Discuss March 2017

discuss@lists.centos.org

125 participants
113 discussions

Mixed bonding and vlan on plain adapter possible?
by Gianluca Cecchi 29 Mar '17

29 Mar '17

Hello, I have a CentOS 7.3 + updates server where my configuration arises from the need to connect via iSCSI to a Dell PS Series storage array and Dell not supporting bonding. So that I need to use 2 nics on the same vlan to connect to iSCSI portal IP and then use multipath. Also, the iSCSI lan is on a dedicated vlan I have only these 2 x 10Gbit adapters and I also need to put other vlans on them through bonding. I plan to use active-backup as bonding mode. My first tests were only with iSCSI in place to verify connection is ok I followed these Dell guidelines, for both multipath and sysctl configs for network adapters: http://en.community.dell.com/techcenter/extras/m/white_papers/20442422 iSCSI vlan is 100 so that the configured devices are p1p1.100 and p1p2.100 and my sysctl config is: net.ipv4.conf.p1p1/100.arp_announce=2 net.ipv4.conf.p1p2/100.arp_announce=2 net.ipv4.conf.p1p1/100.arp_ignore=1 net.ipv4.conf.p1p2/100.arp_ignore=1 # net.ipv4.conf.p1p1/100.rp_filter=2 net.ipv4.conf.p1p2/100.rp_filter=2 So far so good and my lun is viewed this way through multipath [root@ov300 etc]# multipath -l 364817197b5dfd0e5538d959702249b1c dm-3 EQLOGIC ,100E-00 size=1.0T features='0' hwhandler='0' wp=rw `-+- policy='round-robin 0' prio=0 status=active |- 7:0:0:0 sde 8:64 active undef running `- 8:0:0:0 sdf 8:80 active undef running I tried a test workload and both paths are used in a balanced way. Now I temporarily stop the iSCSI layer and ifdown the p1p1.100 and p1p2.100 devices and put in place bonding on plain p1p1 and p1p2 interfaces and then vlans over it and bridges (they are for VMs) [root@ov300 ~]# cat /proc/net/bonding/bond1 Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) Bonding Mode: fault-tolerance (active-backup) Primary Slave: None Currently Active Slave: p1p1 MII Status: up MII Polling Interval (ms): 100 Up Delay (ms): 0 Down Delay (ms): 0 Slave Interface: p1p1 MII Status: up Speed: 10000 Mbps Duplex: full Link Failure Count: 0 Permanent HW addr: a0:36:9f:2e:4d:80 Slave queue ID: 0 Slave Interface: p1p2 MII Status: up Speed: 10000 Mbps Duplex: full Link Failure Count: 1 Permanent HW addr: a0:36:9f:2e:4d:82 Slave queue ID: 0 [root@ov300 ~]# - ifcfg-bond1.65 DEVICE=bond1.65 VLAN=yes BRIDGE=vlan65 ONBOOT=yes MTU=1500 DEFROUTE=no NM_CONTROLLED=no IPV6INIT=no - ifcfg-vlan65 DEVICE=vlan65 TYPE=Bridge DELAY=0 STP=off ONBOOT=yes MTU=1500 DEFROUTE=no NM_CONTROLLED=no IPV6INIT=no [root@ov300 network-scripts]# brctl show vlan65 bridge name bridge id STP enabled interfaces vlan65 8000.a0369f2e4d80 no bond1.65 [root@ov300 network-scripts]# The same for vlans 162, while for vlan 187 I only have the bond1.187 without a bridge on top of it At the end I try to re-start the iSCSI components, but it seems now I have iSCSI connection interrupted and not stable. During this phase the command [root@ov300 network-scripts]# iscsiadm -m session -P1 has in its output for the 2 interfaces Iface Netdev: p1p2.100 SID: 5 iSCSI Connection State: TRANSPORT WAIT iSCSI Session State: FAILED Internal iscsid Session State: REOPEN ... SID: 6 iSCSI Connection State: TRANSPORT WAIT iSCSI Session State: FREE Internal iscsid Session State: REOPEN and then Iface Netdev: p1p2.100 SID: 5 iSCSI Connection State: TRANSPORT WAIT iSCSI Session State: FREE Internal iscsid Session State: REOPEN ... Iface Netdev: p1p1.100 SID: 6 iSCSI Connection State: LOGGED IN iSCSI Session State: LOGGED_IN Internal iscsid Session State: NO CHANGE and from multipath point of view a sequence of these: [root@ov300 network-scripts]# multipath -l 364817197b5dfd0e5538d959702249b1c dm-2 EQLOGIC ,100E-00 size=1.0T features='0' hwhandler='0' wp=rw `-+- policy='round-robin 0' prio=0 status=active |- 14:0:0:0 sde 8:64 active undef running `- 13:0:0:0 sdf 8:80 failed faulty running [root@ov300 network-scripts]# multipath -l 364817197b5dfd0e5538d959702249b1c dm-2 EQLOGIC ,100E-00 size=1.0T features='0' hwhandler='0' wp=rw `-+- policy='round-robin 0' prio=0 status=active |- 14:0:0:0 sde 8:64 active undef running `- 13:0:0:0 sdf 8:80 failed faulty running [root@ov300 network-scripts]# multipath -l 364817197b5dfd0e5538d959702249b1c dm-2 EQLOGIC ,100E-00 size=1.0T features='0' hwhandler='0' wp=rw `-+- policy='round-robin 0' prio=0 status=active |- 14:0:0:0 sde 8:64 active undef running `- 13:0:0:0 sdf 8:80 failed undef running Should my config work or do you see any physical/network intrinsic problems in it? >From first tests it seems the more problematic adapter in iSCSI connection is the one that at the time was the active slave in the active-backup bond..... but I only did preliminary tests Tomorrow I'm going to run further tests and verify better and deeper, but any comment/suggestion would be appreciated in advance. Thanks Gianluca

1 0

Nodejs010 Packages giving unresolved dependency error when building the nodejs packages
by Maheshwari, Shagun 29 Mar '17

29 Mar '17

Hi, I am trying to built an ISO with nodejs010 packages but when I run the command "repoclosure -a x86_64 -r <local-repository-name>" to check its further dependencies, it is giving unresolved dependencies error. Example: package: nodejs010-node-gyp-3.2.0-2.el7.centos.noarch from Harman (it's a local repo name) unresolved deps: npm(minimatch) < 0:4 npm(minimatch) >= 0:3 nodejs(engine) >= 0:0.8.0 In ISO we have nodejs010-nodejs-minimatch-3.0.2-1.el7 but it is giving error that npm(minimatch) < 0.4 or npm(minimatch) >= 0:3 and on mirror.centos.org latest version of this package is 3.0.2-1. It was an example, there are many errors like this. So, Please find the attached nodejs-unresolved-dep-erre.log file. I have also attached the list of nodejs's RPMs which I want to include in my ISO. Steps to reproduce this issue: 1. Built all nodejs packages using mock Mock -r centos-7-x86_64 rebuild -define 'scl nodejs010' nodejs010-x.x.x.src.rpm 2. Copy all nodejs rpms in a folder 3. Make a local repository in /etc/yum.repos.d/ folder e.g. 1. cd /etc/yum.repos.d/ 2. mkdir dep.repo 3. copy following lines in dep.repo file: [harman] name=harman baseurl=file:///path of the folder where you have copied your nodejs rpms/ enabled=1 4. Run the following command in that folder where you have copied your rpms: createrepo . 5. Then run repoclosure -a x86_64 -r harman But when I download all nodejs rpms from http://mirror.centos.org/centos-7/7.3.1611/sclo/x86_64/rh/nodejs010/ site and repeat the same steps then it is not giving any unresolved dependency errors. Why it is happening ? or There is any problem with our rpm building process ? Please response and help. Regards, Shagun Maheshwari

1 0

RHEL 6.9 is out
by Phelps, Matthew 28 Mar '17

28 Mar '17

Red Hat released RHEL 6.9 yesterday. Why isn't CentOS 6.9 out yet? :) -- Matt Phelps System Administrator, Computation Facility Harvard - Smithsonian Center for Astrophysics mphelps(a)cfa.harvard.edu, http://www.cfa.harvard.edu

6 8

mirror for debug_info repo
by jsl6uy js16uy 28 Mar '17

28 Mar '17

Hello all hope all is well. We pull down via rsync from a Centos mirror for general updates/os/etc. I don't see a mirror for debuginfo.centos.org::centos-debuginfo well debuginfo.centos.org. The banner for the site states you should only use this site if you plan to be a public mirror. I have not checked every site on the centos mirror list, checked 10 to 15 in the US, but the only one I found that even had a folder for a debug_info sync stated: "due to size this has been moved to debuginfo.centos.org" I am only syncing debuginfo.centos.org::centos-debuginfo/7/x86_64 and i386. Should I pull from here? Is there a better place? Just trying to do the right thing net/netizen resource usage wise Any help/guidance appreciated thanks all

1 0

Re: [CentOS] firewalld management on a headless server
by m.roth＠5-cent.us 28 Mar '17

28 Mar '17

James B. Byrne wrote: > > On Mon, March 27, 2017 17:31, m.roth(a)5-cent.us wrote: >> Mike wrote: >>> Nice catch, Mr. Schumacher ---> The following modules are included as standard with release 1.831 of Webmin. FirewallD firewalld.wbm.gz Configure a Linux firewall using FirewallD, by editing allowed services and ports. >>> >>> This is likely the right tool for the job. >>> >> Webmin used to be considered insecure, and people would scream and yell if you suggested using it. Has that changed? > > Webmin is as insecure as the administrator cares to make it. > > Our host systems' Webmin instances listen on a reserved IP address different from the host's DNS entry and that address is only reachable through the host's firewall from specified IP addresses originating on our internal LAN. Further, Webmin is configured to automatically switch to https and use a certificate generated by our corporate private CA. Our gateway firewall blocks all access to the port > assigned to Webmin. One has to tunnel in to one of the pre-determined host addresses to obtain remote access. > > A separate webmin logon is set in the webmin configuration which has no existence on the host system. > > Webmin can also be configured to restrict the hours and day that asccess is allowed to specific users but we have not bothered with that. > > The main known weakness is Webmin's dependency on passwords which for all I know is due to my ignorance. If Webmin does support RSA > certificate authentication then I would love to be told where it is configured. However,failing that, very long phase phrases mitigate the password issue somewhat. Further, Webmin does support two-factor authentication using Google or Authy. > > To my knowledge there are no CVEs reported for Webmin since 2015 and I believe that all known problems are resolved in the present release. Which is not to say that there are no exploits left to be uncovered but then again we can hardly claim that about any software. > Thanks for the extended response, James, esp. that last paragraph. I hadn't been following webmin for a number of years - we don't use it here. I did find and use it in a job I was in ten years ago - it was the only way I could get LDAP working, as, at the time, the tools that came with the package were *not* ready for prime time.... mark PS: Tried reply, James, but it bounced.

1 0

Using i3 wm under CentOS7
by C. L. Martinez 28 Mar '17

28 Mar '17

Hi all, Anyone has installed i3 wm under CentOS7? Any samples? I have some doubts about to how to manage battery power, notifications, etc. Thanks -- Greetings, C. L. Martinez

1 0

Re: [CentOS] firewalld management on a headless server
by James B. Byrne 28 Mar '17

28 Mar '17

On Mon, March 27, 2017 17:31, m.roth(a)5-cent.us wrote: > Mike wrote: >> Nice catch, Mr. Schumacher ---> The following modules are included >> as >> standard with release 1.831 of Webmin. FirewallD firewalld.wbm.gz >> Configure a Linux firewall using FirewallD, by editing allowed >> services and ports. >> >> This is likely the right tool for the job. >> > Webmin used to be considered insecure, and people would scream and > yell if you suggested using it. Has that changed? Webmin is as insecure as the administrator cares to make it. Our host systems' Webmin instances listen on a reserved IP address different from the host's DNS entry and that address is only reachable through the host's firewall from specified IP addresses originating on our internal LAN. Further, Webmin is configured to automatically switch to https and use a certificate generated by our corporate private CA. Our gateway firewall blocks all access to the port assigned to Webmin. One has to tunnel in to one of the pre-determined host addresses to obtain remote access. A separate webmin logon is set in the webmin configuration which has no existence on the host system. Webmin can also be configured to restrict the hours and day that asccess is allowed to specific users but we have not bothered with that. The main known weakness is Webmin's dependency on passwords which for all I know is due to my ignorance. If Webmin does support RSA certificate authentication then I would love to be told where it is configured. However,failing that, very long phase phrases mitigate the password issue somewhat. Further, Webmin does support two-factor authentication using Google or Authy. To my knowledge there are no CVEs reported for Webmin since 2015 and I believe that all known problems are resolved in the present release. Which is not to say that there are no exploits left to be uncovered but then again we can hardly claim that about any software. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Re: [CentOS] firewalld management on a headless server
by Mike 28 Mar '17

28 Mar '17

Webmin used to be considered insecure, and people would scream and yell if you suggested using it. Has that changed? mark Ahh, I did not know of this. Well, I'm back to suggesting OP take a little time and get comfortable with firewall-cmd in the terminal. If we want our solid redhat clone then systemd, NetworkManager, and firewalld are soldered into the foreseeable future.

2 1

Does fail2ban protect anything other than SSH logins?
by Robert Moskowitz 27 Mar '17

27 Mar '17

I am looking at fail2ban, and all I see is it protecting remote logins to SSH. Does it protect any other access to systems? Well perhaps other than VNC perhaps? thank you

3 2

Systemd interface rename does not work
by Matt . 27 Mar '17

27 Mar '17

Hi, I'm moving to Systemd for my network management but I don't see my link name changed when I try to using a .link name. The .network file works right, networkmanager is removed as well to accomplish this. Any idea why the rename is not done ? /etc/systemd/network/0-eth.network [Match] MACAddress=00:1a:4a:a9:0a:17 [Network] Address=172.16.3.141/24 Gateway=172.16.3.254 DNS=172.16.3.1 DNS=172.16.3.2 /etc/systemd/network/0-eth.link [Match] MACAddress=00:1a:4a:a9:0a:17 [Link] Name=eth0

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2017