Discuss

discuss@lists.centos.org

34758 discussions

Kickstart deploys more packages?
by Darod Zyree 13 Jan '14

13 Jan '14

Hi, Does anyone know why an Anaconda Kickstart installation deploys more rpm packages than a manual "basic" installation? In both cases the following package groups were installed/used according to anaconda-ks.cfg in root home directory: @core, @server-policy, @workstation-policy

7 15

Re: [CentOS] [resolved ]nfs client kerberos cache
by Darod Zyree 13 Jan '14

13 Jan '14

2014/1/6 Darod Zyree <darodzyree(a)gmail.com> > Greetings, > > Not sure if this is the correct mail list. > > I have the following test environment set up: > - 1x ipa master = ipa1.example.com > - 1x nfs server = nfs1.example.com > - 1x nfs client = nfsclient1.example.com > > NFS version 4 is used and the appropriate Kerberos principal has been > created in IPA: > > [root@nfs1 ~]# ipa service-show nfs/nfs1.example.com(a)EXAMPLE.COM > > Principal: nfs/nfs1.example.com(a)EXAMPLE.COM > Keytab: True > Managed by: nfs1.example.com > > > Mounting using krb5p works: > > [root@nfsclient1 ~]# mount -v -t nfs -o sec=krb5p > nfs1.example.com:/exports/homes/ /mnt > > mount.nfs: timeout set for Mon Jan 6 21:25:56 2014 > mount.nfs: trying text-based options > 'sec=krb5p,vers=4,addr=192.168.12.172,clientaddr=192.168.12.173' > nfs1.example.com:/exports/homes/ on /mnt type nfs (rw,sec=krb5p) > > rpcgssd created the Kerberos cache file as indicated > in /var/log/messages: > rpc.gssd[2473]: INFO: Credentials in CC > 'FILE:/tmp/krb5cc_machine_EXAMPLE.COM' are good until 1389125973 > > > So far so good, but then: > > 1) I unmount everything from nfs1, remove the nfs1.example.host, its DNS > record(s) and service principcals. > 2) I redeploy the nfs1.example.com and re-create the > nfs/nfs1.example.com(a)EXAMPLE.COM principal > > 3) I try to mount the same NFS share from nfs1 on nfsclient1 I get an > error: > mount.nfs: trying text-based options > 'sec=krb5p,vers=4,addr=192.168.12.172,clientaddr=192.168.12.173' > mount.nfs: mount(2): Operation not permitted > > Now I'm not an IPA or Kerberos expert but I am guessing that this > happens because the nfsclient1 still has, and uses, > the /tmp/krb5cc_machine_EXAMPLE.COM cache file? > This file would have the “old” Kerberos credentials?... > > On the NFS server in /var/log/messages this error message is displayed: > "rpc.svcgssd[5983]: ERROR: GSS-API: error in handle_nullreq: > gss_accept_sec_context(): GSS_S_FAILURE (Unspecified GSS failure. Minor > code may provide more information) - Wrong principal in request" > > On the NFS client in /var/log/messages these messages are displayed: > "creating context with server nfs(a)nfs1.example.com" > > "WARNING: Failed to create machine krb5 context with credentials cache > FILE:/tmp/krb5cc_machine_EXAMPLE.COM for server nfs1.example.com" > > "WARNING: Machine cache is prematurely expired or corrupted trying to > recreate cache for server nfs1.example.com" > > Restarting the rpcgssd daemon works, this action removes > the /tmp/krb5cc_machine_EXAMPLE.COM file and upon a mount command it is > recreated. > However restarting the rpcgssd daemon on all NFS clients every time an > NFS server is redeployed doesn't feel right. > > Anyone perhaps have an idea on what I might be doing wrong? > Or is this by design? > > > After dicussing this with Red Hat support the best way to go about this issue is to just restart the rpcgssd deamon on any nfs client that recently had a mount to the re-deployed nfs server. Restarting rpcgssd removes the /tmp/krb5cc_machine_EXAMPLE.COM file so a new one can be created. One other method would be to save various files (things like keytabs) and re-use these after deployment but that turned out to be too much effort to automate.

1 0

Re: [CentOS] CentOS Tshirt ideas
by Johnny King 12 Jan '14

12 Jan '14

How about the CentOS T-shirt wearing penguin with a red fedora cocked on this head. Padre King Sent from my Verizon Wireless 4G LTE DROID Karanbir Singh <mail-lists(a)karan.org> wrote: >hi, > >We have, like in the years past, a table at Fosdem and I'd like to get >some tshirts printed to hand out. In the past, the Linux Ninja's and >Beards ones got quite a bit of attention ( and both were not brand >spammy, which is always nice ). > >Reaching out to the mailing list for ideas on what we can do this year, >with the caveat that I need to finalise by this weekend if we are to get >anything in by Fosdem. > >thanks in advance, > >-- >Karanbir Singh >+44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh >GnuPG Key : http://www.karan.org/publickey.asc >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos

6 5

Credentials issue
by Fabrizio Di Carlo 12 Jan '14

12 Jan '14

Hello to all, I've a frustrating issue, everytime I'm trying to connect to some website (like Linkedin, VMware, CertCollection, etc etc) I have issue with credentials... Or the website didn't recognize my login (and I'm still in login page) or for example I'm logged in linkedin but I'm not able to see which visit my profile cause it ask me my credentials and when I enter I'm going again to login page. For MVA I solved updating my broswer but for other website nothing. I resetted the factory settings in Chome, disable extensions (AdBlock Plus and Privacy Fix mainly), clear my cache but without results and now the problem is really frustating. Can you help me in troubleshooting it? Fabrizio -- "The intuitive mind is a sacred gift and the rational mind is a faithful servant. We have created a society that honors the servant and has forgotten the gift." (A. Einstein) "La mente intuitiva è un dono sacro e la mente razionale è un fedele servo. Noi abbiamo creato una società che onora il servo e ha dimenticato il dono." (A. Einstein) Fabrizio Di Carlo

3 2

Linux reinstallation without rebooting? Alternative to kickstart and other such tools?
by Rafał Radecki 11 Jan '14

11 Jan '14

Hi All. I am curious if it is possible to reinstall linux distribution to centos (or another distro) if I have a remote linux server with no kvm access (i do not want to use virtualization). I know that for installation pxe, tftpboot and kickstart or a proper iso/cd and kickstart are standard options. But for such operations I would need kvm access. Are there any alternatives which do not need it? For example: I have a centos server, then I add some software, run it, point to a kickstart file available through http remotely or give network parameters and partitioning layout and the software takes care of the rest, no need for kvm access during install. Is something like that possible? :) I know that it may be seen as an "exotic" question but there are many opensource projects starting every day and maybe someone knows an interesting piece of software. Thanks! Best regards, Rafal.

5 6

LVM thinpool snapshots broken in 6.5?
by Dennis Jacobfeuerborn 11 Jan '14

11 Jan '14

Hi, I just installed a CentOS 6.5 System with the intention of using thinly provisioned snapshots. I created the volume group, a thinpool and then a logical volume. All of that works fine but when I create a snapshot "mysnap" then the snapshot volume gets displayed in the "lvs" output with the correct information but apparently no device nodes are created under /dev/mapper/ or /dev/(volumge_group_name). Any ideas what might be going on here? Regards, Dennis

1 1

EL7 mirror: "There is no installed groups file."
by Warren Young 11 Jan '14

11 Jan '14

I installed the RHEL 7 beta here to test while waiting for CentOS 7 to arrive. On noticing that yum didn't work, I decided to set up a local mirror. I rsync'd ftp://ftp.redhat.com/pub/redhat/rhel/beta/7/x86_64/os/Packages/ to a local web server here, then regenerated the repodata directory with createrepo. Now yum works fine, for the most part. "yum search foo" pulls up a plausible list of packages, "yum install bar" chases dependencies as expected, etc. Unfortunately, "yum groupinstall" isn't working, which means I have no easy way to install Gnome on my minimal EL7 installation. Apparently I need some kind of "groups file" to feed to createrepo --groupfile, but I don't know where to get one, or how to construct one. I've dug around on ftp.redhat.com and can't find anything that looks plausible. I've tried manually installing packages to build up this GNOME desktop, but despite installing dozens of things, startx still doesn't give me something usable. I know I could get a GNOME desktop by reinstalling the OS, but that would wipe out a lot of the local work I've done on this VM so far. The only reason I need X in the first place is that system-config-printer no longer runs in text mode. (I'm trying to set up a CUPS server. So yeah, X11 is a prerequisite for installing a printer now. Lovely.)

3 3

Re: [CentOS] Can we trust RedHAt encryption tools?
by James B. Byrne 10 Jan '14

10 Jan '14

On Thu, January 9, 2014 17:52, m.roth(a)5-cent.us wrote: > Robert Moskowitz wrote: >> >> On 01/09/2014 05:28 PM, John R Pierce wrote: >>> On 1/9/2014 2:20 PM, Eero Volotinen wrote: >>>> It might be easier to compromise security of commercial products as >>>> source code is not available. they seem to have succeeded in compromising >>>>> STANDARDS and ALGORITHMS, to heck with implementations. >> >> Only algorithm they compromised was an RNG that got pretty strong thumbs >> down from the real cryptographers. They have not compromised any IETF >> standard; maybe kept quite about a problem, but have not put holes in >> any. Most of our problems with TLS is implementations and backwards >> compatiblity options. > > Not quite - anyone mandated to POSIX standards are effectively mandated to > use the compromised algorithms, as I understand it. > > mark Well, regardless of my thoughts on the ethics of this situation and my opinion about those who do these sorts of things, I have continued to research this issue. I have discovered that there is a great deal of literature respecting the weakness of the RNG and PRNG processes implemented on headless hosts, in particular headless hosts that are virtualised. Given the essential nature of true random number generation to cryptographically secure key creation this represents a significant weak point on such hosts. I am not going to reiterate or summarize any of this here because you can find these discussions easily enough via Google. However, I have developed a small script to alleviate the problem to some degree based on the writings and works of others. This requires the epel repository be enabled: #!/bin/bash cat /proc/sys/kernel/random/entropy_avail yum install dieharder haveged rng-tools -q -y cat /etc/sysconfig/rngd sed -i 's:EXTRAOPTIONS="":EXTRAOPTIONS="-r /dev/urandom":' /etc/sysconfig/rngd cat /etc/sysconfig/rngd chkconfig --level 2345 haveged on ; chkconfig --level 2345 rngd on service haveged start ; service rngd start cat /proc/sys/kernel/random/entropy_avail This increased the mean amount of entropy present in /dev/random on the systems I installed these packages on from ~176 bits to ~2048 bits. I continue to look into other related matters. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Why does 'mysql' user has /bin/bash shell?
by Mihamina Rakotomandimby 10 Jan '14

10 Jan '14

Hello, Default MySQL installation on CentOS sets /bin/bash as shell. I'm on a user cleanup task where I want reduce unneeded privileges to users. What is the "mysql" user shell for? (What will happen if I change it to /bin/false or whatever would disable it's shell?) It's not only a matter of SSH (I'm aware I can AllowUsers in sshd_config for example).

5 7

Re: [CentOS] Why does 'mysql' user has /bin/bash shell?
by Warren Young 10 Jan '14

10 Jan '14

On 1/10/2014 13:09, Reindl Harald wrote: > > > i know that but the question is still WHY I don't think there is a good reason. Someone made a mistake. File a bug report upstream. I've now downloaded and examined the .src.rpm for every 6.x point release plus that for 5.10, and they all do this. On skimming the changelog section of the spec file, I can't see an entry that explains why this was done. However, I might have more success if I knew the first version where this changed -- if indeed it ever did behave differently -- but I haven't found that version yet. I don't think I'm going to spend any more time looking, though, since 6.0 takes me back 3 years. This behavior has been in there for quite a long time.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss