Discuss

discuss@lists.centos.org

34758 discussions

securing sshd with selinux
by Hajo Locke 17 May '11

17 May '11

Hello List, dont have experience with selinux, but i want to know if it would be a practicable way to secure sshd with selinux. i have some webservers and want to grant ssh-access to some users. my plan ist to make new server where users are able to log in. the homes from webserver are mounted in by nfs etc. i dont like chroot-env for ssh, a lot of disadvantages... also i dont like if users would scrabble folders that doesn't concern them. so i thought it would be possible to restrict users by selinux so they dont are able to see too much... objective is to restrict users to there home (as far as possible) and run some typical programms like perl, php, some binaries and hide all other... is this a useful scenario for selinux? If not, are there alternatives? Thanks, Hajo

3 2

yum in test mode and downgrade of a package
by Bernard Fay 17 May '11

17 May '11

Is it possible to run yum in test mode? Something similar to rpm --test ... Also, is it possible to downgrade a package? Say we install a package and we find this new version creates problem for an application running on the server and we need to go back to a previous version. Thanks, -- Bernard

2 1

xargs with max each line / argument
by neubyr 17 May '11

17 May '11

How do I pass xargs input one line at a time to subsequent command? For example I want to install rubygems by reading a text file as shown below, however the arguments are getting passed all at once to the 'gem install' command. I hace tried -L (max-lines) and -n (max args) options, but it didn't work. What's missing here?? Any help? $ cat gem.list.1 mkrf rake xmlparser $ awk '{ print $0 }' gem.list.1 | xargs -L 1 -0 -I name sudo gem install name ERROR: could not find gem mkrf rake xmlparser locally or in a repository thanks, neuby.r

6 6

allowing users to write to a web content area
by David Mehler 17 May '11

17 May '11

Hello, I've got apache running on a centos 5.6 machine. All of my users have a umask of 077 set in /etc/bashrc. I'm now wanting to give several of them permission to write to a web area so they can place content visible to the web server. I've got two groups webdev1 and webdev2 which I want one to be able to write to site1 and the other to site2. I've got between 3 and 5 users in each group. I'd prefer not to mess with these users umask settings, but want the correct permissions and ownerships user:webdev1 or user:webdev2 where user is the username of the person who placed the file. Permissions I believe should be 664 so apache can read the files. I'm wondering if I need to look in to ACLS which I've not used or if there's another solution? Thanks. Dave.

6 6

Perhaps an interesting development....
by Lamar Owen 17 May '11

17 May '11

Well, not to take away too much from the tinderbox, but I'd like to point everyone's attention to: http://www.networkworld.com/community/blog/microsofts-open-source-love-expa… Headline: "Microsoft's open source love-in expands with CentOS Linux support" Short version: Microsoft now supports CentOS officially in Hyper-V.

2 1

bond empty after reboot
by wessel van der aart 16 May '11

16 May '11

Hi all, I've setup a ethernet bond on my centos 5.6 server , when i do a reboot the bond does come up but cleared all the slaves and i've to manually re-add them with ifenslave. does anyone know a solution to this? am i missing something? offcourse i can add it to my rc.local but there must be a more elegant way. please see my configs below Thanks, Wessel ifcfg-bond0: DEVICE=bond0 IPADDR=xxx.xx.x.xx NETMASK=255.255.255.0 NETWORK=xxx.xx.x.xx BROADCAST=xxx.xx.x.xx GATEWAY= ONBOOT=yes BOOTPROTO=none USERCTL=no BONDING_MODULE_OPTS='mode=802.3ad miimon=80' TYPE=BOND ifcfg-eth0 (same for eth1,eth2 & eth3): # Intel Corporation 82576 Gigabit Network Connection DEVICE=eth0 ONBOOT=yes BOOTPROTO=none USERCTL=no MASTER=bond0 SLAVE=YES TYPE=ethernet HWADDR=xx:xx:xx:xx:xx:xx /etc/modprobe.conf: alias eth0 igb alias eth1 igb alias eth2 igb alias eth3 igb alias eth4 bnx2 alias eth5 bnx2 alias scsi_hostadapter mptbase alias scsi_hostadapter1 mptsas alias scsi_hostadapter2 ata_piix alias scsi_hostadapter3 usb-storage alias net-pf-10 off alias ipv6 off options ipv6 disable=1 alias bond0 bonding options bond0 miimon=80 mode=4

2 1

Netfilter connmark module libxt_statistic.so
by Usuário do Sistema 16 May '11

16 May '11

Hello Everyone, I'm making an load balance ,on output packages IP from my firewall to Internet, with netfilter connmark and statistic match modules. it's necessary those two modules togethers to do the load balance on connection state. well I'm using CentOS 5.6 and I've searching on Internet but haven't found any package RPM that.this package come with iptables 1.4.x version and CentOS 5.6 still installs , for default, 1.3 iptables version. the package connmark it's ready for default on CetOS 5.6. but the statistic mach module doesn't. the module name is libxt_statistic.so and I've found it only available in build compile. anybody know if there is how update the iptables to 1.4 version in CentOS 5.6 by rpm packages? this way seem that is installed libxt_statistic.so module too. thank.

1 0

issue with fail2ban letting IP's through
by David Mehler 16 May '11

16 May '11

Hello, I'm using fail2ban to block bots in conjunction with existing iptables rules. Here's a few rules from my iptables configuration: # # Set up a temporary pass rule so we don't lock ourselves out when #doing remote ssh iptables -P INPUT ACCEPT # # flush the current rules iptables -F # # Allow SSH connections on tcp port 22 iptables -A INPUT -p tcp --dport 22 -j ACCEPT # # Set default policies for INPUT, FORWARD and OUTPUT chains iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -s 202.0.0.0/8 -j DROP This morning the ssh fail2ban jail blocked this: 202.205.176.125 and the email sent gave me this ip range: inetnum: 202.205.176.0 - 202.205.191.255 That shouldn't have even been seen it should have been blocked by the 202/8 drop rule before fail2ban even saw it. Is that not so? Suggestions welcome. Thanks. Dave.

2 1

1U firewall hardware
by Eero Volotinen 16 May '11

16 May '11

Hi List, I am looking for 1U firewall hardware, any ideas? Something like that (http://www.applianceshop.eu/index.php/firewalls/opnsense/opnsense-pfsense-g…) but at least with 5GBit nics and more memory. -- Eero

10 21

Nokia Cellphone and VMWare
by RoMueller＠atronic.com 16 May '11

16 May '11

Hi, I've connected a Nokia 6310i Cellphone via the USB Port to an ESXi 4.1 Host and added it to a CentOS 5.6 64Bit server. The problem is, that I wont get an suitable tty device (/dev/ttyACM0) like I get when I use Debian.. here is the output of the log files: dmesg: usbcore: registered new driver rndis_host usbcore: registered new driver cdc_acm drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters lsusb: Bus 002 Device 002: ID 0421:0359 Nokia Mobile Phones Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub Bus 002 Device 001: ID 0000:0000 Bus 001 Device 001: ID 0000:0000 I will need the phone to send SMS (Nagios). Can someone help me to get this thing running? Thx Robert

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss