Discuss

discuss@lists.centos.org

34753 discussions

sendmail - smtp security/authentication & port 587 issues
by Max Pyziur 26 Jun '11

26 Jun '11

Greetings, I'm refining a CentOs configuration installation, now just over one month old running on a colocated production server. Previously, we ran a version of Fedora for over seven years. Specifically, I'm reviewing our sendmail configuration, both with respect to authentication and port usage. Previously, we had the following line in the sendmail.mc line: define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl To authenticate, users would first have to POP their mail. A klunky script would scan appropriate log files and copy relevant IP addresses to the /etc/mail/access file that would be regenerated every 5 minutes via cron. Once the IP address was in the /etc/mail/access.db a user could be authenticated and be allowed to send email using the machine as smtp. Is there a better way of doing this? Port 587 issues: Verizon DSL filters out requests on port 25 to smtp servers not belonging to verizon.net. An alternative is to use port 587 for smtp purposes. Are there any views in this CentOs user community on this? Much thanks. Max Pyziur pyz(a)brama.com

3 4

Jumbo frames problem with Realtek NICs?
by Emmanuel Noobadmin 26 Jun '11

26 Jun '11

I was trying to do some performance testing between using iSCSI on the host as a diskfile to a guest vs the VM guest using the iSCSI device directly. However, in the process of trying to establish a baseline performance figure, I started increasing the MTU settings on the PCI-express NICs with RTL8168B chips. First bottleneck was discovering the max MTU allowed on these is 7K instead of 9K but googling seems to indicate that the RTL8168B is only capable of 4K frames. I assumed 4K would still be better than nothing but unfortunately bumping up the MTU to anything else but 1.5K caused the file transfers (using NFS for easy testing), to hang at random points or more accurate slow to a crawl. Checking the syslog, I discovered warnings that increasing MTU with this adapter may cause problems. Searching around, it seems to be a common problem but there doesn't appear to be any clear cut fix, including some suggestions to use a third party driver. Does anybody know of a proven solution or is the Realtek chip itself irrevocably broken/bugged that anything above the default 1500 will simply not work?

7 20

Strange issue's with LDAP and too many open files
by Sebastiaan Koetsier | proserve 26 Jun '11

26 Jun '11

Hi All, I've been growing a large headache on this one, i have a number of LDAP servers behind loadbalancing, since 2 days i constantly get the error: Too many open files. Although I'm not a newbie with linux I'm unable to resolve this, I have took the following stept: Changed the /proc/sys/fs/file-max to 65535 Added the following configuration to /etc/security/limits.conf: ldap soft nofile 65535 ldap hard nofile 65535 ldap - nofile 65535 # End of file If I su to the ldap user where the process is running under: [root@ldap5 ~]# su -m ldap bash: /root/.bashrc: Permission denied bash-3.2$ ulimit -H -n 65535 bash-3.2$ ulimit -S -n 65535 And still I get the error: Too many open files when open files are >1024. I'm bazzled. If anyone can provide me with some tips, please. Cheers, Sebastiaan.

3 5

Shared object packaging in rpm
by Joseph L. Casale 25 Jun '11

25 Jun '11

I whipped up a quick spec to package Zenoss' wmi client and noticed it creates a libasync_wmi_lib.so.0 and libasync_wmi_lib.so.0.0.1 that their python script would otherwise copy during its install routine (obviously I wrote a native rpm section for installation). Anyone know the naming convention associated with so's when they get compiled, what is the .0.1 extra file used for, they are slightly different. Thanks, jlc

3 4

Good Centos Security Advice & Gnome Thumbnails
by Always Learning 25 Jun '11

25 Jun '11

Browsing the net for one thing unexpectedly brought me to two good and useful documents: (1) Guide to the Secure Configuration of Red Hat Enterprise Linux 5 http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf Revision 4.1 February 28, 2011 (2) Hardening Red Hat Enterprise Linux 5 http://people.redhat.com/sgrubb/files/hardening-rhel5.pdf Updated 12 August 2010 Gnome Thumbnail system is mentioned in (1) as dangerous. As many Centos/Red Hat installations use it, here is a brief extract from page 30. 2.2.2.6 Disable All GNOME Thumbnailers if Possible The system’s default desktop environment, GNOME, uses a number of diﬀerent thumbnailer programs to generate thumbnails for any new or modiﬁed content in an opened folder. Execute the following command to prevent the thumbnailers from automatically creating thumbnails for new or modiﬁed folder contents: gconftool-2 --direct \ --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \ --type bool \ --set /desktop/gnome/thumbnailers/disable_all true This eﬀectively prevents an attacker from gaining access to a system through a ﬂaw in GNOME’s Nautilus thumbnail creators. ------ I hate the thumbnailers, particularly as I have over 12,000 photographs on one machine and thousands more to be added. Eye of Gnome just ignores the 'thumbnail' off setting in Gnome. -- With best regards, Paul. England, EU.

1 0

Using umask
by Todd Cary 24 Jun '11

24 Jun '11

Grasping a full understanding of setting default Users, Groups and Masks has alluded me over the years, but now I find myself in a situation where manually "setting" the file/directory attributes is becoming a pain. I understand the fundamentals of the file attributes, though from time to time I have to review the "sticky bit"; what I do not understand is where/how the attributes are set when a user creates or modifies a file/directory. Here is my situation: My /var/www/html files have been manually set by me to apache/apache 774. This allows my PHP applications to access the files, and I assume this is a "good" setting. Now, my server is connected via Samba to my desktop. If I create a file, it is todd/todd 744, so Apache cannot access them. If PHP (Apache) creates or modifies a file, it is apache/apache 755, so I cannot access them (Write/Delete). Is there a way to resolve this? When I FTP to a friend's rent-a-server, I can read/write/delete all of the files I have placed there *and* the same for files touched by PHP (Apache). My Linux Admin books as well as my Linux books do not appear to cover this and/or my experience is lacking. Todd -- Ariste Software Petaluma, CA 94952 http://www.aristesoftware.com

8 11

Firefox 5 on Centos 5.6
by Keith Roberts 24 Jun '11

24 Jun '11

So has anyone actually got FF 5 working OK on CentOS 5.6 i686 32 bit yet? If so, is it actually worth taking the trouble to upgrade to FF 5, and what is the recommended way to do this upgrade please? Kind Regards, Keith Roberts ----------------------------------------------------------------- Websites: http://www.karsites.net http://www.php-debuggers.net http://www.raised-from-the-dead.org.uk All email addresses are challenge-response protected with TMDA [http://tmda.net] -----------------------------------------------------------------

3 2

Exporting /dev/shm as NFS share?
by Emmanuel Noobadmin 24 Jun '11

24 Jun '11

I'm trying to do some network transfer test using NFS. The problem is when I try to eliminate the possibility of the hard disks being the bottleneck. I am unable to export /dev/shm as a NFS share. Initially there was an error about fsid or wrong filesystem. If I use a symbolic such as /home/test -> /dev/shm, on the remote system, this causes the NFS client to see its own /dev/shm If I mount /home/test as a tmpfs on the host and export it, the client also appear to use its own tmpfs rather than the host. Is there anyway to work around this or some other way to test the network speed without being bottlenecked by the sending side?

3 3

/dev/sd and /dev/mapper
by Steve Campbell 24 Jun '11

24 Jun '11

I've done a little research, and can't really find out why it happens, but on one server I have built, I get the old fashion /dev/sda1, /dev/sda2 type partitions and on another server I get the /dev/mapper style partitions. Both machines are hardware raided (before the install) and both machines are Centos 5.5 64 bit, using the same set of CDs to install from. Can someone please explain why this happens? I'm not sure it matters, so this is just a curious bother. The machines are different brands with different raid controllers. Both were partitoned using the "custom layout" when installed. I'm thinking I must have overlooked a checkbox or something during the install. This is not a big deal, not a problem, it's just an itch in my brain. Thanks for any explanation. steve campbell

4 3

No DVD Mirrors - Only Torrent
by Always Learning 24 Jun '11

24 Jun '11

I love Centos. Have in on my data centre servers, my home servers, my laptop and my netbook. Yes there are serious and continuing security concerns relating to Gnome and KDE but they are not Centos. Currently running 5.6 and would like a two set DVD of that version. However none of the mirrors offer pure DVDs only Torrent versions which involve the possibility of bits being tampered with and things leaving my servers without explicit knowledge and authority. None of the CD / DVD sellers I have contacted can offer Centos 5.6 DVDs because, they say, they can't get a virgin 5.6 DVD only Torrent. FreeBSD 8.2 (the latest) offers a virgin 1 DVD download. The whole distribution is about 4 DVDs. Can Centos offer a virgin 1 DVD download of 5.6 for those of us who are unhappy about slow Torrent, the possibility of tampering and the traffic out of our machines ? BY THE WAY, a very BIG and GRATEFUL THANK YOU to the EXCELLENT TEAM that gave us the wonderful Centos 5.6. Very much appreciated and if KBS and the others ever venture out of Kent and London a bit northwards but south of Watford I would be delighted to buy him and the others several rounds of drinks. It makes me want to write an application for Linux. -- With best regards, Paul. England, EU.

5 9

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss