Discuss

discuss@lists.centos.org

34753 discussions

Re: [CentOS] Does anyone use tcp wrappers (hosts.allow/hosts.deny) anymore?
by James B. Byrne 22 Mar '14

22 Mar '14

On Thu, March 20, 2014 18:52, Les Mikesell wrote: > xml isn't intended for humans - it is supposed to be parsed and > verified by machines. The bigger question is why the machines aren't > managing the config files themselves yet? > Possibly because the machines are running programs written by humans that need to understand what they think they have told the machine to do in order to determine why it is not doing what they want it to? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

Re: [CentOS] rsync triggers oomkiller
by SilverTip257 21 Mar '14

21 Mar '14

I added a subject so we can track this message on the list easier. ;) On Fri, Mar 21, 2014 at 12:19 PM, John Doe <jdmls(a)yahoo.com> wrote: > Hey, > > kernel: rsync invoked oom-killer: gfp_mask=0x200da, order=0, oom_adj=0, > oom_score_adj=0 > ... > kernel: Out of memory: Kill process 27974 (mysqld) score 361 or > sacrifice child > kernel: Killed process 27974, UID 27, (mysqld) total-vm:3804672kB, > anon-rss:2890828kB, file-rss:3324kB > > rsync whines he wants more RAM and... mysql gets killed... > That makes me a bit sad! > And from my nagios graphs, at that time, ram usage was only 75% > (4.5GB/6GB) and swap usage 0.3% (/2GB)! > I cannot believe an rsync suddenly needed 1.5GB+2GB and was not > satisfied... > And even after the out of memory, the graphs show no swap usage change at > all. > Anybody would have an idea about this "fake" out of memory? > Wild. I've not encountered oomkiller being triggered when the server has free memory and hasn't swapped to disk yet. After the fact, it will probably be almost impossible to figure out the list of files that rsync was storing in memory. This makes me wonder if there's an option to have rsync log the list of files (to be synced) to a log file of some sort. I'll have to look into it later today when I have a moment. > > Thx, > JD > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- ---~~.~~--- Mike // SilverTip257 //

3 4

Re: [CentOS] Does anyone use tcp wrappers (hosts.allow/hosts.deny) anymore?
by James B. Byrne 21 Mar '14

21 Mar '14

On Thu, March 20, 2014 17:34, Always Learning wrote: > > > Nothing remains static. Software evolves into usually superior products. > Sentimentally longing for the past hampers the introduction of new and > better replacements. Yes. For example look how MicroSoft has improved Windows since XPsp3.;-^) -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

7 6

mellanox ofed on centos kernel 3.x
by Robert Clove 21 Mar '14

21 Mar '14

Hi all, Has anyone installed mellanox ofed on linux kernel 3.x? Regards

2 5

Tar Compression issue
by Bonnie B Mtengwa 21 Mar '14

21 Mar '14

I have a file Server CentOS 5.10, its on the internet, so I compress all csv into one file using (tar -czvf compressed_files.tar.gz *.csv) on this server so that I can download them as one compressed file to save bandwidth, Disk space on this server available is 50Gig, so when I copy the files onto Redhat EL 5.9 and decompress them using (tar -zxvf *.gz) It decompresses maybe 80% then get error: gzip: stdin: unexpected end of file tar: Unexpected EOF in archive tar: Unexpected EOF in archive tar: Error is not recoverable: exiting now what might be the issue here? Bonnie B Mtengwa Email: <mailto:bonnie.mtengwa@potraz.gov.zw> bonnie.mtengwa(a)potraz.gov.zw | <mailto:bonniebm@gmail.com> bonniebm(a)gmail.com Web: <http://www.potraz.gov.zw/> www.potraz.gov.zw

7 6

(no subject)
by John Doe 21 Mar '14

21 Mar '14

Hey, kernel: rsync invoked oom-killer: gfp_mask=0x200da, order=0, oom_adj=0, oom_score_adj=0 ... kernel: Out of memory: Kill process 27974 (mysqld) score 361 or sacrifice child kernel: Killed process 27974, UID 27, (mysqld) total-vm:3804672kB, anon-rss:2890828kB, file-rss:3324kB rsync whines he wants more RAM and... mysql gets killed... That makes me a bit sad! And from my nagios graphs, at that time, ram usage was only 75% (4.5GB/6GB) and swap usage 0.3% (/2GB)! I cannot believe an rsync suddenly needed 1.5GB+2GB and was not satisfied... And even after the out of memory, the graphs show no swap usage change at all. Anybody would have an idea about this "fake" out of memory? Thx, JD

1 0

Re: [CentOS] Does anyone use tcp wrappers (hosts.allow/hosts.deny) anymore?
by m.roth＠5-cent.us 20 Mar '14

20 Mar '14

Matthew Miller wrote: > Does anyone use tcp wrappers (hosts.allow/hosts.deny) anymore? And, would you care strongly if it went away (or would you just migrate to something else)? > > I bring this up because we are discussing dropping it from Fedora. This would be far enough in the future that it wouldn't impact RHEL 7, and therefore won't affect anyone here for Quite Some Time*, but here in the new world order of CentOS, I thought it might be useful to check with some actual downstream users. > > What do you think? Do you rely on hosts.allow/hosts.deny a primary security mechanism? As defense-in-depth? Do you have policies which mandate it? > Someone mentioned US gov't - we're a gov't agency (non-DoD), and I just had a quick conversation with my manager. I know I haven't used it in a *bunch* of years; his reaction was, "what's the point", with firewalls, and tools like fail2ban. We're ok if it goes away. mark "awk, on the other hand, you'll get away from me when you pry my cold, dead fingers off the keyboard"

2 1

NFS Mount: files owned by nobody
by Lists 20 Mar '14

20 Mar '14

This is one of those simple-been-doing-this-forever things that, for some reason, has me stumped today. When I try to NFS (v4) mount a directory, the user/group ownership shows up as user "nobody" even though /etc/passwd has values for the correct user names. How do I get it to mount with the correct user IDs? Hume is the server, running CentOS 6, all updates applied, maybe a week or two ago Bender is the client, running CentOS 6, all updates applied, maybe a week or two ago. ### HUME ### Hume has a backup saved in /home/spfs.450, the directory that I'm trying to export. [root@hume ~]# ll /home/spfs.450/ drwxr-xr-x 3 apache apache 3 Oct 8 2009 y.spfs drwxr-xr-x 3 apache apache 3 Feb 1 2010 yts.spfs --SNIP-- Hume is exporting with /etc/exports /home/spfs.450 192.168.254.0/255.255.255.0(rw,async,no_subtree_check,mp,no_acl,insecure,no_root_squash) Hume has appropriate /etc/passwd entries: [root@hume ~]# grep -i apache /etc/passwd apache:x:48:48:Apache:/var/www:/sbin/nologin To be sure, the files are numerically id'd as 48: [root@hume ~]# ls -ln /home/spfs.450/ drwxr-xr-x 3 48 48 3 Oct 8 2009 y.spfs drwxr-xr-x 3 48 48 3 Feb 1 2010 yts.spfs --SNIP-- Nothing shows in /var/log/messages either when I enable the export or when it's mounted by bender. [root@bender ~]# tail -f /var/log/messages ### BENDER ### Bender is mounting the backup with the following command: [root@bender ~]# /bin/mount -t nfs 192.168.254.9:/home/spfs.450 /home/spfs.450 Files show up with the wrong user name. [root@bender ~]# ll /home/spfs.450/ drwxr-xr-x 3 nobody nobody 3 Oct 8 2009 y.spfs drwxr-xr-x 3 nobody nobody 3 Feb 1 2010 yts.spfs --SNIP-- Bender as appropriate /etc/passwd entries: [root@bender ~]# grep -i apache /etc/passwd apache:x:48:48:Apache:/var/www:/sbin/nologin Nothing shows in /var/log/messages when I mount the export on Bender. [root@bender ~]# tail /var/log/messages

5 9

Disk usage incorrectly reported by du
by Radu Radutiu 20 Mar '14

20 Mar '14

I have an ext4 filesystem for which the reported disk usage is not correct. I have noticed the discrepancy after I rsync-ed the content to another filesystem and noticed that the used space on the target is almost double of the size reported on the source. Both machines are running the same software - with the same kernel version and same coreutils version (which I later upgraded to latest available version). Both filesystems are clean (verified with fsck.ext4). No sparse files. After further investigation I think that the problem is most likely on the source machine. Here is the du output for for one directory exhibiting the problem: #du -h |grep \/51 201M ./51/msg/8 567M ./51/msg/9 237M ./51/msg/6 279M ./51/msg/0 174M ./51/msg/10 273M ./51/msg/2 341M ./51/msg/7 408M ./51/msg/4 222M ./51/msg/11 174M ./51/msg/5 238M ./51/msg/1 271M ./51/msg/3 3.3G ./51/msg 3.3G ./51 after changing the directory and running du again I get different numbers #cd 51 du -h 306M ./msg/8 676M ./msg/9 351M ./msg/6 338M ./msg/0 347M ./msg/10 394M ./msg/2 480M ./msg/7 544M ./msg/4 407M ./msg/11 312M ./msg/5 326M ./msg/1 377M ./msg/3 4.8G ./msg 4.8G . Do you have any idea what could cause this behaviour?

5 9

Re: [CentOS] Linux malware attack
by Johnny Hughes 20 Mar '14

20 Mar '14

On 03/19/2014 11:22 AM, Steve Clark wrote: > On 03/19/2014 12:11 PM, SilverTip257 wrote: >> On Wed, Mar 19, 2014 at 10:01 AM, Johnny Hughes <johnny(a)centos.org> wrote: >> >>> On 03/19/2014 08:50 AM, Timothy Murphy wrote: >>>> SlashDot had an article today on a Linux server malware attack, >>>> < >>> http://it.slashdot.org/story/14/03/18/2218237/malware-attack-infected-25000… >>>> . >>>> >>>> I wonder if there is a simple test to see if a CentOS machine >>>> has been infected in this way? >>>> >>>> The article mentions Yara and Snort rules to test for this, >>>> but I wonder if there is something simpler? >>>> Alternatively, are there Yara or Snort packages for CentOS? >>>> ("Yum search" didn't seem to find anything.) >>>> >>>> >>>> >>> Look at this PDF: >>> >>> http://bit.ly/1qCEQFi >>> >>> >> The article I read, linked to a detection toolkit on GitHub. >> https://github.com/eset/malware-ioc >> >> Read this: >> https://github.com/eset/malware-ioc/blob/master/windigo/README.adoc >> >> > I didn't see anything about how the machines got infected. Did I miss something? Linked PDF, Section 3.2 has a time line ... the bottom line is, people got root access via credentials and password logins. Once they got credentials, they put trojans on and got everyone's username and passwords. If you look at page 66 of the PDF, it tells you how to not get infected ... don't allow root logins and don't use passwords. Don't keep user's sever root passwords in a database, etc.

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss