Discuss

discuss@lists.centos.org

8 participants
34745 discussions

Squid + SquidGuard : static block page not working
by Nicolas Kovacs 15 Mar '18

15 Mar '18

Hi, I've been working with Squid + SquidGuard for a few years, though only on Slackware. I'm currently transferring my proxy expertise to CentOS 7, and right now I'm having a little problem with that. Squid works perfectly so far as a transparent HTTP + HTTPS cache proxy. The next step is to add SquidGuard, so I installed it and edited the most basic /etc/squid/squidGuard.conf file possible. In this setup, my workstation (192.168.2.2) is allowed to access anything on the Web, and all other client machines on the networks are blocked and should be redirected to the avertissement.html block page for every request. --8<------------------------------------------------------------------ # /etc/squid/squidGuard.conf dbhome /var/squidGuard logdir /var/log/squidGuard src admin { ip 192.168.2.2 } acl { admin { pass any } default { pass none redirect http://nestor.microlinux.lan/avertissement.html } } --8<------------------------------------------------------------------ I appended the following lines to /etc/squid/squid.conf: --8<------------------------------------------------------------------ # SquidGuard url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf url_rewrite_children 5 --8<------------------------------------------------------------------ Now this setup sort of works. My workstation can access anything, other clients are blocked. Unfortunately, the block page avertissement.html is not displayed. Instead, I get a Squid error page: The following error was encountered while trying to retrieve the URL: https://http/* Unable to determine IP address from host name "http". Any idea why my static block page avertissement.html is not displayed? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Good work, Red Hat!
by isdtor 15 Mar '18

15 Mar '18

Delivered as per https://access.redhat.com/articles/3311301. This is good news. Backporting those updates across three gcc versions does not look like the easiest exercise to me. $ rpm -qp --changelog gcc-4.4.7-18.el6_9.2.x86_64.rpm |head -n 6 * Wed Jan 31 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.2 - Fix indirect_jump/tablejump patters for retpolines (#1535656) * Tue Jan 23 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.1 - Retpoline support (#1535656) $ rpm -qp --changelog kernel-2.6.32-696.23.1.el6.x86_64.rpm ... * Sat Feb 10 2018 Jan Stancek <jstancek(a)redhat.com> [2.6.32-696.23.1.el6] - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455] - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645] - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645] ...

1 0

CentOS 6 i386 - meltdown and spectre
by Peter Wood 13 Mar '18

13 Mar '18

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

4 7

Squid vs. iptables redirection: exception for certain domains ?
by Nicolas Kovacs 12 Mar '18

12 Mar '18

Hi, I'm currently facing a quite tricky problem. Here goes. I have setup Squid as a transparent HTTP+HTTPS proxy in my local network. All web traffic gets handed over to Squid by an iptables script on the server. Here's the relevant section in /etc/squid/squid.conf: --8<------------------------------------------------------------- # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/amandine.sandbox.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB --8<------------------------------------------------------------- And here's the corresponding section of my firewall script: --8<------------------------------------------------------------- # Commandes IPT=/usr/sbin/iptables SYS=/usr/sbin/sysctl SERVICE=/usr/sbin/service # Internet IFACE_INET=enp2s0 # Réseau local IFACE_LAN=virbr0 IFACE_LAN_IP=192.168.2.0/24 # Serveur SERVER_IP=192.168.2.1 ... # Squid $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 80 -j REDIRECT --to-port 3128 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 443 -j REDIRECT --to-port 3129 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3130 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3130 -j ACCEPT --8<------------------------------------------------------------- This setup works nicely for the vast majority of web sites. BUT: a handful of sites has some trouble with my local certificate. For example, I can't sync my local Github repo anymore. Or my local OwnCloud client spews back a warning message on every startup. I asked on the Squid mailing list if there was a possibility to create an exception for a list of domains, so that these can simply bypass the proxy. The problem is, according to one of the developers, I have to tackle that problem earlier in the process, e. g. in the firewall setup. So here's what I want to do, in plain words: 1. Redirect all HTTP traffic (port 80) to port 3128. So far so good. 2. Redirect all HTTPS traffic (port 443) to port 3129. Equally OK. AND... 3. DO NOT REDIRECT traffic that goes to certain domains, like: github.com credit-cooperatif.coop cloud.microlinux.fr squid-cache.org etc. Ideally, these domains should be read from a simple text file. Any idea how I could do that? I don't even know if this is theoretically possible. Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 6

SELinux breaks Squid's ssl_crtd helper
by Nicolas Kovacs 10 Mar '18

10 Mar '18

Hi, I've setup a transparent HTTP+HTTPS proxy on my server running CentOS 7, using Squid. Here's my configuration file. --8<---------------------------------------------------------------- # /etc/squid/squid.conf # Définitions acl localnet src 192.168.2.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Règles d'accès http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/nestor.microlinux.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # Emplacement de ssl_crtd et du cache des certificats TLS sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 # SSL-Bump acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # Taille du cache dans la RAM cache_mem 2048 MB # Emplacement et taille du cache sur le disque # cache_dir ufs /var/spool/squid 100 16 256 # Vidage système coredump_dir /var/spool/squid # Durée de vie des fichiers sans date d'expiration refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 --8<---------------------------------------------------------------- First, I tested the configuration in permissive mode, where it works perfectly. After running it a while, I get the following SELinux alert. # sealert -a /var/log/audit/audit.log ***** Plugin catchall (17.1 confidence) suggests ***** If you believe that ssl_crtd should be allowed read access on the index.txt file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ssl_crtd' --raw | audit2allow -M my-sslcrtd # semodule -i my-sslcrtd.pp Unfortunately the suggested solution doesn't work, because the problem reappears, and I get all sorts of errors in /var/log/squid/cache.log, all due to ssl_crtd not being able to access stuff under /var/lib/ssl_db. Any idea how I can solve this problem permanently ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 3

kpartx can not detach
by Leon Fauster 10 Mar '18

10 Mar '18

OS: EL6 - sometimes I use kpartx -a /mnt/.../lvdisk.img to map the partitions and mount them via /dev/mapper/loop0pX After using the disk (unmounting it) I noticed that detaching such mapping via kpartx -d does not result in freeing up the loop devices. Results: System reboots shows that the filesystem where lvdisk.img is located can't be unmounted. lsof, fuser, ps does not show any usage. Even removing the device node via dmsetup remove /dev/mapper/loop0pX does not help. Trying to unmount the underlying filesystem still shows /mnt: device is busy. Any other suggestions would be greatly appreciated! -- Thanks LF

2 2

yum list "available" versus "updates", and centosplus versioning
by Robert P. J. Day 10 Mar '18

10 Mar '18

quite possibly more a yum question than a centos question, but i'm a bit confused about the difference between listing "available" packages versus "updates" packages. short example -- listing what the yum man page suggests should be "available" for installation, restricting myself to centosplus: $ yum list available --disablerepo=\* --enablerepo=centosplus ... snip ... Available Packages kernel-plus.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-abi-whitelists.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-doc.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-headers.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ first, i always thought "yum list available" would list only packages that i did not *already* have installed, and if i wanted to list installed packages eligible for update, i would run: $ yum list updates --disablerepo=\* --enablerepo=centosplus Updated Packages postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ as you can see, the alleged updates are also listed as "available" from the first command -- has it always been this way? if so, i guess i just never noticed. (is there a way to list *only* available, uninstalled packages with some sort of filter?) more curiously, some of the available packages from the centosplus repo have a package version that says merely "centos", not "centos.plus": postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus ^^^^^^ is that deliberate? it would seem to have the potential for confusion if one searches later for packages based on that string. finally, the alleged update for python-perf: python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus would seem to match *exactly* the currently installed numeric version on my system: $ rpm -q python-perf python-perf-3.10.0-693.17.1.el7.x86_64 $ that is, both seem to be "3.10.0-693.17.1.el7", so how would this constitute an available "update"? perhaps there's something fundamental about version numbering and the centosplus repo i'm missing here. rday

1 0

Upcoming Dojos: Bangalore, Singapore
by Rich Bowen 09 Mar '18

09 Mar '18

I want to draw attention to two upcoming events. First, we have the CentOS Bangalore Dojo. Details are still emerging, but it will be held on March 21 at the Red Hat India office. Details are https://www.meetup.com/CentOS-India/events/248566854/ and more details will be coming very soon. Then, on the following Sunday, March 25th, we'll be holding another Dojo as part of the FOSSAsia event in Singapore, at the Lifelong Learning Institute. The schedule for that event is almost complete, and further details are available here: https://wiki.centos.org/Events/Dojo/Singapore2018 Other tentative upcoming events are listed at https://wiki.centos.org/Events If you are holding any CentOS events - or if you would like to - please get in touch with the centos-promo mailing list (or me directly, if you prefer) for assistance in producing and/or promoting those events. -- Rich Bowen - rbowen(a)redhat.com @RDOcommunity // @CentOSProject // @rbowen

1 0

Re: [CentOS] FW: Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 09 Mar '18

09 Mar '18

Le 09/03/2018 à 12:01, Patton, Eamonn J a écrit : > Just to let you know that our Office365 safelinks analyser is > categorising the link given below (regarding Squid with SquidAnalyzer > "blog.microlinux.fr") as "malicious". That usually means they have > detected (or think they have detected) some malware on the site. Thanks for reporting this. Though I bluntly admit I just ignore everything coming from Microsoft. Hotmail has been tagging my company's mailserver as a spammer for ages, so I'm tagging everything coming from Microsoft as crapware. Nothing good has ever been produced by this company. The last time I actually used MS Windows for work was around 2001, before Windows XP came out. This is the year I moved to Linux (Slackware 7.1 at the time), and I've been 100 % GNU/Linux ever since. :o) Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

Issues with Mirror Sites
by Kenneth Sutherland 09 Mar '18

09 Mar '18

Hi, Newbie question, is there a problem with the Centos 7 mirror sites, no matter what I do the mirror sites are reporting back the meta data in the repodata folder is wrong and I cant do a Yum Update? when I browse to a few of the mirror sites it looks to me that they sym links are broken? I apologies in advance if I got this completely wrong as am still learning Cheers in advance Ken

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss