Discuss March 2018

discuss@lists.centos.org

75 participants
54 discussions

How insecure is NIS ? Possible alternatives ?
by Nicolas Kovacs 31 Mar '18

31 Mar '18

Hi, In the past I've setup simple centralized authentication with NIS and NFS, without bothering about possible security implications. Over the next month I have to setup a new network in a local school, and I wonder if I should use NIS/NFS. I still have my own documentation, it's simple and somewhat bone-headed to setup, and it just works. RHEL/CentOS 7 still provide NIS, and I vaguely wonder how exactly it is insecure. So I thought I'd simply ask on this list. I know there's FreeIPA available. I gave it a spin some time ago on a local machine, but I think it's a bit overkill. Anyone here who uses central authentication (CentOS server + CentOS clients) ? Any suggestions ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

10 18

GnuPG 2.0.16?
by Kay Schenk 29 Mar '18

29 Mar '18

Hello all -- Does anyone know where I can find GnuPG 2.0.16 for CentOS 6.9 32-bit? I've already looked in the normal repos. I have 2.0.14 now and my Enigmail addon has stopped working. Thanks. -- ------------------------------------------ MzK "Ring out the false, ring in the true." -- poem "In Memoriam", Alfred Lord Tennyson

1 0

Install CentOS 7 over serial port on router board ?
by Nicolas Kovacs 28 Mar '18

28 Mar '18

Hi, I have to install CentOS 7 for a client, to act as cache & filtering proxy using Squid. I'd like to use this piece of specialized hardware : http://store.calexium.com/fr/systeme-pre-assemble/869-systeme-pre-assemble-… There is no VGA or HDMI video output, just a serial port to connect to, and then three NICs and two USB ports. I've never installed CentOS over a serial console, so I don't even know if it's possible in the first place. Has anyone ever done something like that ? Any suggestions ? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

6 10

CentOS-announce Digest, Vol 157, Issue 7
by centos-announce-request＠centos.org 28 Mar '18

28 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2018:0597 CentOS 6 tzdata BugFix Update (Johnny Hughes) 2. CEEA-2018:0579 CentOS 7 kmod-redhat-i40e Enhancement Update (Johnny Hughes) 3. CESA-2018:0592 Important CentOS 7 slf4j Security Update (Johnny Hughes) 4. CEBA-2018:0597 CentOS 7 tzdata BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 27 Mar 2018 19:26:54 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2018:0597 CentOS 6 tzdata BugFix Update Message-ID: <20180327192654.GA25156(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2018:0597 Upstream details at : https://access.redhat.com/errata/RHBA-2018:0597 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: b07bee4e9445dc2e7f28d46222cf487164102f06256a6aefcd65d52c0f7896fc tzdata-2018d-1.el6.noarch.rpm 81c03c9e3f00b0806b40797a9aaf9c3a2b0d3b6f8acc2dae63b0c3eaf299dbcd tzdata-java-2018d-1.el6.noarch.rpm x86_64: b07bee4e9445dc2e7f28d46222cf487164102f06256a6aefcd65d52c0f7896fc tzdata-2018d-1.el6.noarch.rpm 81c03c9e3f00b0806b40797a9aaf9c3a2b0d3b6f8acc2dae63b0c3eaf299dbcd tzdata-java-2018d-1.el6.noarch.rpm Source: 905226831ac71f99f6f75d3089d070aaa531628dc506eede51255003ba6ceedc tzdata-2018d-1.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 27 Mar 2018 20:20:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:0579 CentOS 7 kmod-redhat-i40e Enhancement Update Message-ID: <20180327202042.GA25938(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:0579 Upstream details at : https://access.redhat.com/errata/RHEA-2018:0579 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 973726f539d915e4d6667bcd4a551f08403e56307c00ed85032ac916e5414982 kmod-redhat-i40e-2.1.14_k_dup7.4-2.1.el7_4.x86_64.rpm c5deeb12aef29bff75a15fbf3af2d09acfd97841f64ef5a8596c4bbf09712052 kmod-redhat-i40evf-3.0.1_k_dup7.4-2.1.el7_4.x86_64.rpm Source: ef9a7cd89dea97c47b17796bb25546cb9cbc5dd11a28e74b70af8b3ec5f81a9e kmod-redhat-i40e-2.1.14_k_dup7.4-2.1.el7_4.src.rpm 9f5eb3e913cba0b1883d154f4af9b7f12936377e0977f8295b97273fab22376f kmod-redhat-i40evf-3.0.1_k_dup7.4-2.1.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 27 Mar 2018 20:22:24 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0592 Important CentOS 7 slf4j Security Update Message-ID: <20180327202224.GA26030(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0592 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0592 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 733630907981b82d45bd40cf4d3f113ff2193a4fdf1e293818669a707b739189 slf4j-1.7.4-4.el7_4.noarch.rpm d145b3bc3337e418173681eade8a1666ad7624271a6e0b10cb41a39010c0fdef slf4j-javadoc-1.7.4-4.el7_4.noarch.rpm 58f4c9dd119e297fd38fcc638d1dc1d359fa281fb425d14eaaa6ec79f548c33f slf4j-manual-1.7.4-4.el7_4.noarch.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Tue, 27 Mar 2018 20:23:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2018:0597 CentOS 7 tzdata BugFix Update Message-ID: <20180327202311.GA26075(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2018:0597 Upstream details at : https://access.redhat.com/errata/RHBA-2018:0597 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: ff9063828a3427711ac3054a7c887c06d716eb69a6717669834a4fe59b9be74f tzdata-2018d-1.el7.noarch.rpm 805ffa512bdc30131d519956773e3ad1bd5ab6b1ae94d29d3f12c67ad8b7bbed tzdata-java-2018d-1.el7.noarch.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 7 ***********************************************

1 0

centos7: pptpd vpn problem: mppe_decompress[0]: FLUSHED bit not set in stateless mode!
by Dario Lesca 27 Mar '18

27 Mar '18

I try to setup a PPTP VPN server on Centos 7 and from client a router Vodafone Station (Firmware 5.4.8.1.316.1.21) On c7 I have install this: [root@s-virt tmp]# rpm -q pptpd ppppptpd-1.4.0-2.el7.x86_64ppp-2.4.5- 33.el7.x86_64 and setup all file and firewall like howto say.This now is my config: /etc/pptpd.conf:option /etc/ppp/options.pptpd/etc/pptpd.conf:logwtmp/etc/pptpd.conf:localip 192.168.11.1/etc/pptpd.conf:remoteip 192.168.11.100- 109/etc/ppp/options.pptpd:name pptpd/etc/ppp/options.pptpd:refuse- pap/etc/ppp/options.pptpd:refuse-chap/etc/ppp/options.pptpd:refuse- mschap/etc/ppp/options.pptpd:require-mschap- v2/etc/ppp/options.pptpd:require-mppe- 128/etc/ppp/options.pptpd:lock/etc/ppp/options.pptpd:nobsdcomp /etc/ppp /options.pptpd:novj/etc/ppp/options.pptpd:novjccomp/etc/ppp/options.ppt pd:nologfd/etc/ppp/chap-secrets:myuser pptpd mypass * The connection from V.S. router to my c7 server work:mar 26 12:50:28 s- virt.ansaldi.loc pptpd[26782]: CTRL: Client x.x.x.x control connection startedmar 26 12:50:28 s-virt.ansaldi.loc pptpd[26782]: CTRL: Starting call (launching pppd, opening GRE)mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded.mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: pppd 2.4.5 started by root, uid 0mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Using interface ppp0mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Connect: ppp0 <--> /dev/pts/19mar 26 12:50:28 s-virt.ansaldi.loc NetworkManager[1026]: <info> [1522061428.6946] manager: (ppp0): new Generic device (/org/freedesktop/NetworkManager/Devices/40)mar 26 12:50:28 s- virt.ansaldi.loc pppd[26783]: peer from calling number x.x.x.x authorizedmar 26 12:50:31 s-virt.ansaldi.loc pppd[26783]: MPPE 128-bit stateless compression enabledmar 26 12:50:34 s-virt.ansaldi.loc pppd[26783]: local IP address 192.168.11.1mar 26 12:50:34 s- virt.ansaldi.loc pppd[26783]: remote IP address 192.168.11.100 But when I try to connect from a client (through the V. S. router) to my server via VPN, or ping it, on 4 ping only two work, and into log of server I see this error when the ping fail. > mar 26 12:00:50 s-virt.ansaldi.loc kernel: mppe_decompress[0]: > FLUSHED bit not set in stateless mode! Someone have some suggest to resolve this problem ? Many thanks -- Dario Lesca (inviato dal mio Linux Fedora 27 Workstation)

2 3

How Can I ...
by Eugene Poole 24 Mar '18

24 Mar '18

I've got a WD My Passport Ultra 1TB (USB) plugged into my router and I have 4 Windows machines, all running Windows 7, and all 4 machines can see the device as drive 'Y'. I use this device several ways, i.e. all my Windows machines use the same Firefox bookmarks and cookies I've got 5 machines running CentOS 6 x86_64 and I'd like to know what do I have to do for them to 'see' that same 1TB device? Right now I use winscp to get the data from CentOS and save it on the device via Windows. -- Eugene Poole Woodstock, Georgia

5 4

exim PAM authentication: all users unknown
by hw 22 Mar '18

22 Mar '18

Hi, how come that exim can not authenticate users using PAM? ====================== PLAIN: driver = plaintext server_set_id = $auth2 server_prompts = : server_condition = ${if pam{$auth2:$auth3}{yes}{no}} server_advertise_condition = ${if def:tls_cipher } server_debug_print = "auth: $1 $2 $3" ====================== 2969 SMTP<< AUTH PLAIN AGp2AGdsdWViaXJk 2969 PLAIN authenticator server_condition: 2969 $auth1 = 2969 $auth2 = user 2969 $auth3 = password 2969 $1 = 2969 $2 = user 2969 $3 = password 2969 auth: user password 2969 Running PAM authentication for user "user" 2969 PAM error: Authentication failure 2969 expanded string: no 2969 SMTP>> 535 Incorrect authentication data ======================== unix_chkpwd[2928]: check pass; user unknown unix_chkpwd[2928]: password check failed for user (user) exim: pam_unix(exim:auth): authentication failure; logname= uid=93 euid=93 tty= ruser= rhost= user=user ========================= It works just fine on the old server but not on the new one. I have verified that the user which is considered as unknown can log in to the console just fine, and I tried multiple users. I have found a bug report[1] which suggests that the authentication fails because exim uses its own user-ID to do the authentication. Yet the bug has probably been fixed. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=449256

1 0

CentOS-announce Digest, Vol 157, Issue 6
by centos-announce-request＠centos.org 21 Mar '18

21 Mar '18

1 0

Upgrade Centos 6 to Centos 7 32 Bits i686 architecture.
by Ger van Dijck 20 Mar '18

20 Mar '18

Hi , I am running Centos 6 on an old Acer S2000 PC 1Mb memory and i686 32 bits architecture. Question : Is there a possibility to upgrade to Centos 7 32 bits ? Regards , Ger van Dijck. -- Gemaakt met Opera's e-mailprogramma: http://www.opera.com/mail/

4 3

selinux: how to allow access?
by hw 20 Mar '18

20 Mar '18

Hi, how do I allow exim access to a socket in order to be able to do local deliveries to cyrus? type=AVC msg=audit(1521179280.845:1920270): avc: denied { name_connect } for pid=319 comm="exim" dest=24 scontext=system_u:system_r:exim_t:s0 tcontext=system_u:object_r:lmtp_port_t:s0 tclass=tcp_socket Yet again I could not find any documentation explaining how to do basic things like this :( Selinux is more like a curse than anything else :( Why is there not even a good documentation?

7 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2018