Discuss

discuss@lists.centos.org

34758 discussions

NFS Selinux issues
by Bradley Leonard 06 Mar '12

06 Mar '12

I'm having a strange problem with selinux and the mounting of a nfs directory. I'm specifying the security context as part of the mount command, yet the security context still shows nfs. The mount shows what the security context should be: [root@clienthost ~]# mount serverhost:/usr/local on /usr/local type nfs4 (rw,context="system_u:object_r:usr_t:s0",hard,intr,addr=serverhost,clientaddr=clienthost) yet the directory permissions show the security context of nfs: [root@clienthost ~]# ls -dZ /usr/local drwxr-xr-x. root root system_u:object_r:nfs_t:s0 /usr/local My /etc/fstab entry is: serverhost:/usr/local /usr/local nfs context=system_u:object_r:usr_t:s0,rw,hard,intr 0 0 This is causing some issues with some of my scripts. Both the client and server are 6.2 servers. The client is a virtual image running on the server. The only clue that i have is system logger shows: Mar 6 13:44:39 clienthost kernel: SELinux: initialized (dev 0:14, type nfs4), uses genfs_contexts Mar 6 13:44:39 clienthost kernel: SELinux: initialized (dev 0:15, type nfs4), uses genfs_contexts I can't find any errors anywhere else on either my client or server. There is nothing in the audit logs on either host. Does anybody have any ideas? Brad -- Bradley Leonard EMail: bradley at stygianresearch.com Rob - "The hills are alive with the..the..sound of monkeys?" Bucky - "It's in the key of delicious." Life is simple. Humans make it complicated. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

CentOS 6 connection with sieveshell failed
by Michael Nausch 06 Mar '12

06 Mar '12

Hello, I've some difficulties with my installation, specially with sieveshell. O.K., just have a look on my site: intranet : 10.0.10.0/24 DMZ : 10.0.0.0/24 My IMAP-server is based on DMZ-site on my host vml000070 (10.0.0.70): # netstat -penlut Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 0 137240 25617/cyrus-master tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN 0 137252 25617/cyrus-master tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 8777 1314/sshd tcp 0 0 0.0.0.0:24 0.0.0.0:* LISTEN 0 137258 25617/cyrus-master tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 0 8977 1392/master tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 0 137246 25617/cyrus-master I've no problem to connect with sieveshell on my IMAP-host: [django@vml000070 ~]$ sieveshell --user=django --authname=django 127.0.0.1:2000 connecting to 127.0.0.1:2000 Please enter your password: BUT, if I try to connect from an other host inside my DMZ a see this error: [django@vml000090 ~]$ sieveshell --user=django --authname=django 10.0.0.70:2000 connecting to 10.0.0.70:2000 unable to connect to server at /usr/bin/sieveshell line 170. O.K., so far so "good" :( Just look, I can connect with telnet to port 2000 on my IMAP-host: [django@vml000090 ~]$ telnet 10.0.0.70 2000 Trying 10.0.0.70... Connected to 10.0.0.70. Escape character is '^]'. "IMPLEMENTATION" "Cyrus timsieved v2.3.16-Fedora-RPM-2.3.16-6.el6_1.4" "SASL" "CRAM-MD5 DIGEST-MD5" "SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify envelope relational regex subaddress copy" "STARTTLS" OK SELinux is deactivated and the personal firewall on my IMAP-Host accepts connections to Port: 143, 993 and 2000: [root@vml000070 ~]# iptables -nL Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:143 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:993 ACCEPT tcp -- 10.0.0.80 0.0.0.0/0 state NEW tcp dpt:24 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2000 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination And here comes the strangest thing I can report: If I try to connect from my intranet to my IMAP-Server on port 2000: [django@pml010002 ~]$ sieveshell --user=django --authname=django 10.0.0.70:2000 connecting to 10.0.0.70:2000 Please enter your password: IT WORKS! Im very very confused! :( O.K. all hosts are based on CentOS: DMZ-host: [django@vml000090 ~]$ cat /etc/redhat-release CentOS release 6.2 (Final) [root@vml000090 ~]# yum list cyrus-imapd-utils Installed Packages cyrus-imapd-utils.x86_64 2.3.16-6.el6_1.4 IMAP-host [django@vml000070 ~]$ cat /etc/redhat-release CentOS release 6.2 (Final) [root@vml000070 ~]# yum list cyrus-imapd-utils Installed Packages cyrus-imapd-utils.x86_64 2.3.16-6.el6_1.4 [root@vml000070 ~]# yum list cyrus-imapd Installed Packages cyrus-imapd.x86_64 2.3.16-6.el6_1.4 Intranet-host [django@pml010002 ~]$ cat /etc/redhat-release CentOS release 6.2 (Final) [root@pml010002 ~]# yum list cyrus-imapd-utils Installed Packages cyrus-imapd-utils.x86_64 2.3.16-6.el6_1.4 I'm very confused about that behavior. Why it is possible to connet to Port 2000 from an intranet-host and why it fails inside my DMZ? Any ideas ond/or hints? ttyl Django -- "Bonnie & Clyde der Postmaster-Szene!" approved by Postfix-God http://wetterstation-pliening.info http://dokuwiki.nausch.org http://wiki.piratenpartei.de/Benutzer:Django

1 0

CentOS5 lxc guest under CentOS6 host
by C. L. Martinez 06 Mar '12

06 Mar '12

Hi all, Somebody have tried to run a centos5 lxc guest under centos6 host?? Is it possible?? Thanks.

2 2

restrict postfix to only certain users getting incoming mail
by Bob Hoffman 06 Mar '12

06 Mar '12

Perhaps I am trying to do the impossible. centos6, spamassassin, procmail, dovecot, postfix. Postfix, by default, accepts all incoming mail to any user listed in the shadow/passwd and alias files. I cannot find a way to stop that without manually blocking each non wanted user (like nobody, apache) without killing local delivery. For most of the users listed in those files, who cares. However for one, root, this is a massive issue. Root gets a lot of mail from errors on the system. Preventing local delivery (or through the alias file, delivery through root to another user) makes root never receive those important mails. Not preventing root from incoming mails means root(a)example.com can be slammed with spam. Local and external mail all seem to go through all of the programs (postfix, procmail, spamassassin, dovecot). Local delivery of mails is needed for root. What I would like is to just tell postfix to only allow incoming mail for user1 and user2 and reject all...but only from external sources, not locally sent mail. Postfix does seem to allow you to limit who can send mail out of the server though... I have 2 books on postfix here and spent many days online but I do not see the solution short of /dev/null or reject of all mail, local or external, of root. perplexed.

6 7

Baffled by selinux
by Lars Hecking 06 Mar '12

06 Mar '12

Apache DocumentRoot on an NFS directory: [root@localhost ~]# service httpd start Starting httpd: Warning: DocumentRoot [/home/www/html] does not exist Syntax error on line 292 of /etc/httpd/conf/httpd.conf: DocumentRoot must be a directory [FAILED] [root@localhost ~]# After some research, I found this (dated) link http://www.redhat.com/archives/rhl-list/2005-July/msg02443.html and followed the suggestion, setsebool -P use_nfs_home_dirs=1. But I still can't start httpd. Not sure what to make of the audit log: type=AVC msg=audit(1329395502.678:61926): avc: denied { search } for pid=25674 comm="httpd" name="" dev=0:23 ino=3471615 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=SYSCALL msg=audit(1329395502.678:61926): arch=c000003e syscall=4 success=no exit=-13 a0=7fef342bc080 a1=7fffaf747370 a2=7fffaf747370 a3=7fef30c65c30 items=0 ppid=25673 pid=25674 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1329395502.681:61927): avc: denied { search } for pid=25674 comm="httpd" name="" dev=0:23 ino=3471615 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=SYSCALL msg=audit(1329395502.681:61927): arch=c000003e syscall=4 success=no exit=-13 a0=7fef342eae68 a1=7fffaf747630 a2=7fffaf747630 a3=50 items=0 ppid=25673 pid=25674 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

6 9

routing and virtual machines: how to access dmz if bridged to two networks
by Peter Peltonen 05 Mar '12

05 Mar '12

I am not quite sure if this issue relates to iptables, routing or Xen virtual machines. Too many variables for my simple mind, so I'm asking some advice :) This is my network setup: Internet --- eth2 + CentOS dom0 / firewall / router + eth1 (xenbr1) --- LAN with private IPs --- separate file server and workstations + eth0 (xenbr0) | DMZ network with public IPs --- CentOS6 domU web server Lets assume my dom0's eth2 public ip is 1.2.3.33 and my dmz network 11.22.33.96/255.255.255.224 . I have created NAT from my LAN with iptables. You can see my /etc/sysconfig/iptables here: http://pastebin.com/1FqSTvPH And this is my routing table: # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 1.2.3.32 0.0.0.0 255.255.255.252 U 0 0 0 eth2 11.22.33.96 0.0.0.0 255.255.255.224 U 0 0 0 xenbr0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 xenbr1 169.254.0.0 0.0.0.0 255.255.0.0 U 1004 0 0 eth2 169.254.0.0 0.0.0.0 255.255.0.0 U 1005 0 0 xenbr0 169.254.0.0 0.0.0.0 255.255.0.0 U 1006 0 0 xenbr1 0.0.0.0 1.2.3.34 0.0.0.0 UG 0 0 0 eth2 My goal: To access NFS shares on a (non-virtualized) file server in the LAN network from the domU web server in the DMZ network. What I tried: I attached the domU to both bridges using this Xen config: vif = [ "mac=00:0c:29:de:3a:fe,bridge=xenbr0","mac=00:0C:29:76:19:85,bridge=xenbr1" ] and then created two eth interfaces inside the domU mapping to the MAC addresses above, giving eth1 an IP from the DMZ (11.22.33.111) and giving eth2 an IP from the LAN (192.168.0.12). After this I mounted the NFS share from the file server (192.168.0.2). My problem: If my domU web server is connected to both LAN and DMZ using the two bridges xenbr0 and xenbr1, I can access the NFS share from the domU web server and everything else works as expected, except for one thing -- my workstations in the LAN cannot anymore access the web server: web pages do not open anymore and from the workstations I cannot ping the domU. If the web server domU is only connected to DMZ via xenbr0, the workstations can access it ok. Any advice what I am doing wrong and I could fix my setup? Regards, Peter

1 0

how to find...
by fred smith 05 Mar '12

05 Mar '12

I'm trying to find out from which repo I got xiphos and its matching sword libraries from, and somehow am not finding it. hints, anyone? thanks! -- ------------------------------------------------------------------------------- Under no circumstances will I ever purchase anything offered to me as the result of an unsolicited e-mail message. Nor will I forward chain letters, petitions, mass mailings, or virus warnings to large numbers of others. This is my contribution to the survival of the online community. --Roger Ebert, December, 1996 ----------------------------- The Boulder Pledge -----------------------------

5 7

whcih mailing list for mail server issue?
by Bob Hoffman 05 Mar '12

05 Mar '12

Hello, First of all, thanks for the yum-cron config location, did not see that there. That helped get my yum updates to my root user folder. Second, I am not sure where to go with this one. I want to block emails coming in to the server to root@, etc. But not block the cron jobs (and other internal server setups) that send mail to root to be blocked. I am using postfix/dovecot,spamassassin, and procmail. The file from the logwatch is going through the spamassassin so I figure all 4 are going to deal with any internal and external mail sent to root. I can't see a way to say 'stop incoming mails to root' without killing the internal mail delivery use. In fact, I would really like only a few specified users to get incoming mail period, but allow all internal mail to do as it should. Which mailing list should I hit up. Dovecot does the delivery but is totally hooked up with postfix and the rest using maildir/. not sure where to go with this one.

1 0

CentOS 5.8 Critical Samba Update
by Johnny Hughes 05 Mar '12

05 Mar '12

There is a critical update for samba for centos-5.8 ... we are working on CentOS-5.8 right now and I fully expect it to be released in a week or less. For those of you who can not wait for a week, here is the samba critical update: http://people.centos.org/hughesjr/c58-samba/x8664/critical/ http://people.centos.org/hughesjr/c58-samba/i386/critical/ These may or may not work without the rest of 5.8 ... for those who do try them, please provide feedback here in this thread. Thanks, Johnny Hughes

4 6

getting yum-cron to send a mail
by Bob Hoffman 04 Mar '12

04 Mar '12

Hello, On my old centos 5 system I get updates from yum automatically, it sends a mail to root. on my new centos 6 things have changed and it has a thing called 'yum-cron' I have it on and it is working....except I can find no particular file where mailto might be added. The crontab is going to root, but yum-cron has nothing as far as a variable for this. yum-cron has no man page, no documents...not sure what to do on this one. Thinking about just adding 'mailto=root' in the daily and weekly cron job yum-cron has set. Again, it is definitely updating the server (did so this morning, added stuff to the yum log) but no mails. thanks bob

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss