Discuss

discuss@lists.centos.org

12 participants
34747 discussions

amanda and selinux
by Jon LaBadie 21 Jan '17

21 Jan '17

Anyone familiar with the selinux policy for the amanda backup software package? I'm getting lots of data not being backed up. For example, under /home there are 2 directory trees owned by root. Those get backed up, user home dirs do not. No AVC denials nor messages in /var/log/messages or journalctl log. But if I turn off selinux enforcing, or set amanda_t type to permissive, complete backups are made. I expected the selinux policy would have allowed amanda to be able to read all files. Else, how does one make backups? I'm seeing this on CentOS 7.2, Fedora 24 & 25. Amanda packages from the respective distro repos. As far as I can tell, the selinux policies are the same in all three. But then, I know little selinux speak. Jon -- Jon H. LaBadie jon(a)jgcomp.com 11226 South Shore Rd. (703) 787-0688 (H) Reston, VA 20190 (703) 935-6720 (C)

2 2

Can/should I mix entropy sources?
by Steve Snyder 20 Jan '17

20 Jan '17

I've got 2 sources of entropy in my CentOS7 system, a hardware RNG and the Intel rdrand instruction. Is it advisable to just use a single source or can/should I mix the 2 sources? If I mix the 2 sources how is it done? Presumably I could use the rngd service to handle the Intel source, but would it be a problem if 2 entities were writing to the entropy pool? Thanks.

1 0

SSSD cache case-sensitivity
by Robbert Eggermont 20 Jan '17

20 Jan '17

Dear all, I'm running CentOS 7.3 with SSSD. I'm using sssd-ad to talk to an AD backend. Group names in the AD contain capitals. When sssd-ad is working normally, group names returned are all lowercase. However, when the AD backend goes offline, group names returned from the SSSD cache contain capitals. The change in case breaks stuff (sshd's AllowGroups, for one). Has anybody else seen this behavior? Is there a way to make the group names uniform, whether they come from sssd-ad or the cache? Best, Robbert -- Robbert Eggermont Intelligent Systems R.Eggermont(a)tudelft.nl Electr.Eng., Mathematics & Comp.Science +31 15 27 83234 Delft University of Technology

3 4

CentOS 7 httpd cgi script file not able to write to /tmp
by Jerry Geis 20 Jan '17

20 Jan '17

Hi all, I have a script running in httpd. The script runs fine. However I want to "echo" some debug information into a file. The file is never created. Is there some security thing that has to be enable/disabled to allow a script in httpd to write to a file? Thanks, Jerry

4 5

CentOS-announce Digest, Vol 143, Issue 8
by centos-announce-request＠centos.org 20 Jan '17

20 Jan '17

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2017:0086 Important CentOS 7 kernel Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 Jan 2017 13:30:14 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2017:0086 Important CentOS 7 kernel Security Update Message-ID: <20170119133014.GA30129(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2017:0086 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2017-0086.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: a301e9bd95957c5af03b85f8612aaf2053de837e1805e6e649312da8f49f952d kernel-3.10.0-514.6.1.el7.x86_64.rpm dad8a63d9c77bb941a0424b49ff21b6cc67f56e667258fbb3ae8fe9bf61a2812 kernel-abi-whitelists-3.10.0-514.6.1.el7.noarch.rpm c0f9f36cfe07a52320ac47449654f70400bf73707760037106be9563a1428d56 kernel-debug-3.10.0-514.6.1.el7.x86_64.rpm 09bdd98395b85932b2c73151ff6d025608e4fe874eb8b2a70190a5171bddeda3 kernel-debug-devel-3.10.0-514.6.1.el7.x86_64.rpm 628011a5e1958516519b9c65de9cbe9c17e37cd1d1ec26b123f5ddcfa52ef28c kernel-devel-3.10.0-514.6.1.el7.x86_64.rpm cfccc9265a4450544ef7fe783259517b9b0926e0982cccaa292781a82e6a9aa2 kernel-doc-3.10.0-514.6.1.el7.noarch.rpm 50decaf498dccec72c9925ef0c009158fd6cb298fcd5ed9e8dc688e0aeaf3b3e kernel-headers-3.10.0-514.6.1.el7.x86_64.rpm 389bc2f1b0999c01dbc57278a8a5fb45d353899c2fbc404f73e15ae7cecbb907 kernel-tools-3.10.0-514.6.1.el7.x86_64.rpm b2b363e82c863c73dafa895601bdd1fa9aea72bbd3325e1a63e8fbdec6290b35 kernel-tools-libs-3.10.0-514.6.1.el7.x86_64.rpm 5c32cfb66d0b0fc4c6aa6530b70c0d2a65dd6d2631ee68364c1843196ddcf35d kernel-tools-libs-devel-3.10.0-514.6.1.el7.x86_64.rpm 0e49420a74763b655ebf9b0dfbd3d8d9cb8fca551e7f4cd052667b253630b921 perf-3.10.0-514.6.1.el7.x86_64.rpm ea6b2f457ed461d2e1b1b451b834510dc8869be78d7aa3d59fc730c819f6edc0 python-perf-3.10.0-514.6.1.el7.x86_64.rpm Source: cb4cf328e79357f0d0884ee1c84ff4a014554b6e0c9094b6d616cab540c43289 kernel-3.10.0-514.6.1.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 143, Issue 8 ***********************************************

1 0

[OT] VOIP
by TE Dukes 20 Jan '17

20 Jan '17

Hello, I changed ISPs a few weeks ago and now I'm on cable. In doing so, I lost the ability to use the DSL as a FAX line. So, I bought an OOMA. Turns out it uses a number of ports, three of which are reserved, 53 TCP/UDP, 110 TCP and 443 TCP. These ports have already been port forwarded from my cable modem/router to my server. I'm thinking this isn't going to work unless I change some ports on my server, which I'm not willing to do. I spent over 30 minutes with their support people last night. It appears the ports cannot be changed on the OOMA device. Are there any work arounds? TIA

3 4

SELinux upgrade
by Scott Robbins 19 Jan '17

19 Jan '17

Well, got hit by this too. Ironically, I don't use docker, I think I had it installed being pulled in for something else. So, tried the yum remove docker* but no go. When I do semanage port -a -t ssh_port_t -p tcp <port> I get an error Bad type declaration at /etc/selinux/targeted/tmp/modules/100/docker/cil:1 which is something that doesn't exist. Tried installing container-selinux, but so far, the only way to get SSH to work on a default port is to setenforce 0. This isn't a really important machine, but it is certainly annoying. -- Scott Robbins PGP keyID EB3467D6 ( 1B48 077D 66F6 9DB0 FDC2 A409 FA54 EB34 67D6 ) gpg --keyserver pgp.mit.edu --recv-keys EB3467D6

1 0

Increase CPU usage on HV after upgrade (7.2 -> 7.3)
by Subscriber 19 Jan '17

19 Jan '17

Hello , After upgrading the system from CentOS 7.2.1511 to CenOS 7.3.1611 I see that the average processing time has increased from 5-7% to 12-15% (doubled). Not critical but it is not pleasant. Server as KVM with 5 virtual machines. Someone noticed something similar? If so, how to fix that? Thx.

4 11

SELinux upgrade
by Marcin Trendota 19 Jan '17

19 Jan '17

Hello All After recent system upgrade (this night) i lost access to two servers through SSH, because of change in SELinux policy - i have ssh there on different port and now it's gone. Thanks to puppet i was able to change SSH port back to default and log in, but is this expected behavior? I thought minor upgrade shouldn't break up things? Or maybe "semanage port -a -t ssh_port_t -p tcp port" isn't enough to ensure persistency? -- Over And Out MoonWolf

6 7

Reliable way of having both LAN and WIFI on headless box
by Gary Stainburn 19 Jan '17

19 Jan '17

Once again I am building a headless Centos 7 box that needs to reliably be on both the LAN and WIFI network at all times. Amongst other things it's going to be an AirPrint bridge enabling IPads to print to printers on a different VLAN. I have asked about this before and got a solution working using nmtui to set up both the LAN and WIFI interface, and activate them. However, the WIFI link is unreliable. Sometimes it doesn't activate, or after a while de-activates. Sometimes it doesn't even appear in nmtui to enable me to activate it. Can anyone help me with how I can set up a more reliable server. Thanks Gary

9 15

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss