Discuss

discuss@lists.centos.org

2 participants
34758 discussions

17 Mar '18

Hi, what are the following messages supposed to tell me and does this indicate a problem? # systemctl status cyrus-imapd [...] master[3766]: unable to setsocketopt(IP_TOS): Operation not supported master[3766]: unable to setsocketopt(IP_TOS): Operation not supported [...] Exim says it can not connect to the lmtp socket even when selinux doesn´t get in the way. The configuration looks like this: cyrus.conf (none of the two options work): [...] # lmtp cmd="lmtpd -a" listen="lmtp:127.0.0.1" prefork=4 lmtpunix cmd="lmtpd -a" listen="/var/lib/imap/socket/lmtp" prefork=4 [...] exim.conf: [...] begin transports # cyrus_ltcp: # driver = smtp # protocol = lmtp # delivery_date_add # envelope_to_add # return_path_add # hosts = localhost # allow_localhost lmtp_socket: driver = lmtp socket = /var/lib/imap/socket/lmtp delivery_date_add envelope_to_add return_path_add # ls -la /var/lib/imap/socket/lmtp srwxrwxrwx. 1 root root 0 Mar 16 12:58 /var/lib/imap/socket/lmtp I have this working on the old server (which doesn´t run Centos) and am trying to migrate it to the new one (which runs Centos 7.4). The version of cyrus and sasl are the same on both machines. What´s the problem with Centos that these things don´t just work as they usually do?

2 4

spectre variant 2
by Fred Smith 17 Mar '18

17 Mar '18

Hi all! I'm running an up-to-date Centos-7 on an AMD Vishera 6300, 6 core CPU. I note that when I run the redhat script to test for spectre & meltdown I get this result for variant 2: Variant #2 (Spectre): Vulnerable CVE-2017-5715 - speculative execution branch target injection - Kernel with mitigation patches: OK - HW support / updated microcode: NO - IBRS: Not disabled on kernel commandline - IBPB: Not disabled on kernel commandline and when I run the one from github I get this: CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigated according to the /sys interface: NO (kernel confirms your system is vulnerable) * Mitigation 1 * Kernel is compiled with IBRS/IBPB support: YES * Currently enabled features * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * IBPB enabled: NO * Mitigation 2 * Kernel compiled with retpoline option: YES * Kernel compiled with a retpoline-aware compiler: UNKNOWN > STATUS: VULNERABLE (Vulnerable: Retpoline without IBPB) So, I"m wondering: 1. has RH in fact released mitigations for this issue for AMD processors, and 2. has AMD released microcode updates for this? I have no idea how to query AMD with such a question, anybody here know? Thanks in advance! -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

2 2

CentOS-announce Digest, Vol 157, Issue 4
by centos-announce-request＠centos.org 16 Mar '18

16 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0526 Critical CentOS 6 firefox Security Update (Johnny Hughes) 2. CESA-2018:0527 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 15 Mar 2018 18:59:48 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0526 Critical CentOS 6 firefox Security Update Message-ID: <20180315185948.GA44704(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0526 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0526 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm x86_64: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm 5ab36e9cf3534cc1af6c6ee3d6e302907235e8f8dd2b00f8003ea2e3ef98d272 firefox-52.7.0-1.el6.centos.x86_64.rpm Source: ae98346dd0287b8d7fe36edd4692a1980f4fcf1d53e7633307e33e67adfe9a71 firefox-52.7.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 15 Mar 2018 19:24:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0527 Critical CentOS 7 firefox Security Update Message-ID: <20180315192433.GA58165(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0527 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0527 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3d4f163b3fe61aa41272b201f56732c9352c1e12d13e85dc15f466363d0ba59b firefox-52.7.0-1.el7.centos.i686.rpm 9546d6326537d96a09245d90386164fd8786578b2c5de142e3f877c532e85612 firefox-52.7.0-1.el7.centos.x86_64.rpm Source: 0852393b938ea86a3af795b46909d5fc13cf9da3f9f9b6ff85c8b2c2ee2f3e17 firefox-52.7.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 4 ***********************************************

1 0

VirtualBox on CentOS 7 with bridged network not working
by James Pearson 16 Mar '18

16 Mar '18

I've installed VirtualBox v5.2 on a CentOS 7.4 machine, but VMs set up with bridged networking can not 'see' past the VirtualBox host machine i.e. the VM can ping the host and vice versa, but the VM can not ping anything else and other machines on the same subnet can't ping the VM There are no firewall rules configured on the 7.4 host and selinux is disabled I have a similar set up on a CentOS 6.9 host, where everything works as expected Googling doesn't show up any similar issues, so I guess I'm missing something on the host machine Does anyone have any idea what could be the issue? Thanks James Pearson

3 3

ISCSI target + LVM Problem
by marcos sr 15 Mar '18

15 Mar '18

Hello, I have a LVM with 2 ISCSI disk mounted. The partition started presents problem such " i/o error". I unmounted the device, and restarted target server in scsi, wich as having some problems. After that i mapped iscsi and trying to mount partition again but: When i run the pvdisplay i get the following erro: read failed after 0 of 4096 at 0: Input/output error And cannot mount partition.

2 4

Squid + SquidGuard : static block page not working
by Nicolas Kovacs 15 Mar '18

15 Mar '18

Hi, I've been working with Squid + SquidGuard for a few years, though only on Slackware. I'm currently transferring my proxy expertise to CentOS 7, and right now I'm having a little problem with that. Squid works perfectly so far as a transparent HTTP + HTTPS cache proxy. The next step is to add SquidGuard, so I installed it and edited the most basic /etc/squid/squidGuard.conf file possible. In this setup, my workstation (192.168.2.2) is allowed to access anything on the Web, and all other client machines on the networks are blocked and should be redirected to the avertissement.html block page for every request. --8<------------------------------------------------------------------ # /etc/squid/squidGuard.conf dbhome /var/squidGuard logdir /var/log/squidGuard src admin { ip 192.168.2.2 } acl { admin { pass any } default { pass none redirect http://nestor.microlinux.lan/avertissement.html } } --8<------------------------------------------------------------------ I appended the following lines to /etc/squid/squid.conf: --8<------------------------------------------------------------------ # SquidGuard url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf url_rewrite_children 5 --8<------------------------------------------------------------------ Now this setup sort of works. My workstation can access anything, other clients are blocked. Unfortunately, the block page avertissement.html is not displayed. Instead, I get a Squid error page: The following error was encountered while trying to retrieve the URL: https://http/* Unable to determine IP address from host name "http". Any idea why my static block page avertissement.html is not displayed? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Good work, Red Hat!
by isdtor 15 Mar '18

15 Mar '18

Delivered as per https://access.redhat.com/articles/3311301. This is good news. Backporting those updates across three gcc versions does not look like the easiest exercise to me. $ rpm -qp --changelog gcc-4.4.7-18.el6_9.2.x86_64.rpm |head -n 6 * Wed Jan 31 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.2 - Fix indirect_jump/tablejump patters for retpolines (#1535656) * Tue Jan 23 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.1 - Retpoline support (#1535656) $ rpm -qp --changelog kernel-2.6.32-696.23.1.el6.x86_64.rpm ... * Sat Feb 10 2018 Jan Stancek <jstancek(a)redhat.com> [2.6.32-696.23.1.el6] - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455] - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645] - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645] ...

1 0

CentOS 6 i386 - meltdown and spectre
by Peter Wood 13 Mar '18

13 Mar '18

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

4 7

Squid vs. iptables redirection: exception for certain domains ?
by Nicolas Kovacs 12 Mar '18

12 Mar '18

Hi, I'm currently facing a quite tricky problem. Here goes. I have setup Squid as a transparent HTTP+HTTPS proxy in my local network. All web traffic gets handed over to Squid by an iptables script on the server. Here's the relevant section in /etc/squid/squid.conf: --8<------------------------------------------------------------- # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/amandine.sandbox.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB --8<------------------------------------------------------------- And here's the corresponding section of my firewall script: --8<------------------------------------------------------------- # Commandes IPT=/usr/sbin/iptables SYS=/usr/sbin/sysctl SERVICE=/usr/sbin/service # Internet IFACE_INET=enp2s0 # Réseau local IFACE_LAN=virbr0 IFACE_LAN_IP=192.168.2.0/24 # Serveur SERVER_IP=192.168.2.1 ... # Squid $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 80 -j REDIRECT --to-port 3128 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 443 -j REDIRECT --to-port 3129 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3130 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3130 -j ACCEPT --8<------------------------------------------------------------- This setup works nicely for the vast majority of web sites. BUT: a handful of sites has some trouble with my local certificate. For example, I can't sync my local Github repo anymore. Or my local OwnCloud client spews back a warning message on every startup. I asked on the Squid mailing list if there was a possibility to create an exception for a list of domains, so that these can simply bypass the proxy. The problem is, according to one of the developers, I have to tackle that problem earlier in the process, e. g. in the firewall setup. So here's what I want to do, in plain words: 1. Redirect all HTTP traffic (port 80) to port 3128. So far so good. 2. Redirect all HTTPS traffic (port 443) to port 3129. Equally OK. AND... 3. DO NOT REDIRECT traffic that goes to certain domains, like: github.com credit-cooperatif.coop cloud.microlinux.fr squid-cache.org etc. Ideally, these domains should be read from a simple text file. Any idea how I could do that? I don't even know if this is theoretically possible. Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 6

SELinux breaks Squid's ssl_crtd helper
by Nicolas Kovacs 10 Mar '18

10 Mar '18

Hi, I've setup a transparent HTTP+HTTPS proxy on my server running CentOS 7, using Squid. Here's my configuration file. --8<---------------------------------------------------------------- # /etc/squid/squid.conf # Définitions acl localnet src 192.168.2.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Règles d'accès http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/nestor.microlinux.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # Emplacement de ssl_crtd et du cache des certificats TLS sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 # SSL-Bump acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # Taille du cache dans la RAM cache_mem 2048 MB # Emplacement et taille du cache sur le disque # cache_dir ufs /var/spool/squid 100 16 256 # Vidage système coredump_dir /var/spool/squid # Durée de vie des fichiers sans date d'expiration refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 --8<---------------------------------------------------------------- First, I tested the configuration in permissive mode, where it works perfectly. After running it a while, I get the following SELinux alert. # sealert -a /var/log/audit/audit.log ***** Plugin catchall (17.1 confidence) suggests ***** If you believe that ssl_crtd should be allowed read access on the index.txt file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ssl_crtd' --raw | audit2allow -M my-sslcrtd # semodule -i my-sslcrtd.pp Unfortunately the suggested solution doesn't work, because the problem reappears, and I get all sorts of errors in /var/log/squid/cache.log, all due to ssl_crtd not being able to access stuff under /var/lib/ssl_db. Any idea how I can solve this problem permanently ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss