Discuss

discuss@lists.centos.org

34752 discussions

11 Jul '21

I want to install open-source software on my hosted CentOS 7 server to monitor the system in general, as well as logs, apache webserver, MySQL and PostgreSQL to begin with. I know there are a multitude of packages available and would be interested in hearing if others have a favorite package? My preference is for a graphical interface where it is easy to follow a variety of load measures but also provides alerts etc. Suggestions appreciated!

7 7

Re: [CentOS] Auditing all Linux clients with centralised server
by Adrian van Bloois 10 Jul '21

10 Jul '21

Ever heard of ossec? Se: www.ossec.net -- Adri P. van Bloois "The greatest threat to our planet is the belief that someone else will save it." Robert Swan.

1 0

Centos versions in the future?
by Carlos Oliva 09 Jul '21

09 Jul '21

Will there be newer versions of Centos? We have heard rumors that version 8 will be the last one. We are concerned with using an OS that will loose support in the future. Thank you.

29 107

Auditing all Linux clients with centralised server
by Kaushal Shriyan 09 Jul '21

09 Jul '21

Hi, I have 20 Linux servers in the network. Is there a way to audit all Linux clients using a centralized server? For example, what commands are run by John on Linuxnode1? Steve on Linuxnode15? and so on and so forth to track user activity. Which files have been modified or edited or commands etc...... by the users. I have installed auditd, but it is local to the Linux server. Thanks in advance. Best Regards, Kaushal

7 9

CentOS-announce Digest, Vol 196, Issue 1
by centos-announce-request＠centos.org 08 Jul '21

08 Jul '21

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2021:2658 Important CentOS 7 linuxptp Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 7 Jul 2021 18:17:20 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2021:2658 Important CentOS 7 linuxptp Security Update Message-ID: <20210707181720.GA16669(a)bstore1.rdu2.centos.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2021:2658 Important Upstream details at : https://access.redhat.com/errata/RHSA-2021:2658 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 5d92d36050c5d7174cd65358882ce23f7eab51af6a02070c42917f77f9dcb3fe linuxptp-2.0-2.el7_9.1.x86_64.rpm Source: a0aa8a92f7fc0f029559b186db4016eaab076fb34c67d1aaf9bb54143ca62a9a linuxptp-2.0-2.el7_9.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 196, Issue 1 ***********************************************

1 0

Audacity
by mark 08 Jul '21

08 Jul '21

I'm trying to record a reading of my just-published novel... and I'm underwhelmed. In KDE, I select multimedia->audacity, and it crashes. I can get it to run from a command line, but if I try to start "new", it crashes. When I was testing, and got the correct mike, then wanted to delete what I'd done and actually start, it crashes. This is as installed, nothing odd. Recommendations (other than reinstall)? mark

3 3

Sending mail from rkhunter
by H 08 Jul '21

08 Jul '21

I am having problems getting rkhunter to send the daily report to an outside email account under CentOS 7. I have installed postfix and fail2ban now sends ban messages as expected. I have googled but so far failed to identify the error in my setup: - /etc/aliases contain the correct mail alias for root - /etc/rkhunter.conf has REPORT_EMAIL=themailadress and MAIL-ON-WARNING=themailadress - /var/log/rkhunter/rkhunter.log does not contain any error messages What have I missed?

1 0

Re: [CentOS] CentOS Digest, Vol 198, Issue 6
by Anand Babu 07 Jul '21

07 Jul '21

Hi Leon, Thanks a lot for taking a look at my test and the suggestion. We have tested this suggestion echo never > /sys/kernel/mm/transparent_hugepage/enabled Unfortunately, the Ram usage was the same with this option changed as well. Just to give some additional context to the original question to all, We see 10-25 percent more RSS on CentOS 8 ( as compared to CentOS 7) for the same Java vm process that we are benchmarking . And in that case , the RSS growth for the executable and the shared library of our application is considerably higher. Perhaps, for the big server use cases the rss growth did not matter, but for us, we are trying to use it in an embedded scenario and this is a major issue. We will be glad to hear any further suggestions/ tests that we could check to further understand the differences between the 2 versions. Regards, -Anand On Wed, Jul 7, 2021, 5:30 PM <centos-request(a)centos.org> wrote: > Send CentOS mailing list submissions to > centos(a)centos.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.centos.org/mailman/listinfo/centos > or, via email, send a message with subject or body 'help' to > centos-request(a)centos.org > > You can reach the person managing the list at > centos-owner(a)centos.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of CentOS digest..." > > > Today's Topics: > > 1. RSS usage on centos8.4 is higher for user-application > compared to centos7.9 (Anand Babu) > 2. Re: RSS usage on centos8.4 is higher for user-application > compared to centos7.9 (Leon Fauster) > 3. Re: Centos versions in the future? (Nikolaos Milas) > 4. Re: Centos versions in the future? (J Martin Rushton) > 5. Re: Centos versions in the future? (Nikolaos Milas) > 6. Re: Centos versions in the future? (Leon Fauster) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 6 Jul 2021 15:02:49 +0200 > From: Anand Babu <mail2anand(a)gmail.com> > To: centos(a)centos.org > Subject: [CentOS] RSS usage on centos8.4 is higher for > user-application compared to centos7.9 > Message-ID: > <CAB5++c4-Z= > 7FheHD02RW6YLP6d-trwCqqQqvDdAKsoBZF4tbUg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Centos Community, > > This is my first time here and I apologize in advance if I made a mistake > here and hope you will correct me , if i made any. > > > With that said, > > This is a native example that was written to narrow down the higher RAM > usage that we see when we are using Centos8 as opposed to Centos7. > > The c-code is very small and looks like this : > > #include<stdio.h> > > #include<unistd.h> > > int main() > > { > > pause(); > > return 0; > > } > > I compile and run the binary on centos7 and memory backed section of pmap > output looks like below: > > pmap -X $(pidof sleep) | head -n -2 | awk '{ if (NR > 2 && $5 > 0 ) > printf "%12s %8s %8s %4s %s\n", $1, $6, $7, $2,$13}' > 00400000 4 4 r-xp sleep > 00600000 4 4 r--p sleep > 00601000 4 4 rw-p sleep*7f54514f9000 1808 > 204 r-xp libc-2.17.so <http://libc-2.17.so> > *7f54516bd000 2044 0 ---p libc-2.17.so > 7f54518bc000 16 16 r--p libc-2.17.so > 7f54518c0000 8 8 rw-p libc-2.17.so > 7f54518c7000 136 108 r-xp ld-2.17.so > 7f5451ae8000 4 4 r--p ld-2.17.so > 7f5451ae9000 4 4 rw-p ld-2.17.so > > and ps says the following: > > ** ps -o rss= pidof sleep 352** > > Running the same binary on centos8 leads to > > ** ps -o rss= pidof pause 784 ** > > and the pmap output looks like below: > > 00400000 4 4 r-xp pause > 00600000 4 4 r--p pause > 00601000 4 4 rw-p pause* 7f24029a8000 1776 > 788 r-xp libc-2.28.so <http://libc-2.28.so> * > 7f2402b64000 2044 0 ---p libc-2.28.so > 7f2402d63000 16 16 r--p libc-2.28.so > 7f2402d67000 8 8 rw-p libc-2.28.so > 7f2402d6d000 176 176 r-xp ld-2.28.so > 7f2402f99000 4 4 r--p ld-2.28.so > 7f2402f9a000 8 8 rw-p ld-2.28.so > > For running the same executable, the libc.so takes 788KB(204KB on centos7). > > Note: > > 1. > > This is not the only library that is showing this behavior, but we see > the same behavior for other shared-library as well as executables that > were > compiled on centos7. Running the same executables/shared objects take a > higher amount of pages on centos8 than on centos7. > 2. > > Since the glibc version on Centos8 was 2.28 , i have compiled 2.17 > version and then used patchelf to patch the centos7 built binary to make > use of 2.17 glibc on centos8 host like patchelf --set-interpreter > > > /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib/ld-linux-x86-64.so.2 > --set-rpath /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib > /tmp/pause > > and then run it under LD_DEBUG=libs and verified the 2.17 version of libc > libraries were used and still the memory usage on centos8 was higher than > on centos7 (about the same numbers as above). > > What could be the reason for the higher RAM usage on centos8 vs centos7? I > can imagine some defaults have changed on centos8 and that has meant this > impact and i could change this default and could reproduce the same RSS > numbers on centos8 as well? > > > I am posting my environment details in the P.S below. > > Regards, > > -Anand > > > P.S: > > cat /etc/centos-release > > CentOS Linux release 8.4.2105 > > [root@localhost RSS_measurement]# cat /etc/centos-release > > CentOS Linux release 7.9.2009 (Core) > > I am running both the centos versions under Virtualbox. > > > ------------------------------ > > Message: 2 > Date: Tue, 6 Jul 2021 17:59:11 +0200 > From: Leon Fauster <leonfauster(a)googlemail.com> > To: centos(a)centos.org > Subject: Re: [CentOS] RSS usage on centos8.4 is higher for > user-application compared to centos7.9 > Message-ID: <4e84ea30-9d8b-2e9d-a898-e469303a537c(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 06.07.21 15:02, Anand Babu wrote: > > Hi Centos Community, > > > > This is my first time here and I apologize in advance if I made a mistake > > here and hope you will correct me , if i made any. > > > > > > With that said, > > > > This is a native example that was written to narrow down the higher RAM > > usage that we see when we are using Centos8 as opposed to Centos7. > > > > The c-code is very small and looks like this : > > > > #include<stdio.h> > > > > #include<unistd.h> > > > > int main() > > > > { > > > > pause(); > > > > return 0; > > > > } > > > > I compile and run the binary on centos7 and memory backed section of pmap > > output looks like below: > > > > pmap -X $(pidof sleep) | head -n -2 | awk '{ if (NR > 2 && $5 > 0 ) > > printf "%12s %8s %8s %4s %s\n", $1, $6, $7, $2,$13}' > > 00400000 4 4 r-xp sleep > > 00600000 4 4 r--p sleep > > 00601000 4 4 rw-p sleep*7f54514f9000 1808 > > 204 r-xp libc-2.17.so <http://libc-2.17.so> > > *7f54516bd000 2044 0 ---p libc-2.17.so > > 7f54518bc000 16 16 r--p libc-2.17.so > > 7f54518c0000 8 8 rw-p libc-2.17.so > > 7f54518c7000 136 108 r-xp ld-2.17.so > > 7f5451ae8000 4 4 r--p ld-2.17.so > > 7f5451ae9000 4 4 rw-p ld-2.17.so > > > > and ps says the following: > > > > ** ps -o rss= pidof sleep 352** > > > > Running the same binary on centos8 leads to > > > > ** ps -o rss= pidof pause 784 ** > > > > and the pmap output looks like below: > > > > 00400000 4 4 r-xp pause > > 00600000 4 4 r--p pause > > 00601000 4 4 rw-p pause* 7f24029a8000 1776 > > 788 r-xp libc-2.28.so <http://libc-2.28.so> * > > 7f2402b64000 2044 0 ---p libc-2.28.so > > 7f2402d63000 16 16 r--p libc-2.28.so > > 7f2402d67000 8 8 rw-p libc-2.28.so > > 7f2402d6d000 176 176 r-xp ld-2.28.so > > 7f2402f99000 4 4 r--p ld-2.28.so > > 7f2402f9a000 8 8 rw-p ld-2.28.so > > > > For running the same executable, the libc.so takes 788KB(204KB on > centos7). > > > > Note: > > > > 1. > > > > This is not the only library that is showing this behavior, but we > see > > the same behavior for other shared-library as well as executables > that were > > compiled on centos7. Running the same executables/shared objects > take a > > higher amount of pages on centos8 than on centos7. > > 2. > > > > Since the glibc version on Centos8 was 2.28 , i have compiled 2.17 > > version and then used patchelf to patch the centos7 built binary to > make > > use of 2.17 glibc on centos8 host like patchelf --set-interpreter > > > > > /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib/ld-linux-x86-64.so.2 > > --set-rpath /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib > > /tmp/pause > > > > and then run it under LD_DEBUG=libs and verified the 2.17 version of libc > > libraries were used and still the memory usage on centos8 was higher than > > on centos7 (about the same numbers as above). > > > > What could be the reason for the higher RAM usage on centos8 vs centos7? > I > > can imagine some defaults have changed on centos8 and that has meant this > > impact and i could change this default and could reproduce the same RSS > > numbers on centos8 as well? > > > > > > How does the results look like after doing: > > echo never > /sys/kernel/mm/transparent_hugepage/enabled > > -- > Leon > > > > ------------------------------ > > Message: 3 > Date: Wed, 7 Jul 2021 12:44:15 +0300 > From: Nikolaos Milas <nmilas(a)noa.gr> > To: CentOS mailing list <centos(a)centos.org> > Subject: Re: [CentOS] Centos versions in the future? > Message-ID: <6b3c136f-5aae-1b0a-e65c-868377875f7a(a)noa.gr> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 30/4/2021 7:27 ?.?., Gionatan Danti wrote: > > > > > The correct answer is to buy RH: fine. But do not let Stream touch > > anything which require a kABI compatible modules. As said above, the > > Stream move is squarely addresses *cloud* vendor requests and needs. > > Again, fine. But please leave apart the RH comparison, this is not > > going to help Stream. > > > > Again, don't let me wrong: I wishes the best to Stream, and I will use > > it where appropriate. But "where" is much smaller today than > > yesterday. But this aside, I really thank you all CentOS maintainer > > for your monumental work, and I really hope Stream will be a success. > > I re-visit this thread, since it is crucial for CentOS 8 users. > > RESF / Rocky Linux is gaining worldwide recognition and sets itself as > the primary organization / platform to become the CentOS 8 heir / > successor in the future. > > Google and Microsoft become RESF sponsors/partners: > > https://rockylinux.org/news/community-update-june-2021/ > > And so IBM/RH lose the tremendous advantage they had by owning the > CentOS project, which - it seems - never evaluated correctly. > > From now on, it is clear that hundreds of thousands of CentOS > installations will be migrating to Rocky Linux. > > I also wish the best of success to CentOS Stream, but this is not what > the CentOS community expected. > > My 2c. > Nick > > > > ------------------------------ > > Message: 4 > Date: Wed, 7 Jul 2021 10:47:16 +0100 > From: J Martin Rushton <martinrushton56(a)btinternet.com> > To: centos(a)centos.org > Subject: Re: [CentOS] Centos versions in the future? > Message-ID: <e6298010-bece-df14-98d0-9f8b5e04e8e2(a)btinternet.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > There's also Alma, which is where I've gone after being with CentOS > since 5.3 > > On 07/07/2021 10:44, Nikolaos Milas wrote: > > On 30/4/2021 7:27 ?.?., Gionatan Danti wrote: > > > >> > >> The correct answer is to buy RH: fine. But do not let Stream touch > >> anything which require a kABI compatible modules. As said above, the > >> Stream move is squarely addresses *cloud* vendor requests and needs. > >> Again, fine. But please leave apart the RH comparison, this is not > >> going to help Stream. > >> > >> Again, don't let me wrong: I wishes the best to Stream, and I will use > >> it where appropriate. But "where" is much smaller today than > >> yesterday. But this aside, I really thank you all CentOS maintainer > >> for your monumental work, and I really hope Stream will be a success. > > > > I re-visit this thread, since it is crucial for CentOS 8 users. > > > > RESF / Rocky Linux is gaining worldwide recognition and sets itself as > > the primary organization / platform to become the CentOS 8 heir / > > successor in the future. > > > > Google and Microsoft become RESF sponsors/partners: > > > > ?? https://rockylinux.org/news/community-update-june-2021/ > > > > And so IBM/RH lose the tremendous advantage they had by owning the > > CentOS project, which - it seems - never evaluated correctly. > > > > From now on, it is clear that hundreds of thousands of CentOS > > installations will be migrating to Rocky Linux. > > > > I also wish the best of success to CentOS Stream, but this is not what > > the CentOS community expected. > > > > My 2c. > > Nick > > > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > https://lists.centos.org/mailman/listinfo/centos > > -- > J Martin Rushton MBCS > > > ------------------------------ > > Message: 5 > Date: Wed, 7 Jul 2021 13:07:12 +0300 > From: Nikolaos Milas <nmilas(a)noa.gr> > To: CentOS mailing list <centos(a)centos.org> > Subject: Re: [CentOS] Centos versions in the future? > Message-ID: <ce7e72f7-7159-78ee-4576-e75e806025f7(a)noa.gr> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 7/7/2021 12:47 ?.?., J Martin Rushton via CentOS wrote: > > > There's also Alma, which is where I've gone after being with CentOS > > since 5.3 > > AlmaLinux is a great project too, IMHO, but things show that the new > industry standard (replacing CentOS) will probably be Rocky Linux. > > (Yes, RHEL **AND** CentOS have indeed been industry standards - the > point of reference -, IMHO, and this is what IBM/RHEL have failed to > realize: You don't alter a point of reference.) > > It is interesting to see what Service Providers will do with their (huge > numbers of) CentOS installations, when they migrate... > > From the users/admins' perspective it is to their interest to have > robust and healthy alternatives. > > In our org, I am now using Rocky Linux on new installations (without > issues) and will be migrating several CentOS 8 boxes to Rocky Linux as > well. > > Cheers, > Nick > > > > ------------------------------ > > Message: 6 > Date: Wed, 7 Jul 2021 12:28:58 +0200 > From: Leon Fauster <leonfauster(a)googlemail.com> > To: centos(a)centos.org > Subject: Re: [CentOS] Centos versions in the future? > Message-ID: <9d2d8304-6779-a452-1a8b-62c58d7722e1(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 07.07.21 12:07, Nikolaos Milas wrote: > > On 7/7/2021 12:47 ?.?., J Martin Rushton via CentOS wrote: > > > >> There's also Alma, which is where I've gone after being with CentOS > >> since 5.3 > > > > AlmaLinux is a great project too, IMHO, but things show that the new > > industry standard (replacing CentOS) will probably be Rocky Linux. > > > > (Yes, RHEL **AND** CentOS have indeed been industry standards - the > > point of reference -, IMHO, and this is what IBM/RHEL have failed to > > realize: You don't alter a point of reference.) > > > It should not be forgotten that Rocky Linux will be a 1:1 rebuild, also > in the future. So, to shape this future everyone is invited to > participate at CentOS Stream. This is a great future or not? > > > > > It is interesting to see what Service Providers will do with their (huge > > numbers of) CentOS installations, when they migrate... > > > > From the users/admins' perspective it is to their interest to have > > robust and healthy alternatives. > > > > In our org, I am now using Rocky Linux on new installations (without > > issues) and will be migrating several CentOS 8 boxes to Rocky Linux as > > well. > > > > Cheers, > > Nick > > > > _______________________________________________ > > CentOS mailing list > > CentOS(a)centos.org > > https://lists.centos.org/mailman/listinfo/centos > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos > > > ------------------------------ > > End of CentOS Digest, Vol 198, Issue 6 > ************************************** >

1 0

RSS usage on centos8.4 is higher for user-application compared to centos7.9
by Anand Babu 06 Jul '21

06 Jul '21

Hi Centos Community, This is my first time here and I apologize in advance if I made a mistake here and hope you will correct me , if i made any. With that said, This is a native example that was written to narrow down the higher RAM usage that we see when we are using Centos8 as opposed to Centos7. The c-code is very small and looks like this : #include<stdio.h> #include<unistd.h> int main() { pause(); return 0; } I compile and run the binary on centos7 and memory backed section of pmap output looks like below: pmap -X $(pidof sleep) | head -n -2 | awk '{ if (NR > 2 && $5 > 0 ) printf "%12s %8s %8s %4s %s\n", $1, $6, $7, $2,$13}' 00400000 4 4 r-xp sleep 00600000 4 4 r--p sleep 00601000 4 4 rw-p sleep*7f54514f9000 1808 204 r-xp libc-2.17.so <http://libc-2.17.so> *7f54516bd000 2044 0 ---p libc-2.17.so 7f54518bc000 16 16 r--p libc-2.17.so 7f54518c0000 8 8 rw-p libc-2.17.so 7f54518c7000 136 108 r-xp ld-2.17.so 7f5451ae8000 4 4 r--p ld-2.17.so 7f5451ae9000 4 4 rw-p ld-2.17.so and ps says the following: ** ps -o rss= pidof sleep 352** Running the same binary on centos8 leads to ** ps -o rss= pidof pause 784 ** and the pmap output looks like below: 00400000 4 4 r-xp pause 00600000 4 4 r--p pause 00601000 4 4 rw-p pause* 7f24029a8000 1776 788 r-xp libc-2.28.so <http://libc-2.28.so> * 7f2402b64000 2044 0 ---p libc-2.28.so 7f2402d63000 16 16 r--p libc-2.28.so 7f2402d67000 8 8 rw-p libc-2.28.so 7f2402d6d000 176 176 r-xp ld-2.28.so 7f2402f99000 4 4 r--p ld-2.28.so 7f2402f9a000 8 8 rw-p ld-2.28.so For running the same executable, the libc.so takes 788KB(204KB on centos7). Note: 1. This is not the only library that is showing this behavior, but we see the same behavior for other shared-library as well as executables that were compiled on centos7. Running the same executables/shared objects take a higher amount of pages on centos8 than on centos7. 2. Since the glibc version on Centos8 was 2.28 , i have compiled 2.17 version and then used patchelf to patch the centos7 built binary to make use of 2.17 glibc on centos8 host like patchelf --set-interpreter /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib/ld-linux-x86-64.so.2 --set-rpath /home/babu/RSS_measurement/2_17_downloaded/glibc_home/lib /tmp/pause and then run it under LD_DEBUG=libs and verified the 2.17 version of libc libraries were used and still the memory usage on centos8 was higher than on centos7 (about the same numbers as above). What could be the reason for the higher RAM usage on centos8 vs centos7? I can imagine some defaults have changed on centos8 and that has meant this impact and i could change this default and could reproduce the same RSS numbers on centos8 as well? I am posting my environment details in the P.S below. Regards, -Anand P.S: cat /etc/centos-release CentOS Linux release 8.4.2105 [root@localhost RSS_measurement]# cat /etc/centos-release CentOS Linux release 7.9.2009 (Core) I am running both the centos versions under Virtualbox.

2 1

Centos 8 crypto-policy to get SSL Labs A rating
by Adrian Jenzer 05 Jul '21

05 Jul '21

Dear Community I try to get an SSL Labs A rating for my CentOS8 Apache-server. I'am sure it has to do with my lack of understanding the crypto-policies configuration, can anybody give me an advice where i am wrong? My understanding is that the configuration in the pmod-file will override the ssl.conf values if PROFILE=SYSTEM is active. *** # Current runtime policy dump # DEFAULT:HTTPS arbitrary_dh_groups = 1 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CTR AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CTR AES-128-CBC group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 SHA2-224 SHA1 ike_protocol = IKEv2 key_exchange = ECDHE DHE DHE-RSA DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS mac = AEAD HMAC-SHA2-256 HMAC-SHA1 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 min_dh_size = 2048 min_dsa_size = 2048 min_dtls_version = DTLS1.2 min_rsa_size = 2048 min_tls_version = TLS1.2 protocol = TLS1.3 TLS1.2 DTLS1.2 sha1_in_certs = 1 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 ECDSA-SHA3-384 ECDSA-SHA2-384 ECDSA-SHA3-512 ECDSA-SHA2-512 EDDSA-ED25519 EDDSA-ED448 RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 RSA-SHA3-256 RSA-SHA2-256 RSA-SHA3-384 RSA-$ ssh_certs = 1 ssh_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM AES-256-CTR AES-256-CBC CAMELLIA-256-CBC AES-128-GCM AES-128-CCM CAMELLIA-128-GCM AES-128-CTR AES-128-CBC CAMELLIA-128-CBC ssh_etm = 1 ssh_group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 tls_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CBC *** cat /etc/crypto-policies/policies/modules/HTTPS.pmod cipher = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 *** Part of /etc/httpd/conf.d/ssl.conf *** # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on # List the protocol versions which clients are allowed to connect with. # The OpenSSL system profile is used by default. See # update-crypto-policies(8) for more details. #SSLProtocol all -SSLv3 #SSLProxyProtocol all -SSLv3 SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2 # User agents such as web browsers are not configured for the user's # own preference of either security or performance, therefore this # must be the prerogative of the web server administrator who manages # cpu load versus confidentiality, so enforce the server's cipher order. SSLHonorCipherOrder on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. # The OpenSSL system profile is configured by default. See # update-crypto-policies(8) for more details. SSLCipherSuite PROFILE=SYSTEM #SSLProxyCipherSuite PROFILE=SYSTEM #SSLCipherSuite HIGH:!aNULL:!MD5 #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256 Thanks for any hint! Adrian

3 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss