Discuss September 2017

discuss@lists.centos.org

128 participants
123 discussions

08 Sep '17

hello, some users' login fails since they type upper case for their user ids ,etc ... how can case sensitivity be disabled so they can login with mix of upper and lower case? this is what i tried: in /etc/sssd/sssd.conf i tested this below [domain/default] case_sensitive = false i stopped sssd, deleted all inside /var/sss/db and started sssd but that did not help .... thank you, F-

8 11

installing lxqt on CentOS-7
by Fred Smith 07 Sep '17

07 Sep '17

I see that epel has a bunch of lxqt packages,, but there doesn't seem to be a lxqt group. if I try to install lxqt-* it of course wants to install a whole shipload of stuff alongside it. does anyone here happen to know the correct incantation for getting lxqt onto a C7 system without unnecessary crap? thanks in advance! Fredex -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "For him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy--to the only God our Savior be glory, majesty, power and authority, through Jesus Christ our Lord, before all ages, now and forevermore! Amen." ----------------------------- Jude 1:24,25 (niv) -----------------------------

1 0

lightdm dependency
by Jon LaBadie 05 Sep '17

05 Sep '17

On a CentOS 7 system I'm trying to install lightdm. Yum says it requires "glib2(x86-64) >= 2.50.3". glib2 2.46 is installed but I have not found a 2.50 version. Have I overlooked it in some repo? -- Jon H. LaBadie jcu(a)labadie.us 11226 South Shore Rd. (703) 787-0688 (H) Reston, VA 20190 (703) 935-6720 (C)

2 2

Network Interrogation
by Chris Olson 05 Sep '17

05 Sep '17

Small private networks are a necessary part of our business. We also run some small networks with Internet connectivity through firewall routers. The smallest of these networks has only a printer and a mix of five CentOS and Windows 7 machines. We use a commercial protection product on the W7 system. This product has worked well guarding against unwanted software on the system for about three and a half years. Scans are scheduled and performed routinely once a week or on demand at various times. A recent update to this protection product has caused it to start probing the network for other systems. There is sometimes a message following scans indicating that there are other systems on our network that are unprotected. It appears that the two systems it is naming are a CentOS 6 system and the HP printer. This network probing does not happen with every scan that is run by the protection software and we have not been able to determine what causes that probing to be initiated. We also do not know exactly what is happening over the network during the probing activity. The protection software support folks have been no help in figuring out what is going on. There seems to be no good reason for the probing message to name only these two systems. The available printer status shows no indication of network traffic associated with this probing activity. The CentOS 6 system also does not indicate any related network activity from the system that is running the protection software. We have tried unsuccessfully to capture the network probing activity using Wireshark. Any ideas regarding how to track down what is happening here would be greatly appreciated.

5 4

Kernel 4.12 and nVidia Driver
by Eugene Poole 05 Sep '17

05 Sep '17

I tried to move to the latest stable kernel (4.12) so I could take advantage of my newest custom system (Intel Core I7 6-core; 64 GB RAM; MSI nVidia graphics card; 2 - 120 GB SSD; 2 - 4TB WD Black) on a UEFI Asrock mother board. I've had the machine for 3-months but I couldn't get it to work until I found out that the Nouveau driver was causing me all the 'hardware' issues. I moved to the nVidia driver along with DKMS and all of my issues went away until I attempted to upgrade kernel 4.12 ... It seems that DKMS doesn't automatically upgrade when the kernel is upgraded. Will this issue go away if I change my graphics card to a AMD? -- Eugene Poole Woodstock, Georgia

4 3

Simple OCSP server ??
by Alice Wonder 05 Sep '17

05 Sep '17

Hello list, I'm contemplating running my own CA to implement the new proposed ISP for validation of S/MIME certificates via DANE. I already use self-signed for my MX servers (with 3 1 1 dane records on TCP port 25) but I don't want to use self-signed for S/MIME for user specific x.509 certs because A) That's potentially a lot of DNS records B) That requires a hash of the e-mail addresses in DNS Instead, I will be using a wildcard in DNS with an intermediary that signs the user x.509 certificates. Using an intermediary to sign their certificates though means I can't just revoke their certificates by removing the DNS certificate, I'll need to provide an OCSP server for when one of their private keys gets compromised. I found https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.… but it looks like that is intended for enterprise, more complex than I need. Anyone know of a good simple script for providing OCSP ?? -=- Not relevant to question but just important for me to note, I will *not* be asking people to install my root certificate in their e-mail clients. I think it is a bad practice to get users in the habit of installing root certificates. I think the PKI system has way way way to many root certificates as it is. I want a world where DANE validates most certificates, and only a few root certificates are needed for things like banks where EV certificates are a must. DANE as a way to validate S/MIME I think will be a godsend to e-mail security, I hope clients implement it.

2 5

Problem with IPTABLES logging message to the screen/console
by Jobst Schmalenbach 05 Sep '17

05 Sep '17

Hi I am not sure how to solve this. I am constantly getting messages that should go into the kern/message log printed on screen - MOSTLY from iptables. The messages are ALSO logged to the syslog files. It still prints those message onto the console screen even if I am logged off (security issue). When logged in on the console its anoying as I constantly have to hit CTRL-L to refresh the screen to get rid of those messages. However it does NOT happen when I ssh into the machine. How can I solve this that those messages are NOT printed. thanks Jobst -- Share your knowledge. It's a way to achieve immortality. | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

2 2

selinux denial of cgi script with httpd using ssl
by Gregory P. Ennis 05 Sep '17

05 Sep '17

Everyone, I am trying to use a cgi perl script for a CentOs 7 website that works fine with selinux in permissive mode but fails with selinux in enforcing mode. The problem I have is that I can not find where the selinux error message is being recorded. It does not appear to be in the /var/log/messages or /var/log/audit/audit.log. I do not get any /var/log/httpd/ssl_error_log entries. I do get a successful entry into /var/log/httpd/ssl_access_log and ssl_request_log when selinux is in permissive mode, but not when selinux is in enforcing mode. The only place I can see that I am getting an error message is in the /var/log/httpd/error_log which is as follows : Mon Sep 04 11:40:24.216569 2017] [cgi:error] [pid 2290] [client x.x.x.x:55748] AH01215: (13)Permission denied: exec of '/var/www/cgi-bin/name.of.script.cgi' failed, referer: https://name.domain.com/ When selinux is in permissive mode the above error does not occur and the script works fine. When selinux is in enforcing mode the above error occurs, and the cgi script fails to execute. Is there a way to increase the sensitivity of selinux loging, or is there a different place to look for the error that prevents the execution of the script. Your help would be appreciated. Thanks, Greg Ennis

4 7

CentOS nDPI kmod avaliable for testing
by Eliezer Croitoru 05 Sep '17

05 Sep '17

I have been working for quite some time building nDPI iptables module from vel21ripn for many Linux distributions and I just finished couple basic tests on the module for CentOS 7 and I am quite satisfied. I am looking for other CentOS 7 admins who will want to test this iptables module. More details are at: https://github.com/vel21ripn/nDPI/issues/18 Thanks, Eliezer ---- Eliezer Croitoru Linux System Administrator Mobile: +972-5-28704261 Email: eliezer(a)ngtech.co.il

1 0

rkhunter and prelink
by m.roth＠5-cent.us 02 Sep '17

02 Sep '17

Can't remember if I posted this before... We're getting warnings from rkhunterWarning: Checking for prerequisites [ Warning ] All file hash checks will be skipped because: This system uses prelinking, but the hash function command does not look like SHA1 or MD5. Now, googling, I find people saying to rm /etc/prelink.cache, then run rkhunter --propupd. Works. And then, prelink runs in the middle of the night, via /etc/cron.daily, and when the cron job of rkhunter runs, it's back to complaining. Anyone have any ideas what's going on here? I don't see anything in the prelink.conf, or any options in the prelink manpage to tell is what hash to use. mark

5 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2017