Discuss

discuss@lists.centos.org

2 participants
34758 discussions

ntpd new version
by Vijendra Agarwal (vijagarw) 07 Jul '15

07 Jul '15

Hi All, Currently CentOS site contains the below version of ntpd. ntp-4.2.6p5-3.el6.centos.x86_64.rpm<http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/ntp-4.2.6p5-3.e…> :- 16 mar 2015. Does anybody have any information about when the new version of ntpd is expected to release containing new vulnerabilities fixes? Thanks Vijendra.

4 4

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 06 Jul '15

06 Jul '15

On 07/05/15, Gordon Messmer wrote: That's not the same as checking the media for corruption. You may be able to read all of the files, but if the data is corrupt, rpm may throw and IOError. So, the next thing to do is check your media. The DVD should offer to do that first when you boot from it. ------ Above quoted -------- Booted the DVD again, took the default. It got to 76.2% then told me: The media check is complete. The result is: FAIL. It is not recommended to use this media. [FAILED] Failed to start media check on /dev/sr0. See 'systemctl status checkisomd5(a)-dev-sr0.service' for details. dracut-initqueue[681]: Job for checkisomd5(a)-dev-sr0.service failed. See 'systemctl status checkisomd5(a)-dev-sr0.service' and 'journalctl -xn' for details. [ 243.972119] dracut: FATAL: CD check failed! [ 243.972141] dracut: Refusing to continue Could not unmount /run/install/repo: Device or resource busy [ 245.127417] System halted. Ran the check again, same thing. Took that DVD back to the machine I burned it on, downloaded the MD5SUM from one of the mirrors and checked the file I downloaded. That checks. Used cmp to compare the .iso file to the image on the DVD, they match, the DVD is good. Hmm, what gives. Burned another DVD and verified the burned image matches the .iso file. Took the new DVD to the machine I'm doing the install on and ran the check again. OMG, it did the same thing at 76.2%. Now I'm thinking, wait, it says "Failed to start media check" is that a poorly worded message or does it really mean what it says?

3 2

ssh -X versus -Y
by Stuart Barkley 06 Jul '15

06 Jul '15

On Fri, 26 Jun 2015 at 03:16 -0000, Alexandru Chiscan wrote: > On 06/25/2015 11:51 PM, Stuart Barkley wrote: > > Then from your desktop (assuming Linux already running X) in a > > local xterm do something like: > > > > ssh -Y remote-system > > Do not use that because any user logged on the server can connect to > your X server display and snoop what you are doing, open windows > etc. > > -Y disables all the X server authentication mechanisms > (http://www.x.org/wiki/Development/Documentation/Security/) I believe this is incorrect. The authentication protocols are still used (thus the need for the xorg-x11-xauth package on CentOS). This is not the same as 'xhost +' which should never be used. Both -X and -Y require read access to the ~/.Xauthority file on the remote system in order to connect back to the X server. You can see this by using the 'xauth remove' command to remove the authentication token for the display and clients can no longer connect. > > Note about -X versus -Y with ssh: > > > > -X enables basic X forwarding, It disables some X functionality > > making it "safer" to allow. -X also stops working after about 20 > > minutes (this is by design but not well documented). I only > > recently learned why it would stop working after pulling out the > > last of my hair. > > I have been using ssh X forwarding for current work use (local > betwork) for more than 15 years and never got into this kind of > problem from RH 7 to Centos 7, AIX and Solaris. Likewise, I've used ssh/X for 20+ years on a variety of systems. In most cases -X is sufficient, but some applications seem to require -Y and I have not dug into all of the reasons. > Maybe it is some other issue that is closing your ssh connection > (maybe you should use the KeepAlive options on the ssh > server/client); just guessing. On Debian and FreeBSD 'man ssh_config' now shows: ForwardX11Timeout Specify a timeout for untrusted X11 forwarding using the format described in the TIME FORMATS section of sshd_config(5). X11 connections received by ssh(1) after this time will be refused. The default is to disable untrusted X11 forwarding after twenty minutes has elapsed. This option seems to have appeared in OpenSSH 6.0 [See more at the end of this email]. > > -Y allows the full X protocol which might be a security risk. > > Some applications will only work with -Y. With this, remote X > > applications can grab keyboard interactions, grab passwords, put > > windows on top of other windows (obscuring security messages), > > etc. > > > > For my own choice I use -Y (although I only enable it occasionally > > to specific systems). This is a recent behaviour change on my part with limited use to system I trust. Now that I know about the timeout I can probably just live with -X and will consider moving back to -X for my occasional use, The documentation of the practical differences between -X and -Y is pretty obscure (mostly defering to the X Security extension documentation). I would like to see better clarification of the differences. ...some additional research looking at the source code and revision history... The ForwardX11Timeout change was 5 years ago in OpenSSH 6.0. CentOS 6 still has OpenSSH 5.3 without this change (or if a patch was applied the documentation was not also patched). CentOS 7 has OpenSSH 6.6 which includes this change. http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?… Prior to that there was an intended hard coded 20 minute timeout since at least 2005: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/clientloop.c.diff?… Based upon the comments in the June 2010 revision it appears that the timeout was not working correctly and perhaps was falling back to trusted authentication after 20 minutes: Add X11ForwardTimeout option to specify timeout for untrusted X11 authentication cookies to avoid fallback in X11 code to fully-trusted implicit authentication using SO_PEERCRED described at: http://lists.x.org/archives/xorg-devel/2010-May/008636.html After the X11ForwardTimeout has expired the client will now refuse incoming X11 channel opens. I will need to see it this is an unpatched security issue on CentOS/RedHat 6. If so, I claim credit for observing it as a possibility. Stuart -- I've never been lost; I was once bewildered for three days, but never lost! -- Daniel Boone

5 6

Centos 7 Server Forgets IPv6 Address On Reboot
by Dave Cross 06 Jul '15

06 Jul '15

My Centos 7 server has started to forget its IPv6 address on a reboot. This causes problems with services being unable to start up. It's easy enough to fix each time (ip addr add ...), but it would be nice to be able to convince it to retain that information. Presumably, there's a file somewhere under /etc/sysconfig that should contain this information - does anyone know where it should be stored? Thanks, Dave... -- Dave Cross :: dave(a)dave.org.uk http://dave.org.uk/ @davorg

3 2

IPMI/BMC/BIOS
by Chris Olson 06 Jul '15

06 Jul '15

We have recently been asked to evaluate some computing machinery for a new project. This particular end user has very limited experience with the stated security requirements in a lights-out environment. Their primary work (as well as mine) in the past has been with very small, simple networks of desktop machines and a few servers with extremely limited access. For the most part, their admins haverefused to use any maintenance connectivity to servers other thanthe primary serial ports. There is a concern about system security primarily driven by recent information searches performed by end user admins and included below. IPMI/BMC Security Issues ------------------------ https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface http://www.google.com Search: IPMI "Security Holes" -- Hits: 14,500 http://www.google.com Search: IPMI BMC "Security Holes" -- Hits: 4950 BIOS Security Issues -------------------- https://en.wikipedia.org/wiki/BIOS http://www.google.com Search: BIOS "Security Holes" -- Hits: 342,000 My initial recommendation was to use a totally separate network for any service processors within the servers that implement IPMI/BMC capabilities. This has been standard practice in most systems I have worked on in the past, and has allowed certification with essentially no problems. The BIOS concern seems to be another issue to be addressed separately. Any connectivity and access to a system brings security issues. The list from these searches is huge. Are there specific things that must always be addressed for system security besides keeping junior admins off the server supporting the maintenance network? Thanks in advance for any feedback and best regards.

5 4

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 06 Jul '15

06 Jul '15

On 07/05/15, Gordon Messmer wrote: anaconda will try to delete an rpm file if it gets an IOError. Your media may be corrupt. Check that first. ----- Above quoted ----- No such luck. On the system where I'm doing the install, I used dd to read the entire DVD and also copied every .rpm to /dev/null and didn't get any I/O errors. What next?

3 2

Re: [CentOS] 7.1 install with Areca arc-1224
by C Linus Hicks 05 Jul '15

05 Jul '15

On 07/05/2015 09:17 AM, linush(a)verizon.net wrote: > Someone please tell me what I did to screw this thing up so badly. On 07/05/15, Gordon Messmer<gordon.messmer(a)gmail.com> wrote: Have you looked at the log files in /mnt/sysimage/root/? ------------- Quoting broken in this mailer ------------ So I looked in /mnt/sysimage/var/log/anaconda and found this in anaconda.packaging.log: --------- cut --------- 02:40:53,109 DEBUG packaging: Installing abrt-dbus (684/1349) 02:40:53,125 DEBUG packaging: Installing flite (685/1349) 02:40:54,291 DEBUG packaging: Traceback (most recent call last): 02:40:54,291 DEBUG packaging: File "/usr/libexec/anaconda/anaconda-yum", line 220, in callback 02:40:54,292 DEBUG packaging: return func(amount, total, key, data) 02:40:54,292 DEBUG packaging: File "/usr/libexec/anaconda/anaconda-yum", line 342, in inst_open_file 02:40:54,292 DEBUG packaging: os.unlink(txmbr.po.localPkg()) 02:40:54,292 DEBUG packaging: OSError: [Errno 30] Read-only file system: '/run/install/repo/Packages/flite-1.3-22.el7.x86_64.rpm' 02:40:54,292 DEBUG packaging: FATAL ERROR: python callback <bound method RPMCallback.callback of <__main__.RPMCallback object at 0x7fa4569d1a10>> failed, aborting! 02:40:54,393 INFO packaging: ==== start rpm scriptlet logs ==== 02:40:54,393 INFO packaging: warning: filesystem-3.2-18.el7.x86_64: Header V3 RSA/SHA256 Signature, key ID f4a80eb5: NOKEY 02:40:54,393 INFO packaging: libgcc-4.8.3-9.el7.x86_64 (1/1349) 02:40:54,393 INFO packaging: fontpackages-filesystem-1.44-8.el7.noarch (2/1349) 02:40:54,393 INFO packaging: 1:control-center-filesystem-3.8.6-18.el7.x86_64 (3/1349) --------- cut --------- The path it is complaining is a read-only filesystem is the installation DVD. If my interpretation is correct, it appears to be attempting to delete a file on the DVD. Is there some issue with installing flite or is something else going on? When I searched there was a bug opened on a similar issue, but the person had a RAID array failure and the only error I see in the anaconda.storage.log is this: ------ cut -------- 02:24:19,798 DEBUG blivet: parsing /mnt/sysimage/etc/blkid/blkid.tab 02:24:19,799 INFO blivet: IGNORED: Caught exception, continuing. 02:24:19,799 INFO blivet: IGNORED: Problem description: error parsing blkid.tab 02:24:19,800 INFO blivet: IGNORED: Begin exception details. 02:24:19,800 INFO blivet: IGNORED: Traceback (most recent call last): 02:24:19,800 INFO blivet: IGNORED: File "/usr/lib/python2.7/site-packages/blivet/__init__.py", line 3227, in parseFSTab 02:24:19,800 INFO blivet: IGNORED: blkidTab.parse() 02:24:19,800 INFO blivet: IGNORED: File "/usr/lib/python2.7/site-packages/blivet/__init__.py", line 2282, in parse 02:24:19,800 INFO blivet: IGNORED: with open(path) as f: 02:24:19,800 INFO blivet: IGNORED: IOError: [Errno 2] No such file or directory: '/mnt/sysimage/etc/blkid/blkid.tab' 02:24:19,800 INFO blivet: IGNORED: End exception details. ---------- cut --------- Which doesn't appear to be fatal.

2 1

7.1 install with Areca arc-1224
by linush＠verizon.net 05 Jul '15

05 Jul '15

I must be doing something horribly wrong and I hope somebody can help. The Areca arc-1224 is not supported by the Areca driver included driver in 7.1 so I have to supply that when starting the install. Documentation provided by Areca and in the Red Hat install guide say the same thing, put the driver on an accessible medium then append inst.dd on the boot command, choose the driver and now the drives show up. So far so good. There's already a possible glitch, however. The USB memory stick is mounted as sda1, shifting the hard drives off by one letter. So I break into the shell and partition the drives the way I want them, go back to the GUI installer and select the drives I want to use, assign mount points and formatting options. Done with that, configure the network and disable kdump. Start the installation. Give it a root password. Install completes, reboot. Only it won't boot. Boot the DVD again, use troubleshooting with rescue option, again providing the new Areca driver. Tell it to mount my install under /mnt/sysimage. Look around a bit, there's almost nothing I expect to see in /boot, there's no kernel image. Do chroot /mnt/sysimage and query the RPM database, I see kernel-devel, kernel-headers and kernel-tools-libs. Hmmm, I'll bet that's a problem. What the heck?? I actually did try copying the kernel and a few other required RPMs into a directory inside the chroot jail, install them and that worked fine, so I know those bits on the DVD are good. Someone please tell me what I did to screw this thing up so badly. Linus

2 1

OT Advantage of running DNS server?
by Timothy Murphy 05 Jul '15

05 Jul '15

What is the advantage, if any, of running one's own DNS server? Surely the link between domain name and IP address must already have been established? -- Timothy Murphy gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin

7 6

Gracefully powering off system in case of power failure
by Jatin Davey 04 Jul '15

04 Jul '15

Hi I am using the system as shown below. ********************************* [root@localhost sbin]# cat /etc/*release LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphi cs-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch Red Hat Enterprise Linux Server release 6.5 (Santiago) Red Hat Enterprise Linux Server release 6.5 (Santiago) [root@localhost sbin]# uname -a Linux localhost.localdomain 2.6.32-431.el6.x86_64 #1 SMP Sun Nov 10 22:19:54 EST 2013 x86_64 x86_64 x86_64 GNU/Linux [root@localhost sbin]# ********************************** In case of power failure on this server , how can i make the system to shutdown gracefully so that it unmounts the file-system and cleans up the required buffers. My server does have a battery backup so it will help in shutting down the system more gracefully. I tried looking at this link: https://www.olimex.com/forum/index.php?topic=3326.0 But it did not help. Appreciate if someone can help me in this regard. Thanks Jatin

4 10

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss