Discuss

discuss@lists.centos.org

9 participants
34745 discussions

selinux denial of cgi script with httpd using ssl
by Gregory P. Ennis 05 Sep '17

05 Sep '17

Everyone, I am trying to use a cgi perl script for a CentOs 7 website that works fine with selinux in permissive mode but fails with selinux in enforcing mode. The problem I have is that I can not find where the selinux error message is being recorded. It does not appear to be in the /var/log/messages or /var/log/audit/audit.log. I do not get any /var/log/httpd/ssl_error_log entries. I do get a successful entry into /var/log/httpd/ssl_access_log and ssl_request_log when selinux is in permissive mode, but not when selinux is in enforcing mode. The only place I can see that I am getting an error message is in the /var/log/httpd/error_log which is as follows : Mon Sep 04 11:40:24.216569 2017] [cgi:error] [pid 2290] [client x.x.x.x:55748] AH01215: (13)Permission denied: exec of '/var/www/cgi-bin/name.of.script.cgi' failed, referer: https://name.domain.com/ When selinux is in permissive mode the above error does not occur and the script works fine. When selinux is in enforcing mode the above error occurs, and the cgi script fails to execute. Is there a way to increase the sensitivity of selinux loging, or is there a different place to look for the error that prevents the execution of the script. Your help would be appreciated. Thanks, Greg Ennis

4 7

CentOS nDPI kmod avaliable for testing
by Eliezer Croitoru 04 Sep '17

04 Sep '17

I have been working for quite some time building nDPI iptables module from vel21ripn for many Linux distributions and I just finished couple basic tests on the module for CentOS 7 and I am quite satisfied. I am looking for other CentOS 7 admins who will want to test this iptables module. More details are at: https://github.com/vel21ripn/nDPI/issues/18 Thanks, Eliezer ---- Eliezer Croitoru Linux System Administrator Mobile: +972-5-28704261 Email: eliezer(a)ngtech.co.il

1 0

rkhunter and prelink
by m.roth＠5-cent.us 02 Sep '17

02 Sep '17

Can't remember if I posted this before... We're getting warnings from rkhunterWarning: Checking for prerequisites [ Warning ] All file hash checks will be skipped because: This system uses prelinking, but the hash function command does not look like SHA1 or MD5. Now, googling, I find people saying to rm /etc/prelink.cache, then run rkhunter --propupd. Works. And then, prelink runs in the middle of the night, via /etc/cron.daily, and when the cron job of rkhunter runs, it's back to complaining. Anyone have any ideas what's going on here? I don't see anything in the prelink.conf, or any options in the prelink manpage to tell is what hash to use. mark

5 7

share /var/spool/cups-pdf/SPOOL/?
by hw 02 Sep '17

02 Sep '17

Hi, is there a way to set multiple selinux attributes to files/directories? I would like to share /var/spool/cups-pdf/SPOOL/, which has 'system_u:object_r:print_spool_t:s0' and would also need 'system_u:object_r:samba_share_t:s0'. The point is that there will be files accumulating that only need to be deleted, and there might be files users may actually want access to. Sharing the directory (and a script that automatically deletes files from there which are too old) would be a way to achieve this.

1 0

spice client?
by hw 01 Sep '17

01 Sep '17

Hi, how do I connect to a VM running on a removte machine with some sort of spice client? There doesn´t seem to be any spice client available in Centos 7 that works.

3 7

CentOS-announce Digest, Vol 151, Issue 1
by centos-announce-request＠centos.org 01 Sep '17

01 Sep '17

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2017:2550 Moderate CentOS 6 poppler Security Update (Johnny Hughes) 2. CESA-2017:2534 Important CentOS 6 thunderbird Security Update (Johnny Hughes) 3. CESA-2017:2563 Moderate CentOS 6 openssh Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 31 Aug 2017 18:48:46 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:2550 Moderate CentOS 6 poppler Security Update Message-ID: <20170831184846.GA34711(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:2550 Moderate Upstream details at : https://access.redhat.com/errata/RHSA-2017:2550 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5e00e48b8c0ac31de59d24deaa04247cc665a39827832cfac05df03c164c52c4 poppler-0.12.4-12.el6_9.i686.rpm d25cdcfbfc0bf8ef7f5e548984674c6ce2a8d6a2eaef784b1ea7767840690466 poppler-devel-0.12.4-12.el6_9.i686.rpm 94011927f19dd72b17214ea203338a17c4e75507543666097b0d7244860da132 poppler-glib-0.12.4-12.el6_9.i686.rpm 23425ddf68356964411efc36159173c6ae243d0eb237dce6361e582d2baa9e97 poppler-glib-devel-0.12.4-12.el6_9.i686.rpm f88d5fb1cb327fb9dacc48f2ab02cc12ac09ea043622e39b4eb34ec33088cd76 poppler-qt-0.12.4-12.el6_9.i686.rpm d201890924ed934ca293d1a88c1a7da78be176166099574c7858c60f3ee93c6e poppler-qt4-0.12.4-12.el6_9.i686.rpm 8d645831a8fac15e1c8e5a32fc9183e95713f9ef1ee561af2d1cc7d11bd705fc poppler-qt4-devel-0.12.4-12.el6_9.i686.rpm 5b88d65fe039f4b9f2ea41faeaa59c35ee0e10a6c24bbf1756f5a9ea6fb0a8f0 poppler-qt-devel-0.12.4-12.el6_9.i686.rpm 59ca913a180b4fd587d4479b64efa37f04c1ee5b6812d17319f69e9cc38d5807 poppler-utils-0.12.4-12.el6_9.i686.rpm x86_64: 5e00e48b8c0ac31de59d24deaa04247cc665a39827832cfac05df03c164c52c4 poppler-0.12.4-12.el6_9.i686.rpm 2a7c924303b93c19268086f7202cd4d147d54ba04b4d5e9c31f785c887d0f3ff poppler-0.12.4-12.el6_9.x86_64.rpm d25cdcfbfc0bf8ef7f5e548984674c6ce2a8d6a2eaef784b1ea7767840690466 poppler-devel-0.12.4-12.el6_9.i686.rpm df823b5d17233bc08e976918b1aeb8d16d88e40c8de95da56c6ad9d22cde0f03 poppler-devel-0.12.4-12.el6_9.x86_64.rpm 94011927f19dd72b17214ea203338a17c4e75507543666097b0d7244860da132 poppler-glib-0.12.4-12.el6_9.i686.rpm aaa7b0ad900a0f1b77a503bed3772ca8f8d5cc9299be07eba849d67fff67f21a poppler-glib-0.12.4-12.el6_9.x86_64.rpm 23425ddf68356964411efc36159173c6ae243d0eb237dce6361e582d2baa9e97 poppler-glib-devel-0.12.4-12.el6_9.i686.rpm 77a0cf7d64625bd9547bde17cee820eb1c12c4d153cc92dd1f3edd2afc5113bb poppler-glib-devel-0.12.4-12.el6_9.x86_64.rpm f88d5fb1cb327fb9dacc48f2ab02cc12ac09ea043622e39b4eb34ec33088cd76 poppler-qt-0.12.4-12.el6_9.i686.rpm 29d53b90f6ca5ba1ea401ae122c4ff987a20aa8accfa019f3a9afbb25bb24b46 poppler-qt-0.12.4-12.el6_9.x86_64.rpm d201890924ed934ca293d1a88c1a7da78be176166099574c7858c60f3ee93c6e poppler-qt4-0.12.4-12.el6_9.i686.rpm b411d564f12f72a171e5dfb7a15ed32b276afc23b86ce0799aebd2e3400006cf poppler-qt4-0.12.4-12.el6_9.x86_64.rpm 8d645831a8fac15e1c8e5a32fc9183e95713f9ef1ee561af2d1cc7d11bd705fc poppler-qt4-devel-0.12.4-12.el6_9.i686.rpm 6935fc562c03523283368b0ac587bbc9d98b8ec84006d4991d2e3b243157a134 poppler-qt4-devel-0.12.4-12.el6_9.x86_64.rpm 5b88d65fe039f4b9f2ea41faeaa59c35ee0e10a6c24bbf1756f5a9ea6fb0a8f0 poppler-qt-devel-0.12.4-12.el6_9.i686.rpm 2ce55815fe0011187173d93bba74e0f4fc0c01b5b2b4800081c27d54c659b654 poppler-qt-devel-0.12.4-12.el6_9.x86_64.rpm e75d1d7531bd8ff24932c7ed58fb34b24d9cb1913a3642887e42f441f1725b5d poppler-utils-0.12.4-12.el6_9.x86_64.rpm Source: 8f9a5f707bf29ee83b8e38b90cf211b01a841591e47fd5848061d37fddf66669 poppler-0.12.4-12.el6_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 31 Aug 2017 18:49:52 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:2534 Important CentOS 6 thunderbird Security Update Message-ID: <20170831184952.GA34820(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:2534 Important Upstream details at : https://access.redhat.com/errata/RHSA-2017:2534 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 96494a6bbf9295994238419e7b7e9d0f32bd34771f06b54f0f0d06439c72f95e thunderbird-52.3.0-1.el6.centos.i686.rpm x86_64: 6afe985ea385fb5549fcb8ed89fff3cb4ceacf121de067e809e88da57daa5c48 thunderbird-52.3.0-1.el6.centos.x86_64.rpm Source: 369ece0043d2781f548a3fe74c097d222f6e9afabd2e7f38a07c476f10dd9cb7 thunderbird-52.3.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Thu, 31 Aug 2017 18:50:28 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:2563 Moderate CentOS 6 openssh Security Update Message-ID: <20170831185028.GA35127(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:2563 Moderate Upstream details at : https://access.redhat.com/errata/RHSA-2017:2563 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 7fcc14482bde0ffd56256a95d4e9fb1adde76ff3bd4e51bca62d991216637a41 openssh-5.3p1-123.el6_9.i686.rpm 0b7200aa9e46618664f5ce4418d8dc2a3536246ce4c05a8d49c87a91a2e65c4c openssh-askpass-5.3p1-123.el6_9.i686.rpm 38117542a8fbe8ed16604704c90009c0317759f67de4329b644f1741e72c98fb openssh-clients-5.3p1-123.el6_9.i686.rpm 9446db394224c7ad6b155386d690b5992115d1c0cc2a1e6c324f8db313faffa2 openssh-ldap-5.3p1-123.el6_9.i686.rpm 1b4954075f7f4364460e35cdd4c76c9bdd0f8a6ab5bb7e2ef04cbee9c1098aaa openssh-server-5.3p1-123.el6_9.i686.rpm 318fe5d62ad947c5090fd36310e6938a1f0de93bd2b9b9c490c2bbf2ba9bd65d pam_ssh_agent_auth-0.9.3-123.el6_9.i686.rpm x86_64: ca4e9591f2670255c532f2be9b229eff12799006d60aefd7decdf68ab555975c openssh-5.3p1-123.el6_9.x86_64.rpm 5a8b1a467d7836300f53b54e1e96bdaa93cf8df93cd730729f6d5e430f61a8f5 openssh-askpass-5.3p1-123.el6_9.x86_64.rpm 5c7ac733ef43bdd9169c9ba26d2e44d273496508649c30acf2c119c8ee4dd7d0 openssh-clients-5.3p1-123.el6_9.x86_64.rpm 1c4c57bb410082a30401cd68e492d13d3b58577afa604e9ae79114468f61b006 openssh-ldap-5.3p1-123.el6_9.x86_64.rpm 69b18041197c4be9a2812bbea1fc92f94b45d7adca0dd9c308f87dde7743ac06 openssh-server-5.3p1-123.el6_9.x86_64.rpm 318fe5d62ad947c5090fd36310e6938a1f0de93bd2b9b9c490c2bbf2ba9bd65d pam_ssh_agent_auth-0.9.3-123.el6_9.i686.rpm f87bed409bfde8b91268589a1c32da959cba0bae5a555bed2150c2a4667723f3 pam_ssh_agent_auth-0.9.3-123.el6_9.x86_64.rpm Source: 4c78bd24259d3604ffbf905642dbf44d209c3997696cfc443eae7885a8d9a53a openssh-5.3p1-123.el6_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 151, Issue 1 ***********************************************

1 0

Syncronize systemctl status with reality?
by Leroy Tennison 30 Aug '17

30 Aug '17

The particular issue is with puppetmaster (which admittedly takes 4 minutes to actually start, setting TimeoutStartSec=300 in it's unit file stopped the false timeout report) but I have seen it one other time (don't remember the details). systemctl status puppetmaster ● puppetmaster.service - Puppet master Loaded: loaded (/lib/systemd/system/puppetmaster.service; enabled; vendor preset: enabled) Active: failed (Result: resources) since Tue 2017-08-29 11:24:36 CDT; 22min ago Process: 897 ExecStart=/usr/bin/puppet master (code=exited, status=0/SUCCESS) Aug 29 11:22:39 puppetmaster02 systemd[1]: Starting Puppet master... Aug 29 11:24:36 puppetmaster02 puppet-master[1233]: Reopening log files Aug 29 11:24:36 puppetmaster02 puppet-master[1233]: Starting Puppet master version 3.8.5 Aug 29 11:24:36 puppetmaster02 puppet-master[1233]: Could not run: Address already in use - listen(2) Aug 29 11:24:36 puppetmaster02 systemd[1]: puppetmaster.service: PID 1233 read from file /run/puppet/master.pid does not exist or is a zombie. Aug 29 11:24:36 puppetmaster02 systemd[1]: Failed to start Puppet master. Aug 29 11:24:36 puppetmaster02 systemd[1]: puppetmaster.service: Unit entered failed state. Aug 29 11:24:36 puppetmaster02 systemd[1]: puppetmaster.service: Failed with result 'resources'. However, ps -ef | grep puppet (run just after the above) returns puppet 1380 1 0 11:26 ? 00:00:08 Passenger RubyApp: /usr/share/puppet/rack/puppetmasterd root 2015 1341 0 11:48 pts/0 00:00:00 grep --color=auto puppet Earlier ps .. also reported puppet 1355 1166 3 11:26 ? 00:00:01 Passenger AppPreloader: /usr/share/puppet/rack/puppetmasterd And, the "bottom line", puppet agent -t on a client works. It reports finishing the catalog run and the client's yaml files on puppetmaster are up to date. Is there a command to tell systemd to re-scan running state and update its understanding on what it finds? I tried systemctl daemon-reload just to be sure that didn't solve the problem before posting this.

3 5

A potentially newbie question about vulnerability patching speed in CentOS 7.x's yum repository
by 知乎申诉处理 30 Aug '17

30 Aug '17

I've been dubbing with management of security vulnerabilities and their fixes for a while, recently I discovered there may be a delay in the process of software updates made available on CentOS yum repository. take CVE-2017-5335 for example: In redhat official notice board :https://access.redhat.com/security/cve/cve-2017-5335 we can see there is a link point to advisory for RHEL 7: https://access.redhat.com/errata/RHSA-2017:2292 . from there we can see that the fix happens at gnutls 3.3.26. But when trying to update with yum update from a CentOS 7.3 x64 machine. there is no 3.3.26 available. Only available rpm for CentOS 7.3.1611 for x86_64 is gnutls-3.3.24. This result can be verified using rpm finder: https://www.rpmfind.net/linux/rpm2html/search.php?query=gnutls Same problem happens to other software packages such as: glibc tcpdump libnl mariadb ... (and many others) Why is that? and are those software packages not going to get fixed? - p.s. please excuse me for any formating issues. :) Jeff

3 2

Centos 6 Airprint using CUPS/Avahi
by Gary Stainburn 29 Aug '17

29 Aug '17

I've set up another airprint server, but this time I've had to use Centos 6 because of the age of the kit I'm using - an old 1U rack server. I've configured CUPS and also Avahi. I've run airprint-generate.py and copied the .service files to /etc/avahi/services/ Everything looks fine until I try to print from my IPhone. I usually test by trying to print an email. As soon as I go to search / select a printer I get the following start to appear in /var/log/cups/error_log E [29/Aug/2017:15:24:07 +0100] Request from "10.1.103.237" using invalid Host: field "harpo.local:631" The printer list appears and I can select a printer and click on print. However nothing prints off, and I just keep getting the above error message. I've tried setting [server] host-name=harpo domain-name=ringways.co.uk in /etc/avahi/avahi-daemon.conf but that just prevents Avahi from starting. Can anyone suggest what I need to do to get Avahi and CUPS to be friendly? Gary -- https://fundraise.cancerresearchuk.org/page/garys-march-march

1 0

ALPN and Http/2, CentOS 7.4
by SternData 29 Aug '17

29 Aug '17

Now that 7.4 CR has delivered OpenSSL 1.0.2, I should be able to serve http/2 pages to Chrome, but I still see messages that ALPN is not enabled. OpenSSL 1.0.2 is installed: $ rpm -qa |grep openssl openssl-libs-1.0.2k-8.el7.x86_64 openssl-1.0.2k-8.el7.x86_64 But https://tools.keycdn.com/http2-test says "www.stevenstern.me" supports http 2 but ALPN is not supported. Ideas? Does anything need to be explicitly enabled for ALPN? As I mentioned, the http2 stuff seems to be working. -- -- Steve

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss