Discuss

discuss@lists.centos.org

2 participants
34758 discussions

Modifying RHEL OVAL CVE feed for use with CentOS 7
by Mosley, Graham A. (GSFC-6062)[GSFC - HIGHER EDUCATION] 13 Jul '15

13 Jul '15

Hi all. I am curious if anyone has experience using the OVAL tests for CVEs provided by Red Hat (https://www.redhat.com/security/data/metrics/) for CentOS 7. I was able to get the tests working for the non modified packages provided by RHEL but not the packages modified by CentOS. I believe this is because CentOS 7 no longer has minor versions (PACKAGE.VERSION.el7.*.rpm) whereas RHEL does (PACKAGE.VERSION.el7_1.*.rpm) so the CVE check thinks that the package is out of date. Any ideas? Thanks

1 0

Migrating to IdM
by isdtor 13 Jul '15

13 Jul '15

I have just started looking through the RHEL6 IdM guide, and while the documentation seems quite thorough and extensive, the examples are somewhat on the weak side. Migration scenarios can be much more complex - e.g. migrating away from NIS while at the same time moving to LDAP or AD for user account management. Is anyone aware of any tutorials or guidelines for such a situation? Then there are a number of technical questions that are unclear - are there equivalents for the standard yp* tools (enumeration via ldapsearch may be restricted by policy); can there be local (to the IdM server, not machine) users that are not in LDAP/AD; can there be local passwords for users; etc.etc. Should CentOS7 be considered over CentOS6?

2 1

Wrapper script for shutdown, passwd, etc. commands
by Kwan Lowe 13 Jul '15

13 Jul '15

Hello all. Thank you for reading. I'm hoping someone can point me in the right direction here. I am looking to implement a wrapper script/utility that will prompt for a ticket number before running certain commands. I've used similar scripts in the past on systems that I didn't have admin access. The wrapper would do something like this: [root@vm-helios-019] shutdown -h now *** WARNING *** You are attempting to shutdown a production server: vm-helios-019.digitalhermit.com Please enter the Change Log Ticket for shutdown CHG-FL-102122 Please confirm by entering your login password: xxxxxxxxxxxxxxxxxx Ticket number CHG-GL-102122 for user Kwan Lowe (klowe) has been logged at Sun Feb 4, 2001 at 14:23 (2:23PM). Ideally this would only kick in if the request is coming from an interactive session. Thinking about it, just replacing the command with a wrapper could cause other problems. Has anyone done anything similar? Thanks, Kwan

3 3

CentOS 7 + Dell Latitude E6420 laptop = thermal shutdown
by deoten 13 Jul '15

13 Jul '15

Hi, Thanks for reading this. I installed CentOS 7 (tried the latest ISO image and the previous build) on the laptop and got to the point where I am logging into the desktop environment and the laptop just shuts down. I check the event log in BIOS and find that a thermal event has occurred and the system powered off to prevent damage. I can take the same laptop with Windows 7 installed and run graphically intensive tests for an hour solid and it doesn't lock up. I installed Ubuntu 15.04 and that seemed solid too. Is this a known issue with CentOS 7? Should I be using a particular boot option? It does not seem to matter whether Gnome or KDE is chosen as the desktop environment. Any help you can provide is appreciated. Thanks.

10 17

PXE question
by isdtor 13 Jul '15

13 Jul '15

I was wondering, where is the format and options of files like /usr/share/system-config-netboot/pxelinux.cfg/default from system-config-netboot-cmd described? There are plenty of PXE tutorials with examples out there, but nothing that looks like actual documentation.

3 3

Re: [CentOS] Using gpg to encrypt a URL line on CentOS 6 additional information
by Jerry Geis 13 Jul '15

13 Jul '15

>+1. also, it'd probably be good to state what you're trying to accomplish rather >than if you can throw a technology at vague something or another. I think you'd >find gpg's password input cumbersome for symmetric keys, the output too long in ascii >armor and possibly annoying to deal with public keys... but you don't really say what >you're trying to fix/avoid/do/not do. Sorry if I wasnt being clear enough.... it basically comes down to this. I use an apache interface to my application, the URL line has parameters line mscript?value=2&something=4 etc.. I have a "crude" encoding (wouldnt even call it encryption) that I use right now. I'd like to make that more robust. I started looking and found mcrypt (which I mentioned in the first post) But that did not compile from source, and is not available in the standard yum install. Other repos have it but that may not be an option for me due to other reasons.... No problem. So I started thinking about does GPG support something similiar like mcrypt? Easy way to encrypt a line for URL. That is where my goal lies... Way to encrypt a URL string with what is "standard" in CentOS 6. Thanks, Jerry

3 2

Installing from USB
by Jerry Geis 12 Jul '15

12 Jul '15

I found this http://wiki.centos.org/HowTos/InstallFromUSBkey So for centos 7 if did the dd command seemed to work great. I did the install. So now I'd like to "modify" the USB key to add a boot menu option with my customer install options. I mounted /dev/sdb2 and edited the file /mnt/usb/EFI/BOOT/grub.conf added my menu item and rebooted to try to use it. It does not show up in the menu. How do I get the USB to use my new menu? Thanks Jerry

2 1

Re: [CentOS] puppet files denied by SELinux
by Tim Dunphy 12 Jul '15

12 Jul '15

Hi all, Thanks for all your suggestions. Here's where I'm at with this. Can you give details about your puppetmasterd setup ? it seems that > you're using Foreman as puppet ENC. > Yes, I'm on foreman 1.7.4 and puppet 3.75. You are correct that I'm using foreman, sorry I hadn't thought to mention it! > Foreman works fine with selinux enabled : that's what we use for the > centos.org infra :-) > Which version of puppet/foreman are you using ? Note that foreman has > the foreman-selinux package that is used to automatically tune > contexts and booleans needed for this. > You can still reapply those settings with > /usr/sbin/foreman-selinux-{disable,enable,relabel} > There is no need to recompile a custom selinux policy for > foreman/puppet those days > I didn't recompile any custom selinux policies. All I did to try to resolve the issue is to consult audit2allow and install the module it suggested. I did try running /usr/sbin/foreman-selinux-enable but that didn't seem to have an effect. Knowing nothing of your scenario, look at the source and target context. > > Looks like you copied a crt from an nfs location and you don't have a > file context defined to transition labels, maybe something like: > > semanage fcontext -a -t passenger_t "/etc/puppet/environments(/.*)?" > > However, I know nothing of puppets selinux infrastructure, you may need > a more applicable type. > > In these cases, audit2allow can't possibly guess the right thing and will > certainly produce a rule that is either unsafe or simply wrong. > You are correct that I copied the key and cert from an NFS share! Both the puppet server and the monitor1 client share the same /home directory via NFS. Pretty cool that you picked up on that! I do suspect you're probably right that this may be causing the problem. Just on a hunch, I tried copying the certs and keys from the montior1 host over to the puppet host to the /tmp directory on the puppet server. That leaves out NFS altogether. And when I do that, my bacula puppet module WORKS!! Puppet doesn't complain at all! But if I check out another host where I copied the cert and key from the NFS home directory I still get the error: Error: /Stage[main]/Bacula::Config/File[/etc/pki/tls/private/monitor2.mydomain.com.key]: Could not evaluate: Could not retrieve information from environment production source(s) puppet:///modules/bacula/monitor2/monitor2.mydomain.com.key Error: /Stage[main]/Bacula::Config/File[/etc/pki/tls/certs/monitor2.mydomain.com.crt]: Could not evaluate: Could not retrieve information from environment production source(s) puppet:///modules/bacula/monitor2/monitor2.mydomain.com.crt Also when I try to set context using the line you suggested I get an error: #semanage fcontext -a -t passenger_t "/etc/puppet/environments(/.*)?" ValueError: Type passenger_t is invalid, must be a file or device type So I googled around and found what seems to be the correct syntax: semanage fcontext -a -t passenger_exec_t "/etc/puppet/environments(/.*)?" Because when I applied that line, I didn't get any errors or complaints. However the problem still existed on the monitor2 host which had the key pair copied from the NFS share. So in summary it appears that there is some interaction between SELinux and NFS that is causing the issue. Any thoughts? Thanks, Tim On Sun, Jun 21, 2015 at 11:09 AM, Tim Dunphy <bluethundr(a)gmail.com> wrote: > Yes, you did when you used the audit2allow with the -M option argument >> of "puppet", which is confirmed by the command you issued to try to load >> it "semodule -i puppet.pp" (which you stated in your original message). >> I'm okay with you asserting otherwise and not following my first >> suggestion -- my second is to use a totally different name, e.g., "barf" >> and thus "semodule -i barf.pp". > > > Haha!! Ok man. I get you now. Thanks. Also I meant to send this to the > list.. Whoops! I'll try doing it again with something like 'my' in the > front. I remember having a similar problem with Zabbix last week that I > solved this way. > > On Sun, Jun 21, 2015 at 12:19 AM, Mark Milhollan <mlm(a)pixelgate.net> > wrote: > >> On Sat, 20 Jun 2015, Tim Dunphy wrote: >> >I wrote: >> >> >> That suggests there's already a module named puppet, and thus you are >> >> replacing it with the one you made which does not supply the >> >> puppet_var_lib_t type. Always prefix your own modules with something >> >> that makes them almost certain to be unique, e.g., yourdom_puppet. >> >> >> > >> >No, actually I didn't compile my own selinux module. :) Not sure how you >> >got that idea, but that is not the case. >> >> Yes, you did when you used the audit2allow with the -M option argument >> of "puppet", which is confirmed by the command you issued to try to load >> it "semodule -i puppet.pp" (which you stated in your original message). >> I'm okay with you asserting otherwise and not following my first >> suggestion -- my second is to use a totally different name, e.g., "barf" >> and thus "semodule -i barf.pp". >> >> >> /mark >> > > > > -- > GPG me!! > > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B > > -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 3

Mounting NFS file systems via Nautilus on CentOS 6
by Toralf Lund 11 Jul '15

11 Jul '15

Hi, I'm trying to set up my "work" laptop, which has CentOS 6.6, for easy NFS access to a "NAS" disk at home. I can't set for a normal "permanent" mount, since most of the time, the filesystem will not be available. I know several different ways to mount temporarily from the command line, but I was hoping I could set up the system so I could mount by clicking in the file browser (Nautilus.) I can't seem to find a way to do this, though. I've tried two different approaches: 1. Add an entry of the form server:/directory /directory nfs rw,users,noauto to /etc/fstab. 2. Add a location of the form /net/server/directory to Bookmarks - as the filesystem is mounted automatically when entering this location, provided that autofs is enabled with the default configuration. Unfortunately, neither of these methods work out quite right. Setting up fstab as outlined in 1. means that I can mount the filesystem as a regular user by issuing "mount /directory", but I can't find a direct way to issue this command from the GUI: I actually thought a relevant entry would show up just like that under Places and/or computer:///, but apparently not. This could be related to what's described in https://bugzilla.gnome.org/show_bug.cgi?id=536292, although it mentions that the problem is fixed in GNOME 2.28, and I thought the CentOS 6 had a newer version than that. Method 2. does cause the filesystem to be mounted, but the problem is that it happens too often. The idea was of course that the mount would occur when selecting the bookmark, but it looks like Nautilus will actually try to access the location before that, so that the filesystem pretty much stays mounted at all times. If the disk is available, that is, I haven't tested yet what happens when it isn't, but others with different Linux variants report that Nautlius will lock up completely because it can't get data for the location. So, does anyone have any idea how to best set up the system do to what I want (see above)? I guess I might create special "mount" and "unmount" launchers, but I'd prefer a solution that's more integrated with the normal file browser operation. Thanks, - Toralf

1 0

Using gpg to encrypt a URL line on CentOS 6.
by Jerry Geis 11 Jul '15

11 Jul '15

Is there a way to use GPG to encrypt a URL line with parameters ? I was looking at libmcrypt also but it is not part of CentOS. I have found examples for mcrypt but not for gpg. Thoughts? Thanks. jerry

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss