Discuss November 2018

discuss@lists.centos.org

96 participants
72 discussions

[OT] Where to buy S/MIME ??
by Alice Wonder 29 Nov '18

29 Nov '18

Hi, I'm getting increasingly paranoid. Something I said on a certain social media site several months ago was modified - then reported - then by account was banned until I agreed to delete it. Obviously since what I said was modified I didn't have any issue with deleting it but I want more than just DKIM sigs on my e-mail now. Anyway looking for S/MIME I can use to sign and/or encrypt but mostly sign. Not interested in GnuPG or self-signed S/MIME - I want something that can be trusted because someone else that is trusted actually vouched for me. The "free for personal" S/MIME from Comodo didn't work. Browser said it did but there was nothing to export for me to then import. I suspect it is because I used private browser window, I really don't like the idea of a private key stored in browser anyway. And it never asked for a password to encrypt the private key, nor let me specify key strength (only let me choose between medium and high - I assume high is 4096 but I don't know, it didn't say) Didn't like the "browser generated" process, even if it had worked and generated the final product I could export - I really didn't like the process and have serious questions about the wisdom of a private key without a pass phrase stored in an application that interacts with web sites. Anyway so used openssl to create private key (with aes-256 encryption and pass phrase) and then a CSR. But I can't find anyone who sells certs for S/MIME to send the CSR too. Globalsign but they wanted $89 - no one else. Found a few sites that offered to "send me a quote" that I think were intended for corporate accounts. Where do regular users who just want an inexpensive certificate usable for S/MIME from a CSR generated the traditional way go to buy a cert? -=- Off Topic 2 I'm going to strangle whoever it is at Google that thinks it is a good idea to put so many video results at the top of search results for this kind of thing. I'm really getting sick of how highly ranked videos now are in search engines.

8 12

Gnome_shell out of memory
by Jerry Geis 28 Nov '18

28 Nov '18

Hi All, I have a CentOS 7.5 box running. Its crashing after some time with NO memory. I have 4G in the box, and 4G swap. Nov 28 07:43:20 mediacontroller01 kernel: gnome-shell cpuset=/ mems_allowed=0 Nov 28 07:43:20 mediacontroller01 kernel: CPU: 2 PID: 1419 Comm: gnome-shell Tainted: G OE ------------ 3.10.0-862.3.3.el7.x86_64 #1 Nov 28 07:43:20 mediacontroller01 kernel: 763965 total pagecache pages Nov 28 07:43:20 mediacontroller01 kernel: 792 pages in swap cache Nov 28 07:43:20 mediacontroller01 kernel: Swap cache stats: add 1762910, delete 1762118, find 15701/18190 Nov 28 07:43:20 mediacontroller01 kernel: Free swap = 0kB Nov 28 07:43:20 mediacontroller01 kernel: Total swap = 4095996kB Nov 28 07:43:20 mediacontroller01 kernel: 1020385 pages RAM Nov 28 07:43:20 mediacontroller01 kernel: 0 pages HighMem/MovableOnly Nov 28 07:43:20 mediacontroller01 kernel: 78196 pages reserved Nov 28 07:43:20 mediacontroller01 kernel: Out of memory: Kill process 1419 (gnome-shell) score 25 or sacrifice child Nov 28 07:43:20 mediacontroller01 kernel: Killed process 1419 (gnome-shell) total-vm:9632020kB, anon-rss:179608kB, file-rss:924kB, shmem-rss:4504kB Nov 28 07:43:20 mediacontroller01 gnome-session-binary[1332]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 9 Nov 28 07:43:20 mediacontroller01 gnome-session: gnome-session-binary[1332]: WARNING: Application 'org.gnome.Shell.desktop' killed by signal 9 Nov 28 07:43:22 mediacontroller01 journal: JS WARNING: [resource:///org/gnome/shell/ui/main.js 315]: reference to undefined property "MetaStage" Nov 28 07:43:22 mediacontroller01 journal: JS WARNING: [resource:///org/gnome/shell/ui/layout.js 221]: reference to undefined property "MetaWindowGroup" Nov 28 07:43:22 mediacontroller01 journal: JS WARNING: [resource:///org/gnome/shell/ui/osdMonitorLabeler.js 59]: reference to undefined property "MetaDBusDisplayConfigSkeleton" Nov 28 07:43:22 mediacontroller01 journal: Failed to launch ibus-daemon: Failed to execute child process “ibus-daemon” (No such file or directory) Nov 28 07:43:23 mediacontroller01 journal: JS WARNING: [resource:///org/gnome/shell/ui/slider.js 38]: reference to undefined property "CallyActor" Nov 28 07:43:23 mediacontroller01 dbus[817]: [system] Activating via systemd: service name='org.freedesktop.GeoClue2' unit='geoclue.service' Nov 28 07:43:23 mediacontroller01 systemd: Cannot add dependency job for unit firewalld.service, ignoring: Unit is masked. Nov 28 07:43:23 mediacontroller01 systemd: Starting Location Lookup Service... Nov 28 07:43:23 mediacontroller01 dbus[817]: [system] Activating via systemd: service name='org.freedesktop.Avahi' unit='dbus-org.freedesktop.Avahi.service' Nov 28 07:43:23 mediacontroller01 dbus[817]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.Avahi.service': Unit not found. Nov 28 07:43:23 mediacontroller01 journal: Failed to connect to avahi service: Daemon not running Nov 28 07:43:23 mediacontroller01 dbus[817]: [system] Successfully activated service 'org.freedesktop.GeoClue2' Nov 28 07:43:23 mediacontroller01 systemd: Started Location Lookup Service. Nov 28 07:43:23 mediacontroller01 journal: No permission to trigger offline updates: Polkit.Error: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Action org.freedesktop.packagekit.trigger-offline-update is not registered Nov 28 07:43:23 mediacontroller01 org.gnome.Shell.desktop: Window manager warning: "XF86RFKill" is not a valid accelerator Nov 28 07:43:23 mediacontroller01 journal: Error looking up permission: GDBus.Error:org.freedesktop.portal.Error.NotFound: No entry for geolocation Nov 28 07:43:24 mediacontroller01 gnome-shell: GNOME Shell started at Wed Nov 28 2018 07:43:23 GMT-0500 (EST) Nov 28 07:44:19 mediacontroller01 journal: failed to commit changes to dconf: The connection is closed I have not ran into that before - What does one do ? Thanks Jerry

1 0

Tools/mechanisms for the management of access permissions in big filebased datasets
by Frank Thommen 28 Nov '18

28 Nov '18

Hello, we are currently managing access permissions through classical user-group-others permissions on a multi-petabyte directory tree with partially very deep and broad directories. Projects are represented by directory trees and mapped through GIDs. Lately we had lots of "singular" permission request (one single user needs access to a single dataset but should not be able to see all other datasets belonging to the same project). We realized, that the UGO model doesn't scale and is becoming more and more unmanageable. Can you recommend tools/mechanisms/technologies to overcome the drawbacks of the UGO model? We are thinking about some purely ACL based mechanism (but are open to other ideas). All filesystems in question are mounted via NFSv4 and the clients are (almost) completely CentOS 7.x hsots. Ideally the tool would have some web UI and some kind of (REST)API which allows us to modify permissions from our inhouse data management application (which does /not/ manage permissions, just the structure of the data). Additionally it should be able to visualize/report permissions in directory. I wasn't very successful in googling possible candidates, hence the question to the list. Cheers frank

4 4

CentOS 7 package not present in Red Hat EL 7 - qt-assistant
by Toralf Lund 28 Nov '18

28 Nov '18

I'm using CentOS 7 for development of software that is sometimes used on Red Hat Enterprise Linux 7. I conjunction with an update of one of the applications, I asked some Red Hat users to install the Qt 4 Assistant application via the qt-assistant package (which is used by a "help" function in our software.) It seemed like there was no such package in the Red Hat package set, however, and I also see no mention of it in "package manifests" like https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht…. Yet I can install the package from the "base" repository on my CentOS machine. Questions: Isn't CentOS base supposed to contain exactly the same packages as Red Hat Enterprise, except in some special cases that relate to distribution information, installation sources etc.? Does anyone know what's going on with the specific package I mention above? - Toralf

3 4

aarch64 boot up process/EFI
by Asya Dvorkin 28 Nov '18

28 Nov '18

Hello, I am not sure if this is the correct place to ask, but I do not have anyone else to go to. I'm working on building our own custom aarch64 RHEL distribution and using CentOS SRPMs to rebuild necessary packages. I am also utilizing kickstart. At this point, my kickstart installs all packages (by using a local repository with newly rebuild packages), but in the end I get an error "failed to write boot loader configuration". I noticed that i have /boot/efi/EFI/redhat directory on my newly "installed" server, while centos server has /boot/efi/EFI/centos directory. According to efibootmgr it is trying to boot \EFI\centos\shimaa64.efi, which doesn't exist (EFI\redhat\shimaa64.efi does). Those files are created by shim rpms and they are a total mess. I don't even know where to start or what to look for. `efibootmgr -v` shows 0000 in the beginning of BootOrder Boot0000* CentOS: HD (1,GPT,.......)/File(\EFI\centos\shimaa64.efi). Shim package has the following files/directories: $ rpm -qlp shim-aa64-12-1 /boot/efi/EFI/BOOT/BOOTAA64.EFI /boot/efi/EFI/BOOT/fbaa64.efi /boot/efi/EFI/redhat/BOOTAA64.CSV /boot/efi/EFI/redhat/mmaa64.efi /boot/efi/EFI/redhat/shim.efi /boot/efi/EFI/redhat/shimaa64-redhat.efi /boot/efi/EFI/redhat/shimaa64.efi I have been reading EFI documentation and I understand the concept (or rather I think I do), but not sure how to make it all work with shim RPMs and/or how to properly rebuild them. Would really appreciate any advice... Thank you! Asya

1 0

RHEL 8 Public Beta Released
by Yan Li 27 Nov '18

27 Nov '18

https://www.redhat.com/en/blog/powering-its-future-while-preserving-present… -- Yan Li

7 13

Re: [CentOS] NBDE, clevis and tang for non-root disk
by mark 27 Nov '18

27 Nov '18

Radu Radutiu wrote: > On Tue, Nov 27, 2018 at 3:14 PM mark <m.roth(a)5-cent.us> wrote: > >> What we do is to have the encryption key of the secondary filesystem in >> /etc/crypttab, which is, of course, 600. As it boots, it decrypts from >> that as it mounts the rest of the system. >> > Thanks, this is working as expected and it gave me the hint needed to > find the actual problem. The problem is that the initramfs image generated > by dracut -f does not include the /etc/crypttab from the OS (it only > contains the entry for the root device). Once I have manually added the > other volumes in the /etc/crypttab file from the initramfs image, clevis > is able to decrypt all volumes. Now the question is why the generated > iniramfs image has a different /etc/crypttab. How can I specify > /etc/crypttab for the initramfs so that > furhter kernel updates will not replace it with the wrong file? > Sorry, I think you misunderstood. The key for root is *not* in /etc/crypttab - that's only for the secondary ones. mark

2 1

C7 install, "failed to IDENTIFY"
by mark 27 Nov '18

27 Nov '18

The install from a USB key fails. It's showing ata2:0.0 failed to IDENTIFY. I've been searching online, and the only hint I have is that it might not understand the controller. New Dell Optiplex 7050. Haanyone run into this? mark

2 1

Re: [CentOS] NBDE, clevis and tang for non-root disk
by Radu Radutiu 27 Nov '18

27 Nov '18

On Tue, Nov 27, 2018 at 3:14 PM mark <m.roth(a)5-cent.us> wrote: > What we do is to have the encryption key of the secondary filesystem in > /etc/crypttab, which is, of course, 600. As it boots, it decrypts from > that as > it mounts the rest of the system. > > mark > Thanks, this is working as expected and it gave me the hint needed to find the actual problem. The problem is that the initramfs image generated by dracut -f does not include the /etc/crypttab from the OS (it only contains the entry for the root device). Once I have manually added the other volumes in the /etc/crypttab file from the initramfs image, clevis is able to decrypt all volumes. Now the question is why the generated iniramfs image has a different /etc/crypttab. How can I specify /etc/crypttab for the initramfs so that furhter kernel updates will not replace it with the wrong file? Radu

1 0

CentOS 7 bash perhaps off topic
by Jerry Geis 26 Nov '18

26 Nov '18

hi all, I have a small script that seems to be exiting and hitting the sleep 60... The smwebsocket just connects to the web socket provided and outputs the data. This works manually. the myprogram just opens a database and writes the line... My desire is to run the smwebsocket, connect to the websocket and output the data (line by line) when we get a line that matches Location take that line and output to the database. Seems simple. I desire this to keep the connection alive and just continue to read data and grep on the data etc... if smwebsocket does exit, sleep 60 and reconnect. However it seems to be exiting and running the sleep 60. Am I missing something ? while [ 1 ] do smwebsocket "$URL" | grep Location | while read line do myprogram -data "$line" done sleep 60 Reconnecting... done All the pieces work - just not the actual running. What am I missing? Jerry

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss November 2018