Discuss

discuss@lists.centos.org

34753 discussions

Don't understand how to re-partition this setup or why it was made like this
by Yves S. Garret 01 Apr '13

01 Apr '13

Hello, I did df -h on my CentOS 6.4 machine. $ df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_ysg-lv_root 47G 8.8G 36G 20% / tmpfs 948M 372K 947M 1% /dev/shm /dev/sda1 485M 62M 398M 14% /boot /dev/mapper/vg_ysg-lv_home 4.6G 2.7G 1.7G 63% /home What I don't understand is why is /home so tiny and how can I re-partition this without having to nuke and rebuild my machine?

5 5

Re: [CentOS] DNS forwarding vs recursion
by Les Mikesell 01 Apr '13

01 Apr '13

On Mon, Apr 1, 2013 at 2:54 PM, Michael H. Warfield <mhw(a)wittsend.com> wrote: >> > AFA how BIND should be shipped... Last time I looked (just a couple of > days ago) BIND ships in a fairly secure manner (local caching resolver > listening on localhost only) and the default IP tables blocks DNS > queries and response that are not on-session. The OP mentioned that his > name server was an "authoritative" name server (it was servicing a zone > for which it was configured). That's NOT a shipped configuration. You > have to configure it for a zone. Sooo... We are NOT talking about OOB > (Out Of the Box) configurations here at all. Someone had to > configuration it this way, post installation. So everyone has to add your own zones. I don't see how that leads to the conclusion that it is shipped with appropriate defaults to force/encourage separation of authoritative/recursive instances. >> > I don't think that's the answer either. >> > Establishing best practices and discouraging people from misconfiguring >> > applications would seem to be a better option and best current practices >> > now were not always considered best practices 20 years ago. It's a >> > challenge. It's a BIG challenge in my business. >> >> OK, but of course it is a challenge if you advocate using tools that >> most people don't have or understand - or don't work universally. > > Don't have: Disagree - most have. Where? I'd say it is much more common for firewalls to be separate entities that don't know much about routing. > Don't understand: I'll grant you that. They don't understand the tools, > they don't understand the problem, and they don't understand best > current practices. You got me on that one. There in lies the problem > and the challenge. Exactly. If you can't clearly define the problem or a required topology you can't expect people to re-arrange things. >> > Asymmetric >> > routes (aka triangular routing) should be severely discourage and is >> > generally considered a configuration error unless it's heavily >> > justified. > >> I don't think BGP shares this opinion. > > I'm not sure I follow you on that statement. BGP is a protocol and I've > done some coding on that (I'm the author of the MD5 signature code in > bgpd of the Quagga suite). The crowd on NANOG (North American Network > Operators Group) generally frowns upon asymmetric routing as something > that is occasionally necessary and unavoidable but not admitted to > loudly in public, much akin to an aunt that like to sit in the corner of > a room at a party and frequently farts loudly. Are you saying that something in BGP cares about anything except the best forward path seen at the moment? Or that as this changes dynamically it even tries to keep the reverse path symmetrical? > Asymmetric routing also breaks > stateful firewalls badly if they are in the way... Sure. Do you want reliability or control? Pick one. >> And I'd speculate that the >> simplicity of IP routing only needing to care about the forward route >> direction one hop at a time is the main reason that it became the >> network of choice. Well, that and a taxpayer funded directory service >> from the start. > > This was very true back then but proved to be as problematical as > spoofing attacks abusing the DNS resolvers. Both are rooted in the > early ages of the Internet. Fascinating that you bring up that point. Packets are packets - the concepts of widely distributed, widely available transports aren't going to change, we just do it faster now. > Counter point is in the policy routing present in modern systems and > that IPsec in particular is a policy oriented VPN where triangular / > asymmetric routing frequently break. Hence the continuing popularity of ssl-based VPNs that work better under real-world conditions. OpenVPN, Juniper's, etc. > I would concur with that. I think that's part and parcel of > establishing your nominal security perimeters anyways. Maybe - as organizations grow, merge, relocate, etc. it becomes hard to deal with perimeters or to assume that all the bad guys are outside. >> So you envision an internet where it is impossible to reach a >> recursive resolver outside of your own organization's control? > > Not "impossible" and not under "your own organizations control". > Certainly, ISPs provide recursers for their clients. Yeah, but they mostly do that so they can redirect failed lookups to their own search engines or link farms and show some ads. As though web browsers were the only clients for DNS. > But... What is > the purpose of an indeterminant anonymous client connecting to your > recursive server and making arbitrary queries? Use case: You provide a subscription service to institutions that like strict outbound firewalling. Your servers are located in a few contiguous ranges and you work with their firewall admins to permit access. Then you find out that the desktop clients in question don't have access to full internet DNS. > Yes, there are some of > us who are involved in Internet infrastructure and maintenance for which > some of that may be useful for diagnostic purposes but, to allow anyone > for any reason to anywhere? That's just inviting abuse. Sure, but there's not a reasonable way to distinguish a customer from anyone else at the time they need DNS. > Counter point is that some ISPs (AT&T in particular) have begun blocking > unrestrained DNS as much as they block unrestrained SMTP because of some > of the abuse that has taken place. Or because they make money when they redirect the errors... > Whatever your opinion is on THAT > debate (and I am decidedly NOT on their side, but I do agree with > organizations who do it) it's a fact and it is happening. They don't > even allow their clients to run their own name servers (unless you are a > "business client" and have an agreement to that effect) and force most > of their clients to use their name servers. And then they can charge more for the "business class" where they don't block stuff. -- Les Mikesell lesmikesell(a)gmail.com

1 0

DNS forwarding vs recursion
by John R Pierce 01 Apr '13

01 Apr '13

I have 2 CentOS servers that are both authoritative DNS for several domains and local resolvers. As configured, they are publicly visible resolvers, which I've known for awhile is not a good thing. whats the appropriate way of configuring the bind on CentOS 5.current to not allow recursion on queries from the public side, but still allow recursion locally? is it as simple as adding allow-recursion{} with the appropriate private subnets and localhost to named.conf ? -- john r pierce 37N 122W somewhere on the middle of the left coast

6 8

Re: [CentOS] DNS forwarding vs recursion
by Les Mikesell 01 Apr '13

01 Apr '13

On Mon, Apr 1, 2013 at 1:30 PM, Michael H. Warfield <mhw(a)wittsend.com> wrote: > > Actually, it's pretty easy with netfilter / iptables. Other firewalls > like pf filter on *BSD an proprietary work similar. If you know your > inside networks you merely add a rule to block incoming packets on your > external interface with source addresses that should be inside your > firewall. What does 'inside' mean to TCP/IP? Are you saying it can't work if you are all public? Or if you expect to use redundant public routing among all of your systems? > Do > we all drop BIND in favor of nscd for our authoritative name servers and > dnsmasq for our cachers? Well, first you have to come out and say that recursive resolvers are too fragile to survive in public. Or have too much potential for collateral damage and must be outlawed. Maybe define a way your network topology has to be arranged. Then move on to how BIND should be shipped. > I don't think that's the answer either. > Establishing best practices and discouraging people from misconfiguring > applications would seem to be a better option and best current practices > now were not always considered best practices 20 years ago. It's a > challenge. It's a BIG challenge in my business. OK, but of course it is a challenge if you advocate using tools that most people don't have or understand - or don't work universally. > Asymmetric > routes (aka triangular routing) should be severely discourage and is > generally considered a configuration error unless it's heavily > justified. I don't think BGP shares this opinion. And I'd speculate that the simplicity of IP routing only needing to care about the forward route direction one hop at a time is the main reason that it became the network of choice. Well, that and a taxpayer funded directory service from the start. > They're highly unreliable to begin with (you can forget > about getting through stateful firewalls). Where it can be justified, > then static rules allow it will cover things in ways that attackers can > not exploit. So what you need to establish first is the location of the firewalls in respect to recursive servers. > Perhaps. But I'm not quite so sure where the bad design is or if it's > merely a confluence of extremely powerful tools, like BIND, that can be > used in a multitude of ways. I might agree with you more if the "bad > design" you are referring to is the overall network design, > architecture, and layout. I've seen plenty of well designed tools > misused in badly designed networks. So you envision an internet where it is impossible to reach a recursive resolver outside of your own organization's control? -- Les Mikesell lesmikesell(a)gmail.com

1 0

nagios 3.5 for rpm repository for centos 5
by Eero Volotinen 31 Mar '13

31 Mar '13

Hi List, Is there any good rpm repository that provides nagios 3.5 for centos 5? br, -- Eero

2 1

ext4 deadlock issue
by Joakim Ziegler 30 Mar '13

30 Mar '13

I'm having an occasional problem with a box. It's a Supermicro 16-core Xeon, running CentOS 6.3 with kernel 2.6.32-279.el6.x86_64, 96 gigs of RAM, and an Areca 1882ix-24 RAID controller with 24 disks, 23 in RAID6 plus a hot spare. The RAID is divided into 3 partitions, two of 25 TB plus one for the rest. Lately, I've noticed sporadic hangs on writing to the RAID, which "resolve" themselves with the following message in dmesg: INFO: task jbd2/sdb2-8:3607 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. jbd2/sdb2-8 D 000000000000000a 0 3607 2 0x00000080 ffff881055d03d20 0000000000000046 ffff881055d03ca0 ffffffff811ada77 ffff8810552e2400 ffff88109c6566e8 0000000000002f38 ffff8810546e1540 ffff8810546e1af8 ffff881055d03fd8 000000000000fb88 ffff8810546e1af8 Call Trace: [<ffffffff811ada77>] ? __set_page_dirty+0x87/0xf0 [<ffffffff810923be>] ? prepare_to_wait+0x4e/0x80 [<ffffffffa01e881f>] jbd2_journal_commit_transaction+0x19f/0x14b0 [jbd2] [<ffffffff810096f0>] ? __switch_to+0xd0/0x320 [<ffffffff8107e00c>] ? lock_timer_base+0x3c/0x70 [<ffffffff810920d0>] ? autoremove_wake_function+0x0/0x40 [<ffffffffa01eef78>] kjournald2+0xb8/0x220 [jbd2] [<ffffffff810920d0>] ? autoremove_wake_function+0x0/0x40 [<ffffffffa01eeec0>] ? kjournald2+0x0/0x220 [jbd2] [<ffffffff81091d66>] kthread+0x96/0xa0 [<ffffffff8100c14a>] child_rip+0xa/0x20 [<ffffffff81091cd0>] ? kthread+0x0/0xa0 [<ffffffff8100c140>] ? child_rip+0x0/0x20 I get two of these messages in close succession, then things proceed normally. It doesn't happen often, and only under load. I'm uncertain, but think it might just happen once per boot, once it's happened, it doesn't repeat until rebooting. I'm not sure of this, however. Things otherwise seem fine, other logs, RAID controller event logs, RAID controller physical disk status and health reports are normal, etc. After getting this error once, attempting to re-write the exact same file on the filesystem gets no errors and works normally, so I doubt it's a physical thing with the drives anyway. Anyone seen anything like this before? It's not very frequent, but it's very annoying. -- Joakim Ziegler - Supervisor de postproducción - Terminal joakim(a)terminalmx.com - 044 55 2971 8514 - 5264 0864

2 7

cronie: /usr/bin/run-parts
by Max Pyziur 30 Mar '13

30 Mar '13

Greetings, Per the subject line, what controls the time of the running of scripts located in the /etc/cron.[daily|weekly|hourly] directories? Specifically with CentOS 6.* I've noticed that scripts in /etc/cron.daily and /etc/cron.weekly run at different times of the day, or on different days. In my experience on other rpm-based distributions, cron daily and weekly scripts run at 4am; those that are run weekly run at 4am on Sunday morning. Much thanks in advance, Max Pyziur pyz(a)brama.com

3 3

iptables settings for X11 forwarding in CentOS 6.2
by Pat Haley 30 Mar '13

30 Mar '13

Hi, We recently installed CentOS 6.2 on our cluster. During the installation/debugging of various secondary software, we had disabled iptables. When we re-enabled them, we found that the front-end would no longer X11 forward (although it does so when the iptables are off). What do we need to set in the iptables to permit X11 forwarding? Currently we're using iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix "Dropped by firewall: " iptables -A INPUT -i eth1 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6001 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6002 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6003 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6004 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6005 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp --dport 177 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp --dport 6000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Pat Haley Email: phaley(a)mit.edu Center for Ocean Engineering Phone: (617) 253-6824 Dept. of Mechanical Engineering Fax: (617) 253-8125 MIT, Room 5-213 http://web.mit.edu/phaley/www/ 77 Massachusetts Avenue Cambridge, MA 02139-4301

4 5

Re: [CentOS] a-gnome-oyences
by m.roth＠5-cent.us 30 Mar '13

30 Mar '13

Gordon Messmer wrote: > On 03/28/2013 07:00 AM, m.roth(a)5-cent.us wrote: >> Most of my users are on kde, as am I (I really don't like gnome). I've got one on gnome, though, CentOS 6.4, and I have a problem: I have to start >> an agent running ->on login<-, so that the same one is in the environment >> of every term window he opens. > That would be the normal configuration. >> In kde, no problem, I modify /etc/X11/xinit/xinitrc-common so that code >> in there calls our (newer) ssh-agent instead of the stock one. >> (And, of course, it's killed on logout, and there's only one running, >> not one every time that never go away unless killed manually.) > You're already making things more complicated than they should be. The ssh agent is supposed to be the parent process of your login session. That is, your login session should be: > ssh-agent startkde > or: > ssh-agent gnome-session Well, no. If you look at the stock /etc/X11/xinit/xinitrc-common. at the bottom of the file, that's where it sets this stuff. As I said, we *have* to use the compiled from more recent versions of ssh, because the current stock version doesn't support US gov't PIV cards for authentication. And doing this, I only get one agent, and it gets killed automagically when I log out, as expected. > With GDM, you'd modify the session file in /usr/share/xsessions. You'd a) /usr/share? Why are system-wide configuration files NOT IN /etc? b) UTF-8? What freakin' morons decided it shouldn't be plain ascii, like everything else? #$%^&*$%^&*($%^&*($%^&*(%^&*()_+ No matter what I open it in, it keeps showing up with garbage chars. So I look at /etc/gdm, as I said, and I see it sourcing /etc/X11/xinit/xinitrc-common, where I've got it set to reference our agent. Then I go further down, and see <snip>*************** case "$1" in failsafe) exec -l $SHELL -c "xterm -geometry 80x24-0-0" ;; gnome|gnome-session) # lack of SSH_AGENT is intentional, see #441123. though # the whole thing should really happen in xinitrc.d anyway. exec -l $SHELL -c gnome-session exec /bin/sh -c "exec -l $SHELL -c \"gnome-session\"" ;; kde|kde1|kde2) exec $CK_XINIT_SESSION $SSH_AGENT /bin/sh -c "exec -l $SHELL -c \"startkde\"" <snip>*************** Pause for some googling, ah, here's my answer that's less ugly, from <https://ask.fedoraproject.org/question/10225/is-it-possible-to-replace-gnom…>, which is to create /etc/X11/xinit/Xclients.d/Xclients.gnome-session.sh, whose contents are #!/bin/sh exec -l $SHELL -c "$SSH_AGENT gnome-session" > prefix the "Exec" line with "ssh-agent ", and be done. As those files would be <snip> > Xclients, which runs your session. You shouldn't need to change > anything at all, unless your newer ssh-agent is at a different path. > So, in that case, the only thing you should need to change is to > run gnome-session-properties, and uncheck "SSH Key Agent". First, of course it's in a different path. Second, no, I do *not* want to run a gnome thing - I need to a) do this from a command line, and b) fix it so it can be built that way, or updated. This isn't my machine, I've got dozens of users, and need to administer this remotely, without having to make them stop what they're doing so I can screw with this. Ok, I followed the guy's instructions, but a) I'm afraid to let the keyring not run, and b) I get the one agent running... but gnome-keyring-agent runs *after* it, and so overwrites the environment variables, which means this is the final trick I need to resolve. As a first question on that, in that created file, /etc/X11/xinit/Xclients.d/Xclients.gnome-session.sh, I've got the one line; however, in /etc/gdn/Xession (really /etc/X11/Xsession), to start gnome, it has, as you can see above, *two* execs. Any idea why, and any idea where I can start the agent so that the environment variables are *not* overwritten by gnome-keyring-agent. mark

2 3

new version of wireshark
by Steve Clark 29 Mar '13

29 Mar '13

Hello, Has anyone seen an el6 rpm of wireshark-1.8.6 Thanks, -- Stephen Clark *NetWolves* Director of Technology Phone: 813-579-3200 Fax: 813-882-0209 Email: steve.clark(a)netwolves.com http://www.netwolves.com

3 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss