Discuss

discuss@lists.centos.org

34753 discussions

SSH Weak Ciphers
by Clint Dilks 20 Oct '16

20 Oct '16

Hi, In a recent security review some systems I manage were flagged due to supporting "weak" ciphers, specifically the ones listed below. So first question is are people generally modifying the list of ciphers supported by the ssh client and sshd? On CentOS 6 currently it looks like if I remove all the ciphers they are concerned about then I am left with Ciphers aes128-ctr,aes192-ctr,aes256-ctr for both /etc/ssh/sshd_config and /etc/ssh/ssh_config. Is just using these three ciphers like to cause me any problems? Could having so few ciphers be creating a security concern itself? Thanks The following weak client-to-server encryption algorithms are supported by the remote service: rijndael-cbc(a)lysator.liu.se arcfour256 arcfour128 aes256-cbc 3des-cbc aes192-cbc blowfish-cbc cast128-cbc arcfour aes128-cbc The following weak server-to-client encryption algorithms are supported by the remote service: rijndael-cbc(a)lysator.liu.se arcfour256 arcfour128 aes256-cbc 3des-cbc aes192-cbc blowfish-cbc cast128-cbc arcfour aes128-cbc

9 18

Bacula Restore
by Alessandro Baggi 20 Oct '16

20 Oct '16

Hi list, another question about bacula, but this time about restoring backups. I've a server that I must backup every day. My plan is: from mon to sat incrimental backup and on sunday full backup. When I will perform a restore I must restore from last valid full backup and then all valid incremental backup from last backup to specific date. This server has aweb managed application where user can update data or delete data. Suppose that after a full backup, on monday the user upload a file and incrimental backup is performed. On tuesday the user remove the uploaded file and backup is performed. Suppose that I want perform a restore of these jobs. I restore full, mon-incr and I found on restore path file uploaded on monday. When restoring tuesday incr (where the uploaded file was not present), on restore path I will found the uploaded file or bacula remove it with tuesday incremental backup restore? Sorry but today I can't try this due to time issue. Thanks in advance.

3 4

port running but connection refused
by Jerry Geis 19 Oct '16

19 Oct '16

Hi All, I have a process running on port 5070... I'm using CentOS 7. iptables is running firewalld should be stopped and disabled. When I telnet localhost 5070 I get connection refused. When I stop iptables I still get connection refused. netstat -tnlv | grep 5070 tcp 0 0 192.168.1.8:5070 0.0.0.0:* LISTEN so the process is running and listening. ps ax | grep firewalld returns nothing except the grep command. What else could be blocking this connection? Thanks, Jerry

2 1

glxinfo problem
by Mahmoud A. A. Ibrahim 19 Oct '16

19 Oct '16

Dear Centos Users We are running centos on our HPC. Indeed, we have a problem with running some software using X11 server such as pymol. For your information, we are using cygwin to access to the hpc (using ssh -X -Y username(a)xxx.xxx.xxx.xxx) When we are testing glxinfo on my desktop, it gives us the following error: [username@hpc ~]# glxinfo name of display: localhost:10.0 X Error of failed request: BadValue (integer parameter out of range for operation) Major opcode of failed request: 149 (GLX) Minor opcode of failed request: 3 (X_GLXCreateContext) Value in failed request: 0x0 Serial number of failed request: 20 Current serial number in output stream: 23 The weird thing is that when we use another desktop computer running the same cygwin version and accessing with the same username, glxinfo works fine. Indeed, echo $DISPLAY on my desktop computer gives us localhost:10.0 , while it gives localhost:13.0 on the another desktop. If I set DISPLAY on my desktop to localhost:13.0, it doesn't work One more point, if we run glxinfo on the another desktop using my account and logging at the same time from my desktop with the same username and setting DISPLAY to 13:0, glxinfo works on my desktop. Any kind of help will be highly appreciated. Sincerely; M. Ibrahim

2 1

renaming mdadm name
by Phil Manuel 19 Oct '16

19 Oct '16

Hi I have a disk which two of the partitions are part of a RAID1 setup. I'm trying to rename the the second raided partition mdadm -E /dev/sdc4 /dev/sdc4: Magic : a92b4efc Version : 1.2 Feature Map : 0x1 Array UUID : 83d7657b:ebfddcb7:36b0fa14:d29a350c Name : oldname:2 Creation Time : Tue Aug 30 15:25:10 2016 Raid Level : raid1 Raid Devices : 2 Avail Dev Size : 486696960 (232.08 GiB 249.19 GB) Array Size : 243348480 (232.08 GiB 249.19 GB) Data Offset : 262144 sectors Super Offset : 8 sectors Unused Space : before=262056 sectors, after=0 sectors State : clean Device UUID : 97aba979:dd4cf85c:f6dbf4f6:f1e9ccab Internal Bitmap : 8 sectors from superblock Update Time : Fri Sep 23 14:21:00 2016 Bad Block Log : 512 entries available at offset 72 sectors Checksum : 749e26a8 - correct Events : 7319 Device Role : Active device 0 Array State : A. ('A' == active, '.' == missing, 'R' == replacing) For the first partition I stopped the RAID using mdadm --stop /dev/md127 and then reassembeld using mdadm --assemble /dev/md127 --name=newname_boot --update=name /dev/sdc2 The first partition was easy as the system had started the RAID, but the second parition the system does start, and when I try to assemble it, it tells me it's already active:- mdadm --assemble --uuid=83d7657b:ebfddcb7:36b0fa14:d29a350c --name=newname2 --update=name /dev/md2 /dev/sdc4 mdadm: Found some drive for an array that is already active: /dev/md/oldname:2 So any ideas on how i can rename this ? Thanks Phil.

1 0

Lockd: failed to reclaim lock for pid ...
by Dan Hyatt 18 Oct '16

18 Oct '16

My environment is "heterogeneous" my authentication and home server are currently stuck on a 1G shared network, the production servers and storage servers are on a bonded 40G network, all are in the same VLAN. I have about 100 servers on the 40GB bonded network each with 12cores and 128GB of memory. They are running centos 6.6 Except for my storage servers they are all just running large and small research jobs on a grid engine. Two questions: The errors she seems to spawn is lockd: spurious grace period reject?! lockd: failed to reclaim lock for pid 8225 (errno -37, status 4) lockd: spurious grace period reject?! lockd: failed to reclaim lock for pid 8225 (errno -37, status 4) and at some point, we start getting errors that the file locks are stuck.. you can write and read from the lockfile, but programs that depend on the C construct lock file throw filelock errors until we reboot. Why is dmesg, /var/log/dmesg, and /var/log/messages unique from each other? I thought dmesg was a representation of /var/log/messages/ Is there a way to get a date stamp for the dmesg? if a job failed in the last hour and the message is from yesterday...and I don't know that doesn't help. I think what I am troubleshooting is THAT user who REFUSES to follow direction... and is sending thousands of very large jobs which each might immediately spawn another 10-20 jobs to a grid of 100 servers in a matter of seconds overwhelming either the network or the home directory server or the authentication server... because when she strikes, sometimes users cannot get a response from LDAP or the home server within as much as 10 seconds. Thus she breaks the NFS because it gets hammered and I have to restart all the servers on my grid. We have had problems with "out of memory errors" due to her programs in the recent past and had to restart all 100 servers. */var/adm/messages gives this* Oct 18 13:26:08 blade5-2-1 nslcd[2520]: [dd5cc5] ldap_result() failed: Can't contact LDAP server Oct 18 13:26:08 blade5-2-1 nslcd[2520]: [dd5cc5] ldap_abandon() failed to abandon search: Other (e.g., implementation specific) error Oct 18 13:27:14 blade5-2-1 nslcd[2520]: [e01acb] ldap_result() failed: Can't contact LDAP server Oct 18 13:27:30 blade5-2-1 nslcd[2520]: [8c7a8f] ldap_result() failed: Can't contact LDAP server *dmesg gives these* lockd: server home not responding, still trying lockd: server home OK lockd: spurious grace period reject?! lockd: failed to reclaim lock for pid 8225 (errno -37, status 4) lockd: spurious grace period reject?! lockd: failed to reclaim lock for pid 8225 (errno -37, status 4) */var/log/dmesg gives this* pmi_si: probing via SMBIOS ipmi_si: SMBIOS: io 0xca8 regsize 1 spacing 4 irq 10 ipmi_si: Adding SMBIOS-specified kcs state machine ipmi_si: Trying SMBIOS-specified kcs state machine at i/o address 0xca8, slave address 0x20, irq 10 (NULL device *): The BMC does not support setting the recv irq bit, compensating, but the BMC needs to be fixed. IRQ 10/ipmi_si: IRQF_DISABLED is not guaranteed on shared IRQs ipmi_si ipmi_si.0: Using irq 10 ipmi_si ipmi_si.0: Found new BMC (man_id: 0x0002a2, prod_id: 0x0100, dev_id: 0x20) ipmi_si ipmi_si.0: IPMI kcs interface initialized ACPI: No handler for Region [SYSI] (ffff882029e57348) [IPMI] power_meter ACPI000D:00: Found ACPI power meter. ipmi device interface EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: EXT4-fs (dm-2): mounted filesystem with ordered data mode. Opts: EXT4-fs (dm-3): mounted filesystem with ordered data mode. Opts: EXT4-fs (dm-4): mounted filesystem with ordered data mode. Opts: EXT4-fs (dm-5): mounted filesystem with ordered data mode. Opts: Adding 121724924k swap on /dev/mapper/vg_server-lv_swap. Priority:-1 extents:1 across:121724924

3 2

Disabling sound chip
by Alice Wonder 18 Oct '16

18 Oct '16

01:00.1 Audio device [0403]: NVIDIA Corporation High Definition Audio Controller [10de:0be3] (rev a1) I don't want that seen by the sound software. That's the sound chip on my video card, probably there for the HDMI output. For some reason, that sound device takes preference over my USB headphones and it is really annoying I tried creating /etc/modprobe.d/blacklist with the following : blacklist snd_hda_intel blacklist snd_hda_codec_hdmi That didn't work. Those are not CentOS specific instructions, the only CentOS specific instructions I found are related to nVidia and are rather complex and I don't believe this is that complex - at least it shouldn't be. I'm 99% sure snd_hda_intel is the driver. It shows up as Intel HD Audio in the Mate Sound control panel. I just want it disabled so I don't have to constantly use the control panel. Any hints or suggestions appreciated, not sure why there isn't just a checkbox to disable things like sound devices.

2 2

CentOS 7/GNOME 3 customise top panel
by Toralf Lund 18 Oct '16

18 Oct '16

Hi, Is there any way to customise the top panel in CentOS 7 with GNOME 3 (which I recently tried for the first time)? Specifically, I want to add "application launchers", as it will make start-up faster than the standard alternatives. (Because you can move the mouse directly to the right place - you don't have to carry out another action, wait for icons or menu items to pop up, look for the right one etc first.) People on the web talk about a "context" menu that opens if you use some kind of weird combination of right mouse-click and Alt, Windows key, Ctrl, left click, Alt Gr or whatever, but there seems to be no way to make that happen on CentOS. I found an answer of sorts in https://www.centos.org/forums/viewtopic.php?t=47957 - > In straight Gnome Shell -- CentOS 7 defaults to a modified version > using extensions -- the panel *is* locked. Visit extensions.gnome.org > to see if something there is useful. - but I don't think I quite understand it. I mean, the ability to add extensions is nice, but if the panel is locked, isn't an "unlock" function what I should be looking for? This doesn't quite sound like an "extension". Or is the actual menu everyone talks about itself an extension? If that's the case, surely isn't there some other way to make the changes? If the standard panel allows stuff to be added, there must be a standard way to do it, right? Also, if I do need extensions, I'd prefer to install it via the package manager system rather than through a special web interface... Does anyone know more about this? Any help would be appreciated. - Except, that is, I don't really need anyone to suggest switching to MAME or some other alternative desktop. I might end up doing just that, but it really bugs me that I can't get functionality that's supposed to be there to work... - Toralf

4 7

Re: [CentOS] Is bind-9.8.2-0.47.rc1.el6_8.1.x86_64 vulnerable
by マスターズ　イアン 18 Oct '16

18 Oct '16

Folks Thanks for all the replies, especially the one with the rpm -q command in it (thanks Phil). I didn't know you could do that with rpm. Very useful indeed. Regards Ian

1 0

SELinux context not applied
by Bernard Fay 17 Oct '16

17 Oct '16

Hi, I tried to apply a security context on a directory with the following commands: [root@ local]# semanage fcontext -a -t httpd_sys_rw_content_t "netdot(/.*)?" [root@ local]# restorecon -R netdot/ When I list the contexts, it is part of the list.... [root@ local]# semanage fcontext -l | grep netdot ./netdot(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0 ... but does not appear on the directory itself: [root@ local]# ls -ldZ netdot/ drwxr-xr-x. root root unconfined_u:object_r:*usr_t*:s0 netdot/ I am expecting to see something like: drwxr-xr-x. root root unconfined_u:object_r:*httpd_sys_rw_content_t*:s0 netdot/ What am I doing wrong or do not understand? Thanks,

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss