyboard. It's up, but no network. I try systemctl restart NetworkManager several times, and ip a shows *no* change. Finally, I do an ifdown, followed by an ifup, and everything's wonderful. My manager thinks that the NM daemon thinks everything's fine, and there've been no changes, so it does nothing. He suggests that it might have to be stopped, then started, rather than restarted. This is completely unacceptable behavior, since it leave the system with no network connection. Pre-systemd, as we all know, restart *RESTARTED* the damn thing. Is there some Magic (#insert "pixie-dust-sparkles") incantation, either restarting NetworkManager, or using nm-cli, to force it to perform the expected actions? Btw, if this is supposed to be part of the "hide stuff, desktop Linux users don't need to know this stuff", this is a *much* worse result. mark (and yes, my manager's truly aggravated about this, also)

13 34

(re)build sssd-client.i686 for x86_64
by Stijn De Weirdt 15 Feb '17

15 Feb '17

hi all, i'm trying to rebuild the current sssd-client.i686 rpm that is part of the x86_64 repo, but i fail to do so. rebuilding the sssd.src.rpm on x86_64 does not produce this rpm. i can rebuild sssd.src.rpm with --target=i686, but that sssd-client rpm has conflicts and a whole bunch of i686 deps that the rpm from the centos repo doesn't have. tips/help welcome stijn

3 5

Re: [CentOS] Serious attack vector on pkcheck ignored by Red Hat
by m.roth＠5-cent.us 15 Feb '17

15 Feb '17

Johnny Hughes wrote: > On 02/15/2017 09:37 AM, Leonard den Ottolander wrote: >> On Thu, 2017-02-09 at 15:27 -0700, Warren Young wrote: >>> So you’ve now sprayed the heap on this system, but you can’t upload anything else to it because noexec, so…now what? What has our nefarious attacker gained? >> >> So the heap is set with data provided by the (local) attacker who could initialize it to his liking using either of the two memory leaks in the options parsing. >> >> The heap, that is entirely under the control of the attacker, now contains a call to a library with parameters such that it invokes a zero day kernel escalation privilege exploit. And now the exploit will run because pkcheck allowed the attacker to initialize its entire heap via the command line. <snip> I've skipped most of this thread, but went through this post, and excuse me if this sounds like a stupid question... but when the attacker runs their job, isn't it *THEIR* heap, one allocated for this PID, and not any other, such as the heap allocated for PID 1? mark

1 0

Unable to see Desktop folder and file
by MOHD HOMAIDUR RAHMAN 15 Feb '17

15 Feb '17

Dear Cent OS User Today my Mendeley Reference Manager was crash. To recover freshly I deleted Mendeley file from my system from two place, 1) from share folder and 2) from cache folder by using this command. Copy from history 730 ls -a 731 cd .Mendeley\ Desktop/ 732 ls 733 ll 734 cd ../ 735 mv .Mendeley\ Desktop/ mendelyDestop 736 ll 737 rm -rf mendelyDestop 738 locate Mende 739 rm -rf /home/chinmai/.local/share/data/Mendeley Ltd./Mendeley Desktop/Downloaded* 740 locate Mende 741 rm -rf /home/chinmai/.local/share/data/Mendeley Ltd./Mendeley Desktop* 742 locate Mende 743 clear 744 locate Mende 745 rm -rf /home/chinmai/.local/share/data/Mendeley Ltd./Mendeley Desktop/www.mendeley.com/rajanikr08@gmail.com-1a4c 746 rm -rf /home/chinmai/.local/share/data/Mendeley Ltd./Mendeley Desktop/www.mendeley.com/* 747 locate Mende 748 df -h 749 cd .local/share/data 750 ll 751 rm -rf Mendeley\ Ltd./ 752 ll 753 locate Mende 754 cd ../ 755 ls -a 756 cd .cache/ 757 ll 758 rm -rf Mendeley\ Ltd./ 759 ll 760 top 761 clear 762 ls 763 cd 764 ls -a 765 cd .local/share/ 766 ll 767 cd 768 cd .cache/ 769 ll After deletion, my Mendeley start working but my all folder and file from Desktop are missing. When I am locating the file and folder from desktop it showing their name but I ma unable to see that file or folder. Any guidance regarding how to recover is very helpful to me. Thanks & regards Rahman ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' *M*d* H*omaidur* R**ahman *( Research Scholar ) Lab No. 510, Computational Biophysics Lab. Department of Biotechnology Indian Institute of Technology-Madras Chennai-600 036, India *Mobile No = +91- 7845991785* '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

1 0

Centos7 and old Bind bug
by Robert Moskowitz 15 Feb '17

15 Feb '17

This is my new Centos7 DNS server. In logwatch I am seeing: **Unmatched Entries** dispatch 0xb4378008: open_socket(0.0.0.0#5546) -> permission denied: continuing: 1 Time(s) dispatch 0xb4463008: open_socket(::#1935) -> permission denied: continuing: 1 Time(s) dispatch 0xb4464440: open_socket(::#8554) -> permission denied: continuing: 1 Time(s) dispatch 0xb4464440: open_socket(::#8614) -> permission denied: continuing: 1 Time(s) dispatch 0xb4465008: open_socket(::#1935) -> permission denied: continuing: 1 Time(s) dispatch 0xb4465440: open_socket(0.0.0.0#4321) -> permission denied: continuing: 1 Time(s) dispatch 0xb4465878: open_socket(0.0.0.0#2605) -> permission denied: continuing: 1 Time(s) dispatch 0xb4465878: open_socket(0.0.0.0#4444) -> permission denied: continuing: 1 Time(s) dispatch 0xb4465878: open_socket(0.0.0.0#8611) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466008: open_socket(0.0.0.0#1935) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466008: open_socket(0.0.0.0#5546) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466008: open_socket(0.0.0.0#8611) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466440: open_socket(0.0.0.0#2605) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466440: open_socket(0.0.0.0#4444) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466878: open_socket(0.0.0.0#1935) -> permission denied: continuing: 1 Time(s) dispatch 0xb4466878: open_socket(0.0.0.0#8610) -> permission denied: continuing: 1 Time(s) dispatch 0xb4467440: open_socket(0.0.0.0#8613) -> permission denied: continuing: 1 Time(s) dispatch 0xb4467440: open_socket(0.0.0.0#8614) -> permission denied: continuing: 1 Time(s) etc. This seems to be bug 1103439 which was 'fixed' for Centos6. What should I do about this? Is there a SELinux policy to apply or should I the avoid upd-ports option in Bind? thank you

2 7

vsftp problem C7
by Alessandro Baggi 15 Feb '17

15 Feb '17

Hi list, I've a problem with vsftpd on C7.3. This is a dedicated server protected by a Zywall5. SELINUX is disabled. This is my vsftpd configuration: anonymous_enable=NO local_enable=YES write_enable=YES local_umask=022 dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_file=/var/log/vsftpd.log xferlog_std_format=YES idle_session_timeout=600 data_connection_timeout=120 ftpd_banner=Welcome listen=YES listen_port=21 pasv_enable=YES pasv_min_port=50000 pasv_max_port=50100 pasv_address=public-ip port_enable=YES pasv_addr_resolve=NO listen_ipv6=NO pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES Connecting from localhost to the local ip with ftp command, I've no problems. If I try to connect from remote host to the ftp server I got some problems. Connecting from my workstation I can log in with user and pwd but when listing I get: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (188,213,172,158,206,207) ftp: connect: Connection refused ftp> Seems to be a firewall (zywall5) problem. On server firewalld is disabled and there are not iptables rules. So I've open port 20,21,50000:50100 from my ip to server ip. The problem persists. I've tried to open all ports (Using Any TCP and Any UDP) but the problem persists. I've tried with another local server with the same vsftpd configuration and I've reproduced the problem by closing all ports with iptables. I get the same messages but after enabling specified ports with iptables on server the issue is solved. How I can solve this issue on remote server? THanks in advance.

1 1

CentOS-announce Digest, Vol 144, Issue 4
by centos-announce-request＠centos.org 14 Feb '17

14 Feb '17

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2017:0269 Critical CentOS 6 java-1.7.0-openjdk Security Update (Johnny Hughes) 2. CESA-2017:0269 Critical CentOS 5 java-1.7.0-openjdk Security Update (Johnny Hughes) 3. CESA-2017:0269 Critical CentOS 7 java-1.7.0-openjdk Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 13 Feb 2017 17:16:15 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 6 java-1.7.0-openjdk Security Update Message-ID: <20170213171615.GA22675(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5e812e4583b71107b72779cfc77f78c7fdc1a147a56126136f87d14cc3b4efb8 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.i686.rpm ce382ede1a4eac4ffdba9aa870cc9c06a083749fb40b4d9ca342b17354836553 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el6_8.i686.rpm 4ad8906f9df3db8a1812a2b3b326762a9c2a694d6a494eb0e5220b9596d0718c java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el6_8.i686.rpm 191ff23c7449d819ca45243beb432c700c66476597fd08c57c39ae8ceda8ffd2 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el6_8.noarch.rpm 800b7ed498f4b4fd6d0e024652ad05eef8682237fe2349f82a69106a4ca09d54 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el6_8.i686.rpm x86_64: d9381ac7f354a3d066efe9ef1160264309f46c9373c5b28e26365ca3d81dad1a java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 0057a0bbfe965f73222b4806b7be62f4b79507a1c9903ccc5c4daeb65cd1addf java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 7872f4fef9d877d2e9de8d9e1c11cd64e6afaf3620266997706fcdad9d9b196d java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm 191ff23c7449d819ca45243beb432c700c66476597fd08c57c39ae8ceda8ffd2 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el6_8.noarch.rpm 3c2b900af1a17e21b63aab28f034e6026d983cf96e1ffd7231a677e1ada30623 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm Source: bf4fbc5136e1640ade4a455baa073d802fc25f099af1075fd636d3d1484ee9cb java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Mon, 13 Feb 2017 17:21:05 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 5 java-1.7.0-openjdk Security Update Message-ID: <20170213172105.GA27499(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: f2fb7e8343760a6cc3535a6124bd71411b20795da0ac056b8361c8826ce9a69e java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.i386.rpm 72c2fee994a496787fe7a8080b0871b0d015c63fc57cf5f2457107620bbb9ac1 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el5_11.i386.rpm 2563c40d3b9b9d9ce7787284a8f8808491d4adb7af5ee3a6f9a1daeba47e8012 java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el5_11.i386.rpm d4ca35c4e689c276e1f746664e9d9f7fd46a44df643bc7e42a87183473870530 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el5_11.i386.rpm c9e4741823aec2cfc8674f0c0bf52d87eca0fb31c5ea682a7d4208d1d2f29928 java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el5_11.i386.rpm x86_64: b277770918246adb9966adbdcc06306e0863392d4cbf327bdfb570d4ade8bf73 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm e0ce4d7487d50528ea6fffb32c47f5e2405f3863a91b7ca85025b5b86e07ae99 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm f18a46c869e0fe0bda885e6876f117e3a35604ef23a3c7cdc6c71df754d59ab1 java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm 4a16817c9069a4f5f7d176df443a30e6309bb3551244bfe057054c058b329b70 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm 1d7b5898fd46ae5a447d7b8116919e8e7e16179b40ea3551c0f2ed62b5d1e22f java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el5_11.x86_64.rpm Source: 41d3efcc5b6cccbb9ea0af1bde1b2fc4aab16274d55d26db3e64924068128bc8 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 3 Date: Mon, 13 Feb 2017 18:45:43 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0269 Critical CentOS 7 java-1.7.0-openjdk Security Update Message-ID: <20170213184543.GA36647(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0269 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0269.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: afcc43329737c25752cc4e38a34c8ea0430ab0be696d4cfd2c50f9ac82184984 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 57c42d32708e71c1778811b6201f189f0d9682ef1ee64ac4f5ca221725ecf41f java-1.7.0-openjdk-accessibility-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 962b228787c68649003f8a1e5df6875958fdda37866a9d55dc451643ebf1b865 java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm c68e9ed21e04c0ab6d86cbb445f692eb277346a3a51ffc735ba0893d295a109a java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 629a4dc16c4fb283a3be2b19070cc97ea864018f3b2a18f7a5383eb483154bee java-1.7.0-openjdk-headless-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm 087c956bb48670bd96f861a5996b8535c89b3c83b7f1472af81fbacd7946d754 java-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el7_3.noarch.rpm a8237710facd516d1d6eda6d749a5fb724746172d866b93168c261933569192f java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el7_3.x86_64.rpm Source: 1edbdfcdfacb9daec6390aed4fdad4fe38dbf36023f1a095fff518d29e585594 java-1.7.0-openjdk-1.7.0.131-2.6.9.0.el7_3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 144, Issue 4 ***********************************************

1 0

dhcpcd.conf
by Alice Wonder 14 Feb '17

14 Feb '17

Hi, ran into a problem w/ linode hosted VM where IPv6 address changed after they migrated it to a different host. They claim I can fix it with sed -i 's/slaac private/slaac hwaddr/' /etc/dhcpcd.conf However there appears to be no dhcpcd.conf on any of my CentOS 7 systems. What is the CentOS 7 equivalent?

2 1

A question on networking (CentOS 6)
by KM 13 Feb '17

13 Feb '17

Hi AllThis is NOT specifically related to CentOS per se. I have 2 servers that are on two networks. I did NOT set this up. The NIC went bad and it has been replaced. I knew enough to update the HW address in the ifcfg-* files. The network service restarts successfully without errors. However I cannot connect via ping or ssh with the pt2pt network setup on 192.168.x.*. When I use our internal network ip addresses it is fine. I am not sure how to troubleshoot this separate connection. What can I provide here that will allow someone to help? Thanks in advance. I tried searching a bit but didn't find anything of use so far. KM

2 4

Re: [CentOS] Wich web browser on CentOS6 ?
by James B. Byrne 13 Feb '17

13 Feb '17

On Fri, February 10, 2017 15:44, Alice Wonder wrote: > On 02/10/2017 12:34 PM, James B. Byrne wrote: >> >> On Fri, February 10, 2017 06:26, Patrick Begou wrote: >>> Hello >>> >>> I have more and more troubles using firefox in professional >>> environment with >>> CentOS6. The latest version is 45.7.0 But I can't use it anymore to >>> access some >>> old server hardware (IDRAC7 of DELL C6100) because of >>> "/SSL_ERROR_WEAK_SERVER_CERT_KEY/". I had to install an old >>> Firefox32 >>> version >>> to administrate these servers. >>> >>> Today I upgrade the firmware of 2 DELL switch and now Firefox >>> cannot >>> connect to them anymore saying: /An error occurred during a >>> connection to xxx.xxx.xxx.xxx. The server rejected >>> the handshake because the client downgraded to a lower TLS version >>> than the server supports// //SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT >>> >>> /Is there a CentOS6 recommended web browser allowing continuous >>> connections to olds and new base level (and local) system >>> administration services ? >>> >> >> This situation arises because older, dare I say old, equipment >> released with embedded software and using http/https as the >> administrative front end were shipped with minimally compliant x-509 >> certificates. Often self-signed with 1kb keys and md5 signature >> hashes. Not to mention many are past their expiry dates. >> >> However, given the revelations of state sanctioned snooping on >> network >> traffic browsers are being pushed to implement increased compliance >> checking for the overall security of users. Firefox is simply >> implementing what various 'authorities' are recommending as secure >> practices with respect to authentication using pki and x-509 >> certificates. >> >> The present situation is a PIA. It could be a lot more >> user-friendly >> if FF so chose. They could have easily allowed one to turn off these >> advanced compliance checks for specific IP and DNS addresses so that >> the intended benefit remained but the interference with existing >> infrastructure was minimised. >> >> But, FF is on its own chosen path to oblivion and the idea of >> compromise is totally absent from their project plan. >> >> > > IMHO FireFox is doing the right thing. Compromises in policy is how > system compromises often happen. > > If you can change the setting to be more forgiving of certain bad > vendors, then so can malware. > > What we really need to do is demand better from the manufacturers of > products we use in a "professional environment" - and it is extremely > important we demand better from them now, during the dawn of IoT. > > It is a bit difficult for an end user to insist that a vendor improve a ten year old piece of equipment. Sure, that might be as simple as a firmware update. But why not insist that people buy new product instead and thereby add to the bottom line? Which way do see most commercial firms going? FF is a consumer item that is being shipped with a supposedly Enterprise Linux distribution. This leads to problems that are created by the divergence between the target audience and Enterprise users. Enterprises tend to have a much more robustly secured gateware to the wider Internet than consumers. Which for that audience makes a lot of the more esoteric security enhancements rather useless. If an intruder can carry out a MTM attack on your internal LAN then nothing FF can do is going to have much of an effect. A professional organisation would not simply cut administrators off from the devices that they are required to manage. Nor would it dictate how a company spends its money on hardware. A bunch of self-righteous zealots might. Which may account for the fact that FF (all versions) market share is now less than 10%.[1] [1] https://www.netmarketshare.com/browser-market-share.aspx?qprid=2&qpcustomd=… -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2017