Discuss

discuss@lists.centos.org

2 participants
34758 discussions

RE: [CentOS] More questions about patch management
by Plant, Dean 31 Jan '06

31 Jan '06

Johnny Hughes wrote: > On Mon, 2006-01-30 at 20:56 -0600, Steve Bergman wrote: >> My original understanding was that only security patches get issued >> between quarterly releases. But that then the distro gets updated >> with bug fixes 2 to 4 times per year. >> >> I may be getting this all wrong, but I get the impression that there >> are 3-4 month periods of quiescence punctuated by short periods (or >> a day?) of significantly more intensive patching. >> >> Is that correct? >> > > That is generally correct ... the upstream provider generally releases > security patches between the update set releases. They generally > release bugfix and enhancement updates during an update set (or as we > call it a point release). > > They also generally release an update set at 3-4 month intervals. > > The update sets contain both security, bufix, and enchantment updates > though ... and normally many of the new enhancement and bugfix updates > are required as dependencies for the security updates. > > All of these things are general though ... to see exactly what updates > were released and when, look here (for the upstream EL4 product): > > You can see every update and the date it was released ... you can also > see the update set dates of: > > Release = 2005-02-14 > > update1 = 2005-06-09 > > update2 = 2005-10-05 > > (this is about 4 months between release sets) > > You can also see that there were: > > 27 day zero updates on 02-15-2005, 3 bugfix updates between release > update1, 3 security updates as part of update1, 0 bugfix updates > between update1 and update2, 11 security updates as part of update2, 5 > bugfix/enhancement updates between update2 and now. > > We at CentOS release the updates that are released upstream ... when > they are released upstream ... we do so regardless of whether they are > bugfix or security or enhancement updates ... because, they were > released when they were for a reason :) > > Some other rebuild distros ONLY release security updates between > update sets ... others release hardly any updates at all. We > personally think the the upstream provider is the absolute best > enterprise distro in the world, and that they are smart enough to > release the updates that they want when they want them released, > therefore, we release the same packages too. I found this interesting, an interview of the Red Hat CIO suggests there may be a change in the way Red Hat rolls its updates. From http://cio.co.nz/cio.nsf/UNID/0358EF0F3EFF0584CC2570AA0073523A?OpenDocum ent Johnny posted this in another thread. "One customer told me that it's difficult to meet the SAS-70 auditing requirements, because Red Hat releases security updates and general patches together. Is your company addressing this? It's true that when quarterly updates come out, security is done only for that update. So customers have to move to that update with us if they want to stay secure. What we're looking at now - and this wasn't necessitated until recently, now that we have over 1 million subscriptions out and 36,000 new customers in each of the last two quarters - is offering longer support for back releases. So some customers could stay on an old update release an still get the security patches." Dean

1 0

CentOS 4.2 Mouse Tracking Unstable
by Charles Sliger 31 Jan '06

31 Jan '06

Just installed CentOS 4.2 on a system that was running RedHat-9. The system is connected to the keyboard, video and mouse through a Belkin OmniView Pro KVM switch. After bootup, the the system tracks movement by the mouse just fine. The unstable behavior can be characterized as follows: 1. Console is switched to a different system for a time and then switched back to the Centos system. 2. Movement of the mouse causes the cursor to jump all over the screen erratically. 3. Windows appear/disappear as if mouse-clicks are selecting things rapidly at random. It's pretty difficult to follow visually, so I can't say in detail what is going on. I changed xorg.conf to have "simulate 3-button mouse" set to "no". No change in behavior. The mouse is a pretty simple one that came with an E-Machines box and has worked fine with all of the systems up until now. Any pointers would be greatly appreciated. Charles L. Sliger, Information Systems Engineer, chaz(a)bctonline.com "no matter where you go, there you are..."

6 13

Test Failed for CD3 and CD4
by spart cus 31 Jan '06

31 Jan '06

hi guys, I dont know if my burner here got a problem. Im downloaded the iso's for cd 3 and 4 thrice and burned it on the cd thrice also. but when i test the cd's they failed. But calculating the checksum was ok. any suggestions ? --------------------------------- Do you Yahoo!? With a free 1 GB, there's more in store with Yahoo! Mail.

2 1

More questions about patch management
by Steve Bergman 31 Jan '06

31 Jan '06

I'm still trying to get an idea about how best to handle patches on CentOS. Say I want to apply security patches automatically on a nightly basis. But when the push from 4.2 to 4.3 comes around, I want to defer that for when I can do it manually. Is that possible? (Preferably with yum, but I would use up2date if that were necessary.) Also, I'm used to doing 'yum update'. I understand that 'yum upgrade' enables the obsoletion logic in yum, but practically speaking, when is it appropriate to use one or the other? Thanks, Steve

5 7

Cannot disable SELinux
by Kai Schaetzl 30 Jan '06

30 Jan '06

I'm getting a SELinux warning when trying to start a perl daemon (bigsister) that I installed on a fresh CentOS 4.2 system and the start fails (there is nothing else logged, I cannot be sure that this is the fail reason but I assume it). However, SELinux is set to permissive mode, isn't permissive mode meant to only issue warnings and not block anything? So, as a first workaround I tried disabling SELinux, but this doesn't work either, I still get the warning which should not happen at all if disabled. cat /selinux/enforce shows "0" (= not enforced) I disabled by setting SELINUX=disabled in /etc/sysconfig/selinux (whichs symlinks to /etc/selinux). Yes, I rebooted with each try. The unofficial SELinux FAQ at http://www.crypt.gen.nz/selinux/faq.html says to add a kernel parameter to grub.conf for completely disabling it. However, that's not what I want. I want to disable it by "normal" means (or preferrably set it to *real* permissive mode). What am I doing wrong? Kai -- Kai Schätzl, Berlin, Germany

2 3

Lame update from Dag's repo fails for me, any help?
by William L. Maltby 30 Jan '06

30 Jan '06

Trying yum update for the latest announcements. Part of the problem I experienced last week appears again: lame library DSA key is unavailable. I had tried to resolve this last week, to no avail. Tried again this week and found a French site with the key ID, but for libmad. Anyone can give me the proper instructions so this works? TIA Bill Here is a snipped part of the yum log. =================================================================== Setting up Update Process Setting up repositories dries 100% |=========================| 951 B 00:00 <snip> dag 100% |=========================| 1.1 kB 00:00 <snip> dag : ################################################## 3580/3580 Added 1 new packages, deleted 0 old in 7.86 seconds Resolving Dependencies --> Populating transaction set with selected packages. Please wait. ---> Downloading header for lame to pack into transaction set. lame-3.96.1-3.2.el4.rf.i3 100% |=========================| 7.7 kB 00:00 ---> Package lame.i386 0:3.96.1-3.2.el4.rf set to be updated ---> Downloading header for ffmpeg-libpostproc to pack into transaction set. <snip> --> Running transaction check Dependencies Resolved ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: ffmpeg-libpostproc i386 0.4.9-0.3.20051207.2.el4.rf dag 37 k <snip> Transaction Summary ============================================================================= Install 1 Package(s) Update 6 Package(s) Remove 0 Package(s) Total download size: 5.2 M Is this ok [y/N]: y Downloading Packages: (1/7): lame-3.96.1-3.2.el 100% |=========================| 488 kB 00:00 (2/7): ffmpeg-libpostproc 100% |=========================| 37 kB 00:00 (3/7): python-urlgrabber- 100% |=========================| 98 kB 00:00 (4/7): libdvdread-0.9.5-1 100% |=========================| 63 kB 00:00 (5/7): mplayer-1.0-0.20.p 100% |=========================| 3.5 MB 00:06 (6/7): mplayer-fonts-1.1- 100% |=========================| 1.0 MB 00:02 (7/7): python-elementtree 100% |=========================| 76 kB 00:00 warning: rpmts_HdrFromFdno: V3 DSA signature: NOKEY, key ID 1aa78495 Public key for lame-3.96.1-3.2.el4.rf.i386.rpm is not installed

3 6

dhcpd proxy and/or windows autoupdates
by Dave 30 Jan '06

30 Jan '06

At one of our sites we have most outgoing ports blocked and everyone going through squid for web access. But it seems Windows autoupdate doesn't pick up the local users proxy settings so we ended up opening port 80 to some of the windows update servers. While searching around I found and option called custom-proxy-server but I don't see that setting in the man pages. Anyone have experience setting proxy server settings in dhcpd?

2 3

Help - iSCSI and SAMBA?
by Scott Sharkey 30 Jan '06

30 Jan '06

Hi All, I have a client trying to us a Promise Tech iSCSI array to share 2.8TB via SAMBA. I have CentOS 4.2 with all updates installed on an IBM server. The installation and setup was pretty straightforward. The Promise box is using Gigabit Ethernet, and is the only device on that net (I think they are using a cross-over cable - I didn't set up the hardware). We're experiencing periodic "stoppages" with some of the Samba users on this server. Their Windows clients, which have drives mapped to the IBM server (which has the iSCSI partitions "mounted"), periodically "pause" for about 30-60 seconds. The machines are NOT locked up, as we can take screenshots, move the mouse, etc, but disk IO seems "stuck". When it happens, about anywhere from 3-12 people are affected (but not the other ~80 users). There are no network errors on either the iSCSI interfaces, or the switches and/or network interfaces. The kernel is not swapping (though the symptoms SEEM a lot like a process getting swapped to disk). The cpu usage is not spiking in correlation to the events, as far as we can tell. It DOES appear that the % of time the CPU is servicing IO requests is saturated, from iostat. I will paste the iostat info from one of the events below. Has anyone else seem such behavion, and/or do you have suggestions for troubleshooting or otherwise correcting it? Thanks. -Scott ------------------------------------------------------------------------ This was sent from one of the techs working the problem: I think I located the problem. Collecting iostat data during the last lockup yielded the following information. Time: 03:20:38 PM Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util sda 0.00 0.00 3.09 0.00 24.74 0.00 12.37 0.00 8.00 0.00 0.00 0.00 0.00 sdb 0.00 0.00 85.57 0.00 684.54 0.00 342.27 0.00 8.00 1.03 12.06 12.04 102.99 Time: 03:20:39 PM Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s rkB/s wkB/s avgrq-sz avgqu-sz await svctm %util sda 0.00 13.27 0.00 10.20 0.00 187.76 0.00 93.88 18.40 0.00 0.10 0.10 0.10 sdb 0.00 0.00 82.65 0.00 661.22 0.00 330.61 0.00 8.00 1.02 12.23 12.33 101.94 This clearly shows that the percent of CPU time used for I/O requests has reached the device saturation point which is 100%. The utilization was at or above 100% the entire time that the freeze occured. I am researching the issue now to see if this is something we can resolve with kernel tweaks or otherwise. Any input regarding the issue is appreciated, thanks.

1 0

I guess hacker me - URGENT
by Adriano Frare 30 Jan '06

30 Jan '06

I use Centos 4.2 with all service pack installed. I verified traffic on link WEB and I see port TCP 80 with many traffic. I accessed lod /var/log/httpd/access_log and show below. ca.com/members/index.php HTTP/1.0" 401 - "http://members.sapphicerotica.com/members/index.php" "Mozilla/5.0 ( compatible; MSIE 5.01; Windows XP; NetCaptor )" 68.119.110.138 - - [30/Jan/2006:15:08:08 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9794 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9786 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:09 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:12 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:13 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:14 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:16 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:17 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:18 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/se… HTTP/1.0" 999 4445 "-" "-" 82.39.175.52 - - [30/Jan/2006:15:08:35 -0200] "GET http://l1.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?&.tries=1&.… HTTP/1.0" 502 961 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:43 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 12.206.3.132 - - [30/Jan/2006:15:08:46 -0200] "GET http://us.a1.yimg.com/login.bjs.yahoo.com/config/login?login=big_g_&passwd=… HTTP/1.0" 200 4440 "http://www.yahoo.com/" "-" 84.109.4.111 - - [30/Jan/2006:15:08:51 -0200] "CONNECT login.icq.com:443 HTTP/1.0" 200 - "-" "-" I guess that hacker is using my SERVR APACHE to PROXY. Please, I need help urgent. I stoped service HTTPD because it. Thanks Adriano

5 7

nfs export symlink
by Les Mikesell 30 Jan '06

30 Jan '06

Is there some official way to make an NFS export with a name that doesn't match the real path on the server? A symlink seems to work, but 'showmount -e' still shows the underlying paths. Is there a way that doesn't? -- Les Mikesell lesmikesell(a)gmail.com

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss