Discuss June 2020

discuss@lists.centos.org

103 participants
90 discussions

firewall questions
by Chuck Campbell 23 Jun '20

23 Jun '20

I'm running Centos 7.8.2003, with firewalld. I was getting huge numbers of ssh attempts per day from a few specific ip blocks. The offenders are 45.0.0.0/24, 49.0.0.0/24, 51.0.0.0/24, 111.0.0.0/24 and 118.0.0.0/24, and they amounted to a multiple thousands of attempts per day. I installed and configured fail2ban, but still saw a lot of attempts in the logs, and the ipset created was filling up. I did some more research, and decided to use a few rich rules to block these attempts. I currently have these in place: #firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: p3p1 sources: services: dhcpv6-client ftp http https imap imaps pop3 pop3s smtp-submission smtps ssh ports: 110/tcp 995/tcp 143/tcp 993/tcp 25/tcp 21/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="49.0.0.0/24" reject rule family="ipv4" source address="51.0.0.0/24" reject rule family="ipv4" source address="111.0.0.0/24" reject But I still get hundreds of attempts reported in my fail2ban logs from these ip blocks. How is it that the rich rules don't drop these packets before pam/ssh/fail2ban ever get to see them? There must be some precedence in the firewalling I don't understand. -chuck -- ACCEL Services, Inc.| Specialists in Gravity, Magnetics | (713)993-0671 ph. | and Integrated Interpretation | (713)993-0608 fax 448 W. 19th St. #325| Since 1992 | (713)306-5794 cell Houston, TX, 77008 | Chuck Campbell | campbell(a)accelinc.com | President & Senior Geoscientist | "Integration means more than having all the maps at the same scale!"

7 7

CentOS-announce Digest, Vol 184, Issue 8
by centos-announce-request＠centos.org 23 Jun '20

23 Jun '20

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2020:2615 Important CentOS 7 thunderbird Security Update (Johnny Hughes) 2. CESA-2020:2613 Important CentOS 6 thunderbird Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 19 Jun 2020 21:47:41 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2020:2615 Important CentOS 7 thunderbird Security Update Message-ID: <20200619214741.GA24830(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2020:2615 Important Upstream details at : https://access.redhat.com/errata/RHSA-2020:2615 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: ab6911fa3852547565729fdebb90a6dfd7037df9b68c6c7673107494aa4acb30 thunderbird-68.9.0-1.el7.centos.x86_64.rpm Source: 5234ba5004b097341a81536325039081e0ae1bd9310c184c6d0b634dbdff33a4 thunderbird-68.9.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Fri, 19 Jun 2020 21:49:49 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2020:2613 Important CentOS 6 thunderbird Security Update Message-ID: <20200619214949.GA25009(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2020:2613 Important Upstream details at : https://access.redhat.com/errata/RHSA-2020:2613 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: a3c0238b4566d90fd029bc2edabb1b0c27a40c7833397c2c0f1a954f7baee5bb thunderbird-68.9.0-1.el6.centos.i686.rpm x86_64: 42720ce2acc09a86bfe1d5b0b1343be2bb52dae65776683e8163086419f5f825 thunderbird-68.9.0-1.el6.centos.x86_64.rpm Source: b9c6e2e8e9f5ddbde45f72058b6ddb4ded9ff2d7ddbbd7f1f3c240d83fddb200 thunderbird-68.9.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 184, Issue 8 ***********************************************

1 0

Re: [CentOS] About support for AMD ROME CPUs (Alexander Dalloz)
by 肖正刚 23 Jun '20

23 Jun '20

Hi, Alexander Thanks for your reply . Because we using CentOS7.6 with kernel 3.10.0-957.21.3.el7.x86_64 in production . We want to know which version of CentOS(or CentOS7.6) started to support AMD ROME CPUs and is it necessary to upgrade ? Thanks.

1 0

About support for AMD ROME CPUs
by 肖正刚 21 Jun '20

21 Jun '20

Hi, all We use AMD Rome CPUs, like EPYC 7452. RHEL said that RHEL 7.6.6 began to support these cpus(detials: https://access.redhat.com/support/policy/amd) , but we found that CentOS7.6 with kernel 3.10.0-957.21.3.el7.x86_64 also works fine. So, my questions are: 1) Is there any place that i can find the cpu support info? 2) Dose the kernel 3.10.0-957.21.3.el7.x86_64 from CentOS7.6 already contains changes made by kernel 3.10.0-957.27.2.el7 from RHEL7.6? 3) Does the kernel update has a release note or something like that and where to find ? Any suggestions will help ! Thanks

2 1

Installing owncloud on CentOS 7 server
by H 19 Jun '20

19 Jun '20

I transitioning an owncloud installation from a C6 server to a new C7 server and used yum install owncloud to install it on the C7 server. I expected /var/www/owncloud to be generated but alas not. Quick Googling just showed examples of installing from the latest owncloud repository but not using yum. Have I missed something obvious when using yum to install?

3 7

Updating microcode_ctl froze Centos7
by Robin Lee 19 Jun '20

19 Jun '20

Today when I ran yum update two packages came up microcode_ctl and unbound-libs. The updating process went fine until it outputted Running transaction Updating : 2:microcode_ctl-2.1-61.6.el7_8.x86_64 then it just froze. I could no longer ssh to the machine and the console was just blank. I had to shut down it hard. It came back up seemingly fine. But yum update doesn't work anymore. It says "Error importing repomd.xml from base/7/x86_64: Damaged repomd.xml file" I looked at the logs, but journalctl only shows the latest boot on this machine. So I guess I have three questions - Any idea what happened with the update process? - How can I repair repomd.xml? - How do I configure journalctl to store more boots? /Robin

5 9

Amd es1000
by paride desimone 19 Jun '20

19 Jun '20

Hi, i have a proliant dl380 g5, with an amd as1000. I try to install centos8 with gui, but when try to start the new installed system, the xserver don't start. There is a throuble with the amd es1000 driver. This grafic card, seems not supported more from amd. I need a minimalistic gui for study for rhcsa certification. The gui is mandatory for the exam. Any help? Paride

5 14

Bootable USB keys : which brand ?
by Nicolas Kovacs 19 Jun '20

19 Jun '20

Hi, In my daily work I'm mainly using USB keys for work : one with CentOS 7, one with OpenSUSE Leap 15.1, one with Slax Live for data recovery purposes, one with Ghost4Linux and one with FreeDOS which I use for flashing the odd BIOS. Last week I bought a set of three flashy colored USB keys in a local shop. To my surprise, none of them seem to be able to boot anything. When I write a bootable image (CentOS, OpenSUSE, whatever) to any one of the USB keys, the USB key boot option doesn't show up on any one of my sandbox PCs. Looks like I just learnt the hard way that some USB keys can't be used for installation purposes. As far as I can tell, I need a set of 8 GB keys so the biggest image, the CentOS 8 ISO, can fit. Can you recommend a no-nonsense USB key brand which I can use to make a set of USB installation keys ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32 Mob. : 06 51 80 12 12

3 3

Apache (httpd) fails to start at boot - Centos 8.1
by Jay Hart 19 Jun '20

19 Jun '20

If I do 'systemctl start httpd', apache will start right up. But during boot, it doesn't and I get the resulting errors below. Jun 15 21:17:28 dream httpd[1534]: (99)Cannot assign requested address: AH00072: make_sock: could not bind to address 10.20.30.11:80 Jun 15 21:17:28 dream httpd[1534]: no listening sockets available, shutting down Jun 15 21:17:28 dream httpd[1534]: AH00015: Unable to open logs Jun 15 21:17:29 dream systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE Jun 15 21:17:29 dream systemd[1]: httpd.service: Failed with result 'exit-code'. the box's ip address is 10.20.30.11, and I am trying to get http (80), and https (443) going. Firewall is turned on. The listen parameter in httpd.conf is 10.20.30.11:80 The log files in /var/log/httpd are all owned by root. Httpd runs as user 'apache'. Google searches have not returned anything that looks remotely promising. Got any suggestions? Thanks in advance, Jay

8 11

Can't access Squirrelmail on Centos 8
by Jay Hart 19 Jun '20

19 Jun '20

Good evening, I have not able able to run the http://ip-addr/src/configtest.php script, nor access Squirrelmail. Looking for suggestions on what I might have missed. When I try either http://ip-... or https://ip-..., I get the following reply Forbidden You don't have permission to access /webmail/src/configtest.php on this server. I got squirrelmail installed in /usr/share/squirrelmail and 'configured' to work (using ./conf.pl). This setup below is about the same setup on my Centos 6 box. I'm thinking my issue is more Apache configuration related than Squirrelmail. **Apache is running with no issues** Below are some of my settings in /etc/httpd/conf/httpd.conf Apache ServerRoot is /etc/httpd Apache DocumentRoot is /www Further parameters within httpd.conf include: # # Relax access to content within /var/www. # <Directory "/www"> AllowOverride None # Allow open access: Require all granted </Directory> # Further relax access to the default document root: <Directory "/www"> Options Indexes FollowSymLinks AllowOverride None # # Controls who can get stuff from this server. # Require all granted </Directory> In /etc/httpd/conf.modules.d I created a file called 16-squirrelmail.conf That file contains the following information: # SquirrelMail is a webmail package written in PHP. # Alias /webmail /usr/share/squirrelmail <Directory "/usr/share/squirrelmail/plugins/squirrelspell/modules"> #<Directory "/usr/share/squirrelmail"> AllowOverride None Require all denied </Directory> # this section makes squirrelmail use https connections only, for this you # need to have mod_ssl installed. If you want to use unsecure http # connections, just remove this section: #6-12-2020 commented out next five lines to test sqmail in http mode only <Directory /usr/share/squirrelmail> RewriteEngine on RewriteCond %{HTTPS} !=on RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} </Directory> Any suggestions???? Thanks, Jay

5 11

← Newer
1
2
3
4
5
6
7
8
9
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss June 2020