Discuss March 2018

discuss@lists.centos.org

75 participants
54 discussions

CentOS 6 i386 - meltdown and spectre
by Peter Wood 13 Mar '18

13 Mar '18

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

4 7

Squid vs. iptables redirection: exception for certain domains ?
by Nicolas Kovacs 12 Mar '18

12 Mar '18

Hi, I'm currently facing a quite tricky problem. Here goes. I have setup Squid as a transparent HTTP+HTTPS proxy in my local network. All web traffic gets handed over to Squid by an iptables script on the server. Here's the relevant section in /etc/squid/squid.conf: --8<------------------------------------------------------------- # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/amandine.sandbox.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB --8<------------------------------------------------------------- And here's the corresponding section of my firewall script: --8<------------------------------------------------------------- # Commandes IPT=/usr/sbin/iptables SYS=/usr/sbin/sysctl SERVICE=/usr/sbin/service # Internet IFACE_INET=enp2s0 # Réseau local IFACE_LAN=virbr0 IFACE_LAN_IP=192.168.2.0/24 # Serveur SERVER_IP=192.168.2.1 ... # Squid $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 80 -j REDIRECT --to-port 3128 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 443 -j REDIRECT --to-port 3129 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3130 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3130 -j ACCEPT --8<------------------------------------------------------------- This setup works nicely for the vast majority of web sites. BUT: a handful of sites has some trouble with my local certificate. For example, I can't sync my local Github repo anymore. Or my local OwnCloud client spews back a warning message on every startup. I asked on the Squid mailing list if there was a possibility to create an exception for a list of domains, so that these can simply bypass the proxy. The problem is, according to one of the developers, I have to tackle that problem earlier in the process, e. g. in the firewall setup. So here's what I want to do, in plain words: 1. Redirect all HTTP traffic (port 80) to port 3128. So far so good. 2. Redirect all HTTPS traffic (port 443) to port 3129. Equally OK. AND... 3. DO NOT REDIRECT traffic that goes to certain domains, like: github.com credit-cooperatif.coop cloud.microlinux.fr squid-cache.org etc. Ideally, these domains should be read from a simple text file. Any idea how I could do that? I don't even know if this is theoretically possible. Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 6

SELinux breaks Squid's ssl_crtd helper
by Nicolas Kovacs 10 Mar '18

10 Mar '18

Hi, I've setup a transparent HTTP+HTTPS proxy on my server running CentOS 7, using Squid. Here's my configuration file. --8<---------------------------------------------------------------- # /etc/squid/squid.conf # Définitions acl localnet src 192.168.2.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Règles d'accès http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/nestor.microlinux.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # Emplacement de ssl_crtd et du cache des certificats TLS sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 # SSL-Bump acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # Taille du cache dans la RAM cache_mem 2048 MB # Emplacement et taille du cache sur le disque # cache_dir ufs /var/spool/squid 100 16 256 # Vidage système coredump_dir /var/spool/squid # Durée de vie des fichiers sans date d'expiration refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 --8<---------------------------------------------------------------- First, I tested the configuration in permissive mode, where it works perfectly. After running it a while, I get the following SELinux alert. # sealert -a /var/log/audit/audit.log ***** Plugin catchall (17.1 confidence) suggests ***** If you believe that ssl_crtd should be allowed read access on the index.txt file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ssl_crtd' --raw | audit2allow -M my-sslcrtd # semodule -i my-sslcrtd.pp Unfortunately the suggested solution doesn't work, because the problem reappears, and I get all sorts of errors in /var/log/squid/cache.log, all due to ssl_crtd not being able to access stuff under /var/lib/ssl_db. Any idea how I can solve this problem permanently ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 3

kpartx can not detach
by Leon Fauster 10 Mar '18

10 Mar '18

OS: EL6 - sometimes I use kpartx -a /mnt/.../lvdisk.img to map the partitions and mount them via /dev/mapper/loop0pX After using the disk (unmounting it) I noticed that detaching such mapping via kpartx -d does not result in freeing up the loop devices. Results: System reboots shows that the filesystem where lvdisk.img is located can't be unmounted. lsof, fuser, ps does not show any usage. Even removing the device node via dmsetup remove /dev/mapper/loop0pX does not help. Trying to unmount the underlying filesystem still shows /mnt: device is busy. Any other suggestions would be greatly appreciated! -- Thanks LF

2 2

yum list "available" versus "updates", and centosplus versioning
by Robert P. J. Day 10 Mar '18

10 Mar '18

quite possibly more a yum question than a centos question, but i'm a bit confused about the difference between listing "available" packages versus "updates" packages. short example -- listing what the yum man page suggests should be "available" for installation, restricting myself to centosplus: $ yum list available --disablerepo=\* --enablerepo=centosplus ... snip ... Available Packages kernel-plus.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-abi-whitelists.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-doc.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-headers.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ first, i always thought "yum list available" would list only packages that i did not *already* have installed, and if i wanted to list installed packages eligible for update, i would run: $ yum list updates --disablerepo=\* --enablerepo=centosplus Updated Packages postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ as you can see, the alleged updates are also listed as "available" from the first command -- has it always been this way? if so, i guess i just never noticed. (is there a way to list *only* available, uninstalled packages with some sort of filter?) more curiously, some of the available packages from the centosplus repo have a package version that says merely "centos", not "centos.plus": postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus ^^^^^^ is that deliberate? it would seem to have the potential for confusion if one searches later for packages based on that string. finally, the alleged update for python-perf: python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus would seem to match *exactly* the currently installed numeric version on my system: $ rpm -q python-perf python-perf-3.10.0-693.17.1.el7.x86_64 $ that is, both seem to be "3.10.0-693.17.1.el7", so how would this constitute an available "update"? perhaps there's something fundamental about version numbering and the centosplus repo i'm missing here. rday

1 0

Upcoming Dojos: Bangalore, Singapore
by Rich Bowen 09 Mar '18

09 Mar '18

I want to draw attention to two upcoming events. First, we have the CentOS Bangalore Dojo. Details are still emerging, but it will be held on March 21 at the Red Hat India office. Details are https://www.meetup.com/CentOS-India/events/248566854/ and more details will be coming very soon. Then, on the following Sunday, March 25th, we'll be holding another Dojo as part of the FOSSAsia event in Singapore, at the Lifelong Learning Institute. The schedule for that event is almost complete, and further details are available here: https://wiki.centos.org/Events/Dojo/Singapore2018 Other tentative upcoming events are listed at https://wiki.centos.org/Events If you are holding any CentOS events - or if you would like to - please get in touch with the centos-promo mailing list (or me directly, if you prefer) for assistance in producing and/or promoting those events. -- Rich Bowen - rbowen(a)redhat.com @RDOcommunity // @CentOSProject // @rbowen

1 0

Re: [CentOS] FW: Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 09 Mar '18

09 Mar '18

Le 09/03/2018 à 12:01, Patton, Eamonn J a écrit : > Just to let you know that our Office365 safelinks analyser is > categorising the link given below (regarding Squid with SquidAnalyzer > "blog.microlinux.fr") as "malicious". That usually means they have > detected (or think they have detected) some malware on the site. Thanks for reporting this. Though I bluntly admit I just ignore everything coming from Microsoft. Hotmail has been tagging my company's mailserver as a spammer for ages, so I'm tagging everything coming from Microsoft as crapware. Nothing good has ever been produced by this company. The last time I actually used MS Windows for work was around 2001, before Windows XP came out. This is the year I moved to Linux (Slackware 7.1 at the time), and I've been 100 % GNU/Linux ever since. :o) Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

Issues with Mirror Sites
by Kenneth Sutherland 09 Mar '18

09 Mar '18

Hi, Newbie question, is there a problem with the Centos 7 mirror sites, no matter what I do the mirror sites are reporting back the meta data in the repodata folder is wrong and I cant do a Yum Update? when I browse to a few of the mirror sites it looks to me that they sym links are broken? I apologies in advance if I got this completely wrong as am still learning Cheers in advance Ken

1 0

mate-terminal crash when using drag-n-drop tabs
by James Pearson 09 Mar '18

09 Mar '18

We're using mate-terminal (1.16.3) from EPEL on CentOS 7.4 with the Mate desktop, but mate-terminal crashes when we do the following: Start mate-terminal, open a tab (File -> Open Tab) then with the left mouse button drag a tab and drop it in the same terminal window - and the terminal window crashes ... I did a bit of Googling, and found this issue reported in earlier releases of mate-terminal - which was fixed - but no mention of issues with 1.16.x However, if I rebuild and install the package from the mate-terminal 1.16.3 SRPM from EPEL, it doesn't crash ... Which is rather bizarre Just wondering if anyone else has seen this problem and/or could explain what might be causing the issue with the binary from EPEL ? Thanks James Pearson

1 1

Memory Leak with PHP
by Alain Jean-Mairet 09 Mar '18

09 Mar '18

I understand that this problem may have very little to do with CentOs, but it happens to occur on a CentOS webserver and maybe you’ll have a clue. Since a few months, after many upgrades on several blogs (now running with PHP7), our server is eating up RAM no end. PHP processes swell to over 2 GB (each) and when the whole RAM and the whole swap are full, problems stack up and finally paralyze the system. This despite having “memory_limit = 512M" in all php.ini (there are several PHP versions on the system, selection is made via .htaccess). CenOS 6.9 on a Xeon 8 cores with now 64 GB RAM. This is a snip of a top this morning, just 2 days after the latest reboot: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 31163 apache 20 0 939m 690m 8876 S 51.5 1.1 102:16.90 php-fpm 29603 apache 20 0 1208m 961m 10m S 33.7 1.5 136:54.95 php-fpm 11858 apache 20 0 1660m 1.4g 9564 R 31.3 2.2 190:41.25 php-fpm 31207 apache 20 0 916m 668m 9636 R 18.1 1.0 101:38.72 php-fpm 31218 apache 20 0 930m 682m 9264 S 16.8 1.1 101:55.51 php-fpm 2873 apache 20 0 1694m 1.4g 9972 S 11.2 2.2 194:42.82 php-fpm 2854 apache 20 0 1657m 1.4g 10m S 9.9 2.2 191:15.43 php-fpm 2326 mysql 20 0 4993m 1.3g 6076 S 7.3 2.0 149:11.06 mysqld 2842 apache 20 0 1664m 1.4g 8996 S 4.9 2.2 191:34.00 php-fpm 17085 apache 20 0 1454m 1.2g 9824 S 1.3 1.9 167:25.43 php-fpm 13850 apache 20 0 464m 45m 5872 S 1.0 0.1 0:43.55 httpd 20044 root 20 0 15276 1496 952 R 1.0 0.0 15:05.99 top 1936 apache 20 0 1684m 1.4g 10m S 0.7 2.2 192:37.37 php-fpm 19109 apache 20 0 463m 44m 5808 S 0.7 0.1 0:18.66 httpd 24782 apache 20 0 465m 46m 5720 S 0.7 0.1 0:12.01 httpd 1848 apache 20 0 1579m 1.3g 10m S 0.3 2.1 183:02.13 php-fpm 2718 root 20 0 1074m 12m 2536 S 0.3 0.0 7:32.85 fail2ban-server 15221 apache 20 0 475m 49m 9508 S 0.3 0.1 0:22.24 httpd 16764 apache 20 0 476m 49m 9456 S 0.3 0.1 0:21.82 httpd 17757 apache 20 0 461m 42m 5784 S 0.3 0.1 0:18.26 httpd 19108 apache 20 0 463m 44m 5848 S 0.3 0.1 0:20.80 httpd 19155 apache 20 0 463m 44m 5756 S 0.3 0.1 0:17.15 httpd 24791 apache 20 0 462m 43m 5764 S 0.3 0.1 0:14.87 httpd 24794 apache 20 0 464m 45m 5780 S 0.3 0.1 0:15.07 httpd 29668 apache 20 0 459m 40m 5888 S 0.3 0.1 0:34.05 httpd 29794 apache 20 0 463m 44m 5868 S 0.3 0.1 0:35.23 httpd 31184 apache 20 0 936m 688m 9572 S 0.3 1.1 103:33.80 php-fpm 31212 apache 20 0 908m 660m 9860 S 0.3 1.0 101:27.74 php-fpm Any idea, suggestion would be greatly appreciated! --

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2018