Discuss October 2019

discuss@lists.centos.org

125 participants
118 discussions

DSA key not accepted on CentOS even after enabling
by Gianluca Cecchi 17 Oct '19

17 Oct '19

Hello, I have some users that connect to a server with their DSA key that is of type ssh-dss. I'm migrating (installing as new) the server where they connect to CentOS 8 + updates. I was not able to connect with the keys to this new server even after having added, as found in several internet pages, this directive at the end of /etc/ssh/sshd_config of the CentOS 8 server: # Accept also DSA keys PubkeyAcceptedKeyTypes=+ssh-dss and systemctl restart sshd I kept getting in journal the message: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] I saw that the sshd process had started with the option ... -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com So I found the unit file for sshd that refers to /etc/crypto-policies/back-ends/opensshserver.config In the mean time I was able to reach my target going and editing the /etc/sysconfig/sshd file adding the whole line obtained from the above and adding ssh-dss CRYPTO_POLICY='-oCiphers=aes256-gcm(a)openssh.com, chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com, umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com ,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms= curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com ,ssh-dss' and now it works with pubkey authentication based on DSA keys. Not going to the querelle of OpenSSH 7 removing DSA keys and DSA vs RSA (eg. some considerations by some years ago here: https://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authen… ), any hint on smarter way to add? I suppose further updates could change content of /etc/crypto-policies/back-ends/opensshserver.config that btw is part of crypto-policies-20181217-6.git9a35207.el8.noarch and not openssh-server-7.8p1-4.el8.x86_64 HIH others incurring in this problem and thanks in advance for any insight/hint, Gianluca

2 2

CentOS 7.7 hfs
by Jerry Geis 16 Oct '19

16 Oct '19

I tried to install kmod-hfs and kmod-hfsplus but not found ? What is up ? the system is all updated with yum update. Jerry

1 1

BackupPC v4 from epel
by Ranbir 16 Oct '19

16 Oct '19

Hello Everyone, Has anyone tried to install BackupPC v4 on CentOS 8 from epel? I just did and this happened: [root@resurrect ~]# dnf --enablerepo epel install BackupPC Last metadata expiration check: 0:18:41 ago on Tue 15 Oct 2019 08:03:59 PM EDT. Error: Problem: conflicting requests - nothing provides par2cmdline needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::AutoReconnect) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::RetrHandle) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Time::ParseDate) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(XML::RSS) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl-Time-modules needed by BackupPC-4.3.1-2.el8.x86_64 (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) If that didn't come out too nice, here's a pastebin link: https://pastebin.com/HgjAQmvV I've checked all the disabled repos on my system and none of them have those packages. Is this just a case of the dependencies not being built yet? -- Ranbir

4 3

Attempting to use tproxy on Centos 8 fails with 'No such file or directory'
by Nathan Coulson 16 Oct '19

16 Oct '19

I was working on a haproxy transparent proxy setup that we had working on Centos 7 (iptables), but running into issues getting tproxy working with NFTables on Centos 8. >From https://www.kernel.org/doc/Documentation/networking/tproxy.txt, It should be a matter of: # nft add table filter # nft add chain filter divert "{ type filter hook prerouting priority -150; }" # nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept But when running the 3rd line (add rule), I get root@kryptonite [/lib/modules/4.18.0-80.11.2.el8_0.x86_64]# nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept Error: Could not process rule: No such file or directory add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (In attempting to resolve this, I did the following) modprobe nf_tproxy_ipv4 modprobe nf_tproxy_ipv6 modprobe nf_socket_ipv4 modprobe nf_socket_ipv6 I also noted that: nft add rule filter divert meta l4proto tcp meta mark set 1 accept (Removing socket transparent 1) does not exit with a failure. Also found https://bugzilla.redhat.com/show_bug.cgi?id=1651813, (which did make reference to the nftables version 0.9.0 possibly missing support, I have not tried compiling 0.9.1 yet, but I find it curious the entire line fails with 'socket transparent 1' making me wonder if it is a missing module still) -- Nathan Coulson System Administrator for Bravenet Web Services www.bravenet.com

2 3

easy way to stop old ssl's
by Jerry Geis 15 Oct '19

15 Oct '19

HI all, When CentOS 7 was created things like SSLv2 TLSv1 TLSv1.1 etc... were all OK, but now they have fallen out of favor for various reasons. Updating to CentOS 7.7 does not automatically disable these types of items from apache - is there a script that is available that can be ran to bring a box up to current "accepted" levels ? Or is that an edit by hand, do it yourself on all your boxes or create your own script type of thing. Just checking if there is an easier way. Thanks, Jerry

6 10

Odd issue with 7.7.1908 updated with qemu-kvm-ev
by Lamar Owen 15 Oct '19

15 Oct '19

So, I have a client that has an internal use application that needs an ancient version of libc5. That's not a typo; libc5. Before the server that ran it died about a year and a half ago (said server was an AMD K6-2/450 with a 6GB Western Digital Caviar drive that had been spinning nearly continuously for almost 20 years!) it was running on Red Hat Linux 5.2. The last version of CentOS that shipped with a libc5 was 2.1. So I set them up a KVM guest running CentOS 2.1, mainly because Red Hat 5.2 wouldn't recognize the network at all, using the e1000 network driver, and it ran well. Now, yes, there are no updates, but no it doesn't matter; it's an internal use application that has a very small footprint and very low risk. After the update on the host to 7.7.1908, the network stopped running. The host also has a CentOS 7 guest that is still working properly. If I change the 2.1 system to not automatically load the e1000 driver and console in and 'modprobe e1000' manually, it starts working again, for a while. Any ideas as to where to start looking? qemu-kvm-ev itself, or libvirt? I'm planning to start out with rollbacks to the previous versions of each to try to find where the issue starts.

2 2

Browser doesnt work
by Georgios 15 Oct '19

15 Oct '19

Hello. Im new on Centos I recently installed Centos 8 and i have the following problem with my browser I cant play media on the browser. for example i cant play. https://twitter.com/Ffs_OMG/status/1183397555914366976 Or i cant listen shows or songs on mixcloud. for example https://www.mixcloud.com/parapolitika-parapolitika/%CE%B3%CE%B9%CF%89%CF%81… i get the message "Sorry - your browser is not supported. Please update your browser or install another such as Google Chrome. Mixcloud requires HTML5 audio with MP3 and MP4 support." I suspect that these 2 problems relate. Any ideas how to solve this problem? Thanks in advance!

5 8

Gstreamer1
by Jerry Geis 15 Oct '19

15 Oct '19

How do I tell from source rpm's: 1) the build order of gstreamer packages 2) the command line args for the ./configure For centos 7. Thanks, Jerry

4 3

Re: [CentOS] qeum on centos 8 with nvme disk
by Jerry Geis 15 Oct '19

15 Oct '19

> How do you measure the slowness? Use fio or bonnie++ to share some number. By it taking more than 6 hours to "install" CentOS 8 in the guest :) Jerry

4 8

CVE-2019-6470 - dhcpd6 bug in CentOS 8 not being fixed?
by Steinar Skjelanger 13 Oct '19

13 Oct '19

The CVE-2019-6470 bug in isc-dhcp for ipv6 causing the server to crash on a regular basis is marked as "will not fix" for RHEL 8 on Red Hat's web site [1]. It's already got a fix for RHEL/CentOS 7, and other distros (like Ubuntu and Fedora) have released fixes. Is anyone familiar with the issue, or know about a (reasonable) workaround? Or why Red Hat doesn't want to fix it? I tried to contact Red Hat support to get their reasoning, but as we only have self-support subscriptions with them, they were not particulary interested in talking to me. [1] https://access.redhat.com/security/cve/cve-2019-6470 -- Regards, Steinar Skjelanger

1 0

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2019