Discuss March 2018

discuss@lists.centos.org

75 participants
54 discussions

RADIUS
by hw 09 Mar '18

09 Mar '18

Hi, I´m trying to figure out how to practically use RADIUS to authenticate users. So far, I have only found documentation explaining that the idea is that users somehow magically need to authenticate against a RADIUS server via a device like a switch or a wireless access point before they are given or being denied access to a network. I understand that I have to refer to the documentation of the switch or access point to figure out how to set up RADIUS authentication with the particular device. But how is this achieved in practice? Let´s say I have a couple laptops and a couple phones and a couple computers which connect either to a switch or to a wireless access point. Both the switch and the access point support RADIUS, and I would set them up to talk to the RADIUS server and require every device that wants to connect to the network through them to authenticate first. I also have a couple thin clients and a couple computers which use PXE-boot, and the users of those would have to provide authentication before the machines could even boot. Then what? How do I make it so that the users are actually able to authenticate? Is there any documentation about this? Or am I not supposed to use RADIUS but something else?

10 55

Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 08 Mar '18

08 Mar '18

Hi, I've been running Squid successfully on CentOS 7 (and before that on 6 and 5), and it's always been running nicely. I've been using it mostly as a transparent proxy filter in school networks. So far, I've only been able to filter HTTP. Do any of you do transparent HTTPS filtering ? Any suggestions, advice, caveats, do's and don'ts ? Cheers from the snowy South of France, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

13 32

NIC naming conventions and vmware
by John Ratliff 07 Mar '18

07 Mar '18

I have a couple of CentOS 7 machines running in a vmware environment. On all the older ones I've deployed, the NIC is named ens160, but on all of the new ones, it is named ens192. I can't find any difference in the hardware that would account for this. Any suggestions on what I can do to figure out why some are named ens160 and some ens192? Thanks.

4 3

An selinux issue
by m.roth＠5-cent.us 07 Mar '18

07 Mar '18

CentUS 7.4 >From sealert: SELinux is preventing /usr/sbin/sshd from read access on the file /etc/ssh/moduli. ***** Plugin restorecon (94.8 confidence) suggests ************************ If you want to fix the label. /etc/ssh/moduli default label should be etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/ssh/moduli <...> Additional Information: Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 Target Context system_u:object_r:unlabeled_t:s0 Target Objects /etc/ssh/moduli [ file ] Source sshd Source Path /usr/sbin/sshd --------- Except: ls -laFZ /etc/ssh/moduli -rw-r--r--. root root system:object_r:etc_t:s0 /etc/ssh/moduli ls -laFZ /usr/sbin/sshd -rwxr-xr-x. root root system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd* And I even restarted sshd. So, what's selinux seeing that I'm not? mark

1 0

latest skype (version 8.16.0.4) on Centos 7
by Fred Smith 07 Mar '18

07 Mar '18

Hi all! I've finally been reduced to having to install Skype on my Linux box. I resisted for years, but now ended up trying it. and while the latest RPM installs just fine, it refuses to acknowledge that I have a microphone! In fact I have two: 1 in the USB web cam (it finds the cam), the second in a Plantronics USB headset, which works fine but not with skype. it is as if it doesn't exist. So, when I connect to someone I can hear them, see them, and they can see me, but I'm producing no sound output. All the web hits I can find for nonfunctional microphone on the web are for Ubuntu. GAH! running ldd against the skypeforlinux binary results in a huge list of shared libraries, including libasound (which is what the ubuntu messages say is missing). Anybody got a clue? Thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "For him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy--to the only God our Savior be glory, majesty, power and authority, through Jesus Christ our Lord, before all ages, now and forevermore! Amen." ----------------------------- Jude 1:24,25 (niv) -----------------------------

6 9

evince
by Chris Olson 06 Mar '18

06 Mar '18

We have some small networks with connectivity to the Internet through firewall routers. The smallest has one Windows 7 system and three Linux systems including both CentOS 6 and CentOS 7 machines. The Windows 7 systems have full Adobe packages that are updated regularly and are trouble free. On the Linux systems, evince has been our go to product for viewing and printing .pdf documents. This has worked well for at least four years. Some .pdf documents received recently from insurance companies and financial institutions appear to have a font problem that we have not been able to solve. Information available at the sites listed below have been no help. Previous font problems with various warnings have been solved automatically with substitution, but this does not seem to be working with these new files. The current problem leaves blank nearly half of the pages in some documents. Is there better source to look for answers than these two: http://www.gnome.org/projects/evince/ https://wiki.gnome.org/Apps/Evince Any help with this issue would be greatly appreciated. Thanks. [user@computer ~]$ uname -a Linux delle520 2.6.32-696.20.1.el6.x86_64 #1 SMP Fri Jan 26 17:51:45 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [user@computer]$ evince Plan.pdf Error: could not create type1 face some font thing failed Error: could not create type1 face some font thing failed o o o o

6 6

Addind kmail to EPEL
by Yves Bellefeuille 05 Mar '18

05 Mar '18

I finally decided to move from CentOS 6 to CentOS 7, but was surprised to see that kmail is no longer included: Red Hat deliberately decided to omit it. How can I ask that kmail be added to EPEL? The information on EPEL's site basically says to submit it myself, but that's above my capabilities. -- Yves Bellefeuille <yan(a)storm.ca>

3 2

sqlinux weirdness
by Fred Smith 04 Mar '18

04 Mar '18

Every now and then I get an alert like this one. I have no clue what this "rear" subsystem is, or why madam would be trying to write to its log file. Can anyone enlighten me? thanks in advance! ------------------------- SELinux is preventing /usr/sbin/mdadm from write access on the file /var/log/rear/rear-fcshome.log.lockless. ***** Plugin restorecon (93.9 confidence) suggests ************************ If you want to fix the label. /var/log/rear/rear-fcshome.log.lockless default label should be var_log_t. Then you can run restorecon. Do # /sbin/restorecon -v /var/log/rear/rear-fcshome.log.lockless ***** Plugin leaks (6.10 confidence) suggests ***************************** If you want to ignore mdadm trying to write access the rear-fcshome.log.lockless file, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do # ausearch -x /usr/sbin/mdadm --raw | audit2allow -D -M my-mdadm # semodule -i my-mdadm.pp ***** Plugin catchall (1.43 confidence) suggests ************************** If you believe that mdadm should be allowed write access on the rear-fcshome.log.lockless file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'mdadm' --raw | audit2allow -M my-mdadm # semodule -i my-mdadm.pp Additional Information: Source Context system_u:system_r:mdadm_t:s0-s0:c0.c1023 Target Context system_u:object_r:cron_log_t:s0 Target Objects /var/log/rear/rear-fcshome.log.lockless [ file ] Source mdadm Source Path /usr/sbin/mdadm Port <Unknown> Host fcshome.stoneham.ma.us Source RPM Packages mdadm-4.0-5.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name fcshome.stoneham.ma.us Platform Linux fcshome.stoneham.ma.us 3.10.0-693.17.1.el7.x86_64 #1 SMP Thu Jan 25 20:13:58 UTC 2018 x86_64 x86_64 Alert Count 2550 First Seen 2016-12-13 01:30:06 EST Last Seen 2018-03-03 01:30:07 EST Local ID ce9a5be1-55a8-4ad2-bdd9-eefcb5fc7c5b Raw Audit Messages type=AVC msg=audit(1520058607.285:46041): avc: denied { write } for pid=17471 comm="mdadm" path="/var/log/rear/rear-fcshome.log.lockless" dev="md126" ino=1368832 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cron_log_t:s0 tclass=file -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- God made him who had no sin to be sin for us, so that in him we might become the righteousness of God." --------------------------- Corinthians 5:21 ---------------------------------

3 3

Web site not responding with Firefox 52.6.0 (64-bit)
by dsavage＠peaknet.net 04 Mar '18

04 Mar '18

I don't know if this is a CentOS7/Firefox problem or one with the distant web site slashdot.org. I can connect to it just fine with the latest Firefox on my Windows 10 desktop PC, but not with Firefox 52.6.0 on this CentOS 7.4 laptop. This has been an on-going problem for several weeks. Google search results are sketchy. slashdot.org may have been a DDOS target today, but as I write this network monitors say it's up and running. RC4 deprecation may be a factor, but I doubt it. I can traceroute to the site just fine, and its URL resolves with no trouble. The error message I'm getting is "The connection has timed out" The URL I've used forever is: https://slashdot.org/index2.pl?fhfilter=journal&source=autorefresh&nobeta=1 I'm stumped. Does this sound familiar to anyone in CentOS land? --Doc Savage Fairview Heights, IL

4 3

why does "rescue" mode bring me to runlevel 5 (multi-user target)?
by Robert P. J. Day 02 Mar '18

02 Mar '18

finishing a week of teaching a comptia linux+ class off of centos 7.4 and wanted to demo how to boot to "rescue" mode, so i rebooted, selected "rescue" mode at grub menu, which still booted to full multiuser, graphical mode. what am i doing wrong? or is this a dumb question? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss March 2018