Discuss

discuss@lists.centos.org

11 participants
34747 discussions

SAN certificates for multiple domains and multiple services
by Nicolas Kovacs 28 Apr '17

28 Apr '17

Hi, I'm currently installing and configuring CentOS 7 on a public server. The machine will host a few small-to-midsize projects that are currently running on a handful of Slackware servers: public library databases, our public school's agenda, a small webradio, OwnCloud for myself and a local non-profit, etc. Until recently I've mostly used self-signed SSL certificates for stuff needing a secure connection. Then, some time ago, I discovered LetsEncrypt and Certbot, which works very well, so I moved secure web hosting to using a free LetsEncrypt certificate. Now I want to take this to the next level and use these free certificates for multiple services. Not only web hosting, but also Postfix/Dovecot for mail and Prosody for XMPP. I had to fiddle a bit for permissions, so everything can access the certificate and key files right. I created a certs group and gave everything under /etc/letsencrypt/live to root:certs. Then, when a system user has to access this stuff, I simply add him to the certs group. Then came a moment when I hit a wall, because Postfix can't handle multiple certificates, only one. Let's say I have these domains on my server: * example1.com * example2.com * example1.net * example2.net When setting up Postfix, I can do one of these things: 1. continue to use a self-signed SSL certificate 2. choose one "preferred" domain on my server 3. setup multi-domain (SAN) certificates I tried the SAN certificates (after experimenting a lot and getting it right), and this stuff seems to work. I have one big bundle of certificates stored under /etc/letsencrypt/live/sd-41XXX.dedibox.fr (sd-41XXX.dedibox.fr being my server's FQDN), and I have all the certificates for all domains and subdomains of example1.com, example2.com, example1.net and example2.net. So before I go any further with this, I'm asking the more technically proficient admins here. Are there any drawbacks to using this solution? Is it problematic to bundle all my certificates into one big fat SAN certificate? This being said, the machine will host a maximum of two dozen domains, each with a handful of subdomains like mail.example1.com, xmpp.example1.com, etc.) Cheers, Niki Kovacs -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Web : http://www.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

sha256sum a dvd
by James B. Byrne 27 Apr '17

27 Apr '17

CentOS-6.9 I am trying to verify a locally created dvd. I am using sha256sum in this fashion: sha256sum /dev/sr0 Which gave this result: sha256sum: /dev/sr0: Input/output error So I tried this: sha256sum /dev/cdrom Which, after some time, also produces: sha256sum: /dev/cdrom: Input/output error What does this mean and how do I fix it? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

5 4

CentOS version
by Larry Martell 27 Apr '17

27 Apr '17

I am trying to find out what version of CentOS is running at a customer site, but I do not have remote access and there is no one there to run anything for me. But I do have a dmesg output and I see this: Linux version 3.10.0-327.22.2.el7.x86_64 (builder(a)kbuilder.dev.centos.org) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Jun 23 17:05:11 UTC 2016 >From that can someone tell me what the CentOS version is?

3 3

Re: [CentOS] can't create printers after upgrading cups
by Vanhorn, Mike 26 Apr '17

26 Apr '17

It looks like this may just be a bug upstream: https://access.redhat.com/solutions/3001891 Still trying the work-arounds. --- Mike VanHorn Senior Computer Systems Administrator College of Engineering and Computer Science Wright State University 265 Russ Engineering Center 937-775-5157 michael.vanhorn(a)wright.edu On 4/26/17, 9:51 AM, "CentOS on behalf of Vanhorn, Mike" <centos-bounces(a)centos.org on behalf of michael.vanhorn(a)wright.edu> wrote: After upgrading cups on my CentOS 6 systems from version 1.4.2-72.el6 to 1.4.2-77.el6, I am no longer able to create working printers, either with lpadmin from the command line or with system-config-printer. When I try to run lpadmin, I get this simple error: [root@vlsi66 ~]# lpadmin -p newprinter -v lpd://printserver/serverqueue-E -P /path/to/ppd/thing.ppd lpadmin: Unknown [root@vlsi66 ~]# Sometimes, the printer does get created (i.e. it shows up in the output of ‘lpstat –a’ and printers.conf gets updated), but sometimes it doesn’t. If the printer does get created, then there is no new ppd in /etc/cups/ppd. If I try to create the printer using system-config-printer, I get an error of CUPS server error (adding printer newprinter) There was an error during the CUPS operation: ‘server-error-service-unavailable’. I’ve looked at file and directory permissions, and checked that cupsd is, in fact, running. There is nothing obvious in the logs, except for this, which happens at exactly the time the printer should get created: localhost - - [26/Apr/2017:09:34:01 -0400] "POST /admin/ HTTP/1.1" 401 0 - - This also occurs if I access localhost:631 from a web browser; and everything works fine up to the point of “Add Printer”, and then the web page shows and Error: box with “Unknown” (from the lpadmin command), and the 401 error shows up in the log. I can’t figure out why it would be a 401 (unauthorized), since everything else worked. Has anyone else run into this problem, where you can’t create a new printer? Thanks! --- Mike VanHorn Senior Computer Systems Administrator College of Engineering and Computer Science Wright State University 265 Russ Engineering Center 937-775-5157 michael.vanhorn(a)wright.edu _______________________________________________ CentOS mailing list CentOS(a)centos.org https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.centos.org_mailm…

1 0

can't create printers after upgrading cups
by Vanhorn, Mike 26 Apr '17

26 Apr '17

After upgrading cups on my CentOS 6 systems from version 1.4.2-72.el6 to 1.4.2-77.el6, I am no longer able to create working printers, either with lpadmin from the command line or with system-config-printer. When I try to run lpadmin, I get this simple error: [root@vlsi66 ~]# lpadmin -p newprinter -v lpd://printserver/serverqueue-E -P /path/to/ppd/thing.ppd lpadmin: Unknown [root@vlsi66 ~]# Sometimes, the printer does get created (i.e. it shows up in the output of ‘lpstat –a’ and printers.conf gets updated), but sometimes it doesn’t. If the printer does get created, then there is no new ppd in /etc/cups/ppd. If I try to create the printer using system-config-printer, I get an error of CUPS server error (adding printer newprinter) There was an error during the CUPS operation: ‘server-error-service-unavailable’. I’ve looked at file and directory permissions, and checked that cupsd is, in fact, running. There is nothing obvious in the logs, except for this, which happens at exactly the time the printer should get created: localhost - - [26/Apr/2017:09:34:01 -0400] "POST /admin/ HTTP/1.1" 401 0 - - This also occurs if I access localhost:631 from a web browser; and everything works fine up to the point of “Add Printer”, and then the web page shows and Error: box with “Unknown” (from the lpadmin command), and the 401 error shows up in the log. I can’t figure out why it would be a 401 (unauthorized), since everything else worked. Has anyone else run into this problem, where you can’t create a new printer? Thanks! --- Mike VanHorn Senior Computer Systems Administrator College of Engineering and Computer Science Wright State University 265 Russ Engineering Center 937-775-5157 michael.vanhorn(a)wright.edu

1 0

rsyslog and zipping up "rotated" files
by Ian Diddams 26 Apr '17

26 Apr '17

I have a rsyslog config that suffixes the date to the filename and holds the log files in a non stabdard log directory based on its srver name (long story). Example - config includes: ... $template mailLog,"/var/log/external/%fromhost%/maillog-%$YEAR%%$MONTH%%$DAY%.log"... # Log all the mail messages in one place.mail.* -?mailLog... so that I get over time .. /var/log/external/server/maillog-20170424.log /var/log/external/server/maillog-20170425.log /var/log/external/server/maillog-20170426.log etc. Over time of course these build up, so i have a cronjob to trim any such logs okder than 30 days. To also save on space I copmpress all the files except todays via a cronjobbed script. so in fact I get ... /var/log/external/server/maillog-20170424.log.gz /var/log/external/server/maillog-20170425.log.gz /var/log/external/server/maillog-20170426.log My questions are therefore... - is there a way for rsyslog to compress these logs once a new log is created at midnight - is theer a way for rsyslog to remove any logs older than 30 days? I am of course aware that logrotate does this also, but for the purposes of m,y enquiry I am only interested in using rsyslog if at all possible. I expect the removing of older, zipped logs via rsyslog isn;t available. But the pssibility of zipping files would be of great interest. cheers Ian

1 0

saslauth logging
by Jobst Schmalenbach 26 Apr '17

26 Apr '17

Hi Not sure whether this is the correct list to ask ... if it's not please direct me to the correct one. Is it possible on to log a bit more detail when auth failure occurs when using saslauthd? saslauthd[2119]: do_auth : auth failure: [user=DELETED] [service=smtp] [realm=DELETED] [mech=pam] [reason=PAM auth error] What I want is the IP address and if possible the incorrect password (just to see how far they are off). Is this possible? thanks Jobst -- If a pig loses its voice, is it disgruntled? | |0| | Jobst Schmalenbach | | |0| jobst(a)barrett.com.au |0|0|0| General Manager

4 6

kde panels not retaining launcher icon
by geo.inbox.ignored 26 Apr '17

26 Apr '17

greetings one and all. new install of centos 6.8. 3 kde panels @ left, top, right sides. left and top panel are for program selection. right panel for active running programs. added 'launcher' icons to left and top panels, but panels are not retaining launcher icons. when i close kde to save ~/.kde file and reopen kde, 1, 2, or all 3 panels will be missing launcher. has anyone else seen such or know of cure? much help appreciated. tia. -- The important thing is not to stop questioning. - Albert Einstein CentOS GNU/Linux 6.8 -- KDE 4.3.4 Firefox 45.7.0 -- Thunderbird 45.6.0 GNUCash 2.4.15 -- zoneminder 1.30.0 peace out. tc,hago. g . =+= Tired of having your microsoft os hacked? Change to Linux os, used by microsoft hackers. =+= in a world with out fences, who needs gates. =+=

1 0

Odd disk automount issue on C7.3.1611
by Lamar Owen 25 Apr '17

25 Apr '17

I'm posting here before going through all the fun to do up a real bug report to see if anyone else has seen this behavior. I have two identical Dynex external USB3 drive enclosures with identical 3TB drives in each enclosure. The dmesg output shows: $ dmesg |grep TOSHIBA [ 59.942546] scsi 7:0:0:0: Direct-Access TOSHIBA DT01ACA300 PQ: 0 ANSI: 6 [ 86.301123] scsi 8:0:0:0: Direct-Access TOSHIBA DT01ACA300 PQ: 0 ANSI: 6 $ HOWEVER, the 'Disks' utility program only sees the first one plugged-in, and not the second one. It doesn't matter which one I plug in first; the second one won't get seen by Disks nor will it get automounted. It doesn't even do the 'USB device inserted' sound, for that matter. As another oddity, one of the drives has a LUKS-encrypted ext4 filesystem; the other has an XFS filesystem; if I plug in the XFS-formatted drive first, the LUKS-encrypted on will no longer automount even if the XFS-formatted drive is unmounted and unplugged first, but the the converse does work (mount LUKS+ext4; unmount and unplug; plug in XFS, it gets automounted). If I plug in the LUKS+ext4 disk first, enter the passphrase, and let it mount, then plug in the XFS drive, I can then manually (from the command line) mount it just fine and both drives work just fine. Both drives work fine when used singly, but not when both are plugged-in. So, has anyone else seen this? I don't mind filing a bug report, but I am at a bit of a loss as to what component to file it under. I haven't dug into too many logs or other files as yet, but I can if I need to do so. I ran into this making an encrypted copy of the contents of the XFS disk, which will be wiped and reformated LUKS+ext4, and I'd like to make these two drives back each other up. If I plug in a different USB3 drive, such as my 4TB Seagate, everything works as expected; it seems to only be the identical drives that confuse whatever process is detecting this. -- Lamar Owen Chief Information Officer Pisgah Astronomical Research Institute 1 PARI Drive Rosman, NC 28772 828-862-5554 www.pari.edu

1 0

Bonding mode balance-alb (6): How to control the assigned MAC address?
by Frank Thommen 25 Apr '17

25 Apr '17

Hi, we are trying to switch our bonding modes from 1 (active-backup) to 6 (balance-alb). However it seems, that these bond devices are not always getting the MAC address from the same slave. Sometimes the device gets the MAC address of the first and sometimes of the second slave. Since only the MAC address of the first slave device is (can be) registered in DHCP, this breaks connectivity (about) every second time we boot the computer. Is there a way to control which MAC address is assigned to the bonding device w/o configuring it explicitely in the ifcfg file? Cheers frank

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss