Discuss

discuss@lists.centos.org

3 participants
34748 discussions

Re: [CentOS] UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 28 Jun '16

28 Jun '16

On Mon, June 27, 2016 12:29, Gordon Messmer wrote: > On 06/26/2016 01:50 PM, James B. Byrne wrote: >> However, all I am seeking is knowledge on how to handle this using >> iptables. I am sure that this defect/anomaly has already been >> solved wherever it is an issue. Does anyone have an example on >> how to do this? > > > I think the bit you're missing is that you don't have to address every > detail that your auditors send you. You can label an item a false > positive. You can respond that you are aware, and that you don't > consider an item to be a security defect. Fingerprinting is an > excellent example thereof. As was already noted, the IP ID field is > just one of many aspects of IP networking that can be used to identify > Linux systems. If you don't address them all, addressing one is not a > useful exercise. I understand WRT false positive flagging. And that is exactly what I have done. However, the PCI DSS report piqued my interest in this matter and I thought to satisfy my curiosity. The other stuff flagged in the report seemed a little far-fetched to me. At least the explanation of why they were flagged did. As none of them affect our PCI status I have no interest in the rest. This one however I was previously unaware and so I wanted to discover more about it. Thank you for the information and especially for the references. Sincerely, -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Guest's Additions Virtual CD
by raving Joker 28 Jun '16

28 Jun '16

Hello to everyone I'm a new italian member so I'm sorry if my english isn't perfect. I was thinking... Why not (in CentOS 7) insert a tab in the installation phase that can permit an automatic installation of guest's additions tools (I'm using virtualbox, but it can be applied to other platforms with a menu), a little system that reveals the guest addition's cd and if isn't inserted, displays to the user a message with informations about how insert it and do the installation automatically? Thanks for all of people that want to reply, I know that this virtualization platforms are in part in discordance with the ethical free software's mindset...but why not in centos, with proper informative messages? Good afternoon Raving

1 0

Use USB2.0 Camera with KVM based VM
by Mark LaPierre 28 Jun '16

28 Jun '16

Hey All, I've been googleing this issue for hours but I can't find a workable solution. I found a reply to a bug posting that said the USB hub on the VM defaults to USB 1.1. I see this is true when I lsusb on the CentOS 7 guest. The reply to the bug post went on to say that the problem is that the USB 2.0 camera will not work with the USB 1.1 default hub and that I should change the hub from USB 1.1 to USB 2.0. I see no way to do that. Can anyone shed some light on this? Is there a way to change the USB hub from USB 1.1 to USB 2.0 inside the VM Manager? Is there a better way to get my USB 2.0 web camera to appear in my CentOS 7 guest? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

2 1

Re: [CentOS] UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 27 Jun '16

27 Jun '16

On Fri, June 24, 2016 12:24, John R Pierce wrote: > On 6/24/2016 9:20 AM, James B. Byrne wrote: >> We received a notice from our pci-dss auditors respecting this: >> >> CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps >> the >> IP Identification field at 0 for all non-fragmented packets, which >> could allow remote attackers to determine that a target system is >> running Linux. > > > 2.4 kernels are kinda old. kinda really really old. are you still > running CentOS 4 on PCI audited systems ?!?? > > The CVE is from 2002 and the kernel mentioned refers to the original report. Linux core team said it was a non-problem and the issue remains in the kernel found in CentOS-6.8. Possibly the one in 7. Perhaps it is still present in the development branch. However, all I am seeking is knowledge on how to handle this using iptables. I am sure that this defect/anomaly has already been solved wherever it is an issue. Does anyone have an example on how to do this? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

haproxy + Apache + virtual hosts -> wrong host is displayed
by Alexander Farber 25 Jun '16

25 Jun '16

Hello, I hope my question is not off-topic here. On CentOS 7.2.1511 I have installed: haproxy-1.5.14-3.el7.x86_64 httpd-2.4.6-40.el7.centos.1.x86_64 The /etc/haproxy/haproxy.cfg binds HAProxy to ports 80 and 443 and accepts HTTPS to slova.de: defaults mode http option http-server-close option forwardfor except 127.0.0.0/8 option redispatch .... frontend public bind 144.76.184.151:80 bind 144.76.184.151:443 ssl crt /etc/pki/tls/certs/slova.de.pem reqidel ^X-Forwarded-Proto: reqidel ^X-Forwarded-For: reqadd X-Forwarded-Proto:\ https if { ssl_fc } option forwardfor default_backend apache backend apache server domain 127.0.0.1:8080 The /etc/httpd/conf/httpd.conf binds Apache to port 8080 and serves several Wordpress sites: Listen 127.0.0.1:8080 ServerName 144.76.184.151 <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/afarber.de ServerName afarber.de ErrorLog logs/afarber.de/error_log CustomLog logs/afarber.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/ruhrgebietsingle.de ServerName ruhrgebietsingle.de ErrorLog logs/ruhrgebietsingle.de/error_log CustomLog logs/ruhrgebietsingle.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/bukvy.de ServerName bukvy.de ErrorLog logs/bukvy.de/error_log CustomLog logs/bukvy.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/slova.de ServerName slova.de ErrorLog logs/slova.de/error_log CustomLog logs/slova.de/access_log common </VirtualHost> When I open http://slova.de or https://www.slova.de they work fine. But when I try to open same URLs with "www." prepended, the browser displays http://ruhrgebietsingle.de (the 2nd site out of 4) Why does it happen? I just can not figure it out. What tool would help here to debug? Thank you Alex

1 1

UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 24 Jun '16

24 Jun '16

We received a notice from our pci-dss auditors respecting this: CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux. The NVD entry for which contains this note: CHANGE> [Cox changed vote from REVIEWING to NOOP] Cox> So I asked some kernel guys about this - it's not considered an issue. There are several other ways to identify Linux on the wire and people who care about this kind of thing rewrite their packets in various ways via firewall technology to trick the identifier programs. So, what packet mangling may be done in iptables to solve this without breaking udp transmission? I take it that we are talking about something in the prerouting chain but what kind of mangelling is safe? Is there an example somewhere? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

CPU Compatibility Question
by listmail 24 Jun '16

24 Jun '16

Hi All, Hopefully someone with broad overview of CentOS compatibility issues can comment on this: I am evaluating a Supermicro X10SLM motherboard with an Intel E3-1231 v3 CPU. Testing with boots from Live DVDs, the CentOS 6.x family is panicking at boot time. I have tried 6.8, 6.5, and 6.3, and each one panics at slightly different points, but they all seem to fail after udev starts up (or tries to). On the other hand, I was able to boot CentOS 7.0 1511 from the Live CD. According to the compatibility chart over here: https://access.redhat.com/support/policy/intel ...anything later than 6.3 (6.4 and up) should work with the E3-12xx v3 family of processors. But those are not the results I am seeing. Does anyone have experience or commentary on this compatibility issue? Thanks, --Bill

2 2

sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello -- We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP authentication. The ldap packages that are currently installed on the system are the following: python-sss 1.13.0-40.el7_2.4 python-sssdconfig 1.13.0-40.el7_2.4 sssd 1.13.0-40.el7_2.4 sssd-ad 1.13.0-40.el7_2.4 sssd-client 1.13.0-40.el7_2.4 sssd-common 1.13.0-40.el7_2.4 sssd-common-pac 1.13.0-40.el7_2.4 sssd-dbus 1.13.0-40.el7_2.4 sssd-ipa 1.13.0-40.el7_2.4 sssd-krb5 1.13.0-40.el7_2.4 sssd-krb5-common 1.13.0-40.el7_2.4 sssd-ldap 1.13.0-40.el7_2.4 sssd-libwbclient 1.13.0-40.el7_2.4 sssd-libwbclient-devel 1.13.0-40.el7_2.4 sssd-proxy 1.13.0-40.el7_2.4 sssd-tools 1.13.0-40.el7_2.4 I ran the following commands to set up LDAP/AD authentication: # ln -s /bin/bash /bin/PHSshell # ln -s /home /PHShome # authconfig --enablesssdauth --enablemkhomedir --enablesssd -update # chkconfig sssd on # service sssd restart Initially, I ran into problems because I had not created an sssd.conf file. Eventually I did create one, and its contents are the following: [<domain>.org] enumate = true cache_credentials = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.<domain>.org ldap_search_base = dc=<domain>,dc=org tls_reqcert = demand ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt If there are any additions or corrections that I need to make, please let me know. I reran the service sssd restart command, and the error message that I am seeing via journalctl -xe is the following: Unit sssd.service has begun starting up. Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the configuration database [5]: Input/output error. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process exited, code=exited status=4 Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel> -- -- Unit sssd.service has failed. -- -- The result is failed. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered failed state. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed. Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication Agent for unix-process:6369:52587318 (system bus name :1.2287, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Any ideas? The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the following changes to the nsswitch.conf file as suggested by another mailing-list member: Domain = <company>.org ... Method = nsswitch and I have restarted idmapd service. I checked the nsswitch.conf file, and references to sss are mentioned in the following lines: passwd: shadow: group: ... services: netgroup: ... automount: I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the changes to the nsswitch.conf file as suggested, and I have restarted idmapd service. I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss