Discuss February 2018

discuss@lists.centos.org

96 participants
71 discussions

Re: [CentOS] CentOS Digest, Vol 157, Issue 4
by Stephen Davies 06 Feb '18

06 Feb '18

On 04/02/18 22:30, centos-request(a)centos.org wrote: ---------------- > > Message: 1 > Date: Sat, 3 Feb 2018 16:57:19 -0800 > From: Akemi Yagi <amyagi(a)gmail.com> > To: CentOS mailing list <centos(a)centos.org> > Subject: Re: [CentOS] Update to 3.10.0-693.17.1 breaks ath5k > Message-ID: > <CABA31DoCu6Yf7_nkN6s0Zz=THvrpqAcFfj2=2oTmscTpEPD3XA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > On Fri, Feb 2, 2018 at 10:57 PM, Stephen Davies <sdavies(a)sdc.com.au> wrote: >> Where can I find a suitable module or even source code to build here? >> >> (Centos 7) > > ELRepo used to provide the kmod-ath5k package. However, the module > does not compile under EL7.4 due to the change in the wireless stack. > If your device needs ath5k, give ELRepo's kernel-lt a try. The module > is enabled in this kernel. > > Akemi > > I have worked around this issue by changing the default boot image to the previous release. I realise that this leaves the Intel issue but I can live with that and without future kernel updates. Hopefully somebody will fix the module before I die. Cheers, Stephen

1 0

mod_auth_kerb realm not stripped
by ewae rpok 05 Feb '18

05 Feb '18

Hello all. We have a CentOS 7 system integrated with Active Directory. Achieved using realmd, SSSD and krb5-workstation together with a ktpass-generated keytab. Apache's mod_auth_kerb allows users to authenticate via their AD accounts, and authorise with "require user" directive. But so far we fail to authorise via AD group membership. i.e. adding AuthLDAPUrl and "require ldap-group" directives to httpd.conf results in access being denied. Using ldapsearch with GSSAPI (or password entry) works as expected. After looking at debug logs and tcpdump output, I (possibly incorrectly) put the issue down to being unsure how to get krb5_aname_to_localname to function appropriately with the KrbLocalUserMapping directive of apache's mod_auth_kerb. It does do some transformation, converting to lowercase. However the realm part is not stripped off. Example output from apache error_log: [Thu Jan 25 11:53:33.969841 2018] [auth_kerb:debug] [pid 2176] src/mod_auth_kerb.c(1855): [client 192.168.254.170:65016] kerb_authenticate_a_name_to_local_name Test12 at X.Y.Z -> test12 at x.y.z (All other examples I found have output of format: ... Test12 at X.Y.Z -> Test12 ) I have tried experimenting with auth_to_local tags in the [realms] sections of /etc/krb5.conf, but could see no evidence of the rules being invoked. i.e. Same output in the apache error log regardless. This then appears to get passed on for use in subsequent ldap authorisations (apache mod_authnz_ldap). This does not work for us as we need to authorise against stripped user names (Active Directory sAMAccount or similar; our userPrincipalName is a different format: Test12 at Q.Y.Z, so can't workaround using that). I previously posted a similar messages to kerberos(a)mit.edu but got no feedback. Hopefully this list might be more appropriate. Grateful for any advice, Ewae.

1 0

shutdown or poweroff?
by Walter H. 04 Feb '18

04 Feb '18

Hello, just a simple question, my router has CentOS 6 with the apcupsd running, in the log of apcupsd I see this: 2018-02-01 19:05:54 +0100 apcupsd 3.14.12 (29 March 2014) redhat startup succeeded 2018-02-04 15:52:43 +0100 Power failure. 2018-02-04 15:52:49 +0100 Running on UPS batteries. 2018-02-04 15:53:00 +0100 Reached remaining time percentage limit on batteries. 2018-02-04 15:53:00 +0100 Initiating system shutdown! 2018-02-04 15:53:00 +0100 User logins prohibited 2018-02-04 15:53:37 +0100 apcupsd exiting, signal 15 2018-02-04 15:53:37 +0100 apcupsd shutdown succeeded does this mean the shutdown was successfull? is there other log where I can verify this: because shutting down squid takes almost a minute or so ... Thanks, Walter

2 1

Update to 3.10.0-693.17.1 breaks ath5k
by Stephen Davies 04 Feb '18

04 Feb '18

Where can I find a suitable module or even source code to build here? (Centos 7) Cheers and thanks, Stephen

2 1

OT: RepoForge/RPMForge State Survey
by David Hrbáč 03 Feb '18

03 Feb '18

Hello, RepoForge used to be one of the important repositories for CentOS/RHEL. I know that RepoForge is considered to be clinically dead nowadays. On the other hand RepoForge is still physically alive. We would like to harness community opinion on RepoForge status and future. In case that you use or used to use the RepoForge I kindly ask you to fill up this form to help us with the decision. The form is here: https://goo.gl/forms/4SLFnD16K4yJeitt2 Thanks a lot, David Hrbáč

1 0

Error installing Nvidia driver on a 7.5 beta kernel
by James Pearson 03 Feb '18

03 Feb '18

OK, I know CentOS has nothing to do with RHEL beta releases, but I wanted to test if el7.5 has added support for a particular peripheral (Wacom Pro 2 tablet) ... but was unable to install the propriety Nvidia display driver (v390.25) on a test workstation - and was wondering if anyone could explain on what is going on. All I've done is upgrade an existing CentOS 7.4 install with the RHEL 7.5 beta kernel RPMS However, when installing the Nvidia driver, it fails with: FATAL: modpost: GPL-incompatible module nvidia.ko uses GPL-only symbol '__cachemode2pte_tbl' A bit of Googling seems to suggest that this issue has been 'fixed' in later upstream kernels by changing the export of this symbol from 'EXPORT_SYMBOL_GPL' to 'EXPORT_SYMBOL' However, 7.4 and earlier el7 kernels also export this symbol as EXPORT_SYMBOL_GPL - but the Nvidia driver builds/installs fine on 7.4 kernels ... So, I'm not really sure what the issue is - i.e. is it an Nvidia or Redhat issue ? For now, I've managed to hack around this by patching the stub Nvidia driver src to change MODULE_LICENSE from "NVIDIA" to "GPL" - and the Nvidia driver now installs and loads OK If anyone knows any more about this, then please let me know Thanks James Pearson

2 3

Software does not boot in Secure Boot
by Mikhail Utin 02 Feb '18

02 Feb '18

The matter of EUFI’s Secure Boot vs Legacy Boot has been briefly discussed a couple of days ago. I would ask the List opinion concerning our case. A bit of the history. We’ve been in the research of malicious hypervisor threat since 2013. We finally developed publicly available HyperCatcher freeware. It runs on specially built Ubuntu 14.4. We tried CentOS 6/7 as well. The OS was compiled to minimize the number of services and OS features to only essential to the application. The software is ISO bootable image. The problem. As of today, we recommend to switch to Legacy option before booting. Our attempts to find out how to boot in Secure were unsuccessful. I believe that it is not possible if Secure Boot functions correctly. Does anybody know (excepting hacking the UEFI firmware and utilizing nice 0-day) if boot-up is still possible in Secure Boot? We tried so far a few Dell models. What could we add in bootable image so Secure Boot considered it as OK? There is yet another small issue of Ubuntu output messages while booting, which you could see is you try to use and boot our software. Such “leftovers” are not really important but a bit disturbing people who use our software. Is there anything like compilation option etc. we can use to block Ubuntu boot-up screen output? One technical note on our research. We experimented with VMware hypervisor (CentOS 6/7 and Ubuntu 14 OS as operating environment as well). The conclusion is that well-designed hypervisor adds less than one percent (0.7% in most cases) of current CPU utilization. For instance, 100% utilization means 99.3% user software and 0.7% the hypervisor. You can use your system for years but will never notice that a hypervisor runs below your OS. It can come from anywhere and even from your motherboard firmware. Mikhail Utin, CISSP Rubos, Inc. mutin(a)rubos.com mikhailutin(a)!hotmail.com

1 0

CentOS-announce Digest, Vol 156, Issue 1
by centos-announce-request＠centos.org 02 Feb '18

02 Feb '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0260 Moderate CentOS 7 systemd Security Update (Johnny Hughes) 2. CESA-2018:0262 Important CentOS 7 thunderbird Security Update (Johnny Hughes) 3. CESA-2018:0262 Important CentOS 6 thunderbird Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 1 Feb 2018 23:43:31 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0260 Moderate CentOS 7 systemd Security Update Message-ID: <20180201234331.GA46540(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0260 Moderate Upstream details at : https://access.redhat.com/errata/RHSA-2018:0260 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: a7ff6697cba768a37cfbf5b08cd4fea42887544e64fa81d652726fac42328c22 libgudev1-219-42.el7_4.7.i686.rpm ae8a35516e4db15022c7bdf3dc7fb17d565c3566bfe0598e9e83fd79f7bcb78e libgudev1-219-42.el7_4.7.x86_64.rpm 387700a80d251f5fd2c4ed4f4d6be0c0dd31cd13218034b7bee995602965c794 libgudev1-devel-219-42.el7_4.7.i686.rpm b1e7c83f256176b876f5f9df330e2c97011efd1e301c8e2b8bd6951479f9fced libgudev1-devel-219-42.el7_4.7.x86_64.rpm b048c461c24df985cf5d3daa80c79fddfd435b01c81ece0543b8f6e44902b3c2 systemd-219-42.el7_4.7.x86_64.rpm 5b8a7713fe41db817ca9e7d734f9fc7e3e9bb2c751317adec9129529b1a3a711 systemd-devel-219-42.el7_4.7.i686.rpm df475636c40dff17bb76c95952b1a84df70234ce6164ec5d8d6e0622c18a26de systemd-devel-219-42.el7_4.7.x86_64.rpm 8b0f6580d8ac768bb2bdd2d3fea37471c12f69622070c028c6654a67d9ed62ba systemd-journal-gateway-219-42.el7_4.7.x86_64.rpm 39996be3a24fea93dd74b3858e849bd13d42b3618933646c014999301f74c989 systemd-libs-219-42.el7_4.7.i686.rpm d7ba060ecee893b2e60d18394899768fe93a9199a3eba7eb0e2b2942a4d5b03f systemd-libs-219-42.el7_4.7.x86_64.rpm efe57fcbf99513a07140cb9ab10780cc416bbc0a3fa51775fb628331ee99910a systemd-networkd-219-42.el7_4.7.x86_64.rpm ccff4b016165af8c211c4ff5c0dd2668498487130c7a18da188281f0b8c2fcac systemd-python-219-42.el7_4.7.x86_64.rpm 6179b555b0aea983902a99e83a2e2687ef6cdba897e8fe804c9c860f36fa1642 systemd-resolved-219-42.el7_4.7.i686.rpm 73889e7ca81e3d4f6c918e5c7928ab47927f227a833a20821a2f9f994e393d80 systemd-resolved-219-42.el7_4.7.x86_64.rpm 4669da503e9376fc14044bd230db80452c595c09c439dc769d92b6844b4a5488 systemd-sysv-219-42.el7_4.7.x86_64.rpm Source: 6857f944bb775fce5c2ec5942d5b9bbff74b3ac0d7466b4b0d2c10ed5c6e898a systemd-219-42.el7_4.7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 1 Feb 2018 23:44:38 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0262 Important CentOS 7 thunderbird Security Update Message-ID: <20180201234438.GA46591(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0262 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0262 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: c5a42870fd0dbb44e82f8030a889a0bdf8cb2f8b1becb9d49763070d47820ff0 thunderbird-52.6.0-1.el7.centos.x86_64.rpm Source: 92c034d0d0f6895453c4e371841d78a5bfdedb11df63cf21a1d1c341c5216f35 thunderbird-52.6.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Thu, 1 Feb 2018 23:45:44 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0262 Important CentOS 6 thunderbird Security Update Message-ID: <20180201234544.GA46715(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0262 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0262 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 4c5faa32a2ce2a7945e7e58a31c90a29f5c8bbc1522299ca8074ff0b179fe244 thunderbird-52.6.0-1.el6.centos.i686.rpm x86_64: 4f97f078cdf9f020ebc5cad99100a54f18bb74b23673f8226fb77763320cebc8 thunderbird-52.6.0-1.el6.centos.x86_64.rpm Source: 27aefaa5049fbe2eae663bca4d17c93281223bdae48cf918b774ee2ad6d7fec3 thunderbird-52.6.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 156, Issue 1 ***********************************************

1 0

In reply to: What is best way of managing isolated network environment?
by Leroy Tennison 01 Feb '18

01 Feb '18

(Couldn't find the original request in my email but definitely have an idea). Set up an OpenVPN server on your network and create a client on the isolated network (set up to connect on boot), configure routing appropriately. You get to decide what subnet the VPN IP address is on, in this situation I recommend a static IP address for the client. From your network you connect to the OpenVPN IP address and connect to the rest of the isolated network from it (or set up multiple clients on the isolated network).

1 0

What is best way of managing isolated network environment?
by Xinhuan Zheng 01 Feb '18

01 Feb '18

Hello, We need to manage isolated network environment so that even though host name and ip address could be same, but they are located in isolated network environment so that’s not a problem. However, that would be very challenging to build a server in such an isolated environment. For example, we could do kickstart to build a server in non-isolated network environment, but for isolated one, we don’t have such a kickstart server. If we had such one, that would mean we consume more resources for building server. What is best way of managing such isolated environment in terms of easily building servers? Thank you, - xinhuan

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss February 2018