Discuss

discuss@lists.centos.org

2 participants
34758 discussions

Re: [CentOS] SEmodule dependency hell.
by James B. Byrne 07 Apr '15

07 Apr '15

On Wed, April 1, 2015 16:09, Andrew Holway wrote: > I used the command: semanage port -m -t http_port_t -p tcp 8000 > to relabel a port. perhaps you could try: > "semanage port -m -t unconfined_t -p tcp 8000" > Failing that; would it work to run your application in the httpd_t > domain? > I ended up having to create a custom policy to allow the other application to have access to the http_port_t context. Which is not an issue given that no httpd service is, or will ever be, installed on that host. However, it seems a rather dangerous hole in the logical design of SELinux that one cannot explicitly remove and reassign contexts to ports. In order to accomplish this on a system running httpd but attached to non-standard ports one perforce is required to cross link permissions between all of the affected processes. Which I cannot conceive as a security enhancement. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

tcsd service fails on boot because device missing
by Laurent Blume 07 Apr '15

07 Apr '15

Hello all, On CentOS 7.1, I activated the tcsd service. When I did it manually, it worked without problem, however, on reboot, I noted it was failed. I restarted it, and it worked immediately. But more reboots confirmed that it's always failing when the system starts. It seems the service is started too early, before the device it uses is created. Here's the logs: # journalctl -u tcsd -- Logs begin at Mon 2015-04-06 10:20:59 CEST, end at Tue 2015-04-07 10:11:37 CEST. -- Apr 06 10:21:38 server systemd[1]: Starting TCG Core Services Daemon... Apr 06 10:21:38 server systemd[1]: tcsd.service: control process exited, code=exited status=137 Apr 06 10:21:38 server systemd[1]: Failed to start TCG Core Services Daemon. Apr 06 10:21:38 server systemd[1]: Unit tcsd.service entered failed state. In syslog: Apr 6 10:21:38 server journal: TCSD TDDL[2557]: TrouSerS ERROR: Could not find a device to open! The device appears at about the same time, it must be a matter of seconds: crw------- 1 root root 10, 224 Apr 6 10:21 /dev/tpm0 Is that a bug of the service or something I can fix? Thanks! Laurent

1 0

filesystem corruption?
by m.roth＠5-cent.us 07 Apr '15

07 Apr '15

Got an older server here, running CentOS 6.6 (64-bit). Suddenly, at 0-dark-30 yesterday morning, we had failures to connect. After several tries to reboot and get working, I tried yum update, and that failed, complaining of an python krb5 error. With more investigation, I discovered that logins were failing as there was a problem with pam; this turned out to be it couldn't open /lib64/security/pam_permit.so. The reason for that was that it was a broken symlink, pointing to a file in the same directory, that actually existed in the /lib64. Checking other systems, I found it should, in fact, be a file, not a symlink. At this point, the system was considered suspect. I brought the system down, replaced the root drive, and rebuilt. I was not able to build it as CentOS 7, as something in the older hardware broke the install. CentOS 6 built successfully, and the server was returned to service. I then loaded the drive in another server, and examined it. fsck reported both / and /boot were clean, but when I redid this with fask -c, to check for bad blocks, it found many multiply-claimed blocks. First question: anyone have an idea why it showed as clean, until I checked for bad blocks? Would that just be because I'd gracefully shut down the original server, and it mounted ok on the other server? Mounting it on /mnt, I found no driver errors being reported in the logs, nor anything happening, including logons, before an automated contact from another server, which failed. AND I checked our loghost, and nothing odd shows there, neither in message nor in secure. At this point, I *think* it's filesystem corruption, rather than a compromised system, but I'd really like to hear anyone's thoughts on this. mark

4 3

Satellite sync (spacewalk) of configuration channels?
by Christopher Jacoby 07 Apr '15

07 Apr '15

Hello all. I have inter-Satellite sync set up and working on two Satellite servers downstream from a development Satellite server. Channels sync up fine, but I would like to sync up system groups and configuration channel content as well. Any ideas? Thanks, Chris

1 0

Import Nautilus file notes from C6 Gnome to C7 Mate
by Frank Cox 07 Apr '15

07 Apr '15

With C6 Gnome and C7 Mate you can right-click on a file icon, select Properties, select Notes, and write notes about your file. Does anyone know if those notes can be directly transferred between C6 Gnome and C7 Mate? I'm looking into upgrading someone's desktop machine to C7 and she has a lot of notes attached to her files that she doesn't want to lose. After doing a bit of experimenting, I think the notes are actually stored in a file named ~/.local/share/gvfs-metadata/home Can I just copy that "home" file into the new C7 Mate desktop and have the file notes move in automatically, or do I have to somehow extract the notes and re-import them? Any suggestions will be appreciated. -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

1 1

Firewall-config NetworkManager Problem (Centos-7( 1))
by Günther J. Niederwimmer 06 Apr '15

06 Apr '15

Hello I installed the Firewall-config on a new system and have bad Errors The firewall-config brake with a error line 53 can't load NetworkManager and on a reboot I have this Message. ABRT hat 1 Fehler festgestellt. (Für weitere Informationen: abrt-cli list -- since 1428305986) [root@ipa1 ~]# abrt-cli list --since 1428305986 id 659c6c2d4ec4cc75b8e2156b5be69375e551b82a reason: firewall-config:34:<module>:ImportError: cannot import name NetworkManager time: Mo 06 Apr 2015 09:19:58 CEST cmdline: /usr/bin/python -Es /usr/bin/firewall-config package: firewall-config-0.3.9-11.el7 uid: 0 (root) count: 2 Directory: /var/tmp/abrt/Python-2015-04-06-09:19:58-3224 Have any a Hint? -- mit freundlichen Grüßen / best Regards, Günther J. Niederwimmer

1 0

vncserver on centos 7
by Jerry Geis 06 Apr '15

06 Apr '15

Is there a way to make vncserver on centos 7 to be read only? I want to allow someone to connect and see the screen- but not change it of course. Thanks, jerry

2 1

Selinux issues with 7.1 update
by Joseph L. Casale 05 Apr '15

05 Apr '15

I am trying to update some local policies for bacula that allow a series of clients with pre run scripts to su in order to perform some preparatory work for a backup. With selinux enforcing, the su is denied obviously execute as bacula_t tries su_exec_t. You only see this with enforcing enabled? So creating an initial policy for that (this is not the way to do this) allows one more avc to appear for execute_no_ as bacula_t tries su_exec_t again. The problem is once these are enabled with local policies they seem to be ignored producing the same avc's. Why are the initial avc's not generated in permissive allowing a complete policy to be derived? If they can't appear in permissive mode, even after playing wackamole with avc's one by one, there is no resolution as they continue to get denied. Anyone else seeing similar or know what I am missing? Bacula-fd runs as root/root. Thanks, jlc

1 0

Re: [CentOS] Fail2Ban Centos 7 is there a trick to making it work?
by James B. Byrne 05 Apr '15

05 Apr '15

On Mon, March 9, 2015 13:11, John Plemons wrote: > Been working on fail2ban, and trying to make it work with plain Jane > install of Centos 7 > > Machine is a HP running 2 Quad core Xeons, 16 gig or ram and 1 plus TB > of disk space. Very generic and vanilla. > > Current available epel repo version is fail2ban-0.9.1 > > Looking at the log file, fail2ban starts and stops fine, there isn't > output though showing any login attempts being restricted. > > 2015-03-09 12:54:37,930 fail2ban.server [14805]: INFO > Stopping all jails > 2015-03-09 12:54:37,931 fail2ban.server [14805]: INFO > Exiting Fail2ban > 2015-03-09 12:54:38,338 fail2ban.server [16678]: INFO > Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.1 > 2015-03-09 12:54:38,341 fail2ban.database [16678]: INFO > Connected to fail2ban persistent database > '/var/lib/fail2ban/fail2ban.sqlite3' > > I copied jail.conf and added the edited jail.local to the directory > /etc/fail2ban/ > > This is about as far as I have gotten with searches on how to > configure > with Centos 7. > > Any help would be welcome. What am I missing? > > john > This is what I have for ssh in jail.conf [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=x(a)harte-lyne.ca, sender=x(a)harte-lyne.ca, sendername=Fail2Ban] logpath = /var/log/secure maxretry = 5 And this (among many others) is what we have in /etc/fail2ban/action.d cat /etc/fail2ban/action.d/iptables.conf # Fail2Ban configuration file # # Author: Cyril Jaquier # # [INCLUDES] before = iptables-blocktype.conf [Definition] # Option: actionstart # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # actionstart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I <chain> -p <protocol> --dport <port> -j fail2ban-<name> # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # actionstop = iptables -D <chain> -p <protocol> --dport <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # actioncheck = iptables -n -L <chain> | grep -q 'fail2ban-<name>[ \t]' # Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype> [Init] # Default name of the chain # name = default # Option: port # Notes.: specifies port to monitor # Values: [ NUM | STRING ] Default: # port = ssh # Option: protocol # Notes.: internally used by config reader for interpolations. # Values: [ tcp | udp | icmp | all ] Default: tcp # protocol = tcp # Option: chain # Notes specifies the iptables chain to which the fail2ban rules should be # added # Values: STRING Default: INPUT chain = INPUT HTH -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 3

perf trace
by Александр Кириллов 05 Apr '15

05 Apr '15

# perf trace perf: 'trace' is not a perf-command. See 'perf --help'. Should 'perf trace' work in C6.6 or this is a bug related to https://bugzilla.redhat.com/show_bug.cgi?id=892893? # rpm -qa perf perf-2.6.32-504.12.2.el6.x86_64

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss