Discuss

discuss@lists.centos.org

34753 discussions

yum/RPM and Trust on First Use
by Alice Wonder 21 Dec '15

21 Dec '15

I'm not on the yum / RPM list and I don't know that I want to join just to discuss this but with respect GPG keys - it is a classic example of trust on first use. The first time yum installs a package, it asks to import the GPG key used to sign the packages. Most people accept without validating the key. This is potentially exploitable because most repositories are http What if there was a DNS TXT record that corresponds with the repository, with the fingerprint of the key? The DNS record could be DNSSEC secured (I believe Fedora already uses DNSSEC - some of their servers anyway) and yum could refuse to ask if the fingerprint of the key it is importing does not match the DNSSEC secured fingerprint. Something like TXT record for _rpmkey.security.centos.org. could be requested for the fingerprint for security(a)centos.org Advantage over gpg keyrings is that it can be implemented by anyone without needing to manage your keys with specific gpg keyrings, which has always been messy. When yum is first asked to import a key, it refuses if it can not DNSSEC validate the fingerprint. After it DNSSEC validates the fingerprint, it can then does what it currently does, where the user can verify they trust the key. To get a fingerprint in the centos.org zone and signed by DNSSEC would not be easy for a malicious packager to do. Furthermore when a signing key has been compromised (happened with Fedora once) changing the DNS record would prevent the key from being imported in the future, and could even prevent packages signed by that key from being installed in the future even if the key is already imported. For offline yum usage, a switch could be used to tell yum not to do the DNS lookup and DNSSEC validation. Thoughts?

6 16

Power Management
by Chris Olson 20 Dec '15

20 Dec '15

Recent power management discussions plugged into one of our current frustrations, namely the interaction of the screen lock and power-save features on Intel/CentOS 6 platforms. We certainly would not have guessed that locking the screen would inhibit going into the power-save mode, but it sure seems to do exactly that on some of our test platforms. If one leaves the desktop idle for the timeout period, the computer sleeps. If one locks the screen and then leaves the machine idle, the computer does not sleep. We were hoping that this "feature" was isolated to just our older Dell desktop machine hardware and firmware, but it appears elsewhere as well. Possibly more interesting is that most of our systems were loaded with CentOS 6.X almost two years ago and have been updated at least weekly ever since. This new power-save scenario has appeared just within the last three weeks,and our investigations have not discovered the cause ora solution.

3 2

Critical problem with power management CentOS 7.2
by Alice Wonder 20 Dec '15

20 Dec '15

Thinkpad T410 running CentOS 7 with the Mate desktop (Gnome 3 is too demanding on video capabilities for this hardware) Under CentOS 7.1 - the laptop would sleep when I closed the lid. It no longer does. I can tell because the laptop remains warm when I close the lid now, mail filters in Thunderbird run when the lid is closed, and it doesn't need to re-establish wifi when opening. This is dangerous because thinkpads cool through the keyboard. The battery usage monitor also no longer works. It shows 99% battery even as the laptop starts giving its warning beep that the battery is exhausted and it is about to shut down. Anyone know what broke with the update to 7.2 and how to fix it? No 3rd party kernel modules are involved. -- -=- Sent my from my laptop, may not be able to respond timely

3 5

fail2ban problem new installation
by Günther J. Niederwimmer 20 Dec '15

20 Dec '15

Hello, I have a big problem with fail2ban and firewalld on my new system. I have a server running (CentOS 7.1) and run a Update to 7.2 on this system all is working ? BUT I install a new system with CentOS 7 1511 on this systems fail2ban don't work anymore. I have this error or more, in the firewalld 2015-12-19 08:39:55 ERROR: COMMAND_FAILED: '/sbin/iptables -w2 -t filter -I INPUT_direct 1 -p tcp -m multiport --dports ssh -m set --match-set fail2ban- sshd src -j REJECT --reject-with icmp-port-unreachable' failed: iptables v1.4.21: Set fail2ban-sshd doesn't exist. Try `iptables -h' or 'iptables --help' for more information. Is on 7.2 some missing or not installed I installed fail2ban from the epel repo. Thanks for a answer, -- mit freundlichen Grüßen / best regards, Günther J. Niederwimmer

3 3

LDAP create home directories
by Tim Dunphy 20 Dec '15

20 Dec '15

Hey guys, I've setup an LDAP server on our network. I'm using OpenLDAP. It was really easy to use the authconfig-tui to generate the nsswitch.conf and ldap.conf files that would allow user authentication. But when users would log in, the system wasn't creating the home directories. I found one command that would correct that: authconfig --enablemkhomedir --update After that logging in with an LDAP user to that machine would create the home directories. But that only worked on the first machine. Running the command on other machines would have no effect. Which is odd. You would think it would be consistent. Even after copying over the entire contents of /etc/pam.d from the working machine to the non-working machine and making sure that the non-working machine had the same /etc/nsswitch.conf /etc/openldap/ldap.conf as the one that worked. It still doesn't create the home directories when LDAP users log in. The non-working machine also has the required librariy file: -rwxr-xr-x. 1 root root 11176 Aug 18 10:56 /usr/lib64/security/pam_mkhomedir.so So how can I fix this? How can I get the system to create home directories for LDAP users automatically? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 5

playing DVDs on C7
by Fred Smith 20 Dec '15

20 Dec '15

Hi all! I'm trying to finish setting up my newly upgraded C7 system. It's on the same hardware I ran C6 on for several years. on C6 I had no trouble playing DVDs (after installing tons of packages and libdvdcss). Well, on C7, I've got totem (videos) and all its plugins I can find via yum, VLC (from nux) all the gstreamer and gstreamer1 packages I can find, everything with "dvd" in its name, including libdvdcss from nux. vlc will kinda play movies, i.e., moving garbage appears on the screen, sometimes it'll resemble something from the movie, but most of the time not so much. I can't figure out what's missing here. Totem played a movie for me this afternoon, flawlessly, but now I can't get it to do anything. sometimes it starts up as a plain gray box with no borders, no controls, no nothing, and has to be killed. sometimes it draws the player controls but never starts playing. I've got two DVD drives, one of them replaces a broken one, but the other one has been there for 2-3 years. I've been googling for hours, but haven't turned up anything that I haven't already tried. I'd appreciate suggestions. thanks in advance! here's some yum listings of things I have installed: yum list installed | grep -y dvd dvd+rw-tools.x86_64 7.1-15.el7 @anaconda libdvdcss.x86_64 1.2.13-1.el7.nux @nux-dextop libdvdnav.x86_64 4.2.0-8.el7 @anaconda libdvdread.x86_64 4.2.0-6.el7 @anaconda radvd.x86_64 1.9.2-9.el7 @base yum list installed | grep -y vlc vlc.x86_64 2.2.1-6.el7.nux @nux-dextop vlc-core.x86_64 2.2.1-6.el7.nux @nux-dextop vlc-extras.x86_64 2.2.1-6.el7.nux @nux-dextop yum list installed | grep -y totem totem.x86_64 1:3.14.3-5.el7 @cr totem-nautilus.x86_64 1:3.14.3-5.el7 @cr totem-pl-parser.x86_64 3.10.5-1.el7 @cr yum list installed | grep -y gstreamer PackageKit-gstreamer-plugin.x86_64 1.0.7-5.el7.centos @cr gstreamer.x86_64 0.10.36-7.el7 @anaconda gstreamer-ffmpeg.x86_64 0.10.13-15.el7.nux @nux-dextop gstreamer-plugin-crystalhd.x86_64 3.10.0-11.el7 @epel gstreamer-plugins-bad.x86_64 0.10.23-5.el7.nux @nux-dextop gstreamer-plugins-bad-free.x86_64 0.10.23-20.el7 @anaconda gstreamer-plugins-bad-nonfree.x86_64 0.10.23-2.el7.nux @nux-dextop gstreamer-plugins-base.x86_64 0.10.36-10.el7 @anaconda gstreamer-plugins-good.x86_64 0.10.31-11.el7 @anaconda gstreamer-plugins-ugly.x86_64 0.10.19-17.el7.nux @nux-dextop gstreamer-tools.x86_64 0.10.36-7.el7 @anaconda gstreamer1.x86_64 1.4.5-1.el7 @cr gstreamer1-libav.x86_64 1.0.6-1.el7.nux @nux-dextop gstreamer1-plugins-bad-free.x86_64 1.4.5-3.el7 @cr gstreamer1-plugins-bad-freeworld.x86_64 gstreamer1-plugins-base.x86_64 1.4.5-2.el7 @cr gstreamer1-plugins-good.x86_64 1.4.5-2.el7 @cr gstreamer1-plugins-ugly.x86_64 1.0.6-2.el7.nux @nux-dextop -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- But God demonstrates his own love for us in this: While we were still sinners, Christ died for us. ------------------------------- Romans 5:8 (niv) ------------------------------

4 8

Serial Communication
by Chris Olson 19 Dec '15

19 Dec '15

Many years ago, we began scrapping the RTOS approach for some of our timing-critical applications. Our first applications were based on Solaris real-time extensions and served well us well for many years. Then came the era of shaky support for Intel Solaris and we moved many applications to Linux. There appeared to be no actual need for special real-time features with a good Linux distribution kernel and a GHz processors. One of our most productive applications involves special test equipment computers that drive high speed serial ports. The original development of these systems had the "added benefit" of helping us to learn udev rules. The serial communication is very flexible and most of it is script driven. A current need to update computing platforms is driving script review. There appears to be a bit of variety in outputs to the serial drivers. The echo of a string with redirection to the serial driver, cat of a file with redirection to the serial driver and dd of=/dev/.... are methods used at various places in the scripts. It is not at all clear what drove the choice of the output method at various points in the application. In addition, changing the method of output has not succeeded in breaking most of the applications. Is there some fundamental difference between these methods of output to the driver that might trip us up as we simplify the scripts and port to new computer platforms? Thanks in advance for any assistance.

2 1

CentOS-announce Digest, Vol 130, Issue 8
by centos-announce-request＠centos.org 19 Dec '15

19 Dec '15

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Release for CentOS AltArch 7 (1511) on x86_64 (Karanbir Singh) ---------------------------------------------------------------------- Message: 1 Date: Sat, 19 Dec 2015 00:47:23 +0000 From: Karanbir Singh <kbsingh(a)centos.org> To: CentOS Announcements List <centos-announce(a)centos.org> Subject: [CentOS-announce] Release for CentOS AltArch 7 (1511) on x86_64 Message-ID: <5674A91B.40508(a)centos.org> Content-Type: text/plain; charset=utf-8 I would like to announce the general availability of the following CentOS AltArch 7 Releases: * CentOS AltArch 7 (1511) for i686 * CentOS AltArch UserLand 7 (1511) for Armhfp * CentOS AltArch 7 (1511) for PowerPC64 (TechPreview) * CentOS AltArch 7 (1511) for PowerPC8 LE (TechPreview) We anticipate CentOS AltArch 7 (1511) for Aarch64 will be ready for release within the coming days, and will be announced independently. The CentOS AltArch SIG is a group of people working to build alternative architecture support derived from CentOS Linux's sources. You can find more details about the AltArch group at https://wiki.centos.org/SpecialInterestGroup/AltArch including details on how to get involved and ways to get help for architecture specific issues. Releases under the AltArch SIG are hosted at http://mirror.centos.org/altarch/ and available from external mirrors via rsync, http, ftp as usual, however under the /altarch/ path. Yum configs shipped in the altarch builds points at mirror.centos.org instead of mirrorlist or the external mirrors, as we are still working through the mechanics to facilitate the wider mirrorlist process. We hope to have this in place within the next 2 months, and updates to the yum configs will be issued, when ready, via an updated centos-release rpm. We are hosting a CentOS Dojo in Brussels, Belgium on the 29th Jan 2016. Lots of the key people working on the AltArch builds will be present there and it would be a great forum to engage with these groups. You can get the details for the event at https://wiki.centos.org/Events/Dojo/Brussels2016 including the registration links. In order to bootstrap these builds, we have turned on direct downloads of this content from mirror.centos.org. We do encourage people with the capacity to help seed with external mirrors. Details on howto run a CentOS Mirror are available at https://wiki.centos.org/HowTos/CreatePublicMirrors A key part of our AltArch plans is to make resources available to all the other SIG's in the CentOS environment, so they are able to build, test, deliver their content for these architectures. We are working on setting things up, and hope to start rolling out altarch support for https://cbs.centos.org/ in the first quarter of 2016. If you are engaged in any of the SIGs and would like to find out more details, please come along to our buildsystems meeting that takes place on Mondays in #centos-devel on irc.freenode.net. Details on this meeting and the other SIG meetings can be found in our community meetings calendar published at https://www.centos.org/community/calendar/ . Bug reports and feedback about specific packages should be filed at https://bugs.centos.org/ against the relevant package name, for project CentOS Linux 7, in the same manner as you would for x86_64. However, do mention the architecture as applicable. -------- CentOS AltArch 7 (1511) for i686 : This architecture build supports 32-bit Intel/AMD x86 machines and 32 bit IOT x86 boards. SIG Notes: https://wiki.centos.org/SpecialInterestGroup/AltArch/i386 * CentOS-7-i386-DVD-1511.iso sha256sum : 6af64d8371ed8fb95a56c99530f0dc3eb287e58f72c009c686db0fb80c39f83f direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-DVD-1511.iso * CentOS-7-i386-Everything-1511.iso sha256sum : 918e0ade9f642c93531c414defeecfc9b2c2a9589d57642d690e46e42b0af82a direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-Everything-1511.… * CentOS-7-i386-LiveGNOME-1511.iso sha256sum : a03af3c7f6c75c74e1da5d1551ceaf5922427762c5cd6503f4f5e972737134ed direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-LiveGNOME-1511.i… * CentOS-7-i386-LiveKDE-1511.iso sha256sum : 9fdef81423b872c361bac3ac55718822b4420de1645a4da8d7a255ae500965fc direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-LiveKDE-1511.iso * CentOS-7-i386-Minimal-1511.iso sha256sum : df6edebec370bdee59e67eb70fab7ddc2fcf4c437803ca9e3213552b3908c4e1 direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-Minimal-1511.iso * CentOS-7-i386-NetInstall-1511.iso sha256sum : b106a0c13c86db86aaf821b66da1119063479e8776b8711dbbd35042b16bfd6d direct link : http://mirror.centos.org/altarch/7/isos/i386/CentOS-7-i386-NetInstall-1511.… -------- CentOS AltArch UserLand 7 (1511) for Armhfp : This architecture build delivers support for ARMv7hl devices including the Raspberry pi2, Cubie Truck, Bananapi and similar hardware. SIG Notes: https://wiki.centos.org/SpecialInterestGroup/AltArch/Arm32 The armhfp build is delivered as a userland build, implying that kernel and bootloader delivered is not derived from the CentOS Linux 7 distro, but comes from either an upstream kernel.org mainline kernel or is a vendor supported kernel for their own hardware piece. As such, the Armhfp build does not aim to deliver a complete feature set, and is labelled as a UserLand release. There are also no installer images delivered for this architecture. The images shipped are ready to run and are board specific. While there is plenty of desktop and X related support available, our focus for these builds has been towards the server and IoT roles. We have a dedicated mailing list for the ARM ports ( both Armhfp and Aarch64 ) at https://lists.centos.org/mailman/listinfo/arm-dev ; questions specific to these builds and images should be posted there. * CentOS-Userland-7-armv7hl-Minimal-1511-BananaPi.img.xz sha256sum : d461144b471434a275268e85828def38c09e265da24b71d2f10771d264532368 direct link : http://mirror.centos.org/altarch/7/isos/armhfp/CentOS-Userland-7-armv7hl-Mi… * CentOS-Userland-7-armv7hl-Minimal-1511-CubieTruck.img.xz sha256sum : 17c3944429ac323c636ee955062d8177219f397fea4416dca87ca19092b646ec direct link : http://mirror.centos.org/altarch/7/isos/armhfp/CentOS-Userland-7-armv7hl-Mi… *CentOS-Userland-7-armv7hl-Minimal-1511-RaspberryPi2.img.xz sha256sum : 05e8c58cd837b90c0ab423b3730ee20ad185e19f346f531d3717c51358ea72cf direct link : http://mirror.centos.org/altarch/7/isos/armhfp/CentOS-Userland-7-armv7hl-Mi… -------- CentOS AltArch 7 (1511) for PowerPC64 (TechPreview) : This architecture is for 64-bit IBM POWER7 machines using big endian byte ordering. We are marking this as a Tech Preview release, as it needs wider testing before it can be adopted as a GA release. SIG Notes: https://wiki.centos.org/SpecialInterestGroup/AltArch/ppc64 * CentOS-7-AltArch-ppc64-Everything-1511.iso sha256sum : 40ce665db62483a044a6d1a4996b2d5b507eb7f43c5e7846116dbd72e9e64e6a direct link : http://mirror.centos.org/altarch/7/isos/ppc64/CentOS-7-AltArch-ppc64-Everyt… * CentOS-7-AltArch-ppc64-NetInstall-1511.iso sha256sum : 46715a965f98901fabed13076aba879c32dd51b7bab63fa035b61a5b051f0b04 direct link : http://mirror.centos.org/altarch/7/isos/ppc64/CentOS-7-AltArch-ppc64-NetIns… -------- CentOS AltArch 7 (1511) for PowerPC8 LE (TechPreview) : This architecture is for 64-bit IBM POWER8 machines using little endian byte ordering. We are marking this as a Tech Preview release, as it needs wider testing before it can be adopted as a GA release. SIG Notes: https://wiki.centos.org/SpecialInterestGroup/AltArch/ppc64le * CentOS-7-AltArch-ppc64le-Everything-1511.iso sha256sum : 713ea707eea4eb75d7ff27648e6e3a4e97738bc3b2b274d1e9dc629fe537a170 direct link : http://mirror.centos.org/altarch/7/isos/ppc64le/CentOS-7-AltArch-ppc64le-Ev… * CentOS-7-AltArch-ppc64le-NetInstall-1511.iso sha256sum : fa7c5f504e56ad9115b820b1cf6650e6c20c6ca6224b155ef0c12e1be8e8f666 direct link : http://mirror.centos.org/altarch/7/isos/ppc64le/CentOS-7-AltArch-ppc64le-Ne… -------- I'd like to thank everyone involved in this process. We have come a long way down the route from the initial plans of getting the AltArch project bootstrapped, and its only down to the dedciated efforts from the people involved in this process that we are able to deliver support for five new architectures. I also want to take this opportunity to point out that we run an office hours forum, twice a week. Details are available at https://www.centos.org/community/calendar/#Karanbir_Singh_Office_Hours , please feel free to stop by and say hi. We welcome comments and questions around pretty much anything / everything relevant to the CentOS community. enjoy! -- Karanbir Singh, Project Lead, The CentOS Project +44-207-0999389 | http://www.centos.org/ | twitter.com/CentOS GnuPG Key : http://www.karan.org/publickey.asc ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 130, Issue 8 ***********************************************

1 0

CentOS 7.2 - Fast TSC calibration failed.
by Earl A Ramirez 19 Dec '15

19 Dec '15

Dear All, I have downloaded CentOS 7.2.1511 DVD and tried to install it on a new laptop that comes with an Intel i7 6th generation processor and don't matter which option I use (install, test media or troubleshooting); I get the following error: [ 0.000000] tsc: Fast TSC calibration failed [ 0.321345] pnp 00:0d: can't evaluate _CRS: 1 At this time I am not able to use any keys on the keyboard; therefore, the only option I have is to power the laptop off. The laptop specifications are as follow: Processor : Intel Core i7-6700HQ 2.6GHz (Turbo up to 3.5GHz) Skylake RAM : 32 GB DDR4-SDRAM Graphics Coprocessor : NVIDIA GTX960M 2GB GDDR5 Chipset Brand : Intel I waited for CentOS 7.2 because I saw that upstream had [0] "the 'intel_idle' and 'pstate' driver updated to support 6th Generation Intel Core processor". Shall I file a bug for this or will I need to create a ISO with an customised kernel or use one of ElRepo's 'lt' or 'ml' kernels which will include support for the new hardware. The full specification of the laptop can be found here [1] [0] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/ht… [1] http://store.asus.com/us/item/201510AM170008064/A17602 -- Kind Regards Earl Ramirez

2 2

CentOS 7 installer bug?
by m.roth＠5-cent.us 19 Dec '15

19 Dec '15

The other admin I work with seems to have found a bug in the installer. The setup is: two internal SSD drives. Once the GUI gets to "select drive to install on", he goes to <ctl><alt><f2>, creates a RAID 1, and partitions it, regular MBR (they're small). 1G for /boot as the first partition, 2G for swap as the second partition, and the rest for / as partition 3. fdisk shows the partition types correctly. Back to the GUI, select the MD drive... and /boot's fine, / looks ok... but the one for swap shows with 0 bytes. Anyone else seen this behavior? mark

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss