Discuss

discuss@lists.centos.org

3 participants
34748 discussions

Re: [CentOS] CentOS 7, NSF, "feature" [SOLVED]
by m.roth＠5-cent.us 04 Feb '16

04 Feb '16

The issue: NFS fails to start in CentOS 7 if it cannot resolve any of a list of hosts. Well, my manager had to google to find the *truly* obscure solution that uses a deeply oddball syntax. In /usr/lib/systemd/system/nfs-server.service, you edit the following line so that it looks like this: ExecStartPre=-/usr/sbin/exportfs -r Notice the *deeply* weird syntax of "=-<cmd>". This apparently tells it that "a nonzero exit code" should be ignored and considered "success". And, I read in the manpage for systemd.service that if you precede it with an @, it will pass arguments. Why it does not use the used-everywhere-else of *post*fixing those parms, I have no data. And, speaking specifically about nfs-server.service, I also don't understand why you'd set as an out-of-the-box default that it should fail to come up if it can't resolve any export host, rather than default to coming up. mark, discovering new reasons to dislike systemd

7 10

I am not understanding the size of the iso
by Ramaseshan S 04 Feb '16

04 Feb '16

I suppose, CentOS 7 ships with DVD and minimal version. While the minimal version is just 700M, what makes the minimal along with a GUI about 4.3 GB. Isint it too huge for an OS ? -- Cheers -- S.Ramaseshan Engineer fractalio.com ramaseshan(a)fractalio.com

6 8

CentOS 7, NSF, "feature"
by m.roth＠5-cent.us 03 Feb '16

03 Feb '16

In the last month, we've discovered a new, ahhhh, "feature" in the version of the version of NFS with CentOS 7: on startup, if it cannot resolve a given host, it dies. It does not continue on up, with all the other hosts it's exporting to, and just log a message. Is there a workaround, or a configuration, to change this "fail on unresolved host" behaviour? mark

4 5

nfs stuck, don't know what processes to kill
by Dave Burns 03 Feb '16

03 Feb '16

My NFS server is up and other clients can access x. One particular client can't. I tried to unmount the NFS share: [root@nfsclient ~]# umount -f /disk/x umount2: Device or resource busy umount.nfs: /disk/x: device is busy umount2: Device or resource busy umount.nfs: /disk/x: device is busy If I use df or lsof to try to figure out what process to kill, they hang. I am reluctant to just reboot, as many other users are getting stuff done. dmesg doesn't show anything useful. How to get unstuck? thanks, Dave

4 6

hot do use iscsi loopback
by lejeczek 03 Feb '16

03 Feb '16

hi everybody I've looked it up on the net but info is scarce. Could please someone explain how to use loopback and what is purpose? many thanks

1 1

Re: [CentOS] Latest version of kate editor
by James B. Byrne 03 Feb '16

03 Feb '16

On Tue, February 2, 2016 12:02, H wrote: > > What do people use as a programming editor on CentOS 6? My first > impression of kate was favorable, not only did it support the usual > programming and scripting languages but also markdown which I have > recently discovered... > > I use vim/gvim together with numerous add-ons from Tim Pope. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

strange behavior of firewalld and port-forwarding
by Django 03 Feb '16

03 Feb '16

HI, me and firewalld won't have a good start, but I hope we'll be good friends. One of my hosts must rerote traffic from one to another host. It isn't a big problem. I've a host witch must do: 1) forwarding port 25 tcp to a second host Here I've a special mail-relay. My external.xml look like this one: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> </zone> Every thing works expected, incomming traffic on port 25 is forwarded to 10.0.0.87 port 25. 2) traffic from 80.80.80.80 and destination-port 25 should be forwarded to port 22 tcp on 10.0.0.17 and not to 10.0.0.87 on port 25 So I made a new rule with: firewall-cmd --zone=external --add-rich-rule='rule forward-port port="25" to-port="22" to-addr="10.0.0.17" protocol="tcp" family="ipv4" source address="80.80.80.80"' If I try to connect on host 80.80.80.80 my system with: "telnet 10.0.0.17 25" I can connect the final host 10.0.0.17 on port 22 and open-ssh will greet me "SSH-2.0-oPENssh_6.6.1". It is working like I've expected. If I made my new firewall-rule permanent I use: "firewall-cmd --runtime-to-permanent" an the zone-file has now this content: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> <rule family="ipv4"> <source address="80.80.80.80"/> <forward-port to-addr="10.0.0.17" to-port="22" protocol="tcp" port="25"/> </rule> </zone> O.K. That isn't a miracle. BUT, every is working right till I restart the server or reload the firewalld with: "firewall-cmd --reload" Now I can't access my host 10.0.0.17 via ssh over my transit-host! I'll reach destination-host 10.0.0.87 on port 25. It looks like, my rich rule were'nt definied. :/ Any idea, how to make it reboot-save? Thanx for help ttyl, Django -- "Bonnie & Clyde der Postmaster-Szene!" approved by Postfix-God http://wetterstation-pliening.info http://dokuwiki.nausch.org http://wiki.piratenpartei.de/Benutzer:Django

1 0

CentOS 7 - DNAT with firewalld
by Django 03 Feb '16

03 Feb '16

HI, here I have an eMail with connected to a DMZ 10.0.0.0/24 network. This server holds 10.0.0.87 There are two firewall-hosts one with CentOS 6 10.0.0.10 and one with CentOS 7 10.0.0.17 The CentOS 6 has the following iptables-rule (extract): ----------------------8<----------------------8<----------------------8< *nat -A POSTROUTING -o eth1 -j MASQUERADE -A PREROUTING -i eth1 -d 217.91.103.190/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.87:25 *filter -A FORWARD -d 10.0.0.87/32 -i ppp0 -o eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT ----------------------8<----------------------8<----------------------8< If a external mailserver access the firewall, the traffic is routed to 10.0.0.87 port 25. As IP-adress from the external server I see hois public-IP. Here's the part of maillog: Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: CONNECT from [88.198.212.215]:36131 to [10.0.0.87]:25 Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: PASS OLD [88.198.212.215]:36131 Jan 26 13:03:20 vml000087 postfix/smtpd[10268]: connect from mx1.piratenpartei-bayern.de[88.198.212.215] Jan 26 13:03:31 vml000087 postfix/smtpd[10268]: disconnect from mx1.piratenpartei-bayern.de[88.198.212.215] so far so good, this work'ed fine the last 5 years ... Now I've a second network with a CentOS 7 base firewall. I've tried to adapt the roules I've mad on the old firewall. ----------------------8<----------------------8<----------------------8< # cat /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> </zone> # cat /etc/firewalld/zones/private.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Private</short> <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth0"/> <service name="ssh"/> <masquerade/> </zone> # cat /etc/firewalld/direct.xml <?xml version="1.0" encoding="utf-8"?> <direct> <rule priority="0" table="nat" ipv="ipv4" chain="POSTROUTING">-o eth1 -j MASQUERADE</rule> <rule priority="0" table="nat" ipv="ipv4" chain="PREROUTING">-i eth1 -d 192.168.0.17/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.87:25</rule> <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i eth1 -d 10.0.0.87/32 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT</rule> </direct> ----------------------8<----------------------8<----------------------8< The traffic over this firewall is routed to my mailserver, too. BUT I did'nt see the external customer-IP, I only can see the IP-address of my own firewall. Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: CONNECT from [10.0.0.17]:33803 to [10.0.0.87]:25 Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: WHITELISTED [10.0.0.17]:33803 Jan 26 13:04:52 vml000087 postfix/smtpd[10268]: connect from vml000017.dmz.nausch.org[10.0.0.17] Jan 26 13:04:53 vml000087 postfix/smtpd[11397]: disconnect from vml000017.dmz.nausch.org[10.0.0.17] So I think destination NAT (DNAT) isn't working on my CentOS 7 host. As I seaid on my CentOS6 host DNAT is working very well. So where's my error? in my configuration or in my head? ;) Thanx 4 help! ttyl Django -- "Bonnie & Clyde der Postmaster-Szene!" approved by Postfix-God http://wetterstation-pliening.info http://dokuwiki.nausch.org http://wiki.piratenpartei.de/Benutzer:Django

1 1

Python hashlib and ripemd160
by Alice Wonder 03 Feb '16

03 Feb '16

Hi - I think the patent monster has struck again. rmd = hashlib.new('ripemd160',binascii.unhexlify(someString)).hexdigest() That fails - ValueError: unsupported hash type From some googling, it appears that the supported hash types are from OpenSSL and that means the OpenSSL in CentOS doesn't support ripemd160. I've worked around other stuff missing from CentOS OpenSSL by building LibreSSL and linking against that but python is central to the operation of CentOS and I do not want to mess with replacing the CentOS packaging of python. Is there an alternate way to get a ripemd160 hash in python on CentOS ?

2 3

In A UEFI World, "rm -rf /" Can Brick Your System
by m.roth＠5-cent.us 02 Feb '16

02 Feb '16

Excerpt: Running rm -rf / on any UEFI Linux distribution can potentially perma-brick your system. As a public service announcement, recursively removing all of your files from / is no longer recommended. On UEFI distributions by default where EFI variables are accessible via /sys, this can now mean trashing your UEFI implementation. There is this systemd bug report requesting that UEFI variables be mounted as read-only by default. Lennart Poettering had initially responded and simply said, "Well, there are tools that actually want to write it. We also expose /dev/sda accessible for root, even though it can be used to hose your system. The ability to hose a system is certainly reason enought to make sure it's well protected and only writable to root. But beyond that: root can do anything really." He then closed the ticket. --- end excerpt --- <http://www.phoronix.com/scan.php?page=news_item&px=UEFI-rm-root-directory> "And they closed the ticket"? That tuxedo on the cockroach is so elegent! Ok, *now* tell me why we shouldn't hate systemd? mark

10 22

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss