Discuss

discuss@lists.centos.org

34758 discussions

CentOS-announce Digest, Vol 88, Issue 5
by centos-announce-request＠centos.org 08 Jun '12

08 Jun '12

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2012:0717 Important CentOS 5 bind97 Update (Johnny Hughes) 2. CESA-2012:0716 Important CentOS 5 bind Update (Johnny Hughes) 3. CESA-2012:0716 Important CentOS 6 bind Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 7 Jun 2012 17:22:36 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0717 Important CentOS 5 bind97 Update To: centos-announce(a)centos.org Message-ID: <20120607172236.GA14991(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0717 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0717.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 2b9b6c83fc41075777d1571201e7a1c88eb44a3a137b19b10d5891c731e18d3d bind97-9.7.0-10.P2.el5_8.1.i386.rpm 9cd7c8ef84dd48ecbfa497c7cc9a5b18852f4c06d246bf5937db6bd53271db4d bind97-chroot-9.7.0-10.P2.el5_8.1.i386.rpm c231140964ec0ab35407d6eeb2887c2b0096460bec68d2ce15772acdc7d66932 bind97-devel-9.7.0-10.P2.el5_8.1.i386.rpm a7447f529de7315ead9a05983d355be900d83870f143fbdcb712ec0a0e30813e bind97-libs-9.7.0-10.P2.el5_8.1.i386.rpm f2a40630eda6b048fdad3cc3a4358456eb37ab613ece602014b04c0a891c8ac8 bind97-utils-9.7.0-10.P2.el5_8.1.i386.rpm x86_64: 1d1a3f2e1006da35bcce3a8ddfe2b2e0ef4358b935602610091859d4623a8450 bind97-9.7.0-10.P2.el5_8.1.x86_64.rpm 6438ee28377db46dd744c013d909aacee1a7bd58677aa88d430ec42371505ff2 bind97-chroot-9.7.0-10.P2.el5_8.1.x86_64.rpm c231140964ec0ab35407d6eeb2887c2b0096460bec68d2ce15772acdc7d66932 bind97-devel-9.7.0-10.P2.el5_8.1.i386.rpm bcab3bed2e2be8cf33554db1d8d6a7090af0bb6e6092f56e6bfb758ff17451ef bind97-devel-9.7.0-10.P2.el5_8.1.x86_64.rpm a7447f529de7315ead9a05983d355be900d83870f143fbdcb712ec0a0e30813e bind97-libs-9.7.0-10.P2.el5_8.1.i386.rpm 2cf8f66d57a2bafd3ce19445e915347a3b5965c0141e676ec99eca4c2c3007fe bind97-libs-9.7.0-10.P2.el5_8.1.x86_64.rpm 521102f0597bfc5cf47b2d0ece9ce5478ad387f773392cbc3a7870840df65624 bind97-utils-9.7.0-10.P2.el5_8.1.x86_64.rpm Source: ac9d2233f649da230376ddb9a0cd226f35dbfa2f9a411c7d000c7dbbe859dfca bind97-9.7.0-10.P2.el5_8.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 7 Jun 2012 17:23:50 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0716 Important CentOS 5 bind Update To: centos-announce(a)centos.org Message-ID: <20120607172350.GA15176(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0716 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0716.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: e77741388e628e6f5d5ef07c11e999b58d51f3554594d2551da58a57d5d189e8 bind-9.3.6-20.P1.el5_8.1.i386.rpm 9544267342a5aabb7714607bc7979e55bcb61cc561f4136b725b5c56adcb2614 bind-chroot-9.3.6-20.P1.el5_8.1.i386.rpm 72c8171cab0a3d0c18d1981eb8403469a9ef999945265321bfc1d662098fcb65 bind-devel-9.3.6-20.P1.el5_8.1.i386.rpm 0fa7194e0eee3fe17a0bd9d5d9e4beb16a9bbb1b244454773729a90810cb381d bind-libbind-devel-9.3.6-20.P1.el5_8.1.i386.rpm 5e33cf76249fdef29735f2f37890136c9d9cb525d28230e73a0f6f4b21cce958 bind-libs-9.3.6-20.P1.el5_8.1.i386.rpm 6b8ee07523c01ee8fc9813390fe118982ef4c89de94c50e192995404b1de9081 bind-sdb-9.3.6-20.P1.el5_8.1.i386.rpm 7875d70c531bb1c28b5a374a0b3609a9fa38043c919206cd2fe6343bfadf61be bind-utils-9.3.6-20.P1.el5_8.1.i386.rpm 1e9ff807dea89f7718a655df290e5f3e25b2fd40e351593ff5a46c4ac6bea870 caching-nameserver-9.3.6-20.P1.el5_8.1.i386.rpm x86_64: 8280005de8fd86901d2e779f3991c80854a26e69359f35f94eb55dc84fee39b2 bind-9.3.6-20.P1.el5_8.1.x86_64.rpm 9509c40f89c9f4e08df2ce205eb433078f880b21167da36770cabbb941f54724 bind-chroot-9.3.6-20.P1.el5_8.1.x86_64.rpm 72c8171cab0a3d0c18d1981eb8403469a9ef999945265321bfc1d662098fcb65 bind-devel-9.3.6-20.P1.el5_8.1.i386.rpm ce6fe0b2bcd7332a66ed2a84ce810562eaa454a0cd4d6fcaf6492aab992d3244 bind-devel-9.3.6-20.P1.el5_8.1.x86_64.rpm 0fa7194e0eee3fe17a0bd9d5d9e4beb16a9bbb1b244454773729a90810cb381d bind-libbind-devel-9.3.6-20.P1.el5_8.1.i386.rpm 4cd6e54330bcafef627f62ea30efbca7e10cf668e096b4f4c62f242cb1abf18c bind-libbind-devel-9.3.6-20.P1.el5_8.1.x86_64.rpm 5e33cf76249fdef29735f2f37890136c9d9cb525d28230e73a0f6f4b21cce958 bind-libs-9.3.6-20.P1.el5_8.1.i386.rpm 4a5ac3dae1ac63722f2a65686be8ac966a30de69ef74d76c2696297b95b040ac bind-libs-9.3.6-20.P1.el5_8.1.x86_64.rpm a07f61dc78e390c8cc709c1ac56cdd797657ffc9916d3e98d3b287c53b55fc6f bind-sdb-9.3.6-20.P1.el5_8.1.x86_64.rpm 8b22daca4e19d687432094fe9caf81b8d8203b362289f81cb8c59d3b49a0c8f2 bind-utils-9.3.6-20.P1.el5_8.1.x86_64.rpm 965cdee27c7a5b4aa3623ebef96dfb09db035b8e99063ff2c38ebabb69f4901d caching-nameserver-9.3.6-20.P1.el5_8.1.x86_64.rpm Source: 02788f487ba600dbb39ac972a6383ebf4136678ff8896fc77b46e01af7aeac69 bind-9.3.6-20.P1.el5_8.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Thu, 7 Jun 2012 19:31:20 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0716 Important CentOS 6 bind Update To: centos-announce(a)centos.org Message-ID: <20120607193120.GA22654(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0716 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0716.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 081b3e564fa77e8042355bf02848a1384b8321391e19d11d1348a8c3b220a72d bind-9.7.3-8.P3.el6_2.3.i686.rpm bac48abad13d32c664a68e8730558e65a2ed280d732fc6db37109efa502a7a0f bind-chroot-9.7.3-8.P3.el6_2.3.i686.rpm 2d2debcbb81feac2ca95aed1dd8d0d138ac1ec65cc752b4a3c020f17e6601938 bind-devel-9.7.3-8.P3.el6_2.3.i686.rpm b450fbefc48d5c6fe9e624fb54f5df46b03e02a9eb69da2cc019e6d00e160600 bind-libs-9.7.3-8.P3.el6_2.3.i686.rpm 48917fd1680a3ce07a2e5760f1d2eee9335301c1c86884b5a65dccc052bf53c8 bind-sdb-9.7.3-8.P3.el6_2.3.i686.rpm 342be62081582d5538ef6c7f74d5a7239be2eb293e6780e79872be28cdd1ce05 bind-utils-9.7.3-8.P3.el6_2.3.i686.rpm x86_64: 7e36254c2830868c4555ad564a25b562f48548ecf9b952beefa4354bb05c02f3 bind-9.7.3-8.P3.el6_2.3.x86_64.rpm c6a565e300c2359090febca013f6240435d28976acf8e33685f7a15cca255100 bind-chroot-9.7.3-8.P3.el6_2.3.x86_64.rpm 2d2debcbb81feac2ca95aed1dd8d0d138ac1ec65cc752b4a3c020f17e6601938 bind-devel-9.7.3-8.P3.el6_2.3.i686.rpm 1cb45a52030eff6da500e0716c0d0e1860b40b2d5a8b1f5fc5f252ed92bbf101 bind-devel-9.7.3-8.P3.el6_2.3.x86_64.rpm b450fbefc48d5c6fe9e624fb54f5df46b03e02a9eb69da2cc019e6d00e160600 bind-libs-9.7.3-8.P3.el6_2.3.i686.rpm 1d394744ea456c996cbbb4e8edf5742b67bccc36e376d2ae10df2277412f0faa bind-libs-9.7.3-8.P3.el6_2.3.x86_64.rpm 4513cb91c85a818b1a1719ef4141559102a1eeea29c8294c615ef3196cded645 bind-sdb-9.7.3-8.P3.el6_2.3.x86_64.rpm 3d4739b13cf9b6993e52ffed100be8086571940369f3203ca2c88cd52caf2c2f bind-utils-9.7.3-8.P3.el6_2.3.x86_64.rpm Source: 387212f6401f4d14939be846fdae6d898cc80f65a74044ebf893265a08228b31 bind-9.7.3-8.P3.el6_2.3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 88, Issue 5 **********************************************

1 0

ipoe vs pppoe...
by John Doe 08 Jun '12

08 Jun '12

Hi, we are currently using pppd to connect to the net through pppoe. Some providers seem to propose ipoe instead of pppoe and I cannot find any clue on how/where/if_possible to set up such connection in CentOS. Anybody has any experience with ipoe...? Thx, JD

2 2

Bug 820677 - (CVE-2012-2337) CVE-2012-2337 sudo: Multiple netmask values used in Host / Host_List configuration cause any host to be allowed access
by Fajar Priyanto 08 Jun '12

08 Jun '12

Hi all, I just want to confirm, there is no patch release yet for this sudo, is it? https://bugzilla.redhat.com/show_bug.cgi?id=820677 Thank you. -- Fajar.

2 1

Re: [CentOS] Postfix not reading main.cf
by Adrian P. van Bloois 08 Jun '12

08 Jun '12

Neil wrote: > Hello: > > I just did a fresh install of CentOS 6.2 on a virtual server. > > I am trying to configure Postfix but it does not seem to be > reading configuration directives from /etc/postfix/main.cf > > Here is what I did to test it: > vi /etc/postfix/main.cf and set this directive: > myorigin = hello.world.com > postfix reload > postconf -d | grep myorigin > > I get this output: > append_at_myorigin = yes > myorigin = $myhostname > > Any ideas why it is not picking up the configuration? > > Thanks, > Neil > What you should do is run postconf without paramaters to a file and inspect that. In my case e.g. myorigin is set to $mydomain, but mydomain is set to the correct value. Good lcuk Adrian -- Adri P. van Bloois Antonlaan 104 email: adrian(a)pa0rda.nl 3701 VG Zeist voice: +31-(0)-30-6912741 The Netherlands fax: NONE 52 05'15.77"N 5 4'44.56"E QTH-locater JO 22 OC The whole point of cooking is to get as much flavour out of the ingredients as possible. -- Delia Smith -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

(?) Dual-monitor wallpapers on CEntOS 6
by Jay Leafey 08 Jun '12

08 Jun '12

I've recently set up two workstations running CentOS 6, one with an nVidia card and the elrepo drivers and one with an ATI Radeon card with the elrepo fglrx drivers. Both work well, but one aspect of the systems works different from CEntOS 5 on those systems: I cannot get a wallpaper image to span the two monitors. I have tried both with and without xinerama and there is no difference in this regard. The specified wallpaper is displayed on both monitors. Has anybody else run across this or a solution? I freely admit, this is a trivial issue. It's strictly an aesthetic matter and I'm curious as to why it doesn't work the same. Just wonderin' -- Jay Leafey - jay.leafey(a)mindless.com Memphis, TN

2 3

some security measures I would like to share
by Bob Hoffman 07 Jun '12

07 Jun '12

I apologize for the html, but it is a copy from a web post I did. I wanted to share this with list members and hope it helps others. I tried not to be redundant and add things I have not seen posted before. Always interested in constructive thoughts, better ideas, etc. ** *Security thoughts for server admins/webmasters* ------------------------------------------------------------------------ I would like to add some security measures I like to use. These are not listed on security sites and I feel it is time someone posted this stuff. This concerns programs/items used by webmasters/server admins on a very irregular basis. (not very often). This list assumes you have an IPMI card with its own eth port or an onboard IPMI interface, both having video access. Or accessing the shell of a virtual host to access virtual servers located on it. (if no IPMI) Quote: *PHPMYADMIN* - This is a wonderful tool for use by web programmers. Most security with this program lists just two protections. a)Use htaccess to password protect, force SSL b)Alias the folder from /phpmyadmin to something like /examp This is where security measures, aside from keeping updated, seem to end. This is bad. There is more you can do to protect that access to your database. PhpMyAdmin is a program you will use at times, but 99% of the time you will never touch it at all. So why would you leave it open to hackers all the time? Simply disable the 'alias' in httpd to prevent it from being accessed. For example in CentOS 6 the file /etc/httpd/conf.d/phpmyadmin.conf contains this directory information. (or something like it.) I have added 'Deny from ALL and commented out 'Allow from ALL' and restarted httpd. (the allowoverride is allowing htaccess protection for the folder). You could comment out everything except the allowoverride and deny from all... Quote: <Directory /usr/share/phpMyAdmin/> *Order Deny,Allow* Deny from All Allow from 127.0.0.1 Allow from ::1 *#Allow from All* allowoverride All </Directory> Once httpd is restarted no one can access the phpmyadmin folder if it is not in the html folder. (in centos 6 the program is usually located in /usr/share/phpmyadmin). This prevents the hacking of your phpmyadmin program. If you think about it, outside of a small fix or initial programming you will almost never use the program. So why do you leave it open to everyone 24 hours a day? Quote: *IPMI* IPMI is great but if you are a webmaster you are probably leaving this open to the internet. If you are local to the datacenter, or the datacenter is really cool, you can remove the eth cable from the ipmi port. And ask them to plug it in when there is an issue. This only works if you have a separate ipmi card with its own eth port. (and helps if you tag the cable and port for the center) I think most of us seldom, if ever, use our IPMI during the course of a year once the system is set up. This prevents root access, IPMI card getting hacked, and still allows emergency access with a quick visit or a phone call *IPMI, Virtual Host, Virtual Machines* Quote: *Your Virtual Host server* I seldom ever need to go into my virtual host. It is set up correctly and I get my logwatches every day. I have no ports open up on it. If I never use it, why would I leave a shell port open 24 hours a day? If I have an IPMI card I can log in and open that port. Then I can do what I need to do. Safest, if IPMI is available (with video) is to comment out/disable the ssh port. On a virtual host you most likely use a physical bridge. This means nothing is touching the host. Great Security tip. Quote: *Virtual Machines- DNS* Are your DNS servers virtual machines on a server (or on a dedicated with an IPMI card in it)? I bet you never access shell except to make that very rare dns change. And if you use rndc you never use shell. If you have IPMI with video disable ssh port. Enable it via IPMI on those very rare instances you need to access it. Logwatch can still send out. Only port 53 should be open 24 hours a day (and if rndc that port too...and 5353 if you are doing that.) There is no reason to leave this system open to the net at all. Enable shell when you need it and then disable when done. You do not need to open port 25 (or any port) to send emails out of the system. So why do you leave port 22 (or other shell port) on 24 hours a day if you never ever use it? Quote: *MYSQL servers* Again, if on a virtual host or even its own dedicated disable port 22 (ssh port) and only enable via IPMI on those rare times you need to use it. Quote: *Your website/webserver* The same issue remains. Outside of the times you are using shell OR FTP...these ports should be disabled. Enable using IPMI. This simple act prevents a lot of hack attempts, log filling, and gives massive peace of mind. Yes, you use shell and ftp....but not that much. Think about it. You might use ftp and shell a lot, but you are leaving those ports open 24 hours a day, 7 days a week. I guarantee outside of massive program days you use less than 5% of that time on those ports. So why open your server to being hacked? Close the ports. Quote: *Your open source or commercial web application* .htaccess protect any folder that does not need to be accessed by a user via http. Most files are grabbed by a index file and are still able to be used even with htaccess protection. Try it. Definitely do this with your administrative folders. There is no reason not to do this. But how many times do you really access that admin folder? I would say put a fake htacces protection file in all the folders you can. Fake meaning the user required does not exist and there is no password for it. Then it will not be passed. The admin folder can also be done this way, but add commented out sections with real user/pass info. Then when you need to go to the admin section, you shell/ftp in, change the htaccess file, then do what you need to do. Then comment out the real access info. This prevents any access from an external user to these folders for the 99% of the time you are not using your admin...and 100% of the time for the folders they should never be visiting. Outside of a programming/fix/update you will seldom be doing admin work, program work, and your system/web apps will be running without your input. So why leave all this open to hackers 24 hours a day? These simple things can block 100% of brute force shell attacks across your system...if you can unplug the ipmi card (with an easy way to replug it) then you cannot be accessed via shell across all your systems. Sleep in peace. A majority of hacks on open source revolve getting to that admin folder....or some other folder of a plug in.. The hacker will have a heck of a time brute forcing an htaccess protected folder where no user/pass combo will ever work. *On a final note....* If you are building a web application you should use a mysql user that is only allowed to update and select... With proper programming you can set up items to be deleted via a cron job using a mysql user that has a bit more access. This prevents a hacker from actually deleting or altering any data....and easily rolled back. This is how I program and I think it should be standard. As far as I know not one single program does this...and that is a shame.

1 1

SCO OpenServer under KVM?
by Bill Campbell 07 Jun '12

07 Jun '12

Does anybody here have experience running SCO OpenServer 5.0.6a or earlier under KVM? Bill -- INTERNET: bill(a)celestial.com Bill Campbell; Celestial Software LLC URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way Voice: (206) 236-1676 Mercer Island, WA 98040-0820 Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792 Under democracy one party always devotes its chief energies to trying to prove that the other party is unfit to rule and both commonly succeed, and are right. -- H.L. Mencken

1 0

CentOS-announce Digest, Vol 88, Issue 4
by centos-announce-request＠centos.org 07 Jun '12

07 Jun '12

1 0

Worrying after IPv6 day...
by John Doe 07 Jun '12

07 Jun '12

Hi, after IPv6 day, I was wondering if our server were really secure... And, I know we should switch on IPv6 everywhere but... it will take some time. Usually, we disable(d) IPv6; so we are not running ip6tables. Can I start ip6tables in all cases (even if only IPv4) just to be on the safe side? On CentOS 6 servers, I use the --noipv6 in the kickstart files and I removed NetworkManager; but ifconfig still shows IPv6 adresses. And I wonder from where it gets them... based on the MAC? I guess they are not routable, so I should not get any traffic... right? Thx, JD

2 1

Re: [CentOS] Installing QEMU without KVM[SOLVED]
by Aft nix 07 Jun '12

07 Jun '12

On Thu, Jun 7, 2012 at 6:43 PM, John Doe <jdmls(a)yahoo.com> wrote: > From: Aft nix <aftnix(a)gmail.com> > >> On Thu, Jun 7, 2012 at 5:53 PM, John Doe <jdmls(a)yahoo.com> wrote: >>> From: Aft nix <aftnix(a)gmail.com> >>> >>>> I'm developing some kernel module, so i need a stand alone qemu to >>>> test my kernel. >>>> Although i've seen a qemu in rpmforge, still yum install qemu does >> not work. >>> >>> What do you mean by does not work? >>> Dependencies problems? >> >> No, package qemu availabe. >> >> yum install qemu >> Loaded plugins: fastestmirror, refresh-packagekit, security >> Loading mirror speeds from cached hostfile >> * base: mirrors.sin3.sg.voxel.net >> * epel: ftp.riken.jp >> * extras: mirrors.sin3.sg.voxel.net >> * rpmforge: mirror.oscc.org.my >> * rpmfusion-free-updates: ftp.upjs.sk >> * rpmfusion-free-updates-testing: ftp.upjs.sk >> * updates: mirrors.sin3.sg.voxel.net >> Setting up Install Process >> No package qemu available. >> Error: Nothing to do >> >> You can see rpmforge is infact enabled. > > But not rpmforge-extras... > Hi JD, Thanks for pointing this. everything seems ok now. I'm marking this thread as SOLVED. Cheers. > JD > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos -- -aft

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss