Discuss

discuss@lists.centos.org

34753 discussions

some security measures I would like to share
by Bob Hoffman 07 Jun '12

07 Jun '12

I apologize for the html, but it is a copy from a web post I did. I wanted to share this with list members and hope it helps others. I tried not to be redundant and add things I have not seen posted before. Always interested in constructive thoughts, better ideas, etc. ** *Security thoughts for server admins/webmasters* ------------------------------------------------------------------------ I would like to add some security measures I like to use. These are not listed on security sites and I feel it is time someone posted this stuff. This concerns programs/items used by webmasters/server admins on a very irregular basis. (not very often). This list assumes you have an IPMI card with its own eth port or an onboard IPMI interface, both having video access. Or accessing the shell of a virtual host to access virtual servers located on it. (if no IPMI) Quote: *PHPMYADMIN* - This is a wonderful tool for use by web programmers. Most security with this program lists just two protections. a)Use htaccess to password protect, force SSL b)Alias the folder from /phpmyadmin to something like /examp This is where security measures, aside from keeping updated, seem to end. This is bad. There is more you can do to protect that access to your database. PhpMyAdmin is a program you will use at times, but 99% of the time you will never touch it at all. So why would you leave it open to hackers all the time? Simply disable the 'alias' in httpd to prevent it from being accessed. For example in CentOS 6 the file /etc/httpd/conf.d/phpmyadmin.conf contains this directory information. (or something like it.) I have added 'Deny from ALL and commented out 'Allow from ALL' and restarted httpd. (the allowoverride is allowing htaccess protection for the folder). You could comment out everything except the allowoverride and deny from all... Quote: <Directory /usr/share/phpMyAdmin/> *Order Deny,Allow* Deny from All Allow from 127.0.0.1 Allow from ::1 *#Allow from All* allowoverride All </Directory> Once httpd is restarted no one can access the phpmyadmin folder if it is not in the html folder. (in centos 6 the program is usually located in /usr/share/phpmyadmin). This prevents the hacking of your phpmyadmin program. If you think about it, outside of a small fix or initial programming you will almost never use the program. So why do you leave it open to everyone 24 hours a day? Quote: *IPMI* IPMI is great but if you are a webmaster you are probably leaving this open to the internet. If you are local to the datacenter, or the datacenter is really cool, you can remove the eth cable from the ipmi port. And ask them to plug it in when there is an issue. This only works if you have a separate ipmi card with its own eth port. (and helps if you tag the cable and port for the center) I think most of us seldom, if ever, use our IPMI during the course of a year once the system is set up. This prevents root access, IPMI card getting hacked, and still allows emergency access with a quick visit or a phone call *IPMI, Virtual Host, Virtual Machines* Quote: *Your Virtual Host server* I seldom ever need to go into my virtual host. It is set up correctly and I get my logwatches every day. I have no ports open up on it. If I never use it, why would I leave a shell port open 24 hours a day? If I have an IPMI card I can log in and open that port. Then I can do what I need to do. Safest, if IPMI is available (with video) is to comment out/disable the ssh port. On a virtual host you most likely use a physical bridge. This means nothing is touching the host. Great Security tip. Quote: *Virtual Machines- DNS* Are your DNS servers virtual machines on a server (or on a dedicated with an IPMI card in it)? I bet you never access shell except to make that very rare dns change. And if you use rndc you never use shell. If you have IPMI with video disable ssh port. Enable it via IPMI on those very rare instances you need to access it. Logwatch can still send out. Only port 53 should be open 24 hours a day (and if rndc that port too...and 5353 if you are doing that.) There is no reason to leave this system open to the net at all. Enable shell when you need it and then disable when done. You do not need to open port 25 (or any port) to send emails out of the system. So why do you leave port 22 (or other shell port) on 24 hours a day if you never ever use it? Quote: *MYSQL servers* Again, if on a virtual host or even its own dedicated disable port 22 (ssh port) and only enable via IPMI on those rare times you need to use it. Quote: *Your website/webserver* The same issue remains. Outside of the times you are using shell OR FTP...these ports should be disabled. Enable using IPMI. This simple act prevents a lot of hack attempts, log filling, and gives massive peace of mind. Yes, you use shell and ftp....but not that much. Think about it. You might use ftp and shell a lot, but you are leaving those ports open 24 hours a day, 7 days a week. I guarantee outside of massive program days you use less than 5% of that time on those ports. So why open your server to being hacked? Close the ports. Quote: *Your open source or commercial web application* .htaccess protect any folder that does not need to be accessed by a user via http. Most files are grabbed by a index file and are still able to be used even with htaccess protection. Try it. Definitely do this with your administrative folders. There is no reason not to do this. But how many times do you really access that admin folder? I would say put a fake htacces protection file in all the folders you can. Fake meaning the user required does not exist and there is no password for it. Then it will not be passed. The admin folder can also be done this way, but add commented out sections with real user/pass info. Then when you need to go to the admin section, you shell/ftp in, change the htaccess file, then do what you need to do. Then comment out the real access info. This prevents any access from an external user to these folders for the 99% of the time you are not using your admin...and 100% of the time for the folders they should never be visiting. Outside of a programming/fix/update you will seldom be doing admin work, program work, and your system/web apps will be running without your input. So why leave all this open to hackers 24 hours a day? These simple things can block 100% of brute force shell attacks across your system...if you can unplug the ipmi card (with an easy way to replug it) then you cannot be accessed via shell across all your systems. Sleep in peace. A majority of hacks on open source revolve getting to that admin folder....or some other folder of a plug in.. The hacker will have a heck of a time brute forcing an htaccess protected folder where no user/pass combo will ever work. *On a final note....* If you are building a web application you should use a mysql user that is only allowed to update and select... With proper programming you can set up items to be deleted via a cron job using a mysql user that has a bit more access. This prevents a hacker from actually deleting or altering any data....and easily rolled back. This is how I program and I think it should be standard. As far as I know not one single program does this...and that is a shame.

1 1

SCO OpenServer under KVM?
by Bill Campbell 07 Jun '12

07 Jun '12

Does anybody here have experience running SCO OpenServer 5.0.6a or earlier under KVM? Bill -- INTERNET: bill(a)celestial.com Bill Campbell; Celestial Software LLC URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way Voice: (206) 236-1676 Mercer Island, WA 98040-0820 Fax: (206) 232-9186 Skype: jwccsllc (206) 855-5792 Under democracy one party always devotes its chief energies to trying to prove that the other party is unfit to rule and both commonly succeed, and are right. -- H.L. Mencken

1 0

CentOS-announce Digest, Vol 88, Issue 4
by centos-announce-request＠centos.org 07 Jun '12

07 Jun '12

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2012:0715 Critical CentOS 5 thunderbird Update (Johnny Hughes) 2. CESA-2012:0715 Critical CentOS 6 thunderbird Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 7 Jun 2012 09:01:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0715 Critical CentOS 5 thunderbird Update To: centos-announce(a)centos.org Message-ID: <20120607090137.GA23215(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0715 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2012-0715.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6bf79e5cac8fc2edf5ddd0ea3eb9b8f59856ccef9d2e3f9532717420a4bea844 thunderbird-10.0.5-2.el5.centos.i386.rpm x86_64: 31f5fbeaba9516065a1e96069b9db0c033c35ffebca84b40e91d5ed14905ea28 thunderbird-10.0.5-2.el5.centos.x86_64.rpm Source: 492c542a791f9c5cae5af3026594e5e6a94d11010d5a34ca8a63867b6185a6d8 thunderbird-10.0.5-2.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 7 Jun 2012 12:44:35 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2012:0715 Critical CentOS 6 thunderbird Update To: centos-announce(a)centos.org Message-ID: <20120607124435.GA1118(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2012:0715 Critical Upstream details at : http://rhn.redhat.com/errata/RHSA-2012-0715.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: a6c2d89df73766c12a2f49fc744382ad6abfd251ad6f9de10b5ec551fe1977ce thunderbird-10.0.5-2.el6.centos.i686.rpm x86_64: 4f3b26e0947e4611551bbb19491f6263b7493a9fbcdd347333a5552514c25fef thunderbird-10.0.5-2.el6.centos.x86_64.rpm Source: 159c10043424925479cc0bc79ec1139f6da9f1270bc86388bdf1cf3ae628c187 thunderbird-10.0.5-2.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 88, Issue 4 **********************************************

1 0

Worrying after IPv6 day...
by John Doe 07 Jun '12

07 Jun '12

Hi, after IPv6 day, I was wondering if our server were really secure... And, I know we should switch on IPv6 everywhere but... it will take some time. Usually, we disable(d) IPv6; so we are not running ip6tables. Can I start ip6tables in all cases (even if only IPv4) just to be on the safe side? On CentOS 6 servers, I use the --noipv6 in the kickstart files and I removed NetworkManager; but ifconfig still shows IPv6 adresses. And I wonder from where it gets them... based on the MAC? I guess they are not routable, so I should not get any traffic... right? Thx, JD

2 1

Re: [CentOS] Installing QEMU without KVM[SOLVED]
by Aft nix 07 Jun '12

07 Jun '12

On Thu, Jun 7, 2012 at 6:43 PM, John Doe <jdmls(a)yahoo.com> wrote: > From: Aft nix <aftnix(a)gmail.com> > >> On Thu, Jun 7, 2012 at 5:53 PM, John Doe <jdmls(a)yahoo.com> wrote: >>> From: Aft nix <aftnix(a)gmail.com> >>> >>>> I'm developing some kernel module, so i need a stand alone qemu to >>>> test my kernel. >>>> Although i've seen a qemu in rpmforge, still yum install qemu does >> not work. >>> >>> What do you mean by does not work? >>> Dependencies problems? >> >> No, package qemu availabe. >> >> yum install qemu >> Loaded plugins: fastestmirror, refresh-packagekit, security >> Loading mirror speeds from cached hostfile >> * base: mirrors.sin3.sg.voxel.net >> * epel: ftp.riken.jp >> * extras: mirrors.sin3.sg.voxel.net >> * rpmforge: mirror.oscc.org.my >> * rpmfusion-free-updates: ftp.upjs.sk >> * rpmfusion-free-updates-testing: ftp.upjs.sk >> * updates: mirrors.sin3.sg.voxel.net >> Setting up Install Process >> No package qemu available. >> Error: Nothing to do >> >> You can see rpmforge is infact enabled. > > But not rpmforge-extras... > Hi JD, Thanks for pointing this. everything seems ok now. I'm marking this thread as SOLVED. Cheers. > JD > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos -- -aft

1 0

Installing QEMU without KVM
by Aft nix 07 Jun '12

07 Jun '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm developing some kernel module, so i need a stand alone qemu to test my kernel. But yum install qemu fails. After yum search qemu , i get this : gpxe-roms-qemu.noarch : Network boot loader roms supported by QEMU, .rom format qemu-img.x86_64 : QEMU command line tool for manipulating disk images libvirt-lock-sanlock.x86_64 : Sanlock lock manager plugin for QEMU driver qemu-kvm.x86_64 : Userspace component of KVM qemu-kvm-tools.x86_64 : KVM debugging and diagnostics tools sheepdog.x86_64 : The Sheepdog Distributed Storage System for KVM/QEMU vios-proxy.x86_64 : Network proxy between a QEMU host and QEMU guests using : virtioserial channels vios-proxy-guest.x86_64 : Network proxy using virtioserial for QEMU guest vios-proxy-host.x86_64 : Network proxy using virtioserial for QEMU host But i do not need KVM or anything. I just need a stand alone qemu. I then enabled optional repos like EPEL, RPMFUSION, RPMFORGE etc. Although i've seen a qemu in rpmforge, still yum install qemu does not work. I can build qemu from source, but i like installing packages from repositories. Thanks in advance. Cheers. - -- - -aft -----BEGIN PGP SIGNATURE----- Version: OpenPGP.js v0.1 Comment: http://openpgpjs.org wsBcBAEBAgAQBQJP0IQrCRCJVJ6A/SK8awAAUN8H/jb2hXDAfMQilyZ5ZP1R d5Cyl0710LHTnGJhZ2+2KZEDrnhx1c07L1atQc663rOILBZge6cpfQJkQkT3 LTKOudzrCA/04FyvBPqApO3p39CLEHjYlJ14TU9sAHODlDvENx1S/kWBBxPk r3mKJ7ODwiXoAE9nu1FvwOtYw5PUoreRaDlfpl8nFD9mEO8hFeoZ3JOw5Wy4 /n3FDc+5lIZfHlQ5hHxOwbr82olMMO7jFwrDP0o7YQFFYWpfH3WdPmd6mNWy MU6YInMSWYZ3FQlCAGcb7XV0EhUrdbns3PsG21pMBXNYjefzAB5zLt3Brm4o OjQj6m0NSTM09T53wcDvAb0= =K27A -----END PGP SIGNATURE-----

2 3

mdadm: failed to write superblock to
by sebastian 07 Jun '12

07 Jun '12

Hello, i have a little problem. Our server has an broken RAID. # cat /proc/mdstat Personalities : [raid1] md0 : active raid1 sda1[2](F) sdb1[1] 2096064 blocks [2/1] [_U] md2 : active raid1 sda3[2](F) sdb3[1] 1462516672 blocks [2/1] [_U] md1 : active raid1 sda2[0] sdb2[1] 524224 blocks [2/2] [UU] unused devices: <none> I have remove the partition: # mdadm --remove /dev/md0 /dev/sda1 mdadm: hot removed /dev/sda1 from /dev/md0 # mdadm --remove /dev/md2 /dev/sda3 mdadm: hot removed /dev/sda3 from /dev/md2 Now i want to add the old partition (to sync the raid), unfortunately, comes an error message: # mdadm --add /dev/md0 /dev/sda1 mdadm: failed to write superblock to /dev/sda1 What is wrong here? Here some more details: # mdadm --detail /dev/md0 /dev/md0: Version : 0.90 Creation Time : Fri Sep 2 12:38:17 2011 Raid Level : raid1 Array Size : 2096064 (2047.28 MiB 2146.37 MB) Used Dev Size : 2096064 (2047.28 MiB 2146.37 MB) Raid Devices : 2 Total Devices : 1 Preferred Minor : 0 Persistence : Superblock is persistent Update Time : Thu Jun 7 08:57:12 2012 State : clean, degraded Active Devices : 1 Working Devices : 1 Failed Devices : 0 Spare Devices : 0 UUID : 9beaf2eb:4b5c7416:776c2c25:004bd7b2 Events : 0.147 Number Major Minor RaidDevice State 0 0 0 0 removed 1 8 17 1 active sync /dev/sdb1 Thanks Sebastian

2 2

noexec tmp directory
by Bob Hoffman 07 Jun '12

07 Jun '12

Hello, I am fixing up a system for someone and they did not make a separate partition for /tmp...but I want to make it noexec, nosuid. I came across a site that said I could skip all the mount/unmount and new partition stuff (which would probably include downsizing a lvm to make room for it)... by adding this in fstab /tmp /tmp bind nosuid,noexec,bind 0 0 and then reboot... There is no /tmp in their fstab at the moment and I am afraid to test this.... Is this a correct workaround to mount that folder as noexec? OR was this site wrong?

2 1

[6.2] Postfix not reading main.cf
by Neil Aggarwal 07 Jun '12

07 Jun '12

Hello: I just did a fresh install of CentOS 6.2 on a virtual server. I am trying to configure Postfix but it does not seem to be reading configuration directives from /etc/postfix/main.cf Here is what I did to test it: vi /etc/postfix/main.cf and set this directive: myorigin = hello.world.com postfix reload postconf -d | grep myorigin I get this output: append_at_myorigin = yes myorigin = $myhostname Any ideas why it is not picking up the configuration? Thanks, Neil -- Neil Aggarwal, (972)834-1565, http://UnmeteredVPS.net/centos Virtual private server with CentOS 6 preinstalled Unmetered bandwidth = no overage charges

1 1

repo dates and times
by Jerry Geis 06 Jun '12

06 Jun '12

I am trying to get my kickstart "repo" line to function correctly. repo --name=Updates --baseurl=http://192.168.1.14/centos/6.2/updates/x86_64/ When I comment the above line my install works, When I uncomment it the install fails with a message about dbus package error. This is my nightly script that runs: =============== PLACE="mirror.team-cymru.org/CentOS" mkdir -p /var/www/html/centos/$VERSION/updates/x86_64 cd /var/www/html/centos/$VERSION/updates/x86_64 mkdir Packages rsync -av rsync://$PLACE/$VERSION/updates/x86_64/Packages/* /var/www/html/centos/$VERSION/updates/x86_64/Packages /usr/bin/createrepo . chown -R silentm:silentm /var/www/html/centos/* =============== Everything seems fine. however the dates and times are wrong on the files. From the real repo: Name Last Modified Size Type Parent Directory <http://mirror.team-cymru.org/CentOS/6.2/updates/x86_64/>/ - Directory 389-ds-base-1.2.8.2-1.el6_1.3.x86_64.rpm <http://mirror.team-cymru.org/CentOS/6.2/updates/x86_64/Packages/389-ds-base…> 2011-Sep-28 00:33:09 1.1M application/octet-stream 389-ds-base-1.2.9.14-1.el6_2.2.x86_64.rpm <http://mirror.team-cymru.org/CentOS/6.2/updates/x86_64/Packages/389-ds-base…> 2012-Jan-24 03:11:51 1.3M application/octet-stream From my repo: ls -l 389* -rw-rw-r-- 1 silentm silentm 1221224 Sep 27 2011 389-ds-base-1.2.8.2-1.el6_1.3.x86_64.rpm -rw-rw-r-- 1 silentm silentm 1438440 Jan 23 22:11 389-ds-base-1.2.9.14-1.el6_2.2.x86_64.rpm Notice the dates/times are not the same. not sure if that matters. Also - I changed my "repo" link to point directly to the repo --name=Updates --baseurl= http://mirror.team-cymru.org/CentOS/6.2/updates/x86_64 <http://mirror.team-cymru.org/CentOS/6.2/updates/x86_64/Packages/> and I got the exact same error about dbus. What might it be that I am not doing correctly? I thought it was my local repo until I pointed to the WEB site directly. Thanks, Jerry

1 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss