Discuss

discuss@lists.centos.org

2 participants
34758 discussions

Re: [CentOS] Problem SSH
by James B. Byrne 26 Oct '05

26 Oct '05

On Tue, 25 Oct 2005 10:54:16 -0700, Benjamin Smith <lists(a)benjamindsmith.com> wrote: > Based on your question, I'll consider that you're pretty much > using a standard iptables config. > > edit /etc/sysconfig/iptables > > Add the following line, somewhere in the middle - it allows > inbound connections to TCP port 22: > > -A RH-Firewall-1-INPUT -p tcp --dport 22 -j ACCEPT > > If you want to restrict access to a single IP address try this, > it allows inbound connections to port 22 from ip address 1.2.3.4: > > -A RH-Firewall-1-INPUT -p tcp -s 1.2.3.4/32 --dport 22 -j ACCEPT > > Then restart iptables > /etc/rc.d/init.d/iptables restart; If you also wish to throttle new connections to the sshd daemon (a most useful security measure in my opinion) then you can add this to the top of your INPUT chain as well: # sshd new connection attempts throttled to 4/min./IP addr. -A INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 -- state NEW -j DROP --update --seconds 60 --hitcount 4 --name DEFAULT --rsource # Add new sshd connection attempt to recent ip list -A INPUT -p tcp -m tcp -m state -m recent -i eth0 --dport 22 -- state NEW --set --name DEFAULT --rsource You can alter the comparison period and connection rate values by altering the arguments for --seconds and --hitcount appropriately. For example, to permit no more than twelve connections from a single IP address within any five minute period then use --seconds 300 --hitcount 12. Regards, Jim -- *** e-mail is not a secure channel *** mailto:byrnejb.<token>@harte-lyne.ca James B. Byrne Harte & Lyne Limited vox: +1 905 561 1241 9 Brockley Drive fax: +1 905 561 0757 Hamilton, Ontario <token> = hal Canada L8E 3C3

1 0

CentOS SETI@Home team
by Magnus Hedemark 26 Oct '05

26 Oct '05

http://setiathome.berkeley.edu/team_display.php?teamid=120195 If anyone here is participating in SETI@Home, consider switching teams to boost CentOS. :-) -Magnus

1 0

centos 4.2 with reiserfs
by Lim Wee Cheong 26 Oct '05

26 Oct '05

Hi, I tried to compile the 2.6.9-22.EL kernel with reiserfs enabled. make fails as follows. anyone managed to compile with reiserfs successfully? CC [M] fs/reiserfs/stree.o fs/reiserfs/stree.c: In function `get_lkey': fs/reiserfs/stree.c:322: warning: return from incompatible pointer type fs/reiserfs/stree.c:325: warning: return from incompatible pointer type fs/reiserfs/stree.c:329: warning: return from incompatible pointer type fs/reiserfs/stree.c:332: warning: return from incompatible pointer type fs/reiserfs/stree.c:337: warning: return from incompatible pointer type fs/reiserfs/stree.c:338: warning: return from incompatible pointer type fs/reiserfs/stree.c: At top level: fs/reiserfs/stree.c:346: error: conflicting types for 'get_rkey' include/linux/reiserfs_fs.h:1886: error: previous declaration of 'get_rkey' was here fs/reiserfs/stree.c:346: error: conflicting types for 'get_rkey' include/linux/reiserfs_fs.h:1886: error: previous declaration of 'get_rkey' was here fs/reiserfs/stree.c: In function `get_rkey': fs/reiserfs/stree.c:361: warning: return from incompatible pointer type fs/reiserfs/stree.c:364: warning: return from incompatible pointer type fs/reiserfs/stree.c:368: warning: return from incompatible pointer type fs/reiserfs/stree.c:371: warning: return from incompatible pointer type fs/reiserfs/stree.c:376: warning: return from incompatible pointer type fs/reiserfs/stree.c:377: warning: return from incompatible pointer type fs/reiserfs/stree.c: In function `key_in_buffer': fs/reiserfs/stree.c:399: warning: passing arg 1 of `comp_keys' from incompatible pointer type fs/reiserfs/stree.c:403: warning: passing arg 1 of `comp_keys' from incompatible pointer type make[2]: *** [fs/reiserfs/stree.o] Error 1 make[1]: *** [fs/reiserfs] Error 2 make: *** [fs] Error 2

5 5

CentOS-announce Digest, Vol 8, Issue 9
by centos-announce-request＠centos.org 26 Oct '05

26 Oct '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:809 Moderate CentOS 3 ia64 ethereal - security update (Pasi Pirhonen) 2. CESA-2005:809 Moderate CentOS 4 ia64 ethereal - security update (Pasi Pirhonen) 3. CESA-2005:809 Moderate CentOS 4 x86_64 ethereal - security update (Johnny Hughes) 4. CESA-2005:809 Moderate CentOS 4 i386 ethereal - security update (Johnny Hughes) 5. CESA-2005:809 Moderate CentOS 4 axp ethereal - security update (Pasi Pirhonen) 6. CESA-2005:809 Moderate CentOS 3 s390(x) ethereal - security update (Pasi Pirhonen) 7. CESA-2005:809 Moderate CentOS 4 s390(x) ethereal - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Oct 2005 00:48:05 +0300 From: Pasi Pirhonen <upi(a)papat.org> Subject: [CentOS-announce] CESA-2005:809 Moderate CentOS 3 ia64 ethereal - security update To: centos-announce(a)centos.org Message-ID: <20051025214805.GG1352(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:809 https://rhn.redhat.com/errata/RHSA-2005-809.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/ethereal-0.10.13-1.EL3.1.ia64.rpm updates/ia64/RPMS/ethereal-gnome-0.10.13-1.EL3.1.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Centos 4.2 and Boot/Root on RAID?
by Steve Bergman 26 Oct '05

26 Oct '05

Hi, I have a client that insists on going with software rather than hardware raid1 to save a few dollars. Can Centos 4.2 do Boot and Root on software Raid1? I've heard criticisms of Grub and bootable RAID. Also, if it is not set up to work out of the box, I'd like to try to talk them out of it. I've been down that road before. If I go nonstandard, by the time I actually need to boot from the second drive in an emergency, I've forgotten the special procedure. (Why can't businesses just spend a few extra dollars to do things right?!) Thanks for any info. -Steve

6 13

Which imapd?
by Morten 26 Oct '05

26 Oct '05

Hi. What imapd can you recommend for minimum configuration and maintenance (no Cyrus)? This is for a small shop, so no hard performance requirements. I'd prefer one where I don't have to build my own packages (no Courier, unless packages exist). Thanks. Morten

19 42

Kernel 2.6.9 hangs
by Fong Vang 26 Oct '05

26 Oct '05

I upgraded from a RedHat 9 to CentOS 4.1 system using yum without any hiccup. Upon reboot, the kernel appears to be stalled after printing this message: "Creating block devices". Keyboard is still responsive and you can press ALT-CTRL-DEL to reboot the system (when pressed, it says something about MD being unmounted). This is the last few lines before it hangs: Freeing unused kernel memory: 176k freed Rd Hat nash version 4.2.1.3 starting Mounted /proc/filesystem Mounting sysfs Loading jbd.ko module Loading ext3.ko module Creating block devices The kernel I'm using is the kernel-smp-2.6.9-11.EL.i686.rpm (I've also tried the uni processor kernel with the same result). What happens after creating block devices? Any idea what to look for/check? TIA!

1 0

vsftpd failing since upgrade to 4.2
by scott 26 Oct '05

26 Oct '05

My vsftpd was working. I use it configured via xinetd and turn it off (disabled = yes) when I'm not using it to keep the bad guys from hammering on it. Recently I upgraded to 4.2 (via yum update). That' the only change I know of on the system. And I didn't have any problems with it. Today when I try to ftp, i enabled it in xinetd.d (with disable = no and a "service xinetd restart") But I can't connect. Well, I connect, but then I'm dropped with the reply: 500 OOPS: cannot open config file:/etc/vsftpd/vsftpd.conf The config file is there: -rw------- 1 ftp ftp 4271 Oct 23 21:03 vsftpd.conf I haven't changed it's permissions. the ftp account appears intact: ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin There are no related entries on tehlog, only the connect in /var/log/secure: Oct 23 21:11:58 tn1 xinetd[13086]: START: ftp pid=13113 from=xx.xx.xx.xx I tried starting it manually via service vsftpd start. That appeared to start fine, but when I look no process is running. So I tried to start it manually and get teh same error [root@tn1 init.d]# /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf 500 OOPS: cannot open config file:/etc/vsftpd/vsftpd.conf Anyone help? Thanks, Scott

3 5

Re: [CentOS] Load balancing email?
by Benjamin Smith 25 Oct '05

25 Oct '05

Using multiple A records is good for performance balancing, but what if one of the systems fails? Using your cocnfiguration, the delivering mail server has an "a" record and a single MX, so it wouldn't try the other mail server in the case of a failure, right? Whereas, by listing multiple IPs and mx1/mx2, wouldn't the delivering mail server try the other address? Thanks, -Ben On Tuesday 25 October 2005 16:02, you wrote: > I once did this and it worked great: > > IN MX 10 mx.example.com. > > mx IN A 192.168.1.1 > IN A 192.168.1.2 > > ...etc. Perfect DNS load balancing. > > Jack > > Benjamin Smith wrote: > > >Currently, we have two mail relays for inbound messages, and a third for POP. > > > >The inbound messages go thru all the CPU-intensive anti-spam stuff, and then > >they relay it to the POP server for pickup. > > > >Currently, one of these is the "primary", and the other is "secondary", and > >I'd like them to be considered more or less as equals, since the "primary" > >system is getting beaten pretty hard. > > > >The DNS zone file says something like this: > > > >############################### > >@isp.com > ><SNIP> > > IN MX 100 mx1.isp.com. > > IN MX 1100 mx2.isp.com. > ><SNIP > >################################ > > > >I seem to recall that I make them act as "equals" by simply changing this to > > > >############################### > >@isp.com > ><SNIP> > > IN MX 100 mx1.isp.com. > > IN MX 100 mx2.isp.com. > ><SNIP > >################################ > > > >so that they both get about the same amount of inbound messages. Has anybody > >here actually done this? How well does this work as far as failover if either > >system fails? > > > >-Ben > >-- > >"The best way to predict the future is to invent it." > >- XEROX PARC slogan, circa 1978 > >_______________________________________________ > >CentOS mailing list > >CentOS(a)centos.org > >http://lists.centos.org/mailman/listinfo/centos > > > > > -- "The best way to predict the future is to invent it." - XEROX PARC slogan, circa 1978

2 1

Re: [CentOS] Load balancing email?
by Benjamin Smith 25 Oct '05

25 Oct '05

Just wondering - have you tried greylisting? Why or why not? -Ben On Tuesday 25 October 2005 15:42, replies-lists-centos(a)listmail.innovate.net wrote: > you are correct. setting the ordinals to be the same (whatever value you > select) will cause the entries for the two machines to rotate. failover > works mostly (it depends on how the first machine fails and related > timeout issues). > > i would actually suggest a somewhat different setup. > > the problem with multiple external mail hosts is that the more you have > the more spammers have to hit. [they don't care about mx record > ordinals, etc.] with your spam stuff on these front-end machines (if i > understand your configuration correctly), the spammers are just eating > up your resources. > > so, instead, set up one or more (depending on load/needs) front-end > machines. use DNSBL in sendmail/postfix (whichever you feel more > comfortable configuring) to cut down on the junk. [when i last checked, > dnsbl blocking dynamic IPs (dialup/cable modems) cut the basic trash > down by 60-70%.] > > then, put your anti-spam stuff on one (or more if necessary) back-end > machines that only accept mail from the front-end machines. that way > your anti-spam stuff is only going to see mail that's gone through the > dnsbl and won't be taking up resources of the basic mail handling on the > front-end machine(s). > > after the anti-spam machine(s), pass the mail on to your pop/imap server. > > i suspect that with this setup you could have one front-end machine, > load-balance (with two A-records for the same name but different > ipnumbers (aka DNS shuffle-A)) for two anti-spam machines and you'll be > ok. > > if you want a second front-end machine, for fail-over, you have to > realize that it will get just about as much spam as the first machine, > regardless of your mx-record settings. it's good to have it, just > realize you're provide a second door that the spammers will *always* try. > > in short, put the resource intensive anti-spam stuff back a level from > the external SMTP server(s). that will let the SMTP servers do their job > without getting high load from the anti-spam stuff. > > > - Rick > > > > ------------ Original Message ------------ > > Date: Tuesday, October 25, 2005 03:03:55 PM -0700 > > From: Benjamin Smith <lists(a)benjamindsmith.com> > > To: centos(a)centos.org > > Subject: [CentOS] Load balancing email? > > > > Currently, we have two mail relays for inbound messages, and a third > > for POP. > > > > The inbound messages go thru all the CPU-intensive anti-spam stuff, > > and then they relay it to the POP server for pickup. > > > > Currently, one of these is the "primary", and the other is > > "secondary", and I'd like them to be considered more or less as > > equals, since the "primary" system is getting beaten pretty hard. > > > > The DNS zone file says something like this: > > > >############################### > > @isp.com > > <SNIP> > > IN MX 100 mx1.isp.com. > > IN MX 1100 mx2.isp.com. > > <SNIP > >################################ > > > > I seem to recall that I make them act as "equals" by simply changing > > this to > > > >############################### > > @isp.com > > <SNIP> > > IN MX 100 mx1.isp.com. > > IN MX 100 mx2.isp.com. > > <SNIP > >################################ > > > > so that they both get about the same amount of inbound messages. Has > > anybody here actually done this? How well does this work as far as > > failover if either system fails? > > > > -Ben > > -- > > "The best way to predict the future is to invent it." > > - XEROX PARC slogan, circa 1978 > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > http://lists.centos.org/mailman/listinfo/centos > > ---------- End Original Message ---------- > -- "The best way to predict the future is to invent it." - XEROX PARC slogan, circa 1978

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss