Discuss

discuss@lists.centos.org

8 participants
34745 discussions

Fix for CVE-2020-1971 on CentOS 6.10
by Simon Matter 16 Dec '20

16 Dec '20

Hi, While many of us were busy lately with upgrading CentOS 6 systems to CentOS 8, a lot of systems may still be running CentOS 6 and migrations came to a halt this week with the announcement of RedHats new direction for the CentOS project. Since security updates for CentOS 6 are not provided anymore, I've decided to try my best to address CVE-2020-1971 and I welcome others to do the same for this and other new issues which may come up. Attached patches: openssl.spec.patch.gz openssl-1.0.1e-cve-2020-1971.patch.gz Please let me know if you find any issues. Regards, Simon

3 4

The conclusio: CentOS is dead
by Walter H. 15 Dec '20

15 Dec '20

Why? it is called "rolling release" and no one gave officially a statement to the question I asked, if it is meant like that of Win10 ... a beta release is not the same that many expect as a stable system, as they are used to have with CentOS; you should think of renaming CentOS to something different, because with Enterprise this CentOS Stream has nothing in common; and does Redhat really expect everone - even private people - afford a RHEL subscription¹ just to have a stable system? ¹ I would in case I only need just one RHEL subscription for ALL my private used VMs (including the ones hosted in internet as VPS) - a DNS server - a proxy server (squid) - a mail server (mail store - cyrus-imapd) - a mail server (mail router f. outgoing mails) - a mail server (mail scanner f. incoming mails with SpamAssassin and ClamAV) - a 2nd proxy server (squid, with SSL interception and Squidclamav plus ClamAV) - a web server (apache) - a jump host - a 6in4 router - desktop with graphical UI (plus Firefox and Thunderbird) is a now a SL, but they decided several time ago, not to do their own system based on RHEL, they use CentOS, that is now a little bit bad for this/SL's use case; - a VPS with OpenVPN (used with my smartphone) - a VPS with a proxy (squid, to avoid censorship due to geolocation blocking) - a VPS as the other end of 6in4 - a VPS with storage of my own files (all VPS run a bind, too) Thanks for read; Walter

13 15

Oracle Linux - oracle-epel vs epel - dnf priority
by Frank Cox 14 Dec '20

14 Dec '20

I'd like to run this by you guys and get your opinion. For those of us who are considering moving to Oracle Linux (or at least doing some experimenting with it), I just had an idea for dealing with the fact that the oracle-el-epel apparently doesn't have all of the packages that are in the fedora-el-epel that we all know and love. It makes sense to me to use the oracle epel with OL to the greatest extent possible simply because it's part of OL. To get around the missing package issue, what about setting up both oracle-epel and fedora-epel, and then using the dnf priorities to pick the stuff from oracle-epel first and if it's not there then grab it from fedora-epel. One issue that I can see (though it may not be an actual issue) is the way the priorities setting works: QUOTE: priority integer The priority value of this repository, default is 99. If there is more than one candidate package for a particular operation, the one from a repo with the lowest priority value is picked, possibly despite being less convenient otherwise (e.g. by being a lower version). END OF QUOTE By setting fedora-epel to a lower priority, the if a package we want is only in fedora-epel, we'll grab it from there. But if that package has a dependency on another package version X that can be found in fedora-epel and for some reason oracle-epel supplies only package version X-1, what happens then? Is dnf smart enough to pick the higher-versioned (and required) package from fedora-epel even though it has a lower priority. I'll try to explain that again. I want to install Foo, which is only in fedora-epel. Foo requires Bar version 2.0. Bar 2.0 exists in fedora-epel, but oracle-epel has only Bar version 1.0. What happens then? Does dnf see that Foo requires Bar-2.0 and get it from fedora-epel even though it has a lower priority? -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

3 4

Announcing Open-sourced & Community-Driven RHEL Fork by CloudLinux
by Ljubomir Ljubojevic 13 Dec '20

13 Dec '20

Someone is smarter then Red Hat/IBM, "Carpe Diem": Announcing Open-sourced & Community-Driven RHEL Fork by CloudLinux (https://blog.cloudlinux.com/announcing-open-sourced-community-driven-rhel-f…) CentOS is a fork of Red Hat Enterprise Linux (RHEL) and undoubtedly a popular choice to deploy on production servers because of its rock-solid stability and compatibility. But, now with CentOS Stream, Red Hat just killed CentOS as we know it. And as expected, people started to fork Red Hat to give a viable community-based alternative to RHEL. As we already maintain CloudLinux OS, we plan to release a free, open-sourced, community-driven, 1:1 binary compatible fork of RHEL® 8 (and future releases) in the Q1 of 2021. We will create a separate, totally free OS that is fully binary compatible with RHEL® 8 (and future versions). We will sponsor the development & maintenance of such OS. We will work on establishing a community around the OS, with the governing board from members of the community. Why We Are Doing It We have all the infrastructure, software and experience to do that already. We have a large staff of developers and maintainers that have a decade of experience in building an RHEL fork, starting from RHEL5 to RHEL8. We expect that this project will put us on the map, and allow people to discover our rebootless update software and Extended Lifecycle Support offering. What Will We Do To Make Sure That It Doesn't Go Wrong We plan to make all the build and test software free, open-sourced, easy to set up, so if we ever go in the wrong direction - the community can just pick up where we left off. What It Means For You If you are running CloudLinux OS 8 - it will continue to have stable and well-tested updates until 2029, and ELS releases for years after that. If you are running CentOS 8 - we will release an OS very similar to CentOS 8 based on RHEL 8 stable. We will provide stable and well-tested updates until 2029 - completely free. You will be able to convert from CentOS 8 at any moment by running a single command that switches repositories & keys. Timeline Q1 2021 -- Ljubomir Ljubojevic (Love is in the Air) PL Computers Serbia, Europe StarOS, Mikrotik and CentOS/RHEL/Linux consultant

12 20

Oracle Linux 8 - short experiment with install and basic setup of Mate Desktop
by Frank Cox 13 Dec '20

13 Dec '20

So after reading other folks' opinions of an Oracle Linux 8 (thanks again, Nicolas!) trial installation, I decided to crank up a Virtual Box session and try an install myself. As others have stated, what you get when you install OL8 is identical in every way to what you see when installing Centos 8; literally the only difference is the logo and the default desktop background. There are no demands for registration or anything else when you install OL8. It's exactly the same experience as installing Centos 8. Since I use Mate on my computers (installed from https://copr.fedorainfracloud.org/coprs/stenstorp/MATE/ ) I immediately decided to see if I can get that going. I ran into two small issues, both easily dealt with. First, the PowerTools repo doesn't seem to exist under that name on OL8. It's called ol8_codeready_builder, for some reason. "dnf-config-manager --set-enabled ol8_codeready_builder" works fine and gets us where we need to be. A slightly more serious issue is that the oracle-epel, found through the rpm named oracle-epel-release-el8, appears to be less complete that the original Fedora epel found at https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm. Mate requires ImageMagick as a dependency for caja-image-converter and if you have oracle-epel installed it can't find ImageMagick. The solution (at least the solution that I used, which worked) is just to delete the oracle-epel-release-el8 rpm and install epel-release-latest-8 rpm instead. Then the Mate desktop can be installed on OL8 from the copr rpms listed above. Ultimately, the take-away here seems to be that if you decide to use OL8 instead of Centos 8 you'll be better advised to stick with "real" epel and not the oracle epel since there appears to be at least some stuff missing on the oracle epel. After I jumped through those minor hoops, what I ended up with was an Oracle Linux 8 installation with a Mate desktop and literally everything looks and works identical to what I already have with Centos 8. (An issue that I haven't seen anyone address yet is this. It's my understanding that epel builds their stuff on the current RHEL. Therefore the upcoming Centos Stream might get out-of-sync with whatever epel is building on at any given point in time.) -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

4 3

Re: [CentOS] CentOS Digest, Vol 191, Issue 12
by DBC-MMILLER 12 Dec '20

12 Dec '20

Sent from my iPhone > On Dec 12, 2020, at 07:00, centos-request(a)centos.org wrote: > > Message: 51 > Date: Fri, 11 Dec 2020 13:15:43 -0800 > From: Lists <lists(a)benjamindsmith.com> > To: CentOS mailing list <centos(a)centos.org> > Subject: [CentOS] Baffled by firewall rules with a Qemu VM, CentOS 7 > Message-ID: <2155552.iZASKD2KPV(a)tesla.effortlessis.com> > Content-Type: text/plain; charset="us-ascii" > > I've understood iptables well enough for a long, long time, and although I > think firewall-cmd is a poor replacement for iptables, I've always been able to > "get it to work" by comparing output with iptables -L or iptables -S and using > a direct-rule or two. > > And this time, I'm just baffled. > > I have a qemu VM running on a host. Postgresql runs on the host, and I'm > trying to connect to the Postgresql server on the host from the VM. > > VM: loco > Host: tesla > > 1) If I turn OFF the firewall on tesla, I have no trouble connecting from loco. > tesla: systemctl stop firewalld > loco: psql -U postgres -h 192.168.122.1 # yay! connection! > > 2) If I turn ON the firewall on tesla, I can't connect NO MATTER WHAT I DO > tesla: systemctl start firewalld; > loco: psql -U postgres -h 192.168.122.1 # Connection refused > > > I have tried: > tesla# firewall-cmd --zone=public --add-port=5432/tcp > tesla# firewall-cmd --add-service=postgresql > tesla# firewall-cmd --set-default-zone=trusted; > tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWI 0 -j ACCEPT > tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWO 0 -j ACCEPT > tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWX 0 -j ACCEPT > > ... and many more things. Literally stumped for a few hours. The output of > iptables indicates that I've wildcarded everything: > > tesla# iptables -S > -P INPUT ACCEPT > -P FORWARD ACCEPT > -P OUTPUT ACCEPT > -N LIBVIRT_FWI > -N LIBVIRT_FWO > -N LIBVIRT_FWX > -N LIBVIRT_INP > -N LIBVIRT_OUT > -A INPUT -j LIBVIRT_INP > -A FORWARD -j LIBVIRT_FWX > -A FORWARD -j LIBVIRT_FWI > -A FORWARD -j LIBVIRT_FWO > -A OUTPUT -j LIBVIRT_OUT > -A LIBVIRT_FWI -d 192.168.122.0/24 -j ACCEPT > -A LIBVIRT_FWI -i virbr0 -j ACCEPT > -A LIBVIRT_FWI -j ACCEPT > -A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate > RELATED,ESTABLISHED -j ACCEPT > -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable > -A LIBVIRT_FWO -i virbr0 -j ACCEPT > -A LIBVIRT_FWO -j ACCEPT > -A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT > -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable > -A LIBVIRT_FWX -j ACCEPT > -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT > -A LIBVIRT_INP -j ACCEPT > -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT > -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT > -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT > -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT > -A LIBVIRT_OUT -j ACCEPT > -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT > -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT > -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT > -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT > > There are no REJECT rules not preceded by a wildcard ACCEPT, but I can't > connect with this config. But simply stopping host (tesla) firewalld allows me > to connect just fine. > > Any ideas? >

1 0

Baffled by firewall rules with a Qemu VM, CentOS 7
by Lists 12 Dec '20

12 Dec '20

I've understood iptables well enough for a long, long time, and although I think firewall-cmd is a poor replacement for iptables, I've always been able to "get it to work" by comparing output with iptables -L or iptables -S and using a direct-rule or two. And this time, I'm just baffled. I have a qemu VM running on a host. Postgresql runs on the host, and I'm trying to connect to the Postgresql server on the host from the VM. VM: loco Host: tesla 1) If I turn OFF the firewall on tesla, I have no trouble connecting from loco. tesla: systemctl stop firewalld loco: psql -U postgres -h 192.168.122.1 # yay! connection! 2) If I turn ON the firewall on tesla, I can't connect NO MATTER WHAT I DO tesla: systemctl start firewalld; loco: psql -U postgres -h 192.168.122.1 # Connection refused I have tried: tesla# firewall-cmd --zone=public --add-port=5432/tcp tesla# firewall-cmd --add-service=postgresql tesla# firewall-cmd --set-default-zone=trusted; tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWI 0 -j ACCEPT tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWO 0 -j ACCEPT tesla# firewall-cmd --direct --add-rule ipv4 filter LIBVIRT_FWX 0 -j ACCEPT ... and many more things. Literally stumped for a few hours. The output of iptables indicates that I've wildcarded everything: tesla# iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N LIBVIRT_FWI -N LIBVIRT_FWO -N LIBVIRT_FWX -N LIBVIRT_INP -N LIBVIRT_OUT -A INPUT -j LIBVIRT_INP -A FORWARD -j LIBVIRT_FWX -A FORWARD -j LIBVIRT_FWI -A FORWARD -j LIBVIRT_FWO -A OUTPUT -j LIBVIRT_OUT -A LIBVIRT_FWI -d 192.168.122.0/24 -j ACCEPT -A LIBVIRT_FWI -i virbr0 -j ACCEPT -A LIBVIRT_FWI -j ACCEPT -A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWO -i virbr0 -j ACCEPT -A LIBVIRT_FWO -j ACCEPT -A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWX -j ACCEPT -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT -A LIBVIRT_INP -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -A LIBVIRT_OUT -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT There are no REJECT rules not preceded by a wildcard ACCEPT, but I can't connect with this config. But simply stopping host (tesla) firewalld allows me to connect just fine. Any ideas?

3 3

Debug information packages for 8.3 missing?
by Oliver Freyermuth 12 Dec '20

12 Dec '20

Dear all, after the upgrade from 8.2 to 8.3 one of the applications we use has unclear Kerberos authentication issues. I was going to diagnose these and tried: yum debuginfo-install krb5-libs However, I get: Could not find debuginfo package for the following installed packages: krb5-libs-1.18.2-5.el8.x86_64 Could not find debugsource package for the following installed packages: krb5-libs-1.18.2-5.el8.x86_64 Checking on http://debuginfo.centos.org/8/x86_64/Packages/ , I do indeed not find these packages, also glibc and other debug info packages are missing. Are they still being uploaded, or am I using a wrong repository? Thanks and cheers, Oliver

2 4

Question on nmcli CentOS 8
by Jerry Geis 11 Dec '20

11 Dec '20

I am trying to modify the current eth0 with nmcli I ran this: nmcli con mod eth0 ipv4.addr 192.168.1.15/22 gw4 192.168.1.1 ipv4.dns 192.168.1.14 and now nmcli shows (two ipv4) addresses. inet4 192.168.1.15/22 inet4 192.168.2.212/22 I think the original connection was DHCP... the 2.212 item listed. So I want to change the original DHCP to a static network - how do I do that? I only want the one address not two. So now I need to "remove" both or all and add the 1 I want as static ? how do I do that? Thanks, Jerry

3 2

Re: [CentOS] Moving to CentOS 8 Stream
by Kienker, Fred 11 Dec '20

11 Dec '20

"It takes years to build a reputation and seconds to destroy it." -- Business 101 class Best regards, Fred

6 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss