Discuss

discuss@lists.centos.org

34753 discussions

KVM does not start anymore
by Bernd Bartmann 19 Oct '14

19 Oct '14

Hi, I had a C7 virtual machine running on a C7 host for several weeks without any problems. Today I rebootet the host and now the virtual machine does not start anymore. I can see grub coming up and starting the kernel. After some seconds the last thing that is visble on the VM console is "ss perfctr msr (MSR c1 is0)" then the screen goes blank with just a blinking cursor in the upper left corner. After that nothing happens anymore. The CPU load on the host is nearly 0%. Any ideas what could be the reason and how to solve this? Best regards, Bernd

1 1

Centos 7 tmpwatch
by Frank Cox 18 Oct '14

18 Oct '14

I have noticed that tmpwatch isn't automatically installed with Centos 7, or at least it wasn't when I set up this computer. I further noticed that the Centos 7 tmpwatch rpm no longer includes /etc/cron.daily/tmpwatch I suspect that at least part of the reason for this is because the /tmp directory is now mounted as a tmpfs by default, so it's automatically cleared when the machine is rebooted. However, this does nothing to maintain /var/tmp and /var/cache Installing the Centos 7 tmpwatch rpm and copying the /etc/cron.daily/tmpwatch file from a Centos 6 installation onto a Centos 7 machine might not be particularly wise because the excluded directories listed in the Centos 6 tmpwatch script don't include such things as the systemd-private* directories that should probably not be made to disappear on a Centos 7 installation. This leads to two questions: Is tmpwatch even required on Centos 7 anymore, or has it been superseded somehow? And if it is required (or a good idea), is there an updated script to put into /etc/cron.daily that accounts for directories and files that should not be molested by tmpwatch? -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

2 2

Re: [CentOS] curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Reindl Thank you for your post. I am sorry for the second post, my transition to evolution is ... I like to have a better understanding of this problem before I open a bug report. Looking at the report openssl 1.01h has the cipher which support www.kraxel.org certificate specifically the OpenSSL 1.0.1h TLS 1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) FS It appears my cipher, openssl 1.01e, accepts the certificate used by kraxel, the output of sslscan: Accepted TLS12 256 ECDHE-RSA-AES256-GCM-SHA384 So why does this not work? Why would this be a bug if I just need to upgrade openssl to 1.01h from 1.01e? Thank for your assistance, Aaron On Sat, 2014-10-18 at 18:25 +0200, Reindl Harald wrote: > Am 18.10.2014 um 18:15 schrieb Aaron Siegel: > > I am stumped. I am trying to us the kraxel qemu repository, it appears > > the repository moved to secure server since then I have not been able to > > configure this properly. https://www.kraxel.org/repos/jenkins/ > > I receive the following error when I try to use the repository > > curl: (35) Cannot communicate securely with peer: no common encryption > > algorithm(s) > > "no common encryption algorithm" should be pretty clear: > > a) the server only offers weak ciphers you no longer support > b) the server only offers modern ciphers you don't support > > in fact b) is the case here and so you should open a bugreport against > NSS/Curl and not dig around in manually compile things and ruin your setup > > https://www.ssllabs.com/ssltest/analyze.html?d=kraxel.org > that server only accepts TLS1.2 > > [harry@srv-rhsoft:~]$ sslscan www.kraxel.org:443 | grep Accept > Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-SHA256 > Accepted TLS12 256 bits AES256-GCM-SHA384 > Accepted TLS12 256 bits AES256-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits AES128-GCM-SHA256 > Accepted TLS12 128 bits AES128-SHA256 > > >

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Hello I am stumped. I am trying to us the kraxel qemu repository, it appears the repository moved to secure server since then I have not been able to configure this properly. https://www.kraxel.org/repos/jenkins/ I receive the following error when I try to use the repository curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s). I have discovered this problem on my fedora 20 computer, the fedora mailing list will not accept my email, I am experiencing this problem with curl on both my Centos and fedora systems. I receive the same error with centos 7 minimal installation and fedora 20. What am I doing wrong, I have recently switch to the Fedora platform, I have not read all the manuals but trying. I have imported the gpg keys that Kraxel has posted on his blog using rpm --import. I can only download file through my web browser. I was going to clone his git repository and set up a local repository, bit git report the same error. Which leads me to believe the problem is with my certificates. I have even tried the firefox-db2pem.sh, I am not sure it did anything. Does curl need to be recompiled with nss support? Is there a package I need to compile? nss 3.17.2 is installed, non of the man page work. Looking deeper into the nss, # certutil -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. I think there is something wrong with my nss certificates, but I have run out of time. Any suggestions. This is on a brand new installation Fedora 20 and Centos 7, I have not had time to break anything. The openssl command connect with the server, is $ openssl s_client -connect www.kraxel.org:443 The curl output is posted below in fedora system the output for the centos is the same with the exception of the curl and nss versions: $ curl -v https://www.kraxel.org/repos/jenkins/repodata/repomd.xml * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x6bea60) send_pipe: 1, recv_pipe: 0 * About to connect() to www.kraxel.org port 443 (#0) * Trying 217.197.83.6... * Connected to www.kraxel.org (217.197.83.6) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Error in TLS handshake, trying SSLv3... > GET /repos/jenkins/repodata/repomd.xml HTTP/1.1 > User-Agent: curl/7.32.0 > Host: www.kraxel.org > Accept: */* > * Connection died, retrying a fresh connect * Closing connection 0 * Issue another request to this URL: 'https://www.kraxel.org/repos/jenkins/repodata/repomd.xml' * About to connect() to www.kraxel.org port 443 (#1) * Trying 217.197.83.6... * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 1 (0x6bea60) send_pipe: 1, recv_pipe: 0 * Connected to www.kraxel.org (217.197.83.6) port 443 (#1) * TLS disabled due to previous handshake failure * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Closing connection 1 curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

1 0

POODLE and TLSv1
by James B. Byrne 17 Oct '14

17 Oct '14

I read this on the RHN commentary respecting cve-2014-3566: https://securityblog.redhat.com/2014/10/15/poodle-a-ssl3-vulnerability-cve-…: . . . The first aspect of POODLE, the SSL 3.0 protocol vulnerability, has already been fixed through iterative protocol improvements, leading to the current TLS version, 1.2. It is simply not possible to address this in the context of the SSL 3.0 protocol, a protocol upgrade to one of the successors is needed. Note that TLS versions before 1.1 had similar padding-related vulnerabilities, which is why we recommend to switch to TLS 1.1, at least. (SSL and TLS are still quite similar as protocols, the name change has non-technical reasons.) . . . If run nmap to view the ciphers on a host running apache-2.2.15 I see this: # nmap --script ssl-enum-ciphers -p 443 inet09 Starting Nmap 6.01 ( http://nmap.org ) at 2014-10-17 12:48 EDT Nmap scan report for for x.y.z.a Host is up (0.00034s latency). rDNS record for x.y.z.a PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.0 | Ciphers (5) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL | TLSv1.1 | Ciphers (5) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL | TLSv1.2 | Ciphers (9) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA256 - strong | TLS_RSA_WITH_AES_128_GCM_SHA256 - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_AES_256_CBC_SHA256 - unknown strength | TLS_RSA_WITH_AES_256_GCM_SHA384 - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL |_ Least strength = unknown strength . . . If read the advisory aright then TLSv1.0 suffers from exactly the same flaw as SSLv3. So, how do I configure apache-2.2.15 to deny TLSv1.0 and keep service TLSv1.1+? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

What happens to in-use files when I restart samba?
by Patrick Bervoets 17 Oct '14

17 Oct '14

One of the services that has to be restarted after the openssl update is samba. And now I wonder if I can safely restart samba when there are possible files in-use (ie writes could be happening). I can't find an answer on Google (could be me asking the wrong questions) Thanks for any pointers Patrick

2 1

CentOS-announce Digest, Vol 116, Issue 10
by centos-announce-request＠centos.org 17 Oct '14

17 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:1653 Moderate CentOS 5 openssl Security Update (Johnny Hughes) 2. CEEA-2014:1649 CentOS 7 kpatch Enhancement Update (Johnny Hughes) 3. CESA-2014:1652 Important CentOS 7 openssl Security Update (Johnny Hughes) 4. CESA-2014:1653 Moderate CentOS 5 openssl Security Update (Johnny Hughes) 5. CESA-2014:1652 Important CentOS 6 openssl Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Oct 2014 15:21:39 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1653 Moderate CentOS 5 openssl Security Update Message-ID: <20141016152139.GA19436(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1653 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1653.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0c3787137a7d1a0402612833b173693910eb27f79e0c4f8cedf6185b4f7141f9 openssl-0.9.8e-31.el5_11.i386.rpm 5ef64e16dd1349a254a96e91cfdfdd6215fb9daa846360d2efff515bbb6a56b8 openssl-devel-0.9.8e-31.el5_11.i386.rpm b98e5df6d59eddee85d544ca35bf0b7ca469a4c7032138465189c4c7bc27e5e6 openssl-perl-0.9.8e-31.el5_11.i386.rpm x86_64: 85ee93123052e86fd4204694e3ac52fad6797b3f7009d8bce8e1f908bfed5352 openssl-0.9.8e-31.el5_11.x86_64.rpm 5ef64e16dd1349a254a96e91cfdfdd6215fb9daa846360d2efff515bbb6a56b8 openssl-devel-0.9.8e-31.el5_11.i386.rpm 11362d4d6755f5e33609a8adf6fbd0002f1343e72cd5e06ddbf2c8e99cf0d514 openssl-devel-0.9.8e-31.el5_11.x86_64.rpm 4aa6b35c036489a83a193ceb26fea4d1b5da93e7fddc08245fe59ffde0d7f509 openssl-perl-0.9.8e-31.el5_11.x86_64.rpm Source: 1741388be54beb7176f7b5d90a3ddd1be99e1fcd5296725f4999c446a30c35c5 openssl-0.9.8e-31.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 16 Oct 2014 16:22:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2014:1649 CentOS 7 kpatch Enhancement Update Message-ID: <20141016162222.GA58256(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2014:1649 Upstream details at : https://rhn.redhat.com/errata/RHEA-2014-1649.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 51d8cfeb1a49efd3d778fcbf00537076b2d68f6ebcd0098fa174cd885c29dc6a kpatch-0.1.10-3.el7_0.noarch.rpm Source: 4d7cb8146fc0433167cd8e18f439d3b3cf7748649ce21b509b501fd46cc45c58 kpatch-0.1.10-3.el7_0.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Thu, 16 Oct 2014 16:22:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1652 Important CentOS 7 openssl Security Update Message-ID: <20141016162242.GA58353(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1652 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1652.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 982ba4376041d2d99d4b84dc05fbeac6b925777aa34d631aceeedb598bb98413 openssl-1.0.1e-34.el7_0.6.x86_64.rpm 426ba8dc7ac74f8b71f7965ec2e6e6b398ab466dc892394e8d1d5bd80ca4a4e6 openssl-devel-1.0.1e-34.el7_0.6.i686.rpm 7fdf24148ed86f0abb2618d92741d5c8f0769de6136b4ed9df2a60b8c795abe3 openssl-devel-1.0.1e-34.el7_0.6.x86_64.rpm ebc0fc79108a67efd64da36669c90865b4a75a38b4c07a5316078edd98b65da9 openssl-libs-1.0.1e-34.el7_0.6.i686.rpm 5d0607c487922602ae315f62d9d3c0eb8ca76a65c288e6c8fc61f688dad59593 openssl-libs-1.0.1e-34.el7_0.6.x86_64.rpm 4b092081206a1140a5d2901c2f5513c8155ec2b57a05cafdd6c9011ccdde78f5 openssl-perl-1.0.1e-34.el7_0.6.x86_64.rpm d664f61543bb84773467300c726d870700584f5af616df7a9f29922822773dd8 openssl-static-1.0.1e-34.el7_0.6.i686.rpm c57075f8c198ec81db1936eb2dea8ff210de317f76047ffa601eefd8230d3bae openssl-static-1.0.1e-34.el7_0.6.x86_64.rpm Source: 6638e94c18b6961748e7986823b7115d852b25883ccff03ec89a16234cbca517 openssl-1.0.1e-34.el7_0.6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Thu, 16 Oct 2014 17:53:19 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1653 Moderate CentOS 5 openssl Security Update Message-ID: <20141016175319.GA26372(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1653 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1653.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0f38fea6d167a87276c20f5a4d56c2f41faf7fc08d9c76e28329ecadbe0de51f openssl-0.9.8e-31.el5_11.i386.rpm c9660117d38961e5388d2fd72b0a68816b2047dc828a7438b0f6a4c74da4f27b openssl-0.9.8e-31.el5_11.i686.rpm 6244227177fb88cf9db43d1ffe086014c5786f8764c1d161d7ff5c0e4b4bcb78 openssl-devel-0.9.8e-31.el5_11.i386.rpm 33e546cd8897b47e2ddf836f07ad103a2ebb2f4282cd32c7b730d39ab462b67b openssl-perl-0.9.8e-31.el5_11.i386.rpm x86_64: c9660117d38961e5388d2fd72b0a68816b2047dc828a7438b0f6a4c74da4f27b openssl-0.9.8e-31.el5_11.i686.rpm 802ed9a049e7ae8c417c2bb108348cc9bd132698e805aa68795862276a320493 openssl-0.9.8e-31.el5_11.x86_64.rpm 6244227177fb88cf9db43d1ffe086014c5786f8764c1d161d7ff5c0e4b4bcb78 openssl-devel-0.9.8e-31.el5_11.i386.rpm 70cc0ab04b906816a2b8db05603c96fb709cb45473b116c73da1e5569295672b openssl-devel-0.9.8e-31.el5_11.x86_64.rpm cd7303f6689aac1013530cc766a70b6fdae56dc3b87960ecdec567ed68bfb168 openssl-perl-0.9.8e-31.el5_11.x86_64.rpm Source: 2d15a9cccc5453a329e53986061386de39e6e512af147b84354c3473b39a957b openssl-0.9.8e-31.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Thu, 16 Oct 2014 20:48:09 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1652 Important CentOS 6 openssl Security Update Message-ID: <20141016204809.GA19739(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1652 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) ----------------------------- i386 ----------------------------- 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm dc42eb136b3cfef78d590d4ab29d36e5e5951bc9433d20d5ca633033d960a00d openssl-perl-1.0.1e-30.el6_5.2.i686.rpm 95e67f00f7d58348e5f0df6ac74d7baecb9d5fc214d58ad257a14bec353219a3 openssl-static-1.0.1e-30.el6_5.2.i686.rpm ----------------------------- X86_64 ----------------------------- 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm 17bfdb52afcb2ebaa16875819b9d8d2f3dc84eb061ee3e194da14e286bc76029 openssl-1.0.1e-30.el6_5.2.x86_64.rpm dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm 7c390aab888c07887fc783686f42216711665738e58c2b23029748292dd0f96d openssl-devel-1.0.1e-30.el6_5.2.x86_64.rpm dfdcf88163743d5f4fda06a69cba00b822b73ba66aa5841faf8c0e9841b91bcb openssl-perl-1.0.1e-30.el6_5.2.x86_64.rpm 0f8cc0615d96d4d7e74b5ffc109143873510406dbb6be679d4ab94bd4f731cdb openssl-static-1.0.1e-30.el6_5.2.x86_64.rpm ----------------------------- Source: ----------------------------- 1a1c3ed0d8eb5775d89b726e7f19ff2d8b52b7ef27f6e36260e83ffc40328460 openssl-1.0.1e-30.el6_5.2.src.rpm ===================================================== The following upstream security issues are addressed in this update: https://rhn.redhat.com/errata/RHSA-2014-1652.html ===================================================== NOTE: This update is released into the CentOS-6.5 tree and has a .el6_5 dist tag, *NOT* the .el6_6 dist tag that Red Hat used for RHEL in the link above. This update was built against 'CentOS-6.5 + updates' and that is where it is intended to be used. The CentOS team will build and release a openssl-1.0.1e-30.el6_6.2.src.rpm as a zero day update to CentOS-6.6 when that is released as we are currently building CentOS-6.6 from the released Red Hat Enterprise Linux sources. Please also note that even after installing this update, further action is required to mitigate the POODLE issue on CentOS-6. Please see this link for steps to take and ways to test for both the POODLE and TLS_FALLBACK_SCSV issues. http://wiki.centos.org/Security/POODLE -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos at irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 116, Issue 10 ************************************************

1 0

POODLE on CentOS
by Johnny Hughes 17 Oct '14

17 Oct '14

The following updates address POODLE on CentOS: CentOS-5: http://lists.centos.org/pipermail/centos-announce/2014-October/020696.html CentOS-6.5: http://lists.centos.org/pipermail/centos-announce/2014-October/020697.html CentOS-7: http://lists.centos.org/pipermail/centos-announce/2014-October/020695.html Please note that the CentOS-6.5 updates are built from: openssl-1.0.1e-30.el6_5.2.src.rpm This is the version that Red Hat released for RHEL 6.6 as openssl-1.0.1e-30.el6_6.2.src.rpm. Notice that the dist tag is different for our release. The reason is that we are currently working on CentOS-6.6 and it will not be released for several more days. Rather than wait on the POODLE issue, the CentOS team decided to build a version of this update for 6.5: (the current release, built from openssl-1.0.1e-30.el6_5.2.src.rpm) as well a version based on openssl-1.0.1e-30.el6_6.2.src.rpm as a zeroday update for CentOS-6.6 when it is released. You must also take action to disable SSLv3 as well as installing these update to mitigate POODLE on CentOS-5, CentOS-6 and/or CentOS-7, please see this link for details: http://wiki.centos.org/Security/POODLE Thanks, Johnny Hughes

2 1

needs-restarting: one server reports nothing te restart (after updating openssl) C6.5
by Patrick Bervoets 17 Oct '14

17 Oct '14

Hi, After updating openssl on most of my C6.5-servers needs-restarting reports at least sshd, ntpd and sendmail. But on 1 server needs-restarting reports nothing. And yes, sshd, ntpd and sendmail are running. All yum-utils are latest yum-utils-1.1.30-17.el6_5.noarch. openssh-clients-5.3p1-94.el6.x86_64 ntp-4.2.6p5-1.el6.centos.x86_64 sendmail-8.14.4-8.el6.x86_64 At least ssh and ntp are straight out of distro and all my sendmails have the same configuration. How reliable is needs-restarting? Or how can this be explained? Thanks Patrick

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss