Discuss

discuss@lists.centos.org

34758 discussions

Re: [CentOS] TPM and secure boot
by John R Pierce 20 May '13

20 May '13

On 5/19/2013 2:06 PM, Reindl Harald wrote: > Am 19.05.2013 22:59, schrieb John R Pierce: >> >is this typically used in conjunction with disk encryption such that the >> >TPM module supplies the decryption keys? does linux have any concept >> >of signed executables, kernel, and so forth? would replacing the RPM >> >keys with keys signed by our own certificate authority such that the TPM >> >would be involved in RPM authentication be practical? > did you not read any IT news in the last year? > forget it on CentOS / RHEL currently > > even Fedora is far far away from what you think you need and the > complete chain of trust is more or less impossible on a opensource > system without make any 3rd party kernel module completly impossible > > https://fedoraproject.org/wiki/Secureboot > http://www.networkworld.com/community/blog/microsofts-secure-boot-red-hat-r… > TPM is not the same as the new secureboot UEFI BIOS stuff. this is an optional module (tamperproofed so if its unplugged, it erases) on most server motherboards, you initialize it with your OWN security keys if you want to use it, Microsoft has nothing to do with it. TPM has been around since 2006 or earlier. -- john r pierce 37N 122W somewhere on the middle of the left coast

2 1

Centos6.4 cannot reboot
by muiz 20 May '13

20 May '13

Dear all， I install new version centos 6.4 64bit and everything is ok except it cannot reboot, below is the /var/messages information: May 20 10:08:07 ravi2 smbd[1712]: failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL May 20 10:22:24 ravi2 init: tty (/dev/tty1) main process (1727) killed by TERM signal May 20 10:22:24 ravi2 init: tty (/dev/tty2) main process (1729) killed by TERM signal May 20 10:22:24 ravi2 init: tty (/dev/tty3) main process (1731) killed by TERM signal May 20 10:22:24 ravi2 init: tty (/dev/tty4) main process (1733) killed by TERM signal May 20 10:22:24 ravi2 init: tty (/dev/tty5) main process (1735) killed by TERM signal May 20 10:22:24 ravi2 init: tty (/dev/tty6) main process (1737) killed by TERM signal May 20 10:22:25 ravi2 xinetd[1618]: Exiting... May 20 10:22:26 ravi2 init: Disconnected from system bus May 20 10:22:26 ravi2 auditd[1530]: The audit daemon is exiting. May 20 10:22:26 ravi2 kernel: type=1305 audit(1369016546.436:112): audit_pid=0 old=1530 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 May 20 10:22:26 ravi2 kernel: type=1305 audit(1369016546.539:113): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 May 20 10:22:26 ravi2 kernel: Kernel logging (proc) stopped. May 20 10:22:26 ravi2 rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1546" x-info="http://www.rsyslog.com"] exiting on signal 15. (No message after this line until I click the Reset button) Do you know why? Muiz

1 0

TPM and secure boot
by John R Pierce 19 May '13

19 May '13

has anyone implemented any sort of 'secure boot' using TPM 1.2 modules on the server boards using CentOS 6.x ? I'm not finding much concrete stuff on how to setup and manage a system like this, but I've been asked to research it for a security application internally at my job. our primary application for the TPM is for client authentication certificates in an SSL application (the machine with the TPM is an unmanned embedded client, that accesses webservices on a remote server which needs to authenticate this client). We've already done similar client authentication using USB Tokens, but would like to use TPM for this in the future. I think the client authentication part is pretty straight forward, using Trousers and so forth and PKCS#11 to access the keys. Once we get the client authentication side working, we'd like to also secure the OS itself to prevent tampering, presumably using trusted grub and such? is this typically used in conjunction with disk encryption such that the TPM module supplies the decryption keys? does linux have any concept of signed executables, kernel, and so forth? would replacing the RPM keys with keys signed by our own certificate authority such that the TPM would be involved in RPM authentication be practical? (yes, I know, this would mandate using a private yum repository, and building/signing all our own system components). I realize this will greatly complicate system management, security is always a tightrope act. -- john r pierce 37N 122W somewhere on the middle of the left coast

1 0

OpenStack Grizzly on CentOS-6.4
by Florian La Roche 19 May '13

19 May '13

Hello, setting up the newest OpenStack Grizzly release seems to be really straight-forward. Red Hat has put together all support for this at http://openstack.redhat.com/. I've documented installation, post-install config tweaks, how to add a few ready-to-use guest images and links to a few gotchas on the following wiki page: http://jur-linux.org/testwiki/index.php/CloudLinux/OpenStack Most items can be setup on the command line this way, no need to e.g. use the web interface to upload guest images. best regards, Florian La Roche

2 5

[Fwd: GThread-ERROR **: GThread system may only be initialized once.]
by James B. Byrne 18 May '13

18 May '13

I posted this to the Jitsi users mailing list on Thursday last and have received no replies. Does anyone here have any idea of what is causing this and how to fix it? One other bit of information. When I first installed Jitsi it initially worked for a non-privileged user as I ran it from the gnome menu of my login account. However, at some point it seemed get 'confused' and hung. Since then I have been unable to get it to run as a non-privileged user. I have removed and reinstalled it. I have also rebooted the host. Nothing changes its current behaviour. -------------------------- Original Message -------------------------- Subject: GThread-ERROR **: GThread system may only be initialized once. From: "James B. Byrne" <byrnejb(a)harte-lyne.ca> Date: Thu, May 16, 2013 16:54 To: users(a)jitsi.org ---------------------------------------------------------------------- I installed jitsi-2.2 on a CentOS-6.4 x86_64 host. When I run it as a non-privileged user then I see this error: $ jitsi ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.rear ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.center_lfe ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.side ALSA lib pcm_dmix.c:957:(snd_pcm_dmix_open) The dmix plugin supports only playback stream GThread-ERROR **: GThread system may only be initialized once. aborting... Aborted and it dies. If instead I run it as a privileged user then I see this: $ sudo jitsi [sudo] password for byrnejb: ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.rear ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.center_lfe ALSA lib pcm.c:2209:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.side ALSA lib pcm_dmix.c:957:(snd_pcm_dmix_open) The dmix plugin supports only playback stream java.lang.UnsatisfiedLinkError: /usr/share/jitsi/lib/native/libglobalshortcut.so: /usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.15' not found (required by /usr/share/jitsi/lib/native/libglobalshortcut.so) at java.lang.ClassLoader$NativeLibrary.load(Native Method) at java.lang.ClassLoader.loadLibrary1(ClassLoader.java:1939) at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1864) at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1854) at java.lang.Runtime.loadLibrary0(Runtime.java:845) at java.lang.System.loadLibrary(System.java:1084) at net.java.sip.communicator.impl.globalshortcut.NativeKeyboardHook.<clinit>(NativeKeyboardHook.java:254) at net.java.sip.communicator.impl.globalshortcut.GlobalShortcutServiceImpl.<init>(GlobalShortcutServiceImpl.java:56) at net.java.sip.communicator.impl.globalshortcut.GlobalShortcutActivator.start(GlobalShortcutActivator.java:104) at org.apache.felix.framework.util.SecureAction.startActivator(SecureAction.java:629) at org.apache.felix.framework.Felix.activateBundle(Felix.java:1904) at org.apache.felix.framework.Felix.startBundle(Felix.java:1822) at org.apache.felix.framework.Felix.setActiveStartLevel(Felix.java:1192) at org.apache.felix.framework.StartLevelImpl.run(StartLevelImpl.java:266) at java.lang.Thread.run(Thread.java:722) And it works. What is going on and how do I fix it? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3 -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

F18: Create a USB install of CentOS 6 from iso
by Mihamina Rakotomandimby 18 May '13

18 May '13

Hi all, On a F18, I installed livecd-tools-18.15-1 I downloaded CenOS6.x minimal .iso and with livecd-iso-to-disk the resulting USB is never bootable: the computer doesnt boot on it. Tested on many computers. The fact is I succeded to install CentOS on a Netbook (no CD/DVD tray), but I dont remember how I invoked livecd-iso-to-disk. I tried with many combinations (/dev/sdc is the USB pendrive): 1°) $ sudo livecd-iso-to-disk --format --force <ISO> /dev/sdc 2°) $ sudo livecd-iso-to-disk --format --force <ISO> /dev/sdc1 3°) - Format with VFAT on partiion #1 then $ sudo livecd-iso-to-disk <ISO> /dev/sdc1 4°) - Format with Ext on partiion #1 then $ sudo livecd-iso-to-disk <ISO> /dev/sdc1 ... N°) I dont remember what I tried, but it was many, mostly tried with CentOS 6.2 Please, if someone has a F18 + an USB drive: would you test and see if you succed? If you ever succed, how did you? -- RMA.

5 5

device in use after a reboot
by sebastian 17 May '13

17 May '13

Hello, I have a server with an 17tb scsi-storage. In past, the storage has a "jfs"-filesystem. Now i want to create a "ext4"-filesystem. I have update the e2fsprogs from 1.41 to 1.42 (16tb limit >1.41). Now I have an 17tb-storage as /dev/sda1 with ext4. I can mount this device as /home/ (/etc/fstab "/dev/sda1 /home/ ext4 defaults 1 2". Now I start a e2fschk /dev/sda1 (umounted). No error-messages are in the screen. If I now reboot the server, the server does not started: <---// Checking filesystems /dev/md2: clean, ..... /dev/md0: clean, ..... /dev/sda1 is in use. e2fsck: Cannot continue, aborting. *** An error occurred during the file system check. *** Dropping you to a shell; the system will reboot *** when you leave the shell. Give root password for maintenance (or type Control-D to continue): //---> I think thats can be a problem with the e2fsprogs 1.42, now i reinstall the server with the default e2fsprogs 1.41 from CentOS 6.4 and create only a 16tb /dev/sda1 partition with ext4. But if i start a "e2fschk /dev/sda1" and reboot the server, i have the same message in the boot-screen and the server does not boot. Why the system thinks that the device still be in use? How can i change this? Thanks Sebastian

4 6

python-pandas 10
by m.roth＠5-cent.us 17 May '13

17 May '13

Anyone familiar with building python modules? We've got a user who needs pandas 10 - he says that there was a memory handling issue that kills him in the lower releases. My counterpart (the humanoid one <g>) says that it seems to want to build against python 2.7, rather than the CentOS 2.6.6. Plus, of course, there are the dependencies.... 1. Are there any tarball installs? 2. Alternatively, are there any src rpms? I haven't found any so far.... Thanks in advance. mark

1 0

CentOS-announce Digest, Vol 99, Issue 8
by centos-announce-request＠centos.org 17 May '13

17 May '13

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2013:0831 Moderate CentOS 6 libvirt Update (Johnny Hughes) 2. CESA-2013:0830 Important CentOS 6 kernel Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 17 May 2013 00:35:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0831 Moderate CentOS 6 libvirt Update To: centos-announce(a)centos.org Message-ID: <20130517003537.GA14466(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0831 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0831.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5a32ff9a43563fa625339e17c72f9d0030c37739795c8dbd7214855357a1df31 libvirt-0.10.2-18.el6_4.5.i686.rpm b0aaeb027d374f4efda4c8e63572ef5ce541de8d8a783886c51bdea8c1c81e93 libvirt-client-0.10.2-18.el6_4.5.i686.rpm ff21809b7f8094694dbd1f56ddc528865779bb0d5ec4d92f2aa988d2b66ec09f libvirt-devel-0.10.2-18.el6_4.5.i686.rpm a5a19eb3740fa9e6c094763aa835e6f7c2a8bc7a5011863bf02340827983e803 libvirt-python-0.10.2-18.el6_4.5.i686.rpm x86_64: 1f5989987a4f696420ca59034ef7468faf42ff6d44a2b821a0138c1f038f35a3 libvirt-0.10.2-18.el6_4.5.x86_64.rpm b0aaeb027d374f4efda4c8e63572ef5ce541de8d8a783886c51bdea8c1c81e93 libvirt-client-0.10.2-18.el6_4.5.i686.rpm 7bfae1084c8cc01f4e328d9acd1c93c81949c545463b72fbec518fdb5ca06678 libvirt-client-0.10.2-18.el6_4.5.x86_64.rpm ff21809b7f8094694dbd1f56ddc528865779bb0d5ec4d92f2aa988d2b66ec09f libvirt-devel-0.10.2-18.el6_4.5.i686.rpm f4abd67b2614301da6c16cc0ffb69fd611bff1369faa694d9314d13769e3ce07 libvirt-devel-0.10.2-18.el6_4.5.x86_64.rpm 25e82884d275305505133b373b1d42cfbfd0ce1e6b27daeba786ea8b97edcc62 libvirt-lock-sanlock-0.10.2-18.el6_4.5.x86_64.rpm 573b22172850a5da5e96ffe8fe72db605cfa1e7918d9f07ac92d606497b98d3f libvirt-python-0.10.2-18.el6_4.5.x86_64.rpm Source: ae8026063f273636fcab9947c0711be9c53ea6c2e73f574f2408025e79cf641d libvirt-0.10.2-18.el6_4.5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Fri, 17 May 2013 00:36:04 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0830 Important CentOS 6 kernel Update To: centos-announce(a)centos.org Message-ID: <20130517003604.GA14607(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0830 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0830.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: d6c94ff701e9d6772f164e87df48073eb7fc3ccbc5ec23bf27d59d084066b912 kernel-2.6.32-358.6.2.el6.i686.rpm 68728b5f77c56b745477478fe9decc6245a9015cbf1d9a2c54c868606be9d010 kernel-debug-2.6.32-358.6.2.el6.i686.rpm c862327110fa5efb09031a4618347d0a78d117c1482bf69c50423464e7d351d7 kernel-debug-devel-2.6.32-358.6.2.el6.i686.rpm 60d3d223fd5185bd7f9ee24bb8492dfef3cfe07bb6751542f240c351855c11d8 kernel-devel-2.6.32-358.6.2.el6.i686.rpm e1fc1dd9210cda92fd773c05a796008ed481b61d3e99bdef601e87c1d0451ef2 kernel-doc-2.6.32-358.6.2.el6.noarch.rpm 59f2d900bce7aeb443f72f00b9a8febed3a6e53f05e7668ef8cb42df5a03ac7f kernel-firmware-2.6.32-358.6.2.el6.noarch.rpm e4b4d7e137ff7ee822cacc67d4e01bdbbdd0e87ce8688564274f1a2df361e419 kernel-headers-2.6.32-358.6.2.el6.i686.rpm c30d700ed6271a2d88d261c5002b1185beeeffb10cbc44c740d89f19e9b37231 perf-2.6.32-358.6.2.el6.i686.rpm cf4da5b6bac241b0836ba8330845d04a2d498982e1f294c3c403d962930f9fc7 python-perf-2.6.32-358.6.2.el6.i686.rpm x86_64: edc9ee434ce217fcca48ccfc6fa6a0378bd39f531da1ca3a0be7fef8f0373ffb kernel-2.6.32-358.6.2.el6.x86_64.rpm 355e8fadb8450359940a9008ac7700a3aebf8984bd7f1516fb7f68b6f1c33a04 kernel-debug-2.6.32-358.6.2.el6.x86_64.rpm d9c0ccfc888ac4a922ca8b59418b75c588bddad145e030b3dd31924db3e6d576 kernel-debug-devel-2.6.32-358.6.2.el6.x86_64.rpm a97cff3f2aa6d5169cca4464eeea5d0efd14c9d57fd65175a5ce91450f1d1448 kernel-devel-2.6.32-358.6.2.el6.x86_64.rpm e1fc1dd9210cda92fd773c05a796008ed481b61d3e99bdef601e87c1d0451ef2 kernel-doc-2.6.32-358.6.2.el6.noarch.rpm 59f2d900bce7aeb443f72f00b9a8febed3a6e53f05e7668ef8cb42df5a03ac7f kernel-firmware-2.6.32-358.6.2.el6.noarch.rpm a6d5cba3af49028f5dab732ce29d618b49e4d9191e948febe8dfca6b83d5d821 kernel-headers-2.6.32-358.6.2.el6.x86_64.rpm 3ce8c55f629e5e40033c5b34ab22eea770124df86050de7920fb4e7ac02dd4d6 perf-2.6.32-358.6.2.el6.x86_64.rpm 94965c8a82fc3330fa572bff243ff20513446d4a2daabc8314f8f5e69b3e7d4b python-perf-2.6.32-358.6.2.el6.x86_64.rpm Source: c36c02aa994327cf9d0724117240ddb5b4b89073f19b2ed83f78336c98552310 kernel-2.6.32-358.6.2.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 99, Issue 8 **********************************************

1 0

CVE-2013-2094 and CentOS 6.x
by David C. Miller 17 May '13

17 May '13

For those who don't know yet here is the redhat bugzilla on this exploit. https://bugzilla.redhat.com/show_bug.cgi?id=962792 Does anyone know if CentOS 6 have the debug packages available to apply the temp patch for this listed in the bugzilla link? David.

4 4

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss