Discuss September 2018

discuss@lists.centos.org

77 participants
61 discussions

Firefox Issue
by Chris Olson 17 Sep '18

17 Sep '18

We have several small networks, some of which have only four systems that are usually a mix of Windows 7 and CentOS 6 and CentOS 7 machines. All of these systems are Internet connected and updated regularly when yum finds packages available. Information about one of the CentOS 6 machines is included below. This system experienced a Firefox issue. [user@computer]$ uname -a Linux computer 2.6.32-754.3.5.el6.x86_64 #1 SMP Tue Aug 14 20:46:41 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [user@computer]$ Several weeks ago, one of the Firefox updates did something unusual. It changed the browser-stored home page to https://www.centos.org/ from the original home page file:///usr/share/doc/HTML/index.html. This original home page had been in place since 2014, and had survived all Firefox updates for a little over four years. Last week, someone left one browser running and the system went into power save mode. To wake the system up we used the standard method of a quick push of the power button on the front of the Dell tower system. Although the system seemed to be running, the monitor and mouse never came to life. We also could not ssh into the system from any other computer on the network. We decided to use a steady push on the power button to shut the system down. After powering up again, the system seemed to run normally, but the browser home page was back to file:///usr/share/doc/HTML/index.html. Has anyone else experienced such an issue with Firefox recently?

2 1

Very weird problem with handling symbolic links
by Nicolas Kovacs 17 Sep '18

17 Sep '18

Hi everyone, I just discovered something very weird on a vanilla CentOS 7 installation. If I create a link to /tmp as a normal user, it looks like I can't remove this link anymore. Here's what this looks like: $ mkdir test_link $ cd test_link/ $ ln -s /tmp/ link_to_tmp $ ls -l total 0 lrwxrwxrwx. 1 kikinovak kikinovak 5 Sep 17 10:56 link_to_tmp -> /tmp/ $ rm link_to_tmp/ rm: cannot remove ‘link_to_tmp/’: Is a directory $ rmdir link_to_tmp/ rmdir: failed to remove ‘link_to_tmp/’: Not a directory I tried the same thing on a different box, running Slackware 14.2, and I can remove my symbolic link without any hassle. I sense something is very wrong here. Any suggestions? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 2

ipset-service save fails when module compiled into kernel
by Kenneth Porter 15 Sep '18

15 Sep '18

I want to use the ipset-service to store ipsets persistently across boots. (For use by iptables rules. firewalld has direct support for persistent ipsets but I need the more general capability of raw iptables.) I'm using a kernel with ipsets compiled in, rather than loaded as a module. The support script that saves ipsets checks if the module is loaded before saving and finds nothing, so aborts. Why does it need to make this check? Should this package be able to handle a custom kernel with compiled-in modules? (I'm actually running CentOS 7 on a Linode VM with the default Linode kernel. Their kernel has modules compiled in and listed in /proc/config.gz.) For reference, here's the latest Rawhide package containing the ipset.start-stop script that's used to save ipsets persistently. <https://fedora.pkgs.org/rawhide/fedora-x86_64/ipset-service-6.38-1.fc29.noa…>

3 3

Routing(?) issue
by Marcin Trendota 15 Sep '18

15 Sep '18

Hello all I have weird problem i can't understand and don't know where to look. [root@chamber ~]# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether bc:ae:c5:02:c7:dc brd ff:ff:ff:ff:ff:ff inet 10.0.0.200/24 brd 10.0.0.255 scope global noprefixroute enp1s0 valid_lft forever preferred_lft forever inet6 fe80::beae:c5ff:fe02:c7dc/64 scope link noprefixroute valid_lft forever preferred_lft forever 3: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether c0:4a:00:03:bc:3e brd ff:ff:ff:ff:ff:ff inet 10.0.49.1/25 brd 10.0.49.127 scope global noprefixroute enp3s0 valid_lft forever preferred_lft forever inet6 fe80::6b5a:6660:981b:7b84/64 scope link noprefixroute valid_lft forever preferred_lft forever [root@chamber ~]# ip route default via 10.0.0.1 dev enp1s0 proto static metric 100 10.0.0.0/24 dev enp1s0 proto kernel scope link src 10.0.0.200 metric 100 10.0.49.0/25 dev enp3s0 proto kernel scope link src 10.0.49.1 metric 101 [root@chamber ~]# firewall-cmd --list-all --zone=home home (active) target: default icmp-block-inversion: no interfaces: enp3s0 sources: services: mdns samba http ipp-client dhcpv6-client vnc-server nfs dns dhcp imaps samba-client tftp smtp ports: 143/tcp 5666/tcp 26666/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: root@chamber ~]# firewall-cmd --list-all --zone=external external (active) target: default icmp-block-inversion: no interfaces: enp1s0 sources: services: ssh http ports: protocols: masquerade: yes forward-ports: source-ports: icmp-blocks: rich rules: There is nginx on port 80. I've turned off SELinux for testing purposes. [root@chamber ~]# nmap chamber -p80 [...] PORT STATE SERVICE 80/tcp open http [root@chamber ~]# nmap -p80 chmura.<domain> [...] PORT STATE SERVICE 80/tcp closed http Same for any host within network (chamber is router). chmura.<domain>'s IP is public IP of chamber (well sort of - it's IP of ISP's router mounted on my chimney - it's WiMax or something like this). All ports are redirected to chamber (port 80 for sure). When i'm checking from network outside of mine, port is open and everything works as expected. I'm puzzled - really don't know what is happening. Any suggestions? -- Over And Out MoonWolf

3 4

CentOS-announce Digest, Vol 163, Issue 1
by centos-announce-request＠centos.org 14 Sep '18

14 Sep '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEEA-2018:2675 CentOS 6 microcode_ctl Enhancement Update (Johnny Hughes) 2. CESA-2018:2693 Critical CentOS 6 firefox Security Update (Johnny Hughes) 3. CEEA-2018:2397 CentOS 7 microcode_ctl Enhancement Update (Johnny Hughes) 4. CESA-2018:2692 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 13 Sep 2018 16:31:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:2675 CentOS 6 microcode_ctl Enhancement Update Message-ID: <20180913163122.GA13250(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:2675 Upstream details at : https://access.redhat.com/errata/RHEA-2018:2675 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6d40eac28340c2041aea1775a75ec383b7f780ca639adfe80af7e4bf792f87ef microcode_ctl-1.17-33.9.el6_10.i686.rpm x86_64: 708d9c6ae4359eda6f81c2754e386abe87c48f9128f85c5d15d452db2f57b27a microcode_ctl-1.17-33.9.el6_10.x86_64.rpm Source: 189742813c8cb69b901f271a97526b05a9304d341b464e7f80b6dd8ddf6be9a9 microcode_ctl-1.17-33.9.el6_10.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 13 Sep 2018 16:33:00 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2693 Critical CentOS 6 firefox Security Update Message-ID: <20180913163300.GA13573(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2693 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:2693 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 47b91c3c0b9a2638bf0d112135fc471f07f5aa6c1c3da98e49f47a6ac760a5c0 firefox-60.2.0-1.el6.centos.i686.rpm x86_64: 47b91c3c0b9a2638bf0d112135fc471f07f5aa6c1c3da98e49f47a6ac760a5c0 firefox-60.2.0-1.el6.centos.i686.rpm 70c9d1dbd0e7267587a35305aa71b410970613193cc3b605dc909d4b87529582 firefox-60.2.0-1.el6.centos.x86_64.rpm Source: a39331bda94050cee7f97cb2a129d81630b93d6e6fad92f0e6c1df75e9ce59d3 firefox-60.2.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Thu, 13 Sep 2018 16:38:49 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:2397 CentOS 7 microcode_ctl Enhancement Update Message-ID: <20180913163849.GA16692(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:2397 Upstream details at : https://access.redhat.com/errata/RHEA-2018:2397 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: da193dfc42db4ecdb5171c334055587d0cd4f7acc7d685e1cd70a4ac50758e1c microcode_ctl-2.1-29.16.el7_5.x86_64.rpm Source: 93964bfebfaa8951d74d1c3b271297671a80890e90b923cefd36976c95ba767b microcode_ctl-2.1-29.16.el7_5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Thu, 13 Sep 2018 16:39:24 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:2692 Critical CentOS 7 firefox Security Update Message-ID: <20180913163924.GA16780(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:2692 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:2692 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3f94564b9ed464fda896cb37e839435b47c1463950f4b47e51c78ea7dd6a9a99 firefox-60.2.0-1.el7.centos.i686.rpm a4c0c4a8ab59de84063ad40867f60501ea65d340f7c66b81032c259f3a55ce2e firefox-60.2.0-1.el7.centos.x86_64.rpm Source: d409b37535e62658b878652ec9765daff7d4b1d642903807714443f713f25844 firefox-60.2.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 163, Issue 1 ***********************************************

1 0

CentOS 6: meson/ninja in python36 requires python27
by wwp 14 Sep '18

14 Sep '18

Hello there, on a CentOS 6 box, in the need for `meson`, I've installed rh-python36 using yum, then meson and ninja using `pip3.6 install meson ninja`. Later at run-time, while building atk 2.29.1: $ meson --prefix /opt/atk _build $ ninja-build -C _build FAILED: atk/atkmarshal.c /opt/gimp-2.8/bin/glib-genmarshal --prefix atk_marshal --output atk/atkmarshal.c --body ../atk/atkmarshal.list --include-header atkmarshal.h /opt/rh/python27/root/usr/bin/python: error while loading shared libraries: libpython2.7.so.1.0: cannot open shared object file: No such file or directory ninja: build stopped: subcommand failed. Adding /opt/rh/python27/usr/lib64 to LD_LIBRARY_PATH works around this problem, but I wonder if there isn't a dependency issue, or did I do something wrong? Regards, -- wwp

1 0

postgresql Service Blind
by Bee.Lists 13 Sep '18

13 Sep '18

Hi folks. postgresql fresh install, roles, users, databases, all done. I can log in after I SSH to the box. I entered my user (myself) in pg_hba.conf: host all rich 192.168.1.4 255.255.255.255 md5 When I nmap the CentOS box, I can’t see that port open. I’ve turned off SELinux, so I’m not sure why I can’t see the open port 5432. What am I missing? It has to be something I’ve overlooked. - SELinux off - firewall poked holes port 5432 - service running Cheers, Bee

2 1

Re: [CentOS] ca-bundle questions
by Pete Biggs 13 Sep '18

13 Sep '18

You need to dig deeper - I will give you a start ... > > > Sometime in Feb, yum updated something to do with ca-bundle. The "something" is the ca-certificates.noarch rpm. It is updated every year around May. The last update was around May 16th this year. Not February. > > > I didn't > > > notice at the time, but it put these two files on my machine: > > > > > > /etc/pki/tls/certs/ca-bundle.trust.crt.rpmnew and > > > > > > /etc/pki/tls/certs/ca-bundle.crt.rpmnew > > > > > > Both of those on the existing system are symbolic links > > > > > > ca-bundle.trust.crt -> > > > /etc/pki/ca-trust/extracted/openssl/ca-bundle-trust.crt and > > > > > > ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem That is what is defined in the ca-certificates package. See the output of rpm -qv --list ca-certificates-2018.2.22-70.0.el7_5.noarch > > > > > > I'm not sure how exactly I'm supposed to use thes files to update those > > > locations. one points to a .pem file, which the .rpmnew file is not, and > > > there is no file of the corresponding name in the direstory pointed to > > > by the link. What do the .rpmnew files contain? The repository version of those files are symlinks, so to me it looks like some other package is trying to install those files. > > > > > > Shouldn't the rpm have "done the right thing", and put them where they > > > belong? There is something that is stopping it from "doing the right thing". > > > > Except as noted above, there is no ca-bundle.crt file in the tree, only > this: > > tls-ca-bundle.pem > > > > Do I rename it, or what? > The simple answer is possibly. The sensible answer is that you need to find out if anything has tried to add different certificate files (and why) and work around that to work out what the best thing to do is. Use the 'rpm' command to find out what provides that files that have a .rpmnew suffix: rpm -q --whatprovides /etc/pki/tls/certs/ca-bundle.trust.crt It should come up with just one package - the ca-certificates-2018 package. If it returns multiple packages, then something else is causing confusion. P.

1 0

Re: [CentOS] Panic / EL6 / KVM / kernel-2.6.32-754.2.1.el6.x86_64
by Leon Fauster 12 Sep '18

12 Sep '18

Am 30.08.2018 um 20:28 schrieb Simon Matter <simon.matter(a)invoca.ch>: > Am 30.08.2018 um 12:16 schrieb Leon Fauster <leonfauster(a)googlemail.com>: >> >> BTW upstream bug report: >> >> https://bugzilla.redhat.com/show_bug.cgi?id=1623692 > > Well, I have an account and am logged in, still can not see the bug. It seems that the default bugzilla classification doesn't allow bug reports associated with the kernel to get a read status or so ... just to summarize the status briefly: They fortunately can reproduce the problem and are trying to find the cause now. So, +1! -- LF

1 0

Fwd: OpenSSL version 1.1.1 published - needed for TLS 1.3
by Robert Moskowitz 12 Sep '18

12 Sep '18

If anyone here is thinking about supporting TLS 1.3, every indication is that you will need openSSL 1.1.1. Fedora 29 pre-beta is still one 1.1.1-pre9, I hope to see 1.1.1 release soonish. Hopefully Redhat will be backporting support in RHEL7 so we will have it in C7. Part of the challenge is that there is an API change from 1.1.0 to 1.1.1. Got to love it... Further complication is no FIPS support yet in 1.1.1. That is next on the docket for openSSL. -------- Forwarded Message -------- Subject: [openssl-users] OpenSSL version 1.1.1 published Date: Tue, 11 Sep 2018 13:42:31 +0000 From: OpenSSL <openssl(a)openssl.org> Reply-To: openssl(a)openssl.org, openssl-users(a)openssl.org Organisation: OpenSSL Project To: openssl-project(a)openssl.org, OpenSSL User Support ML <openssl-users(a)openssl.org>, OpenSSL Announce ML <openssl-announce(a)openssl.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 OpenSSL version 1.1.1 released =============================== OpenSSL - The Open Source toolkit for SSL/TLS https://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.1.1 of our open source toolkit for SSL/TLS. For details of changes and known issues see the release notes at: https://www.openssl.org/news/openssl-1.1.1-notes.html OpenSSL 1.1.1 is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under https://www.openssl.org/source/mirror.html) * https://www.openssl.org/source/ * ftp://ftp.openssl.org/source/ The distribution file name is: o openssl-1.1.1.tar.gz Size: 8337920 SHA1 checksum: e4559f31dca37ce815e0c7135488b747745a056d SHA256 checksum: 2836875a0f89c03d0fdf483941512613a50cfb421d6fd94b9f41d7279d586a3d The checksums were calculated using the following commands: openssl sha1 openssl-1.1.1.tar.gz openssl sha256 openssl-1.1.1.tar.gz Yours, The OpenSSL Project Team. -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEhlersmDwVrHlGQg52cTSbQ5gRJEFAluXuZ8ACgkQ2cTSbQ5g RJFPFQf9G1LopuN1P3tIUTgps9Z1SS+TuC7OeRPu9TCEqOR0yO8WGyTCfLZnoXZ7 0BqFASYW4VbPCy8LH3glHLBe64NApdoA1HoMmHCvd+TxPQHEvhc0OejSaOGZKY/r 2LGUvEguiyYpjQS4bQmsl8wNl3CrYRGSMqBcbFj+qF/Rrlpa1hpKGnH4ooMxe7Nx /Ro4AjMe46vQL/RU980yFl+JTkhAvSOxw0cltbILPO2MP6Fo4QZqMO8mYRjEnqUZ E/Ixl/dIkSWjPC8pkkRS9FmMQHHYe66S20OK7V2Zl3Zd88FrNI+qeKgEF3ABGknR 6vR0kPkddRl43JktQ4B1QKS+GcwzHw== =fvfm -----END PGP SIGNATURE----- -- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss September 2018