Discuss

discuss@lists.centos.org

2 participants
34758 discussions

RE: [CentOS] CentOS-4.4 - Some major changes on the way
by Nielsen, Steve 22 Jun '06

22 Jun '06

Just curious... are there preview packages of seamonkey available anywhere for download ? Steve -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Johnny Hughes Sent: Tuesday, June 20, 2006 6:03 AM To: CentOS ML Subject: [CentOS] CentOS-4.4 - Some major changes on the way I would like to take the time to inform people that CentOS-4.4 will contain some major changes. The changes are significant enough that I would like to spell out some of them now, probably at least a month before the release of the upstream "EL4 update 4" is released. The Mozilla Suite (Browser, Mail, Chat clients) will be replaced by SeaMonkey. This is due to Mozilla's change in policy and support for older versions. The Firefox 1.0.x (currently 1.0.8) web browser will be replaced by Firefox 1.5.x (currently 1.5.0.3). We currently have a version of Firefox 1.5.x in the CentOSPlus repo. That version will be replaced by the EL4 version after some more testing ... and the new version will be rolled into CentOS-4.4 in the Base repository when CentOS-4.4 is released. The Thunderbird 1.0.x (currently 1.0.8) will be upgraded to Thunderbird 1.5.x (currently 1.5.0.2). The OpenOffice.org 1.1.2 will be replaced by OpenOffice 1.1.5. This allows better sharing of files between OpenOffice.org 2.0 and CentOS clients. ------------------------------- All these changes will be implemented upstream and rolled out in the released source code, so they will be incorporated into CentOS as well. We will fully test these packages prior to release of the CentOS-4.4 ISOs, however these changes are fairly substantial. I would also like to remind people who are more cautious that CentOS has a vault that will contain CentOS-4.3 after we shift the main mirrors to CentOS-4.4. The vault is available at: http://vault.centos.org/ I am not suggesting that people don't upgrade (as security updates would require one to maintain the current version), but I am just providing information so that if the updates break something, you can easily get back to a known previous version. We have not had any problems so far with the new packages in our testing, and they will be deemed STABLE by upstream when they are released, however these changes are by far the most significant since the release of CentOS-4 and I think they deserve some special attention. Thanks, Johnny Hughes CentOS-4 Lead Developer

1 0

RE: [CentOS] Apache Security
by King, John (Greg) (LMIT-HOU) 22 Jun '06

22 Jun '06

Just as an fyi on a good checklist for linux (not comprehensive but a good start) http://www.cisecurity.org/bench_linux.html And some good areas via google on secure centos installations. If they do it again then it wont be your perl script obviously as you mentioned disabling the script, but if not, is your script configured with use strict and taint? Is every var in the script checked to ensure the data is within an allowed range? Does the perl script rely on third-party modules? If so you might check there as well. The rest is an assumption that you may have php installed on the system and someone may have used a php script as a gateway into your system. Even though the box has been compromised you may get lucky if this is related to apache by looking at the timestamp on the files in /tmp and correlate those with your apache logs. If so check your php logs as well(if you enabled it in /etc/php.ini). Are you running in safe mode? There are some things you can do to help reduce the amount of damage a vulnerable php script can do: safe_mode = On safe_mode_gid = On safe_mode_include_dir = /path where any include files you trust reside. Read only by apache process safe_mode_exec_dir = /path to area where you allow any executables to be called from php scripts Also (not restricted to safe mode) is if this is a home server you can also restrict where php scripts can 'roam': open_basedir = /var/www/html (for example) will prevent php scripts from going outside the /var/www/html area. If your done debugging any web code set this display_errors = off And turn on php file logging log_errors = On error_log = /var/log/phplogfilename.log Unless you need to allow file uploads turn that off too file_uploads = Off The same goes for treating URLs as files allow_url_fopen = Off Also make sure all the files in /var/www/html or whatever are not owned by the apache process so they cannot be over-written if at all possible. -Greg -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Matthew T. O'Connor Sent: Thursday, June 22, 2006 11:53 AM To: CentOS mailing list Subject: [CentOS] Apache Security Hello, I have a server running CentOS 4.3 with all the latest updates. The server in question has been hacked by spammers a few times. The details of the hack have been basically the same every time. I find some directory created by the apache user account in /tmp. The new directory contains an html file, and a list of email addresses to spam and a perl script that spams all those email addresses with the html file. My question is why is this happening? Obviously it's some apache exploit. I have removed mod_perl, that didn't help. I have now changed the permissions on the perl executable, that might help we will see, but that doesn't address the core problem. How is it that someone can upload arbitrary files to my server and then execute an arbitrary command via apache. Is this a know problem? Have others seen it? What can I do to help prevent this? Thanks, Matt _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

RE: [CentOS] Apache Security
by mike.redan＠bell.ca 22 Jun '06

22 Jun '06

Hello, I have a server running CentOS 4.3 with all the latest updates. The server in question has been hacked by spammers a few times. The details of the hack have been basically the same every time. I find some directory created by the apache user account in /tmp. The new directory contains an html file, and a list of email addresses to spam and a perl script that spams all those email addresses with the html file. My question is why is this happening? Obviously it's some apache exploit. Why is this obvious? What else is exposed to the internet on this server? They could be coming in another way, then creating files owned by the apache user to make it look like an Apache problem. Is SSH exposed to the internet? Maybe there is a user with a weak password or something. I have removed mod_perl, that didn't help. I have now changed the permissions on the perl executable, that might help we will see, but that doesn't address the core problem. How is it that someone can upload arbitrary files to my server and then execute an arbitrary command via apache. What is exposed via apache? Are there any custom applications/CGI's? Is this a know problem? Have others seen it? What can I do to help prevent this? Thanks, Matt _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Tracking down whats causing a high load?
by Ian mu 22 Jun '06

22 Jun '06

Hiya, Currently running Centos 4.2 x86_64 dist on a dual 3G xeon, 2G ram, scsi setupand everythings been running fine on it for some time. Then at 4am last night something kicked in (have mrtg running monitoring when) and since then its been running a load of about 1.5 (normally around 0.4). CPU usage is Cpu(s): 1.1% us, 0.6% sy, 0.0% ni, 97.9% id, 0.2% wa, 0.1% hi, 0.1%si. Can't see any new processes that would cause the load, just wondering is there any way to try and track down whats actually causing this? It's not excessive load, but want to add some new services and wary now, its something that seems wrong given the sudden increase at 4am (think thats when some o.s housekeeping tasks are normally scheduled, but there's none running that I can see that started today). Just hoping someone may have some tips on checking whats always waiting or how to isolate whats happening. As said, ps -ef shows no new processes, and cpu usage is very low. Tia, Ian

8 10

Adobe Reader 7.0.8 on x86_64 system
by Kanwar Ranbir Sandhu 22 Jun '06

22 Jun '06

Hi Everyone, [yes, this is about a proprietary product, but I'm just asking for some tips/pointers] Has anyone tried installing the new Adobe Reader (7.0.8) RPM from Adobe on a CentOS 4.3 x86_64 box? I just attempted an upgrade from AdobeReader_enu-7.0.1-1 (also RPM install), and I'm getting this error: error: Failed dependencies: libGLU.so.1 is needed by AdobeReader_enu-7.0.8-1.i386 It looks like Adboe wants the i386 version of that library, which is provided by xorg-x11-Mesa-libGLU.i386. However, I already have the x86_64 version installed. What's stranger is that I was able to install the previous version without any problems. Any tips/suggestions/flames appreciated. Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.16-1.2111_FC4 i686 GNU/Linux 01:17:39 up 3 days, 18:46, 2 users, load average: 1.23, 0.56, 0.41

2 2

completely custom rpm's
by Tom Brown 22 Jun '06

22 Jun '06

Hi During a 'normal' install i have to add a bunch of users and modify some files such as DNS, Syslog, ssh key files etc While i can do this with a shell script post install it would be VERY neat to just have all these changes packaged up into an rpm and i can then just rpm -i this post install. Can i do this and if so can anyone point me to a how-to that would help me through the steps required. thanks

3 2

Problem generating SSL certificates
by mbneto 22 Jun '06

22 Jun '06

Hi, I am trying to generate client certificates (to use in internal web/email servers) but the process is aborting. I can generate the CA OK but when I try to generate the client... openssl ca -days 365 -out certs/xxxx.crt -in csr/xxx.csr -config ../tls/openssl.cnf Using configuration from ../tls/openssl.cnf Enter pass phrase for ../CA/private/cakey.pem: wrong number of fields on line 1 (looking for field 6, got 1, '' left) Any ideas? The openssl.cnf is the one that comes with the distro with the following modification: --- ../tls/openssl.cnf 2006-06-01 16:29:56.000000000 -0400 +++ ../tls/openssl.cnf.orig 2006-06-01 15:29:15.000000000 -0400 -dir = ../CA # Where everything is kept +dir = ../../CA # Where everything is kept Without the modification it simply complains about a missing file.

1 0

Re: [CentOS] Appended 1 in fstab entries CentOS4.X installs
by cweisiger＠i-55.com 22 Jun '06

22 Jun '06

Ok so its a bug(feature?) HEH. alright. Well I'll just deal with it for now. Is there a way to fix the appended 1 after a completed install.

6 6

What is hald doing?
by Steve Snyder 22 Jun '06

22 Jun '06

The hald daemon is the second largest consumer of CPU time on my CentOS v4.3 system. Is there a way to determine what it is spending all this time on? Thanks.

2 1

Apache problem
by kishore chowdary 22 Jun '06

22 Jun '06

hi I maintain 10 webservers which is used for add delivery using PHP.sometimes when the load is high my apache process suddenly dies & i restart apache. i find the following errors in my /var/log/messages/ server1 kernel: audit(1150892521.827:18474474): avc: denied { write } for pid=28135 comm="httpd" name="php-mmcache" dev=sda7 ino=2146317 scontext=root:system_r:httpd_t tcontext=system_u:object_r:var_t tclass=dir i think the above one is something related to selinux.so i disabled selinux stopped iptables & disabled firewall. /sbin/fixfiles restore but still i get the above error message in my /var/log/messages how to fix this??? when i run top d 1 i see a few Zombie process of httpd 12198 apache 16 0 0 0 0 Z 3.0 0.0 0:00.09 httpd <defunct> Os Centos 4.2 X86_64 bit Apache 2.0.52 below i am attaching the output of test.php which is in test.zip how can i fix this problem .. thanx & regards kishore chowdary

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss