Discuss

discuss@lists.centos.org

34758 discussions

OpenDKIM and SELinux
by James B. Byrne 12 May '14

12 May '14

Following the most recent kernel updates I restarted our outgoing SMTP MTA which was recently reconfigured to DKIM sign messages using OpenDKIM. This morning I discovered that Postfix had stopped on that server. Whether it is related to the Postfix issue or not is yet to be determined but, in the process of getting things restarted I ran across this error with Open DKIM: # service opendkim restart Stopping OpenDKIM Milter: [FAILED] Starting OpenDKIM Milter: opendkim: /etc/opendkim.conf: refile:/etc/opendkim/TrustedHosts: dkimf_db_open(): Permission denied [FAILED] I check the permissions and ownership on the file and everything seems normal. I then checked audit2why and got this: audit2allow: error: no such option: -- [root@inet08 opendkim]# audit2why -l -a type=AVC msg=audit(1399898848.286:2317): avc: denied { dac_read_search } for pid=15213 comm="opendkim" capability=2 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=unconfined_u:system_r:dkim_milter_t:s0 tclass=capability Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. type=AVC msg=audit(1399898848.286:2317): avc: denied { dac_override } for pid=15213 comm="opendkim" capability=1 scontext=unconfined_u:system_r:dkim_milter_t:s0 tcontext=unconfined_u:system_r:dkim_milter_t:s0 tclass=capability Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. We have been using dkim for a little while now and our dmarc records indicate that messages from our domains should be signed so this problem needed an immediate fix or workaround. What I ended up with was this .te file that generates an SEModule which at least gets the service running. What else it opens us up to I am not sure so I would appreciate some commentary on how I should proceed to obtain a permanent fix: module localOpenDKIMmod 1.0; require { type dkim_milter_t; class capability { dac_read_search dac_override }; } #============= dkim_milter_t ============== allow dkim_milter_t self:capability { dac_read_search dac_override }; -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 2

CentOS-announce Digest, Vol 111, Issue 6
by centos-announce-request＠centos.org 12 May '14

12 May '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2014:0479 CentOS 6 mdadm Update (Johnny Hughes) 2. CEBA-2014:0482 CentOS 6 virt-viewer Update (Johnny Hughes) 3. CEBA-2014:0480 CentOS 6 glibc Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 12 May 2014 09:09:48 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0479 CentOS 6 mdadm Update To: centos-announce(a)centos.org Message-ID: <20140512090948.GA31608(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0479 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0479.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: dcb06cb9223e8beb2895b015325541f002cc17e65a4969ae5e8ae4a4cafab646 mdadm-3.2.6-7.el6_5.2.i686.rpm x86_64: a345fb7da35c8d6939f8528df57a1d5ddea5a32c5c2e35f0ce7ebb8d1d4fc1ea mdadm-3.2.6-7.el6_5.2.x86_64.rpm Source: 790cde83904db3954594552c52d02c7fd7995a96b6af820121a7b4988d9d25dc mdadm-3.2.6-7.el6_5.2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Mon, 12 May 2014 09:10:49 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0482 CentOS 6 virt-viewer Update To: centos-announce(a)centos.org Message-ID: <20140512091049.GA31801(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0482 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0482.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 05fb9063c98b4a2ec8c8e486e9a14920aae1343d9155e4e03caec34b13f2d1fe virt-viewer-0.5.6-8.el6_5.2.i686.rpm x86_64: 2a34e3b003095390204c557e3ad38ad63a927815e34277423b0854563d2f4a16 virt-viewer-0.5.6-8.el6_5.2.x86_64.rpm Source: 14436b7735f3bb8bea20d4ee331f283d69464c99a270e8ae363c91de534dc8a5 virt-viewer-0.5.6-8.el6_5.2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Mon, 12 May 2014 09:20:03 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2014:0480 CentOS 6 glibc Update To: centos-announce(a)centos.org Message-ID: <20140512092003.GA32302(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:0480 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-0480.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 61ee3b95a41c3248bf1f6869bb4395bd7ecd5f5458390b0a532aba2e24867cc5 glibc-2.12-1.132.el6_5.1.i686.rpm 51d4dc05d99974de458a504b0898b68f384fe494739ad022753c4c60f6e0d694 glibc-common-2.12-1.132.el6_5.1.i686.rpm 2291ca8dae36ee186e1952b2d97305b0b69db1da636bfeb232e95f8dca86983c glibc-devel-2.12-1.132.el6_5.1.i686.rpm bc9e8f1257f5eff0d27524289bb983664e213a8e66ee81831e7230058602556e glibc-headers-2.12-1.132.el6_5.1.i686.rpm bf67d3ac8390077100787c4e669c24215b0a594ce0fe6d3d18ddc85765fcbcc2 glibc-static-2.12-1.132.el6_5.1.i686.rpm 94b09ee7111e03c16c74459257b67d974962f8a0f27436a103ce9afa07accdbf glibc-utils-2.12-1.132.el6_5.1.i686.rpm ed69e226d681c5c613797eac67f8973824ed44cd8a54804e69ab75f002af69fc nscd-2.12-1.132.el6_5.1.i686.rpm x86_64: 61ee3b95a41c3248bf1f6869bb4395bd7ecd5f5458390b0a532aba2e24867cc5 glibc-2.12-1.132.el6_5.1.i686.rpm 23e70f730344720b009071e1397557205523da758de754c6d4f96dd23570bff4 glibc-2.12-1.132.el6_5.1.x86_64.rpm 366c7a05c3dab6c0eb2f3e044834930cfe2e52822ca69c65ba0c2bf5c5217366 glibc-common-2.12-1.132.el6_5.1.x86_64.rpm 2291ca8dae36ee186e1952b2d97305b0b69db1da636bfeb232e95f8dca86983c glibc-devel-2.12-1.132.el6_5.1.i686.rpm dd1a75ab2fa5aee65542f277bab51822201ff200fe02c1bd7a674e20527b162c glibc-devel-2.12-1.132.el6_5.1.x86_64.rpm 2609cf80b2840c0fafc3824e7451c95322a4e0c54bfacf0dee3228015151838e glibc-headers-2.12-1.132.el6_5.1.x86_64.rpm bf67d3ac8390077100787c4e669c24215b0a594ce0fe6d3d18ddc85765fcbcc2 glibc-static-2.12-1.132.el6_5.1.i686.rpm 1862effada19be6bb1c6fc5a2218f74dafd7ea7fa62496cbec7d88177a13fb0c glibc-static-2.12-1.132.el6_5.1.x86_64.rpm 25c607944fc32cd1e7afb059fdf4a3ff5fcbfa326d8658f3a66f541daf34ce6b glibc-utils-2.12-1.132.el6_5.1.x86_64.rpm 80817131e2d9df5685f3d751061cae77691f350462f8217273112c11542a6abb nscd-2.12-1.132.el6_5.1.x86_64.rpm Source: 381c5ee5987f7161db5f5ea411aafe30fb2e344a536942dfaf5ff8507f4fa06a glibc-2.12-1.132.el6_5.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 111, Issue 6 ***********************************************

1 0

EFI and RAID questions
by CS_DBA 12 May '14

12 May '14

Hi All; I have a new server we're setting up that supports EFI or Legacy in the bios I am a solid database guy but my SA skills are limited to what I need to get by 1) I used EFI because I wanted to create a raid 10 array with 6 4TB drives and apparently I cannot setup gpt partitions via parted in legacy mode (at least that's what I've read - is this true?) 2) I installed the OS on 2 500GB drives, I used to do all my installs with software RAID (mirrored) without LVM as follows: - create 2 raid partitions (one on each drive) for swap, /boot and / - create a raid1 device for each set of partitions above The installer would not let me proceed without a /boot/efi partition I tried to create a raid partition on each drive for this and create a /boot/efi raid disk but when I doit this way in the installer I no longer see the "EFI SYSTEM Partition" as an option for the filesystem type so this did not work either. I ended up doing hardware raid for the OS drives and software raid for the 6 4TB data drives. It works but I prefer to do software raid for everything so we ca have standard methods of monitoring for bad drives. Is there a way to setup software raid with EFI? Do I need to add a /boot/efi partition only to one of the 2 OS drives? If so how do I recover if we loose the drive with the /boot/efi partition? Is it required to use LVM to do this? Thanks in advance

4 4

how to replace a raid drive with mdadm
by CS_DBA 11 May '14

11 May '14

Hi all If we loose a drive in a raid 10 array (mdadm software raid) what are the steps needed to correctly do the following: - identify which physical drive it is - replace the drive - add the new drive to the array and force it to re-sync Thanks in advance

3 3

[ask] iodined: open_tun: /dev/net/tun: Operation not permitted
by Morning Star 10 May '14

10 May '14

Hi guys, I got error when executing iodined at my vps: $ sudo iodined -f -P test1 192.168.0.1 localhost iodined: open_tun: /dev/net/tun: Operation not permitted: Operation not permitted so i check -. iodine version: iodine IP over DNS tunneling server version: 0.5.1 from 2009-03-21 -. uname 2.6.32-042stab068.8 #1 SMP Fri Dec 7 17:06:14 MSK 2012 i686 i686 i386 GNU/Linux -. ls -l /dev/net/tun rw-rw-rw- 1 root root 10, 200 May 5 00:24 /dev/net/tun how can i resolve this problem? thanks in advance. regards, marco

5 6

CentOS 6.5 fresh install, public ssh keys cannot authenticate
by Dan Bikle 10 May '14

10 May '14

Dear List, I cannot get public ssh keys to work in a fresh install of centos6.5 This might be a centos bug. I've googled for a solution. Mostly I found threads suggesting I debug sshd or run ssh -v for clues. Also I've seen threads suggesting I look at file and directory permissions. I dont think I should need to debug sshd after a fresh install. Also I think a fresh install should correctly set file and directory permissions. I think ssh should just simply work or I should see some simple documentation to make it work. Steps to reproduce this bug: Get the latest copy of virtualbox software. Get a centos6.5 dvd. Press the new button in virtualbox In the settings of the new install ask virtual box to setup a bridged adapter. Walk through the virtualbox wizard UI. When it asks for distribution point it at centos6.5 iso When the iso boots inside of virtualbox, choose to install desktop which is the first choice of choices. Eventually it will ask for a username, give the name of 'dan' and password paloalto9. When presented a login screen, login as dan. Start a terminal. try ssh: ssh dan@localhost That should prompt you for password and log you in. Also it should create ~dan/.ssh/ cd ~dan/.ssh/ do this: ssh-keygen That should create 2 files: ~dan/.ssh/id_rsa ~dan/.ssh/id_rsa.pub do this: cat ~dan/.ssh/id_rsa.pub > ~dan/.ssh/authorized_keys try: ssh dan@localhost It should log me in. Instead it prompts for password. I've walked through this type of scenario many times over the past few years and it has always worked. Currently it works well on ubuntu 12.04. I think something in centos6 might be broken? Perhaps there is a documented step somewhere which has been added to fresh centos installs which I missed? Dan

4 4

Kickstarts failing 30% of time on Dell 620 blades
by Dan Hyatt 09 May '14

09 May '14

I have a large set of Dell 620 blades fully populated with memory and duel socket CPUs, Centos6.4 image. I have a kickstart that I am using to pxe boot 36 blades. I have two internal drives which are raid1 (two disks formed into one, no redundancy), not san attached In the first set, 9 successfully completed. 7 more built correctly after trying another pxe boot. 2 just wont pxeboot In the second set I had 11 fail and 5 succeed and the two I tried again failed. When they fail, they go to GRUB. I try booting from disk from the drac and still get grub It looks like the complete centos kickstart occurs as it goes through the whole install before rebooting and failing. Any idea why this would happen with identical hardware, identical kickstart/image, inside the same blade chassis. Any idea what to test. -- Dan Hyatt Division of Statistical Genomics Washington University School of Medicine 4444 Forest Park Blvd, Campus Box 8506 St. Louis, MO 63108 314 747 4767 (o) 314 473 8713 (c) dhyatt(a)dsgmail.wustl.edu

3 2

Processes launched from rc*.d and ulimit -n
by Mitch Patenaude 09 May '14

09 May '14

I'm running fedora directory server on some boxes in a multi-master arrangement. The problem is that when dirsrv is lauched from init (on boot) the maximum number of allowed file descriptors (ulimit -n) is only 4096. That means that the slapd process can only accept ~4k connections, and it needs to accept ~10k or so. The value for nofile for all users in /etc/security/limits.conf (and limits.d/*) is 65536, and as soon as I restart the process (service dirsrv restart) it comes up with ulimit -n being 64K, the way it's supposed to. Why isn't it doing this at boot? Right after boot: ldap07:~ mpatenaude$ ldapsearch -x -h localhost -LLL -D 'cn=directory manager' -W -b 'cn=config' -s base nsslapd-maxdescriptors Enter LDAP Password: dn: cn=config nsslapd-maxdescriptors: 4096 ldap07:~ mpatenaude$ sudo service dirsrv restart [sudo] password for mpatenaude: Shutting down dirsrv: ldap07... [ OK ] Starting dirsrv: ldap07... [ OK ] ldap07:~ mpatenaude$ ldapsearch -x -h localhost -LLL -D 'cn=directory manager' -W -b 'cn=config' -s base nsslapd-maxdescriptors Enter LDAP Password: dn: cn=config nsslapd-maxdescriptors: 65535 Thanks, -- Mitch Patenaude

3 3

CentOS-announce Digest, Vol 111, Issue 5
by centos-announce-request＠centos.org 09 May '14

09 May '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:0475 Important CentOS 6 kernel Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 8 May 2014 17:53:25 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2014:0475 Important CentOS 6 kernel Update To: centos-announce(a)centos.org Message-ID: <20140508175325.GA24045(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:0475 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-0475.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 267ceab23c1f901e62d2985a419e7ca13f36babf76290e489a1c767a48a36b59 kernel-2.6.32-431.17.1.el6.i686.rpm 84b4eed6521edd16bf2a23cb0666739310dcf33dd8686f1bd45dd11ceeb9bc0f kernel-abi-whitelists-2.6.32-431.17.1.el6.noarch.rpm e4a09451b5c7b0261183f6833301ce5038aec87fc7cb0f0b2432872bccf09fa7 kernel-debug-2.6.32-431.17.1.el6.i686.rpm 4eb771030ff176ae50ab047e5566c20efbd680cca03da218fed89ed137b22694 kernel-debug-devel-2.6.32-431.17.1.el6.i686.rpm 595668b669552f21b2c25d7f690d2ba339c91d588b50deb3f6748bc0626b5906 kernel-devel-2.6.32-431.17.1.el6.i686.rpm 32d42356c1ce28c095bc896e2a5bf6a78d5008ba90f28b723bcddc4e28001d12 kernel-doc-2.6.32-431.17.1.el6.noarch.rpm 004a89382221072d038dd28cd37b3d78f35a5bc0c135bf9d98fe0dec29588c95 kernel-firmware-2.6.32-431.17.1.el6.noarch.rpm ba3e5aa5673a4327a28e815c710dcba33b5463d711da6e7e7dba66b4471d7e84 kernel-headers-2.6.32-431.17.1.el6.i686.rpm 991c1f3f53890e9f9d7b425642f2c741a524f7c059c2c74daf640c9b1c78ef43 perf-2.6.32-431.17.1.el6.i686.rpm 023970cca2b6437cfe0f01db2e623df3e45f606709cc70b8851d60590a3e1849 python-perf-2.6.32-431.17.1.el6.i686.rpm x86_64: c1342c8ceb9dd2b5f81e9a6775d4b51156b0389fad1499413165fb18ccd805e1 kernel-2.6.32-431.17.1.el6.x86_64.rpm 84b4eed6521edd16bf2a23cb0666739310dcf33dd8686f1bd45dd11ceeb9bc0f kernel-abi-whitelists-2.6.32-431.17.1.el6.noarch.rpm dcd8aa7f637ca5aaa90d2d9679149192866beefcab48a1a3443d3b8875d35120 kernel-debug-2.6.32-431.17.1.el6.x86_64.rpm 96e73ab864fa657282c525a3d117ccfdc6fe73807dd572a9c6cc8b3420b7006d kernel-debug-devel-2.6.32-431.17.1.el6.x86_64.rpm ed2064e32ce4a24a7496e59fe67a9a2dc8398bd316d0939a2df40ee0a639c99e kernel-devel-2.6.32-431.17.1.el6.x86_64.rpm 32d42356c1ce28c095bc896e2a5bf6a78d5008ba90f28b723bcddc4e28001d12 kernel-doc-2.6.32-431.17.1.el6.noarch.rpm 004a89382221072d038dd28cd37b3d78f35a5bc0c135bf9d98fe0dec29588c95 kernel-firmware-2.6.32-431.17.1.el6.noarch.rpm 3d4824821ff14fd58c401b43396f9db9e42cdf071266d448d3497a59a1e3595e kernel-headers-2.6.32-431.17.1.el6.x86_64.rpm fa072fb210e20d3c273d96cdc43bd795d5f051c750aa8eea883c0676847de5b2 perf-2.6.32-431.17.1.el6.x86_64.rpm 78270504fff7321e0fa56aa359abb9cf92447aca3375e9aa0823f4c46a1acd13 python-perf-2.6.32-431.17.1.el6.x86_64.rpm Source: 0b647383a66ba3440ccebb136cacc9c366eb283d2b575c6146921d2661204054 kernel-2.6.32-431.17.1.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 111, Issue 5 ***********************************************

1 0

plug in phones, speaker does not mute.
by Fred Smith 09 May '14

09 May '14

Hi all! Using C6 on an Asus M5A99X EVO R2.0 motherboard with AMD six core FX6300. That board uses Realtek ALC892 audio chipset. For the first time since I got that motherboard I tried plugging in headphones to the front panel speaker output. I was somewhat displeased to note that the speakers don't mute when that happens. I recall seeing info on that in Fedora, but not Centos, and haven't so far scared up how to troubleshoot it. I can MANUALLY change the setting in sound preferences, which offers only two choices: "Analog Output" and "Analog Headphones". Suggestions will be welcomed! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss