Discuss

discuss@lists.centos.org

2 participants
34758 discussions

Re: [CentOS] firewalld management on a headless server
by James B. Byrne 28 Mar '17

28 Mar '17

On Mon, March 27, 2017 17:31, m.roth(a)5-cent.us wrote: > Mike wrote: >> Nice catch, Mr. Schumacher ---> The following modules are included >> as >> standard with release 1.831 of Webmin. FirewallD firewalld.wbm.gz >> Configure a Linux firewall using FirewallD, by editing allowed >> services and ports. >> >> This is likely the right tool for the job. >> > Webmin used to be considered insecure, and people would scream and > yell if you suggested using it. Has that changed? Webmin is as insecure as the administrator cares to make it. Our host systems' Webmin instances listen on a reserved IP address different from the host's DNS entry and that address is only reachable through the host's firewall from specified IP addresses originating on our internal LAN. Further, Webmin is configured to automatically switch to https and use a certificate generated by our corporate private CA. Our gateway firewall blocks all access to the port assigned to Webmin. One has to tunnel in to one of the pre-determined host addresses to obtain remote access. A separate webmin logon is set in the webmin configuration which has no existence on the host system. Webmin can also be configured to restrict the hours and day that asccess is allowed to specific users but we have not bothered with that. The main known weakness is Webmin's dependency on passwords which for all I know is due to my ignorance. If Webmin does support RSA certificate authentication then I would love to be told where it is configured. However,failing that, very long phase phrases mitigate the password issue somewhat. Further, Webmin does support two-factor authentication using Google or Authy. To my knowledge there are no CVEs reported for Webmin since 2015 and I believe that all known problems are resolved in the present release. Which is not to say that there are no exploits left to be uncovered but then again we can hardly claim that about any software. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Re: [CentOS] firewalld management on a headless server
by Mike 28 Mar '17

28 Mar '17

Webmin used to be considered insecure, and people would scream and yell if you suggested using it. Has that changed? mark Ahh, I did not know of this. Well, I'm back to suggesting OP take a little time and get comfortable with firewall-cmd in the terminal. If we want our solid redhat clone then systemd, NetworkManager, and firewalld are soldered into the foreseeable future.

2 1

Does fail2ban protect anything other than SSH logins?
by Robert Moskowitz 27 Mar '17

27 Mar '17

I am looking at fail2ban, and all I see is it protecting remote logins to SSH. Does it protect any other access to systems? Well perhaps other than VNC perhaps? thank you

3 2

Systemd interface rename does not work
by Matt . 27 Mar '17

27 Mar '17

Hi, I'm moving to Systemd for my network management but I don't see my link name changed when I try to using a .link name. The .network file works right, networkmanager is removed as well to accomplish this. Any idea why the rename is not done ? /etc/systemd/network/0-eth.network [Match] MACAddress=00:1a:4a:a9:0a:17 [Network] Address=172.16.3.141/24 Gateway=172.16.3.254 DNS=172.16.3.1 DNS=172.16.3.2 /etc/systemd/network/0-eth.link [Match] MACAddress=00:1a:4a:a9:0a:17 [Link] Name=eth0

3 2

SNMP oddity
by Digimer 25 Mar '17

25 Mar '17

Hi all, Not sure if this is on topic or not. I'm trying to query an SNMP value from centos 6 and I get a bad response if I don't specify the MIB to use: 0 digimer@pulsar:~/anvil/striker$ snmpget -v2c -c public -m /home/digimer/Downloads/APC/AP7900/MIB/powernet421.mib 10.255.2.1 .1.3.6.1.2.1.2.2.1.6.2 RFC1213-MIB::ifPhysAddress.2 = Hex-STRING: 00 C0 B7 5F 8A 85 0 digimer@pulsar:~/anvil/striker$ snmpget -v2c -c public 10.255.2.1 .1.3.6.1.2.1.2.2.1.6.2 IF-MIB::ifPhysAddress.2 = STRING: 0:c0:b7:5f:8a:85 Note the second reply is not returning the first character (should be '00:', returning '0:'. Trying to request Hex doesn't seem to help, either: 0 digimer@pulsar:~/anvil/striker$ snmpget -v2c -c public -Ox 10.255.2.1 .1.3.6.1.2.1.2.2.1.6.2 IF-MIB::ifPhysAddress.2 = STRING: 0:c0:b7:5f:8a:85 Any SNMP folks know what I might be doing wrong? Thanks! -- Digimer Papers and Projects: https://alteeve.com/w/ "I am, somehow, less interested in the weight and convolutions of Einstein’s brain than in the near certainty that people of equal talent have lived and died in cotton fields and sweatshops." - Stephen Jay Gould

3 2

Disabling Firewall/iptables on CentOS 7??
by James Pifer 24 Mar '17

24 Mar '17

I apologize if this has been asked and answered, but I googled and attempted things for several hours today without success. I have a freshly installed CentOS 7 system that I'd like to disable the firewall and all iptables rules. Basically the equivalent of doing iptables -F In a nutshell I've tried the following commands, in many different ways and orders, but when the system restarts it still seems to end up with some form of default rules. It even has a couple rules specifying 192.168.122.0 and I can't figure out where it's coming from. #Disable Firewall systemctl stop firewalld systemctl disable firewalld rm '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service' rm '/etc/systemd/system/basic.target.wants/firewalld.service' systemctl disable firewalld systemctl stop firewalld iptables --flush iptables --list iptables -L yum install iptables-services service iptables save systemctl enable iptables service iptables save Any help is appreciated. Thanks James

3 3

polkit helper timeout and defunct pkla-check-authorization processes on CentOS 7.3
by Edgecombe, Jason 24 Mar '17

24 Mar '17

Hi everyone, We seem to be having issues on multiple CentOS 7.3 machines. The problem seems to revolve around polkitd. At some random time, polkitd seems to stop responding on my systems. Along with this, there might be hundreds of defunct pkla-check-authorization processes. If I reboot, then things are fine for a while. I don't see any activity in the unabridged journal to suggest anything that might be triggering polkitd. The puppet run finished 5 minutes before polkitd lost it's head. polkit version is polkit-0.112-11.el7_3.x86_64 Any help is appreciated. Thanks, Jason Here is some condensed output from the "journalctl -u polkit" command: Mar 09 04:02:14 myhost systemd[1]: Starting Authorization Manager... Mar 09 04:02:14 myhost polkitd[1018]: Started polkitd version 0.112 Mar 09 04:02:14 myhost polkitd[1018]: Loading rules from directory /etc/polkit-1/rules.d Mar 09 04:02:14 myhost polkitd[1018]: Loading rules from directory /usr/share/polkit-1/rules.d Mar 09 04:02:14 myhost polkitd[1018]: Finished loading, compiling and executing 7 rules Mar 09 04:02:14 myhost systemd[1]: Started Authorization Manager. Mar 09 04:02:14 myhost polkitd[1018]: Acquired the name org.freedesktop.PolicyKit1 on the system bus Mar 09 04:02:53 myhost polkitd[1018]: Registered Authentication Agent for unix-session:c1 (system bus name :1.41 [gnome-shell --mode=gdm], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) Mar 09 04:08:25 myhost polkitd[1018]: Reloading rules Mar 09 04:08:25 myhost polkitd[1018]: Collecting garbage unconditionally... Mar 09 04:08:25 myhost polkitd[1018]: Loading rules from directory /etc/polkit-1/rules.d Mar 09 04:08:25 myhost polkitd[1018]: Loading rules from directory /usr/share/polkit-1/rules.d Mar 09 04:08:25 myhost polkitd[1018]: Finished loading, compiling and executing 8 rules Mar 09 04:08:25 myhost polkitd[1018]: Reloading rules Mar 09 04:08:25 myhost polkitd[1018]: Collecting garbage unconditionally... Mar 09 04:08:25 myhost polkitd[1018]: Loading rules from directory /etc/polkit-1/rules.d Mar 09 04:08:25 myhost polkitd[1018]: Loading rules from directory /usr/share/polkit-1/rules.d Mar 09 04:08:25 myhost polkitd[1018]: Finished loading, compiling and executing 8 rules Mar 09 04:08:53 myhost polkitd[1018]: Reloading rules ... (snipped more rules loading) Mar 09 04:10:39 myhost polkitd[1018]: Collecting garbage unconditionally... Mar 09 04:10:39 myhost polkitd[1018]: Loading rules from directory /etc/polkit-1/rules.d Mar 09 04:10:39 myhost polkitd[1018]: Loading rules from directory /usr/share/polkit-1/rules.d Mar 09 04:10:39 myhost polkitd[1018]: Finished loading, compiling and executing 7 rules Mar 09 16:59:42 myhost polkitd[1018]: /etc/polkit-1/rules.d/49-polkit-pkla-compat.rules:21: Error: Error spawning helper: Timed out after 10 seconds (g-io-error-quark, 24) Mar 09 16:59:42 myhost polkitd[1018]: Error evaluating authorization rules Mar 10 04:13:34 myhost polkitd[1018]: /etc/polkit-1/rules.d/49-polkit-pkla-compat.rules:21: Error: Error spawning helper: Timed out after 10 seconds (g-io-error-quark, 24) Mar 10 04:13:34 myhost polkitd[1018]: Error evaluating authorization rules Mar 10 04:14:32 myhost polkitd[1018]: /etc/polkit-1/rules.d/49-polkit-pkla-compat.rules:21: Error: Error spawning helper: Timed out after 10 seconds (g-io-error-quark, 24) ... (snipped more lines about error evaluating rules)... --------------------------------------------------------------------------- Jason Edgecombe | Linux Administrator UNC Charlotte | The William States Lee College of Engineering 9201 University City Blvd. | Charlotte, NC 28223-0001 Phone: 704-687-1943 jwedgeco(a)uncc.edu | http://engr.uncc.edu | Facebook --------------------------------------------------------------------------- If you are not the intended recipient of this transmission or a person responsible for delivering it to the intended recipient, any disclosure, copying, distribution, or other use of any of the information in this transmission is strictly prohibited. If you have received this transmission in error, please notify me immediately by reply e-mail or by telephone at 704-687-1943. Thank you.

1 1

kerberized-nfs - any experts out there?
by Matt Garman 23 Mar '17

23 Mar '17

Is anyone on the list using kerberized-nfs on any kind of scale? I've been fighting with this for years. In general, when we have issues with this system, they are random and/or not repeatable. I've had very little luck with community support. I hope I don't offend by saying that! Rather, my belief is that these problems are very niche/esoteric, and so beyond the scope of typical community support. But I'd be delighted to be proven wrong! So this is more of a "meta" question: anyone out there have any general recommendations for how to get support on what I presume are niche problems specific to our environment? How is paid upstream support? Just to give a little insight into our issues: we have an in-house-developed compute job dispatching system. Say a user has 100s of analysis jobs he wants to run, he submits them to a central master process, which in turn dispatches them to a "farm" of >100 compute nodes. All these nodes have two different krb5p NFS mounts, to which the jobs will read and write. So while the users can technically log in directly to the compute nodes, in practice they never do. The logins are only "implicit" when the job dispatching system does a behind-the-scenes ssh to kick off these processes. Just to give some "flavor" to the kinds of issues we're facing, what tends to crop up are one of three things: (1) Random crashes. These are full-on kernel trace dumps followed by an automatic reboot. This was really bad under CentOS 5. A random kernel upgrade magically fixed it. It happens almost never under CentOS 6. But happens fairly frequently under CentOS 7. (We're completely off CentOS 5 now, BTW.) (2) Permission denied issues. I have user Kerberos tickets configured for 70 days. But there is clearly some kind of undocumented kernel caching going on. Looking at the Kerberos server logs, it looks like it "could" be a performance issue, as I see 100s of ticket requests within the same second when someone tries to launch a lot of jobs. Many of these will fail with "permission denied" but if they immediately re-try, it works. Related to this, I have been unable to figure out what creates and deletes the /tmp/krb5cc_uid_random files. (3) Kerberized NFS shares getting "stuck" for one or more users. We have another monitoring app (in-house developed) that, among other things, makes periodic checks of these NFS mounts. It does so by forking and doing a simple "ls" command. This is to ensure that these mounts are alive and well. Sometimes, the "ls" command gets stuck to the point where it can't even be killed via "kill -9". Only a reboot fixes it. But the mount is only stuck for the user running the monitoring app. Or sometimes the monitoring app is fine, but an actual user's processes will get stuck in "D" state (in top, means waiting on IO), but everyone else's jobs (and access to the kerberizes nfs shares) are OK. This is actually blocking us from upgrading to CentOS 7. But my colleagues and I are at a loss how to solve this. So this post is really more of a semi-desperate plea for any kind of advice. What other resources might we consider? Paid support is not out of the question (within reason). Are there any "super specialist" consultants out there who deal in Kerberized NFS? Thanks! Matt

4 5

KVM guest fails to boot cleanly
by James B. Byrne 22 Mar '17

22 Mar '17

I have a KVM vm running CentOS-6.8 on a host also running CentOS-6.8. This instance is used for occasional development projects which require segregation. Thus it is seldom accessed. At some point in the recent past this guest developed an issue with starting. Specifically these messages were found in the system log files: /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_cm_xnet245.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_00' [32.00 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_01' [32.00 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_02' [32.00 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet242.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet243.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet244.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages-20170312:Mar 10 16:31:06 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet245.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_cm_xnet245.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_00' [32.00 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_01' [32.00 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet241.harte-lyne.ca_02' [32.00 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet242.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet243.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet244.harte-lyne.ca_00' [31.25 GiB] inherit /var/log/messages:Mar 20 08:52:10 vhost04 kernel: dracut: inactive '/dev/vg_vhost04/lv_vm_xnet245.harte-lyne.ca_00' [31.25 GiB] inherit It appears that this issue was first encountered on March 10 as our log files go back much further than that and have no earlier record. The symptom presented on the guest console during boot is: Error 13: Invalid or unsupported executable format Press any key to continue... Pressing enter brings up the following text display GNU GRUB version 0.97 (615K lower / 3668980K upper memory) CentOS (2.6.32-641.15.1.el6.x86_64) CentOS (2.6.32-641.13.1.el6.x86_64) CentOS (2.6.32-641.11.1.el6.x86_64) CentOS (2.6.32-641.2.1.el6.x86_64) Use the ↑ and ↓ keys to select which entry is highlighted Press enter to boot the selected OS, 'e' to edit . . . The first choice repeats the Error. The second choice boots cleanly. Looking at yum history I see this: yum history Loaded plugins: etckeeper, fastestmirror, priorities, refresh-packagekit, security ID | Login user | Date and time | Action(s) | Altered --------------------------------------------------------------------- . . . 368 | root <root> | 2017-03-10 16:46 | Update | 4 367 | root <root> | 2017-03-10 16:42 | E, U | 35 EE . . . Looking at transaction 367 more closely we see that the kernel was updated to 2.6.32-642.15.1.el6.x86_64 on March 10 but that a number or errors, whose nature I do not comprehend, were also reported. # yum history info 367 Loaded plugins: etckeeper, fastestmirror, priorities, refresh-packagekit, security Transaction ID : 367 Begin time : Fri Mar 10 16:42:32 2017 Begin rpmdb : 1489:fd0eb9a01b1667f826b8fead9bc0a05e5bc43efd End time : 16:43:59 2017 (87 seconds) End rpmdb : 1461:cac690d6280fa97910ccb59d0d1f6d43990dfd0a User : root <root> Return-Code : Success Transaction performed with: Installed rpm-4.8.0-55.el6.x86_64 @base Installed yum-3.2.29-75.el6.centos.noarch @updates Installed yum-metadata-parser-1.1.2-16.el6.x86_64 @anaconda-CentOS-201207061011.x86_64/6.3 Installed yum-plugin-fastestmirror-1.1.30-37.el6.noarch @base Installed yum-utils-1.1.30-37.el6.noarch @base Packages Altered: Updated firefox-45.7.0-1.el6.centos.x86_64 @updates Update 45.7.0-2.el6.centos.x86_64 @updates Updated gnome-settings-daemon-2.28.2-35.el6.x86_64 @base Update 2.28.2-35.el6_8.2.x86_64 @updates Erase initscripts-9.03.53-1.el6.centos.1.x86_64 @updates Erase kernel-2.6.32-642.4.2.el6.x86_64 @updates Erase kernel-firmware-2.6.32-642.13.1.el6.noarch @updates Updated kernel-headers-2.6.32-642.13.1.el6.x86_64 @updates Update 2.6.32-642.15.1.el6.x86_64 @updates Updated kexec-tools-2.0.0-300.el6_8.1.x86_64 @updates Update 2.0.0-300.el6_8.2.x86_64 @updates Erase libbasicobjects-0.1.1-11.el6.x86_64 @base Erase libblkid-2.17.2-12.24.el6_8.1.x86_64 @updates Erase libcollection-0.6.2-11.el6.x86_64 @base Erase libdhash-0.4.3-11.el6.x86_64 @base Erase libini_config-1.1.0-11.el6.x86_64 @base Erase libipa_hbac-1.13.3-22.el6_8.4.x86_64 @updates Erase libpath_utils-0.2.1-11.el6.x86_64 @base Erase libref_array-0.1.4-11.el6.x86_64 @base Erase libsss_idmap-1.13.3-22.el6_8.4.x86_64 @updates Erase libuuid-2.17.2-12.24.el6_8.1.x86_64 @updates Updated openssl-1.0.1e-48.el6_8.3.i686 @updates Erase openssl-1.0.1e-48.el6_8.3.x86_64 @updates Update openssl-1.0.1e-48.el6_8.4.i686 @updates Updated openssl-devel-1.0.1e-48.el6_8.3.x86_64 @updates Update 1.0.1e-48.el6_8.4.x86_64 @updates Updated python-libipa_hbac-1.13.3-22.el6_8.4.x86_64 @updates Update 1.13.3-22.el6_8.6.x86_64 @updates Erase python-sssdconfig-1.13.3-22.el6_8.4.noarch @updates Erase selinux-policy-3.7.19-292.el6_8.2.noarch @updates Erase selinux-policy-targeted-3.7.19-292.el6_8.2.noarch @updates Erase sssd-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-ad-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-client-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-common-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-common-pac-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-ipa-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-krb5-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-krb5-common-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-ldap-1.13.3-22.el6_8.4.x86_64 @updates Erase sssd-proxy-1.13.3-22.el6_8.4.x86_64 @updates Erase util-linux-ng-2.17.2-12.24.el6_8.1.x86_64 @updates Scriptlet output: 1 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/weak-updates failed: No such file or directory 2 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/modules.order failed: No such file or directory 3 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/modules.networking failed: No such file or directory 4 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/modules.modesetting failed: No such file or directory 5 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/modules.drm failed: No such file or directory 6 warning: erase unlink of /lib/modules/2.6.32-642.4.2.el6.x86_64/modules.block failed: No such file or directory Reviewing grub.conf I note that the initrd entry is missing from the newest kernel entry. Which of course explains the boot error message. However, as kernel updates are entirely automated when performed by yum I am at a lost to explain its absence. default=saved fallback= 0 1 2 timeout=5 splashimage=(hd0,0)/grub/splash.xpm.gz hiddenmenu title CentOS (2.6.32-642.15.1.el6.x86_64) root (hd0,0) kernel /vmlinuz-2.6.32-642.15.1.el6.x86_64 ro root=/dev/mapper/vg_xnet241-lv_root rd_NO_LUKS LANG=en_CA(a)yyyy-mmm-dd.UTF-8 rd_LVM_LV=vg_xnet241/lv_swap rd_LVM_LV=vg_xnet241/lv_root rd_NO_MD SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet crashkernel=auto radeon.modeset=0 title CentOS (2.6.32-642.13.1.el6.x86_64) root (hd0,0) kernel /vmlinuz-2.6.32-642.13.1.el6.x86_64 ro root=/dev/mapper/vg_xnet241-lv_root rd_NO_LUKS LANG=en_CA(a)yyyy-mmm-dd.UTF-8 rd_LVM_LV=vg_xnet241/lv_swap rd_LVM_LV=vg_xnet241/lv_root rd_NO_MD SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet crashkernel=auto radeon.modeset=0 initrd /initramfs-2.6.32-642.13.1.el6.x86_64.img There is no initramfs-2.6.32-642.15.1.el6.x86_64.img file present in /boot so something is seriously wrong somewhere. As shown above I have since reconfigured grub.conf to fallback to the last working kernel. Nonetheless, I would like guidance on how to proceed with fixing/removing the broken one. Suggestions? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Centos 7.3.1611 - NetworkManager + dhcp + ipv6
by Diaulas Castro 22 Mar '17

22 Mar '17

Used steps on sysctl from Centos7 FAQ (https://wiki.centos.org/FAQ/CentOS7) and some gathered on internet # cat /etc/sysctl.d/90-disable_ipv6.conf net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 net.ipv6.conf.eth0.disable_ipv6=1 net.ipv6.conf.eth1.disable_ipv6=1 net.ipv6.conf.all.use_tempaddr=0 net.ipv6.conf.all.autoconf=0 net.ipv6.conf.all.accept_ra=0 net.ipv6.conf.default.autoconf=0 net.ipv6.conf.default.accept_ra=0 net.ipv6.conf.eth0.autoconf=0 net.ipv6.conf.eth1.autoconf=0 But with dhcp, NetworkManager (or something) reenables ipv6 on interfaces. #sysctl -a | grep ipv6 | grep disable net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.eth0.disable_ipv6 = 0 net.ipv6.conf.eth1.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1 And the interface gets the ipv4 but still have temporary ipv6 on it (our dhcp doesnt support ipv6) # ip a s eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 link/ether 00:0c:29:31:5a:9d brd ff:ff:ff:ff:ff:ff inet 10.10.216.247/24 brd 10.10.216.255 scope global dynamic eth0 valid_lft 451sec preferred_lft 451sec inet6 fe80::20c:29ff:fe31:5a9d/64 scope link valid_lft forever preferred_lft forever And this bugs my use for ovftool with the option "--X:waitForIp" because it's returns (mostly of times) the ipv6 addr It's a bug, missing documentation or my

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss