Discuss

discuss@lists.centos.org

34753 discussions

Re: [CentOS] OpenDKIM and SELinux
by James B. Byrne 13 May '14

13 May '14

On Mon, May 12, 2014 14:05, Daniel J Walsh wrote: >> dac_read_search and dac_override are usually bad to add. They typically >> mean the permission flags on the file in question is two tight for a >> root process to read/use. >> >> Loosing up the group/other permissions would probably allow a root >> process to read the object without requiring these capabities. > I just wrote a quick blog on this. > > https://danwalsh.livejournal.com/69478.html > > So, to turn on full path reporting I do this: # echo "-w /etc/shadow -p w" >> /etc/audit/audit.rules # service auditd restart My question is: what is the effect that "-w /etc/shadow -p w" has on SELinux with respect to reporting the full path of file names in AVCs? In other words, why does that work? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Change server name in postfix configuration
by Joseph Hesse 13 May '14

13 May '14

Hi, A consultant, long gone, set up postfix, dovecot, amavisd and squirrelmail for my wife. It works fine but my wife wants to change the server name from old.com to new.com so the name is more appropriate for her business. My approach would be to use sed to change all occurences of old.com to new.com. Specifically, I used grep to identify the following files where I should make the changes. /etc/postfix/main.cf /etc/dovecot/dovecot.conf /etc/squirrelmail/config.php /etc/amavisd.conf /etc/sysconfig/network (change host name) In addition, there would be an MX record for mail.new.com pointing to the IP of the server. My question is, will this work or will I corrupt my email server? If I mess it up I can always restore it to the original. Thank you, Joe

5 4

Samba problem
by Joseph Hesse 12 May '14

12 May '14

Hello, My only hard drive failed on a private server so I had to replace it and reinstall Centos 6.5 and Samba. My smb.conf file is OK according to "testparm". I configured smb and nmb, with chkconfig, to start when the system boots. After the system boots if I do "service nmb status" I get the response "nmbd dead but pid file exists". I can delete the pid file manually and start nmb with "service nmb start". The problem is that when the system shuts down and restarts I still find that "nmbd dead but pid file exists". Any suggestions on how to fix the problem would be much appreciated. Thank you, Joe

2 1

SSSD Passwd change problem
by Eric Falbe 12 May '14

12 May '14

Hi, I have sssd set up and it mostly works how I would expect, but the ldap_chpass_uri does not seem to work correctly with the passwd command. I have two configs, one working and one not: Working: ldap_uri = ldap://ldap.example.com ldap_chpass_uri = ldap://ldap.example.com Non Working: ldap_uri = ldap://ldap3.example.com,ldap://ldap2.example.com,ldap:// ldap.example.com ldap_chpass_uri = ldap://ldap.example.com ldap.example.com is the master ldap server, and the other two are read-only consumers. I have the clients set up with sssd to use their local ldap replication, except for changing their password. With the non working config the only thing I have changed is the ldap_uri. The behavior seems like it is not using the ldap_chpass_uri directive. I can post more of the config files if needed. When I use the passwd command to update a password, the first config snippet works as expected, whereas the second does not. Any ideas? Thanks, Eric Falbe

2 1

Xnest and gnome
by m.roth＠5-cent.us 12 May '14

12 May '14

I still don't like gnome.... Got a user who wants the "whole gnome experience" (i.e., he can't deal w/ the command line), so I'm testing this: I'm running 6.5, KDE. On the server, I've installed both Xnest, "Gnome Desktop Environment", and "X Window System". Xnest works fine, I can start xclock, or an xterm, but if I try DISPLAY=:1, I see the taskbar and top bar start to appear on the Xnest window, and then it crashes. Most recently, I've been using Xnest -query hostname :1 to start.... I *suspect* it has something to do with .Xauthority or something in my home directory, NFS mounted, of course, on both my workstation and the server, but.... Any clues or suggestions? The messages when it crashes start with: Error: (9) Connection ":1.246" is not allowed to own the service "org.freedesktop.NetworkManagerUserSettings" due to security policies in the configuration file Xlib: extension "RANDR" missing on display ":1". Xlib: extension "RANDR" missing on display ":1". Xlib: extension "DPMS" missing on display ":1". X Error of failed request: BadMatch (invalid parameter attributes) Major opcode of failed request: 73 (X_GetImage) Serial number of failed request: 5764 Current serial number in output stream: 5764 gnome-panel: Fatal IO error 0 (Success) on X server :1. mark

1 0

OpenDKIM and SELinux
by James B. Byrne 12 May '14

12 May '14

Following the most recent kernel updates I restarted our outgoing SMTP MTA which was recently reconfigured to DKIM sign messages using OpenDKIM. This morning I discovered that Postfix had stopped on that server. Whether it is related to the Postfix issue or not is yet to be determined but, in the process of getting things restarted I ran across this error with Open DKIM: # service opendkim restart Stopping OpenDKIM Milter: [FAILED] Starting OpenDKIM Milter: opendkim: /etc/opendkim.conf: refile:/etc/opendkim/TrustedHosts: dkimf_db_open(): Permission denied [FAILED] I check the permissions and ownership on the file and everything seems normal. I then checked audit2why and got this: audit2allow: error: no such option: -- [root@inet08 opendkim]# audit2why -l -a type=AVC msg=audit(1399898848.286:2317): avc: denied { dac_read_search } for pid=15213 comm="opendkim" capability=2 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=unconfined_u:system_r:dkim_milter_t:s0 tclass=capability Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1399898848.286:2317): avc: denied { dac_override } for pid=15213 comm="opendkim" capability=1 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=unconfined_u:system_r:dkim_milter_t:s0 tclass=capability Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. We have been using dkim for a little while now and our dmarc records indicate that messages from our domains should be signed so this problem needed an immediate fix or workaround. What I ended up with was this .te file that generates an SEModule which at least gets the service running. What else it opens us up to I am not sure so I would appreciate some commentary on how I should proceed to obtain a permanent fix: module localOpenDKIMmod 1.0; require { type dkim_milter_t; class capability { dac_read_search dac_override }; } #============= dkim_milter_t ============== allow dkim_milter_t self:capability { dac_read_search dac_override }; -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 2

CentOS-announce Digest, Vol 111, Issue 6
by centos-announce-request＠centos.org 12 May '14

12 May '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2014:0479 CentOS 6 mdadm Update (Johnny Hughes) 2. CEBA-2014:0482 CentOS 6 virt-viewer Update (Johnny Hughes) 3. CEBA-2014:0480 CentOS 6 glibc Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 May 2014 09:09:48 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0479 CentOS 6 mdadm Update To: centos-announce(a)centos.org Message-ID: <20140512090948.GA31608(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0479 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0479.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: dcb06cb9223e8beb2895b015325541f002cc17e65a4969ae5e8ae4a4cafab646 mdadm-3.2.6-7.el6_5.2.i686.rpm x86_64: a345fb7da35c8d6939f8528df57a1d5ddea5a32c5c2e35f0ce7ebb8d1d4fc1ea mdadm-3.2.6-7.el6_5.2.x86_64.rpm Source: 790cde83904db3954594552c52d02c7fd7995a96b6af820121a7b4988d9d25dc mdadm-3.2.6-7.el6_5.2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Mon, 12 May 2014 09:10:49 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0482 CentOS 6 virt-viewer Update To: centos-announce(a)centos.org Message-ID: <20140512091049.GA31801(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0482 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0482.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 05fb9063c98b4a2ec8c8e486e9a14920aae1343d9155e4e03caec34b13f2d1fe virt-viewer-0.5.6-8.el6_5.2.i686.rpm x86_64: 2a34e3b003095390204c557e3ad38ad63a927815e34277423b0854563d2f4a16 virt-viewer-0.5.6-8.el6_5.2.x86_64.rpm Source: 14436b7735f3bb8bea20d4ee331f283d69464c99a270e8ae363c91de534dc8a5 virt-viewer-0.5.6-8.el6_5.2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Mon, 12 May 2014 09:20:03 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0480 CentOS 6 glibc Update To: centos-announce(a)centos.org Message-ID: <20140512092003.GA32302(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0480 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0480.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 61ee3b95a41c3248bf1f6869bb4395bd7ecd5f5458390b0a532aba2e24867cc5 glibc-2.12-1.132.el6_5.1.i686.rpm 51d4dc05d99974de458a504b0898b68f384fe494739ad022753c4c60f6e0d694 glibc-common-2.12-1.132.el6_5.1.i686.rpm 2291ca8dae36ee186e1952b2d97305b0b69db1da636bfeb232e95f8dca86983c glibc-devel-2.12-1.132.el6_5.1.i686.rpm bc9e8f1257f5eff0d27524289bb983664e213a8e66ee81831e7230058602556e glibc-headers-2.12-1.132.el6_5.1.i686.rpm bf67d3ac8390077100787c4e669c24215b0a594ce0fe6d3d18ddc85765fcbcc2 glibc-static-2.12-1.132.el6_5.1.i686.rpm 94b09ee7111e03c16c74459257b67d974962f8a0f27436a103ce9afa07accdbf glibc-utils-2.12-1.132.el6_5.1.i686.rpm ed69e226d681c5c613797eac67f8973824ed44cd8a54804e69ab75f002af69fc nscd-2.12-1.132.el6_5.1.i686.rpm x86_64: 61ee3b95a41c3248bf1f6869bb4395bd7ecd5f5458390b0a532aba2e24867cc5 glibc-2.12-1.132.el6_5.1.i686.rpm 23e70f730344720b009071e1397557205523da758de754c6d4f96dd23570bff4 glibc-2.12-1.132.el6_5.1.x86_64.rpm 366c7a05c3dab6c0eb2f3e044834930cfe2e52822ca69c65ba0c2bf5c5217366 glibc-common-2.12-1.132.el6_5.1.x86_64.rpm 2291ca8dae36ee186e1952b2d97305b0b69db1da636bfeb232e95f8dca86983c glibc-devel-2.12-1.132.el6_5.1.i686.rpm dd1a75ab2fa5aee65542f277bab51822201ff200fe02c1bd7a674e20527b162c glibc-devel-2.12-1.132.el6_5.1.x86_64.rpm 2609cf80b2840c0fafc3824e7451c95322a4e0c54bfacf0dee3228015151838e glibc-headers-2.12-1.132.el6_5.1.x86_64.rpm bf67d3ac8390077100787c4e669c24215b0a594ce0fe6d3d18ddc85765fcbcc2 glibc-static-2.12-1.132.el6_5.1.i686.rpm 1862effada19be6bb1c6fc5a2218f74dafd7ea7fa62496cbec7d88177a13fb0c glibc-static-2.12-1.132.el6_5.1.x86_64.rpm 25c607944fc32cd1e7afb059fdf4a3ff5fcbfa326d8658f3a66f541daf34ce6b glibc-utils-2.12-1.132.el6_5.1.x86_64.rpm 80817131e2d9df5685f3d751061cae77691f350462f8217273112c11542a6abb nscd-2.12-1.132.el6_5.1.x86_64.rpm Source: 381c5ee5987f7161db5f5ea411aafe30fb2e344a536942dfaf5ff8507f4fa06a glibc-2.12-1.132.el6_5.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 111, Issue 6 ***********************************************

1 0

EFI and RAID questions
by CS_DBA 11 May '14

11 May '14

Hi All; I have a new server we're setting up that supports EFI or Legacy in the bios I am a solid database guy but my SA skills are limited to what I need to get by 1) I used EFI because I wanted to create a raid 10 array with 6 4TB drives and apparently I cannot setup gpt partitions via parted in legacy mode (at least that's what I've read - is this true?) 2) I installed the OS on 2 500GB drives, I used to do all my installs with software RAID (mirrored) without LVM as follows: - create 2 raid partitions (one on each drive) for swap, /boot and / - create a raid1 device for each set of partitions above The installer would not let me proceed without a /boot/efi partition I tried to create a raid partition on each drive for this and create a /boot/efi raid disk but when I doit this way in the installer I no longer see the "EFI SYSTEM Partition" as an option for the filesystem type so this did not work either. I ended up doing hardware raid for the OS drives and software raid for the 6 4TB data drives. It works but I prefer to do software raid for everything so we ca have standard methods of monitoring for bad drives. Is there a way to setup software raid with EFI? Do I need to add a /boot/efi partition only to one of the 2 OS drives? If so how do I recover if we loose the drive with the /boot/efi partition? Is it required to use LVM to do this? Thanks in advance

4 4

how to replace a raid drive with mdadm
by CS_DBA 10 May '14

10 May '14

Hi all If we loose a drive in a raid 10 array (mdadm software raid) what are the steps needed to correctly do the following: - identify which physical drive it is - replace the drive - add the new drive to the array and force it to re-sync Thanks in advance

3 3

[ask] iodined: open_tun: /dev/net/tun: Operation not permitted
by Morning Star 10 May '14

10 May '14

Hi guys, I got error when executing iodined at my vps: $ sudo iodined -f -P test1 192.168.0.1 localhost iodined: open_tun: /dev/net/tun: Operation not permitted: Operation not permitted so i check -. iodine version: iodine IP over DNS tunneling server version: 0.5.1 from 2009-03-21 -. uname 2.6.32-042stab068.8 #1 SMP Fri Dec 7 17:06:14 MSK 2012 i686 i686 i386 GNU/Linux -. ls -l /dev/net/tun rw-rw-rw- 1 root root 10, 200 May 5 00:24 /dev/net/tun how can i resolve this problem? thanks in advance. regards, marco

5 6

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss