Discuss

discuss@lists.centos.org

8 participants
34745 discussions

Centos 8 crypto-policy to get SSL Labs A rating
by Adrian Jenzer 05 Jul '21

05 Jul '21

Dear Community I try to get an SSL Labs A rating for my CentOS8 Apache-server. I'am sure it has to do with my lack of understanding the crypto-policies configuration, can anybody give me an advice where i am wrong? My understanding is that the configuration in the pmod-file will override the ssl.conf values if PROFILE=SYSTEM is active. *** # Current runtime policy dump # DEFAULT:HTTPS arbitrary_dh_groups = 1 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CTR AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CTR AES-128-CBC group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 SHA2-224 SHA1 ike_protocol = IKEv2 key_exchange = ECDHE DHE DHE-RSA DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS mac = AEAD HMAC-SHA2-256 HMAC-SHA1 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 min_dh_size = 2048 min_dsa_size = 2048 min_dtls_version = DTLS1.2 min_rsa_size = 2048 min_tls_version = TLS1.2 protocol = TLS1.3 TLS1.2 DTLS1.2 sha1_in_certs = 1 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 ECDSA-SHA3-384 ECDSA-SHA2-384 ECDSA-SHA3-512 ECDSA-SHA2-512 EDDSA-ED25519 EDDSA-ED448 RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 RSA-SHA3-256 RSA-SHA2-256 RSA-SHA3-384 RSA-$ ssh_certs = 1 ssh_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM AES-256-CTR AES-256-CBC CAMELLIA-256-CBC AES-128-GCM AES-128-CCM CAMELLIA-128-GCM AES-128-CTR AES-128-CBC CAMELLIA-128-CBC ssh_etm = 1 ssh_group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 tls_cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CBC AES-128-GCM AES-128-CCM AES-128-CBC *** cat /etc/crypto-policies/policies/modules/HTTPS.pmod cipher = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 *** Part of /etc/httpd/conf.d/ssl.conf *** # SSL Engine Switch: # Enable/Disable SSL for this virtual host. SSLEngine on # List the protocol versions which clients are allowed to connect with. # The OpenSSL system profile is used by default. See # update-crypto-policies(8) for more details. #SSLProtocol all -SSLv3 #SSLProxyProtocol all -SSLv3 SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.2 # User agents such as web browsers are not configured for the user's # own preference of either security or performance, therefore this # must be the prerogative of the web server administrator who manages # cpu load versus confidentiality, so enforce the server's cipher order. SSLHonorCipherOrder on # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. # The OpenSSL system profile is configured by default. See # update-crypto-policies(8) for more details. SSLCipherSuite PROFILE=SYSTEM #SSLProxyCipherSuite PROFILE=SYSTEM #SSLCipherSuite HIGH:!aNULL:!MD5 #SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256 Thanks for any hint! Adrian

3 4

BTRFS to ext4
by Christopher Wensink 05 Jul '21

05 Jul '21

Hello Everyone, We have two virtual machines running CentOS 7, one for file sharing and one for email. Both base Filesystems run BTRFS. I need to convert both filesystems over from BTRFS to ext4. Both guest VM's are in a vmware environment on the same server. The file server has 2.8 TB of space total allocated to it, 2.1 TB of total used space The mail server has 2TB allocated to it, and 982 GB of total used space. The host it is attached to has 13.97 TB of total usable space, with 3.4 TB free. What steps would you go through to migrate the file systems over? Would you set up a duplicate VM and rsync data over? Expand the capacity of the existing VM, add a new partition then move data over from one partition to another from within the same VM? What are your thoughts? -- Christopher Wensink IS Administrator Five Star Plastics, Inc 1339 Continental Drive Eau Claire, WI 54701 Office: 715-831-1682 Mobile: 715-563-3112 Fax: 715-831-6075 cwensink(a)five-star-plastics.com www.five-star-plastics.com

3 2

Two directories for 8.4.2105 and 8-stream in the centos mirrors
by Burn Alting 05 Jul '21

05 Jul '21

Recently, it appears that two directories for 8.4 and 8-stream are being distributed in the Centos mirrors. You can't see it if you view the mirrors, but if one downloads the filelist.gz file and grep for '^\.\/\.' one will see the directories, with content, .8.4.2105 and .8-stream. Can this be explained? An error or a new distribution concept?? Rgds

1 0

[C8 stream] update
by Helmut Drodofsky 01 Jul '21

01 Jul '21

Hello, actual, C8 stream update only with exclude platform-python-pip-9.0.3-20.el8.noarch net-snmp* ? -- Viele Grüße Helmut Drodofsky Internet XS Service GmbH Heßbrühlstraße 15 70565 Stuttgart Geschäftsführung Helmut Drodofsky HRB 21091 Stuttgart USt.ID: DE190582774 Fon: 0711 781941 0 <tel:+497117819410> Fax: 0711 781941 79 Mail: info(a)internet-xs.de www.internet-xs.de

3 2

Tracking down application sending mail in CentOS 7
by H 25 Jun '21

25 Jun '21

I am running CentOS 7 on a server where I have only recently installed postfix. Postfix is configured to only send outgoing mail via an external relay server and test mails created on my server are indeed delivered via this external server. However, I must have some other application on the server generating mails where the recipient's address is incorrect resulting in being rejected by the external relay server. Viewing /var/log/maillog I get some information but cannot see which application generated that e-mail, nor the content of it which would likely allow me to see where it comes from. Can anyone suggest how to track down the app so I can reconfigure the mail address? Thanks.

4 6

Help with default shell
by Hooton, Gerard 24 Jun '21

24 Jun '21

Hi all, I have a computer with CentOS 7. The users are authenticated using OpenLDAP. On LDAP the default shell is csh. When ssh to login it works, i.e. $SHELL = /bin/csh Also, when using xrdp it works. However, a login from the keyboard and screen attached computer we get $SHELL = /bin/bash Any help is welcome. Regards, Ger. -- Gerard Hooton. Senior Technical Officer School of Engineering. University College Cork. College Road. Cork. Ireland.

4 6

libvoikko-devel not available on Centos8?
by Myyrä, Timo 23 Jun '21

23 Jun '21

Hi, Any ideas why CentOS 8 doesn't include the libvoikko-devel package? The libvoikko package is present but it doesn't have the development headers in it. The Fedora RPM SPEC seems to have separate package for the headers: https://src.fedoraproject.org/rpms/libvoikko/blob/rawhide/f/libvoikko.spec I'm looking at using a postgresql extension using libvoikko but it needs those header files. -- Timo Myyrä Palvelinylläpitäjä Puhelin +358 40 860 2103 Käyntiosoite: Verkkosaarenkatu 5, HELSINKI Postiosoite: PL 510, 00043 NORDIC MORNING Edita Prima Oy Edita Prima tuottaa automatisoituja prosesseja asiakasviestinnän hallintaan. Autamme yrityksiä poistamaan tehottomuutta ja parantamaan asiakaskokemusta. www.editaprima.fi

2 1

Security Updates not properly flagged
by Doczkal, Thomas 22 Jun '21

22 Jun '21

Hi, I assumed that it's possible to install security updates with "yum --security update". On the centos-announce mailinglist and I have received several security updates recently. Most are not relevant for us but glib2 and kernel are two we would like to address without updating the whole system. Unfortunately both glib2 and kernel updates are filtered while running yum --security update This is the output: --> glib2-2.56.1-9.el7_9.x86_64 from updates removed (updateinfo) --> kernel-3.10.0-1160.31.1.el7.x86_64 from updates removed (updateinfo) There are probably more security updates which should be installed by yum --security but those are the packages I am most interested in. Please change as necessary to allow yum --security to work. Many thanks. Best Regards, Thomas -- Thomas Doczkal Snr System Engineer Socionext Europe GmbH pittlerstrasse 47 63225 langen, germany tel +49-6103-3745-386 mobile +49-174-9226082 fax +49-6103-3745-122 thomas.doczkal(a)socionext.com www.eu.socionext.com www.socionext.com Geschaeftsfuehrer/Managing Director: Toshihiko Tanaka, Dirk Weinsziehr, Koichi Otsuki, Yutaka Yoneyama Sitz/Seat: Langen, Hessen; Registergericht/Commercial Register: Offenbach/Main HRB 48005 This e-mail and any attachment contains information which is private and confidential and is intended for the addressee only. If you are not an addressee, you are not authorized to read, copy or use the e-mail or any attachment. If you have received this e-mail in error, please notify the sender by return e-mail and then delete it.

6 7

An error occurred while processing your request.
by Kaushal Shriyan 22 Jun '21

22 Jun '21

Hi, I am facing the below issue while hitting https://repo.ius.io/7/src/packages/p/ An error occurred while processing your request. Reference #30.d5961160.1624319418.82c229 Please comment. Thanks in advance. Best Regards, Kaushal

2 2

EL8: openldap-servers migration to 389
by Leon Fauster 21 Jun '21

21 Jun '21

Hey all, in preparation to migrate an EL7 server I noticed that the openldap-servers package is not shipped in EL8 anymore. Is it possible to operate 389-ds as standalone ldap server? I am asking this for the context of CentOS Linux because I read somewhere that 389-ds is mainly used for RHDS only and unsure now about the possibilities to substitute openldap-servers/slapd ... -- Thanks Leon

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss