Discuss

discuss@lists.centos.org

34758 discussions

CentOS 5.11 / Firefox 31 -- totally borked...
by Robert Heller 20 Oct '14

20 Oct '14

OK, I just updated my two CentOS 5 boxes (my laptop and by desktop) and discoved that FF 31 is totally borked -- it seems not to be possible to install either Firebug (either 2.0.4 or 1.12.8) or Firefox 2, the theme reloaded (1.0.8). These two addons are critical to me. So I have snaged the FF 24.8.0 rpms from the CentOS 5 vault and downgraded to this version and blocked further updates of FF. Where is the best place to report this problem? -- Robert Heller -- 978-544-6933 Deepwoods Software -- Custom Software Services http://www.deepsoft.com/ -- Linux Administration Services heller(a)deepsoft.com -- Webhosting Services

6 10

djbdns under CentOS7: startup and socket issues
by Boris Epstein 20 Oct '14

20 Oct '14

Hello all, I am trying to get djbdns ( http://en.wikipedia.org/wiki/Djbdns ) running on CentOS 7. So far I have wirtten the djbdns.service and djbdns.socket files. The sockets (TCP and UDP 53) for some reason would not start and I don't know how to debug that; the service does start but only when I start it manually by running systemctl start djbdns So, I am a real noob when it comes to systemd, hence any advice on how to proceed will be much appreciated. Cheers, Boris.

4 7

Re: [CentOS] [CentOS-announce] CESA-2014:1652 Important CentOS 6 openssl Security Update
by David Hrbáč 20 Oct '14

20 Oct '14

Hi, This announcement has different body scheme than the rest of announcement messages. Is it a new scheme? It breaks the importing scripts... Thanks, DH Dne 16.10.2014 v 22:48 Johnny Hughes napsal(a): > CentOS Errata and Security Advisory 2014:1652 > > The following updated files have been uploaded and are currently > syncing to the mirrors: ( sha256sum Filename ) > > ----------------------------- > i386 > ----------------------------- > > 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm > dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm > dc42eb136b3cfef78d590d4ab29d36e5e5951bc9433d20d5ca633033d960a00d openssl-perl-1.0.1e-30.el6_5.2.i686.rpm > 95e67f00f7d58348e5f0df6ac74d7baecb9d5fc214d58ad257a14bec353219a3 openssl-static-1.0.1e-30.el6_5.2.i686.rpm > > ----------------------------- > X86_64 > ----------------------------- > > 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm > 17bfdb52afcb2ebaa16875819b9d8d2f3dc84eb061ee3e194da14e286bc76029 openssl-1.0.1e-30.el6_5.2.x86_64.rpm > dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm > 7c390aab888c07887fc783686f42216711665738e58c2b23029748292dd0f96d openssl-devel-1.0.1e-30.el6_5.2.x86_64.rpm > dfdcf88163743d5f4fda06a69cba00b822b73ba66aa5841faf8c0e9841b91bcb openssl-perl-1.0.1e-30.el6_5.2.x86_64.rpm > 0f8cc0615d96d4d7e74b5ffc109143873510406dbb6be679d4ab94bd4f731cdb openssl-static-1.0.1e-30.el6_5.2.x86_64.rpm > > ----------------------------- > Source: > ----------------------------- > > 1a1c3ed0d8eb5775d89b726e7f19ff2d8b52b7ef27f6e36260e83ffc40328460 openssl-1.0.1e-30.el6_5.2.src.rpm > > ===================================================== > > The following upstream security issues are addressed in this update: > > https://rhn.redhat.com/errata/RHSA-2014-1652.html > > ===================================================== > > NOTE: This update is released into the CentOS-6.5 tree and has a .el6_5 dist > tag, *NOT* the .el6_6 dist tag that Red Hat used for RHEL in the link above. > > This update was built against 'CentOS-6.5 + updates' and that is where it is > intended to be used. > > The CentOS team will build and release a openssl-1.0.1e-30.el6_6.2.src.rpm as > a zero day update to CentOS-6.6 when that is released as we are currently > building CentOS-6.6 from the released Red Hat Enterprise Linux sources. > > Please also note that even after installing this update, further action is > required to mitigate the POODLE issue on CentOS-6. Please see this link for > steps to take and ways to test for both the POODLE and TLS_FALLBACK_SCSV issues. > > http://wiki.centos.org/Security/POODLE > > -- > Johnny Hughes > CentOS Project { http://www.centos.org/ } > irc: hughesjr, #centos at irc.freenode.net > > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce

2 2

Your experience with os hardening tool - Bastille?
by Rafał Radecki 19 Oct '14

19 Oct '14

Hi All:) I would like to start using a tool for automating of os hardening. I found some informations about Bastille. One things which attracted my attention is that in http://bastille-linux.sourceforge.net/news_updates.htm the last post is from January 29th, 2012 :D Is the tool ready to use at the moment with CentOS 6/7? Are there any alternatives which you can recommend? Thanks for all info :) BR, Rafal.

3 3

CentOS-6 updates
by Johnny Hughes 19 Oct '14

19 Oct '14

We are currently building and testing our CentOS-6.6 release. It normally takes about 2-4 weeks for us to get a full point release out. We can not release updates that are based on 6.6 until we get 6.6 out. All current updates will be released on the same day as the release. We have a CR repo ( http://wiki.centos.org/AdditionalResources/Repositories/CR ) and we are likely going to release the CR repo around 7-10 days after the release of RHEL-6.6. All updates will also be released into there when it is released. Please remember, there are around 350 Source RPMs that need to be built and tested for 6.6 and it normally takes 7-10 days for CR and 14-28 days for the full release. We are going as fast as we can, but point releases take time. Thanks, Johnny Hughes

5 5

KVM does not start anymore
by Bernd Bartmann 19 Oct '14

19 Oct '14

Hi, I had a C7 virtual machine running on a C7 host for several weeks without any problems. Today I rebootet the host and now the virtual machine does not start anymore. I can see grub coming up and starting the kernel. After some seconds the last thing that is visble on the VM console is "ss perfctr msr (MSR c1 is0)" then the screen goes blank with just a blinking cursor in the upper left corner. After that nothing happens anymore. The CPU load on the host is nearly 0%. Any ideas what could be the reason and how to solve this? Best regards, Bernd

1 1

Centos 7 tmpwatch
by Frank Cox 18 Oct '14

18 Oct '14

I have noticed that tmpwatch isn't automatically installed with Centos 7, or at least it wasn't when I set up this computer. I further noticed that the Centos 7 tmpwatch rpm no longer includes /etc/cron.daily/tmpwatch I suspect that at least part of the reason for this is because the /tmp directory is now mounted as a tmpfs by default, so it's automatically cleared when the machine is rebooted. However, this does nothing to maintain /var/tmp and /var/cache Installing the Centos 7 tmpwatch rpm and copying the /etc/cron.daily/tmpwatch file from a Centos 6 installation onto a Centos 7 machine might not be particularly wise because the excluded directories listed in the Centos 6 tmpwatch script don't include such things as the systemd-private* directories that should probably not be made to disappear on a Centos 7 installation. This leads to two questions: Is tmpwatch even required on Centos 7 anymore, or has it been superseded somehow? And if it is required (or a good idea), is there an updated script to put into /etc/cron.daily that accounts for directories and files that should not be molested by tmpwatch? -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

2 2

Re: [CentOS] curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Reindl Thank you for your post. I am sorry for the second post, my transition to evolution is ... I like to have a better understanding of this problem before I open a bug report. Looking at the report openssl 1.01h has the cipher which support www.kraxel.org certificate specifically the OpenSSL 1.0.1h TLS 1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) FS It appears my cipher, openssl 1.01e, accepts the certificate used by kraxel, the output of sslscan: Accepted TLS12 256 ECDHE-RSA-AES256-GCM-SHA384 So why does this not work? Why would this be a bug if I just need to upgrade openssl to 1.01h from 1.01e? Thank for your assistance, Aaron On Sat, 2014-10-18 at 18:25 +0200, Reindl Harald wrote: > Am 18.10.2014 um 18:15 schrieb Aaron Siegel: > > I am stumped. I am trying to us the kraxel qemu repository, it appears > > the repository moved to secure server since then I have not been able to > > configure this properly. https://www.kraxel.org/repos/jenkins/ > > I receive the following error when I try to use the repository > > curl: (35) Cannot communicate securely with peer: no common encryption > > algorithm(s) > > "no common encryption algorithm" should be pretty clear: > > a) the server only offers weak ciphers you no longer support > b) the server only offers modern ciphers you don't support > > in fact b) is the case here and so you should open a bugreport against > NSS/Curl and not dig around in manually compile things and ruin your setup > > https://www.ssllabs.com/ssltest/analyze.html?d=kraxel.org > that server only accepts TLS1.2 > > [harry@srv-rhsoft:~]$ sslscan www.kraxel.org:443 | grep Accept > Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-SHA256 > Accepted TLS12 256 bits AES256-GCM-SHA384 > Accepted TLS12 256 bits AES256-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits AES128-GCM-SHA256 > Accepted TLS12 128 bits AES128-SHA256 > > >

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Hello I am stumped. I am trying to us the kraxel qemu repository, it appears the repository moved to secure server since then I have not been able to configure this properly. https://www.kraxel.org/repos/jenkins/ I receive the following error when I try to use the repository curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s). I have discovered this problem on my fedora 20 computer, the fedora mailing list will not accept my email, I am experiencing this problem with curl on both my Centos and fedora systems. I receive the same error with centos 7 minimal installation and fedora 20. What am I doing wrong, I have recently switch to the Fedora platform, I have not read all the manuals but trying. I have imported the gpg keys that Kraxel has posted on his blog using rpm --import. I can only download file through my web browser. I was going to clone his git repository and set up a local repository, bit git report the same error. Which leads me to believe the problem is with my certificates. I have even tried the firefox-db2pem.sh, I am not sure it did anything. Does curl need to be recompiled with nss support? Is there a package I need to compile? nss 3.17.2 is installed, non of the man page work. Looking deeper into the nss, # certutil -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. I think there is something wrong with my nss certificates, but I have run out of time. Any suggestions. This is on a brand new installation Fedora 20 and Centos 7, I have not had time to break anything. The openssl command connect with the server, is $ openssl s_client -connect www.kraxel.org:443 The curl output is posted below in fedora system the output for the centos is the same with the exception of the curl and nss versions: $ curl -v https://www.kraxel.org/repos/jenkins/repodata/repomd.xml * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x6bea60) send_pipe: 1, recv_pipe: 0 * About to connect() to www.kraxel.org port 443 (#0) * Trying 217.197.83.6... * Connected to www.kraxel.org (217.197.83.6) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Error in TLS handshake, trying SSLv3... > GET /repos/jenkins/repodata/repomd.xml HTTP/1.1 > User-Agent: curl/7.32.0 > Host: www.kraxel.org > Accept: */* > * Connection died, retrying a fresh connect * Closing connection 0 * Issue another request to this URL: 'https://www.kraxel.org/repos/jenkins/repodata/repomd.xml' * About to connect() to www.kraxel.org port 443 (#1) * Trying 217.197.83.6... * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 1 (0x6bea60) send_pipe: 1, recv_pipe: 0 * Connected to www.kraxel.org (217.197.83.6) port 443 (#1) * TLS disabled due to previous handshake failure * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Closing connection 1 curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss