Discuss October 2019

discuss@lists.centos.org

125 participants
120 discussions

Hiding a grub menuentry?
by James Pearson 17 Oct '19

17 Oct '19

Does anyone know if it is possible to 'hide' a grub menuentry with CentOS 7 ? I have a custom menuentry that I don't want to be seen on the grub screen - but it needs to be selectable as the entry to boot via 'grub2-reboot' I've scanned the grub2 documentation - but I can't find anything obvious - so I'm guessing it can't be done - unless someone knows otherwise ? Thanks James Pearson

3 3

vainfo on Intel
by Jerry Geis 17 Oct '19

17 Oct '19

I am trying to get accelerated video on this device NUC5CPYB Intel Driver is loaded: grep Intel Xorg.0.log [ 18.006] (**) | |-->Device "Intel Graphics" [ 18.048] (II) intel: Driver for Intel(R) Integrated Graphics Chipsets: [ 18.051] (II) intel: Driver for Intel(R) HD Graphics [ 18.051] (II) intel: Driver for Intel(R) Iris(TM) Graphics [ 18.051] (II) intel: Driver for Intel(R) Iris(TM) Pro Graphics [ 18.056] (--) intel(0): Integrated Graphics Chipset: Intel(R) HD Graphics [ 18.437] (II) config/udev: Adding input device HDA Intel PCH Front Headphone Surround (/dev/input/event10) [ 18.438] (II) config/udev: Adding input device HDA Intel PCH HDMI/DP,pcm=3 (/dev/input/event11) [ 18.440] (II) config/udev: Adding input device HDA Intel PCH Mic (/dev/input/event8) [ 18.441] (II) config/udev: Adding input device HDA Intel PCH Headphone Front (/dev/input/event9) Vainfo fails: vainfo libva info: VA-API version 0.40.0 libva info: va_getDriverName() returns 0 libva info: Trying to open /usr/lib64/dri/i965_drv_video.so libva info: va_openDriver() returns -1 vaInitialize failed with error code -1 (unknown libva error),exit [root@nuc5cdev2 tmp]# ls /usr/lib64/dri/ i915_dri.so i965_dri.so kms_swrast_dri.so nouveau_dri.so r300_dri.so r600_dri.so radeonsi_dri.so swrast_dri.so virtio_gpu_dri.so vmwgfx_dri.so [root@nuc5cdev2 tmp]# [root@nuc5cdev2 tmp]# yum provides "*/*i965_drv_video.so" Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: ftp.ussg.iu.edu * elrepo: ord.mirror.rackspace.com * epel: ord.mirror.rackspace.com * extras: ftp.ussg.iu.edu * updates: ftp.ussg.iu.edu No matches found So vainfo fails, The file its looking for is not on my system and yum says its not available. What do I do ? Jerry

1 1

DSA key not accepted on CentOS even after enabling
by Gianluca Cecchi 17 Oct '19

17 Oct '19

Hello, I have some users that connect to a server with their DSA key that is of type ssh-dss. I'm migrating (installing as new) the server where they connect to CentOS 8 + updates. I was not able to connect with the keys to this new server even after having added, as found in several internet pages, this directive at the end of /etc/ssh/sshd_config of the CentOS 8 server: # Accept also DSA keys PubkeyAcceptedKeyTypes=+ssh-dss and systemctl restart sshd I kept getting in journal the message: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] I saw that the sshd process had started with the option ... -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com So I found the unit file for sshd that refers to /etc/crypto-policies/back-ends/opensshserver.config In the mean time I was able to reach my target going and editing the /etc/sysconfig/sshd file adding the whole line obtained from the above and adding ssh-dss CRYPTO_POLICY='-oCiphers=aes256-gcm(a)openssh.com, chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com, umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com ,hmac-sha2-256,hmac-sha1,umac-128(a)openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms= curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=rsa-sha2-256,ecdsa-sha2-nistp256, ecdsa-sha2-nistp256-cert-v01(a)openssh.com,ecdsa-sha2-nistp384, ecdsa-sha2-nistp384-cert-v01(a)openssh.com,rsa-sha2-512,ecdsa-sha2-nistp521, ecdsa-sha2-nistp521-cert-v01(a)openssh.com,ssh-ed25519, ssh-ed25519-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com ,ssh-dss' and now it works with pubkey authentication based on DSA keys. Not going to the querelle of OpenSSH 7 removing DSA keys and DSA vs RSA (eg. some considerations by some years ago here: https://security.stackexchange.com/questions/5096/rsa-vs-dsa-for-ssh-authen… ), any hint on smarter way to add? I suppose further updates could change content of /etc/crypto-policies/back-ends/opensshserver.config that btw is part of crypto-policies-20181217-6.git9a35207.el8.noarch and not openssh-server-7.8p1-4.el8.x86_64 HIH others incurring in this problem and thanks in advance for any insight/hint, Gianluca

2 2

CentOS 7.7 hfs
by Jerry Geis 16 Oct '19

16 Oct '19

I tried to install kmod-hfs and kmod-hfsplus but not found ? What is up ? the system is all updated with yum update. Jerry

1 1

BackupPC v4 from epel
by Ranbir 16 Oct '19

16 Oct '19

Hello Everyone, Has anyone tried to install BackupPC v4 on CentOS 8 from epel? I just did and this happened: [root@resurrect ~]# dnf --enablerepo epel install BackupPC Last metadata expiration check: 0:18:41 ago on Tue 15 Oct 2019 08:03:59 PM EDT. Error: Problem: conflicting requests - nothing provides par2cmdline needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::AutoReconnect) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Net::FTP::RetrHandle) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(Time::ParseDate) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl(XML::RSS) needed by BackupPC-4.3.1-2.el8.x86_64 - nothing provides perl-Time-modules needed by BackupPC-4.3.1-2.el8.x86_64 (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) If that didn't come out too nice, here's a pastebin link: https://pastebin.com/HgjAQmvV I've checked all the disabled repos on my system and none of them have those packages. Is this just a case of the dependencies not being built yet? -- Ranbir

4 3

Attempting to use tproxy on Centos 8 fails with 'No such file or directory'
by Nathan Coulson 16 Oct '19

16 Oct '19

I was working on a haproxy transparent proxy setup that we had working on Centos 7 (iptables), but running into issues getting tproxy working with NFTables on Centos 8. >From https://www.kernel.org/doc/Documentation/networking/tproxy.txt, It should be a matter of: # nft add table filter # nft add chain filter divert "{ type filter hook prerouting priority -150; }" # nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept But when running the 3rd line (add rule), I get root@kryptonite [/lib/modules/4.18.0-80.11.2.el8_0.x86_64]# nft add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept Error: Could not process rule: No such file or directory add rule filter divert meta l4proto tcp socket transparent 1 meta mark set 1 accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (In attempting to resolve this, I did the following) modprobe nf_tproxy_ipv4 modprobe nf_tproxy_ipv6 modprobe nf_socket_ipv4 modprobe nf_socket_ipv6 I also noted that: nft add rule filter divert meta l4proto tcp meta mark set 1 accept (Removing socket transparent 1) does not exit with a failure. Also found https://bugzilla.redhat.com/show_bug.cgi?id=1651813, (which did make reference to the nftables version 0.9.0 possibly missing support, I have not tried compiling 0.9.1 yet, but I find it curious the entire line fails with 'socket transparent 1' making me wonder if it is a missing module still) -- Nathan Coulson System Administrator for Bravenet Web Services www.bravenet.com

2 3

easy way to stop old ssl's
by Jerry Geis 15 Oct '19

15 Oct '19

HI all, When CentOS 7 was created things like SSLv2 TLSv1 TLSv1.1 etc... were all OK, but now they have fallen out of favor for various reasons. Updating to CentOS 7.7 does not automatically disable these types of items from apache - is there a script that is available that can be ran to bring a box up to current "accepted" levels ? Or is that an edit by hand, do it yourself on all your boxes or create your own script type of thing. Just checking if there is an easier way. Thanks, Jerry

6 10

Odd issue with 7.7.1908 updated with qemu-kvm-ev
by Lamar Owen 15 Oct '19

15 Oct '19

So, I have a client that has an internal use application that needs an ancient version of libc5. That's not a typo; libc5. Before the server that ran it died about a year and a half ago (said server was an AMD K6-2/450 with a 6GB Western Digital Caviar drive that had been spinning nearly continuously for almost 20 years!) it was running on Red Hat Linux 5.2. The last version of CentOS that shipped with a libc5 was 2.1. So I set them up a KVM guest running CentOS 2.1, mainly because Red Hat 5.2 wouldn't recognize the network at all, using the e1000 network driver, and it ran well. Now, yes, there are no updates, but no it doesn't matter; it's an internal use application that has a very small footprint and very low risk. After the update on the host to 7.7.1908, the network stopped running. The host also has a CentOS 7 guest that is still working properly. If I change the 2.1 system to not automatically load the e1000 driver and console in and 'modprobe e1000' manually, it starts working again, for a while. Any ideas as to where to start looking? qemu-kvm-ev itself, or libvirt? I'm planning to start out with rollbacks to the previous versions of each to try to find where the issue starts.

2 2

Browser doesnt work
by Georgios 15 Oct '19

15 Oct '19

Hello. Im new on Centos I recently installed Centos 8 and i have the following problem with my browser I cant play media on the browser. for example i cant play. https://twitter.com/Ffs_OMG/status/1183397555914366976 Or i cant listen shows or songs on mixcloud. for example https://www.mixcloud.com/parapolitika-parapolitika/%CE%B3%CE%B9%CF%89%CF%81… i get the message "Sorry - your browser is not supported. Please update your browser or install another such as Google Chrome. Mixcloud requires HTML5 audio with MP3 and MP4 support." I suspect that these 2 problems relate. Any ideas how to solve this problem? Thanks in advance!

5 8

Gstreamer1
by Jerry Geis 15 Oct '19

15 Oct '19

How do I tell from source rpm's: 1) the build order of gstreamer packages 2) the command line args for the ./configure For centos 7. Thanks, Jerry

4 3

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss October 2019