- Discuss - lists.centos.org

Posting check
by Robert Heller 27 Apr '18

27 Apr '18

I am wondering if I am able to post to the CentOS list. -- Robert Heller -- 978-544-6933 Deepwoods Software -- Custom Software Services http://www.deepsoft.com/ -- Linux Administration Services heller(a)deepsoft.com -- Webhosting Services

2 1

Postfix config problem w/ tls
by Chuck Campbell 26 Apr '18

26 Apr '18

I have followed the guides on setting up postfix relay to my account at network solutions. I added these to main.cf: inet_interfaces = localhost relayhost = [mail.mydomain.com]:587 smtp_sasl_auth_enable = yes smtp_sasl_security_options = noanonymous smtp_sasl_password_maps = hash:/etc/postfix/sasl_password smtp_use_tls = yes smtp_tls_CAfile = /etc/pki/tls/certs/sendmail.pem The username and password are correct, and all these options work fine from thunderbird on a windows box in my local network. I get no errors on postfix restart, but when I try to send an email from the centos box, I get this: Apr 26 17:00:33 host postfix/smtp[10627]: C9C1D80075: to=<campbell(a)somedomain.com>, relay=mail.mydomain.com[xxx.xxx.xxx.xxx]:587, delay=0.87, delays=0.08/0.02/0.72/0.04, dsn=5.0.0, status=bounced (host mail.mydomain.com[xxx.xxx.xxx.xxx] said: 503 you must authenticate first (#5.5.1) (in reply to MAIL FROM command)) Why is tls not authenticating? Under centos 5 I used sendmail, and it all worked just fine. -chuck -- ACCEL Services, Inc.| Specialists in Gravity, Magnetics | (713)993-0671 ph. | and Integrated Interpretation | (713)993-0608 fax 448 W. 19th St. #325| Since 1992 | (713)306-5794 cell Houston, TX, 77008 | Chuck Campbell | campbell(a)accelinc.com | President & Senior Geoscientist | "Integration means more than having all the maps at the same scale!"

1 1

[OFF-TOPIC] Reminder to tighten ALL types of security
by Always Learning 25 Apr '18

25 Apr '18

This posting is off-topic because it is not about Centos. Please refrain from replying to the list as that will generate further off-topic traffic inevitably irritating subscribers. On the balance of probabilities, I think everyone will benefit from reading at least the first 6 pages of a 19 pages English criminal sentencing statement about a child, in England, successfully breaking into the home and business computer systems of top USA CIA, FBI and Homeland Security entities. It is shocking and disquieting. Security is more than a firewall and SELINUX - it is procedures too. When the CIA director is easily hacked and his family pestered, how safe are you and your systems ? In the Crown Court at Leicester (England) The Queen versus Kane Gamble Sentenced at the Central Criminal Court (Old Bailey, London) 20 April 2018 Sentencing remarks of Mr Justice Haddon-Cave https://www.judiciary.gov.uk/judgments/r-v-kane-gamble-sentencing-remarks-o… https://www.judiciary.gov.uk/wp-content/uploads/2018/04/r-v-gamble-sentenci… P. -- Regards, Paul. England, EU. England's place is in the European Union.

1 0

Vmware - Slightly off topic
by Jerry Geis 25 Apr '18

25 Apr '18

Hi All, What is the correct way to provide a CentOS 7 - WMware image for ESX ? As an amateur to VMware - I thought - great I can get VMplayer and ESX should be able to import my image... Wrong... I even went through the trouble of "converting" to VMWare workstation and thinking ESX could import that - Apparently still Wrong... I cannot for the life of me understand how one product family is so incompatible with itself. But that is another story. I just want to be able to provide a pre-built image with CentOS 7 and my other programs on a bootable VMware image that is easily imported into any VMware platform - Workstation, ESX or other. How is that accomplished ? Thanks for your thoughts and experience. Jerry

9 8

Down C6 ALL without torrent ?
by Always Learning 25 Apr '18

25 Apr '18

Hi, I have a machine with a BIOS that does not permit DVD installation. It accepts everything else including some old superseded media types. Is it possible to download C6 combined parts 1 and 2 not using Torrent ? I have an aversion to using anything that comes from unknown sources, as used by Torrent. Thank you. -- Regards, Paul. England, EU. England's place is in the European Union.

11 21

Re: [CentOS] BUG: soft lockup - CPU#0 stuck for 36s! [swapper/0:0]
by KM 25 Apr '18

25 Apr '18

All,This happens on all of our CentOS 7 VMs. but as stated in the email trail, the file softlockup_thresh does not exist. Should it be added? What is the best way to get rid of this behavior. Thanks in advance and sorry if I missed something along the way.KM From: correomm <correomm(a)gmail.com> To: CentOS mailing list <centos(a)centos.org> Sent: Thursday, August 18, 2016 1:55 PM Subject: Re: [CentOS] BUG: soft lockup - CPU#0 stuck for 36s! [swapper/0:0] Yes, I tried it, but does not exists: vmguest # cat /proc/sys/kernel/softlockup_thresh cat: /proc/sys/kernel/softlockup_thresh: No such file or directory On Thu, Aug 18, 2016 at 2:06 PM, Carlos A. Carnero Delgado < carloscarnero(a)gmail.com> wrote: > 2016-08-18 12:39 GMT-04:00 correomm <correomm(a)gmail.com>: > > > This bug is reported only on the VM's with CentOS 7 running on on VMware > > ESXi 5.1. > > The vSphere performance graph shows high CPU consume and disk activity > only > > on VM's with CentOS 7. Sometimes I can not connect remotely with ssh > > (timeout error). > > > > I'm also seeing those errors in several servers, running under 5.5. > Currently investigating if this > <https://kb.vmware.com/selfservice/microsites/search. > do?language=en_US&cmd=displayKC&externalId=1009996> > has anything to do (the resource overcommit bit). > > HTH, > Carlos. > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos > _______________________________________________ CentOS mailing list CentOS(a)centos.org https://lists.centos.org/mailman/listinfo/centos | | Virus-free. www.avg.com |

5 6

VGA connectors fail to work with i915 & 3.10.0-693.21.1.el7.x86_64 kernel
by Gregory P. Ennis 25 Apr '18

25 Apr '18

Everyone, A while back I reported problems with the Intell i915 video driver in an ASUS mother board. I never found a solution, but did find a work around. It is apparent that when the VGA cable is connected during boot time the screen becomes blank and does not allow a login, but if the vga cable is disconnected and the DVI connector on the video screen and motherboard are used everything works as expected. I am posting this so that if others have the same problem they can easily bypass the problem with a DVI cable, and probably an HDMI cable, but I was not able to test the HDMI. Greg Ennis

1 1

Will RHSA-2018:0980 hit Centos repos soon?
by Sean 24 Apr '18

24 Apr '18

Hi all, RH published the advisory 2 weeks ago, according to https://access.redhat.com/errata/RHSA-2018:0980. The main repo does not appear to have the packages noted yet - http://mirror.centos.org/centos/7/updates/x86_64/Packages/ We've been waiting on a few of these bugs to be fixed for some time. I don't mean to be impatient, just looking for an ETA. Thanks for all the great work the team does!

2 1

Libreswan IPSec Protected GRE Tunnel & firewall-cmd
by Adam Tauno Williams 24 Apr '18

24 Apr '18

I am attempting to setup an IPSec protected GRE tunnel with a Cisco router. I believe the IPSec association is up, however I cannot move traffic over the tunnel. It is not clear how to integrate the tunnel interface (gre1) with firewall-cmd; adding the interface to trusted does not appear to 'stick'. [root@aqueduct ~]# firewall-cmd --add-interface=gre1 --zone=trusted The interface is under control of NetworkManager and already bound to 'trusted' The interface is under control of NetworkManager, setting zone to 'trusted'. [root@aqueduct ~]# firewall-cmd --list-all --zone=trusted trusted target: ACCEPT icmp-block-inversion: no interfaces: <<<< nothing ... No traffic ever appears to be received by the GRE interface. 6: gre1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1460 qdisc noqueue state UNKNOWN qlen 1 link/gre A.B.C.D peer X.Y.W.Z inet 10.65.1.1 peer 10.65.1.2/32 scope global gre1 valid_lft forever preferred_lft forever inet6 fe80::200:5efe:4acc:1a64/64 scope link valid_lft forever preferred_lft forever [root@aqueduct ~]# ifconfig gre1 gre1: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1460 inet 10.65.1.1 netmask 255.255.255.255 destination 10.65.1.2 inet6 fe80::200:5efe:4acc:1a64 prefixlen 64 scopeid 0x20<link> unspec 4A-CC-1A-64-00-00-F0-00-00-00-00-00-00-00-00-00 txqueuelen 1 (UNSPEC) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 146 bytes 12180 (11.8 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 -- Adam Tauno Williams <mailto:awilliam@whitemice.org> GPG D95ED383 OpenGroupware Developer <http://www.opengroupware.us/>

1 1

OpenVPN server and firewalld
by Kenneth Porter 24 Apr '18

24 Apr '18

How do I insert the iptables rule below using firewalld? I'm moving up from CentOS 6 to 7 on an office gateway and I'm trying to get OpenVPN working to allow home workers to access PCs at the office. I've got it all working but only by manually inserting an ACCEPT rule in the FORWARD iptables chain: iptables -I FORWARD 3 -i tun+ -j ACCEPT This rule was extracted from my iptables firewall under CentOS6. The 3 puts it after the accepts for established connections and loopback connections, but before any firewalld sub-chains. With this I can connect to an internal Windows 10 system with Remote Desktop. How can I inject this rule using firewalld, either as a direct rule or as some more firewalld-approved kind of rule?

5 7

touchpad stopped working in KDE only
by twebb 23 Apr '18

23 Apr '18

I just installed CentOS 7 on a ThinkPad T420s. All went well. Touchpad worked fine at login screen, in Gnome, and in KDE. KDE is my preferred environment, so I began customizing - including configuring the touchpad to accept "Tapping" gestures via System Settings, Input Devices, Touchpad. As soon as I hit "apply", the touchpad stopped responding to cursor movements. The touchpad buttons continue to work, just no cursor movements with touches. Touch pad is still fully functional at login prompt and in Gnome. However, cursor movements stop as soon as KDE desktop (KDE Plasma) starts. Any help would be greatly appreciated. I'm almost ready to just re-install CentOS 7 again and not mess with the touchpad settings ever again, but I figure this must be something simple. Other online solutions have not worked, which is why I'm asking here. Thanks, TW

1 0

USB audio on Centos-7
by Fred Smith 22 Apr '18

22 Apr '18

I'm using Centos-7 on my PC, with ASUS motherboard. internal audio has always worked fine EXCEPT that I can never get audio input (for recording) to work. I want to feed audio from a phono turntable and from a cassette deck. I use a phono preamp for the turntable, or directly connect the tape deck. but either nothing, or low level with horrible distortion. so, I gave up (after years of intermittent battles) and bought a Behringer UFO202, which looks like it should work fine with Linux. It allegedly uses a TI PCM2902 chipset, which many online postings claim works fine with various flavors of Linux. This device has a USB port, a pair of line in and line out jacks, a phono jack, a headphone volume control, and a switch to change the line in to phono in. I can use headphones plugged into the UFO202 to listen to audio playing on the computer, but I cannot for the life of me figure out how to feed audio into the UFO202 (via its line in RCA jacks) and have it come out speakers or phones connected to the computer. I've poked and proded at alsamixer, the mate sound tool, and pavucontrol. No useful results. Pavucontrol, in its input section, does show the device listed, and it shows activity on its level mater when there is audio input via the line in jacks on the UFO202. Disconnect the line input and the activity ceases. (Mate sound control also lists the device, but I don't even get an indication of any input at all, as I described above for pavucontrol.) but I simply cannot figure out how to get that audio to play in any audible way. I know that USB audio input works, because I have a Plantronics USB headset with microphone that I use often to converse online, and it works nicely. (and a possibly separate issue: how the heck does one point Audacity to a USB input? Can't find anything in its UI, and there's darn little help online that is actually helpful, in this regard.) Can you sense my frustration here? I'd appreciate any help that is actually helpful,... perhaps someone who reads this actually has one of these things and has made it work? thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- God made him who had no sin to be sin for us, so that in him we might become the righteousness of God." --------------------------- Corinthians 5:21 ---------------------------------

3 6

Anyone using GQRX in Centos-7, for SDR ?
by Fred Smith 22 Apr '18

22 Apr '18

I gave myself a toy, one of those cheap USB Software Define Radios, and would like to use it on my C7 box. Having wasted some time on it, I gave up and installed Ubuntu on a USB HD so I can boot that to play with SDR. The Ubuntu GQRX installation is well documented and went off without a hitch. but I just hate having to boot something else on my main box (partly because it also runs a mailserver for my personal domain, partly because, well, I just want my box running CentOS, not Ubuntu.) Searching through SDR info on line I see someone has documented installing all the bits for C6, but I suspect the process is different for C7. BTW, I installed the various bits I could find from, er, I think some came from li.nux.ro, some perhaps from epel, on C7, but couldn't get them to properly function. Worse, when the USB radio is unplugged from the system, it locks up hard. then a few days ago, I had been playing with it using the UBUNTU install, did a reboot and for kicks fired up the GQRX on Centos, and lo and behold it worked! I tried running it on Centos yesterday and it reverted to type, i.e., lock up hard. I suspect that Ubuntu is leaving some hardware in a state that allows it to work on a subsequent Centos boot (without poweroff), but no clue what. So, if anyone can point me to how to use it on C7, I'd greatly appreciate it. thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- Show me your ways, O LORD, teach me your paths; Guide me in your truth and teach me, for you are God my Savior, And my hope is in you all day long. -------------------------- Psalm 25:4-5 (NIV) --------------------------------

2 4

question re: ls oddity
by Fred Smith 20 Apr '18

20 Apr '18

Hi all! I use Centos-7 all the time. I also have a Fedora-26 VM that I use only occasionally. Today I noticed that ls on the two systems gives different results when listing the same (networked) directory. the one on fedora 26 shows files with spaces in the names like this: 'CHURCH FAMILY ADDRESS AND PHONE LIST.doc' whereas the one on Centos shows it without the quotes. both systems have the same alias for ls I don't see anything based on a brief excursion of the respective man pages. the one on Centos is version 8.22, and the one on F26 is 8.27, so unless there is some dotfile somewhere that ls refers to for options, this must be a version-change. it seems like a possibly useful feature, one might be able to use that to avoid nasty quoting problems in shellscripts, for instance. Anybody know how that gets enabled? thanks! -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "Not everyone who says to me, 'Lord, Lord,' will enter the kingdom of heaven, but only he who does the will of my Father who is in heaven." ------------------------------ Matthew 7:21 (niv) -----------------------------

2 1

tftpd server S not responding
by Asif Iqbal 19 Apr '18

19 Apr '18

I have a tftpd server S running on centos 7 and managed by systemd It is not respoding to A server which is sending the tftp read request RRQ. I do see the RRQ packets coming from A to S, but S never responds back from a different port Y to A So this part is working fine https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol#/media/File:Tf… But I do not see any attempts to even send a data packet back in my packet capture running on S So this event is not occuring, as if my tftpd server is dead. I have the firewalld turned off on S to eliminate the possibility that firewalld blocking those packets from reeaching to tftpd daemon. I also turned off selinux to eliminate any permission issue. https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol#/media/File:Tf… I do have tftpd running and managed by systemd $ systemctl status -l tftp ● tftp.service - Tftp Server Loaded: loaded (/etc/systemd/system/tftp.service; indirect; vendor preset: disabled) Active: active (running) since Wed 2018-03-28 18:57:42 UTC; 1min 44s ago Docs: man:in.tftpd Main PID: 1685 (in.tftpd) Memory: 136.0K CGroup: /system.slice/tftp.service └─1685 /usr/sbin/in.tftpd --verbose --verbosity 10 --secure /tftpboot --port-range 4069:4169 Mar 28 18:57:42 S.example.net systemd[1]: Started Tftp Server. Mar 28 18:57:42 S.example.net systemd[1]: Starting Tftp Server... Any help is appreciated! -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

5 14

Enterprise company using CentOS
by Mats Bennsäter 19 Apr '18

19 Apr '18

Hi all We are about to create a business case for migrate RHEL to CentOS for all or a subset of our RHEL holdings. I have two questions that I hope to get help answering. 1. I want to get in touch with a company that have done this journey on an Enterprise company. 2. Suggestion/recommendation of vendors that can provide support for CentOs. Scop: North Europe Number of RHEL +8.000 Support 24x7 Thanks //mats

4 5

Nvidia-detect error with on HP Z4 (CentOS 6.9)
by Danny Smit 17 Apr '18

17 Apr '18

Hi all, I'm testing an installation of nvidia drivers on a HP Z4 workstation (nvidia Quadro P600) with CentOS 6.9. Running nvidia-detect with this setup gives the following output: # nvidia-detect Error getting device_class nvidia-detect also quits with exit-code 255. Could this be a bug in nvidia-detect? Or is it an unsupported configuration? The following hardware is detected, it seems some sort of unknown Intel device is detected by the OS: # lspci | grep VGA 00:1f.5 Non-VGA unclassified device: Intel Corporation Device a2a4 21:00.0 VGA compatible controller: NVIDIA Corporation Device 1cb2 (rev a1) # lspci -n | egrep '00:1f.5|21:00.0' 00:1f.5 0000: 8086:a2a4 21:00.0 0300: 10de:1cb2 (rev a1) Tested with the following version (with equal results): nvidia-detect-390.25-1.el6.elrepo.x86_64.rpm nvidia-detect-390.48-1.el6.elrepo.x86_64.rpm -- Regards, Danny

3 6

CentOS 7.4 paniced when running LTP tests
by wuzhouhui 17 Apr '18

17 Apr '18

LTP version: ltp-full-20180118 Kernel version: 3.10.0-693.el7.x86_64 Reproduce procedure: 1. cd ltp-full-20180118; ./configure; make && make install 2. cd /opt/ltp; ./runltp Trace: [ 377.516270] BUG: unable to handle kernel NULL pointer dereference at (null) [ 377.521746] IP: [<ffffffff813510a7>] asn1_ber_decoder+0x327/0xd30 [ 377.525865] PGD 9c6ea067 PUD 66831067 PMD 0 [ 377.529043] Oops: 0000 [#1] SMP [ 377.531454] Modules linked in: ext4 mbcache jbd2 loop ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter snd_seq_midi snd_seq_midi_event sb_edac edac_core coretemp iosf_mbi crc32_pclmul ghash_clmulni_intel ppdev aesni_intel lrw gf128mul glue_helper ablk_helper cryptd vmw_balloon snd_ens1371 snd_rawmidi snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm dm_mod pcspkr joydev snd_timer nfit sg snd vmw_vmci libnvdimm soundcore [ 377.592112] shpchp i2c_piix4 parport_pc parport ip_tables xfs libcrc32c sr_mod cdrom ata_generic pata_acpi sd_mod crc_t10dif crct10dif_generic vmwgfx drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm crct10dif_pclmul crct10dif_common drm crc32c_intel ata_piix mptspi libata scsi_transport_spi e1000 mptscsih serio_raw mptbase i2c_core [ 377.618291] CPU: 1 PID: 32027 Comm: add_key02 Not tainted 3.10.0-693.el7.x86_64 #1 [ 377.624130] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 [ 377.632341] task: ffff880134c8bf40 ti: ffff8800b04c8000 task.ti: ffff8800b04c8000 [ 377.638459] RIP: 0010:[<ffffffff813510a7>] [<ffffffff813510a7>] asn1_ber_decoder+0x327/0xd30 [ 377.645145] RSP: 0018:ffff8800b04cbcc0 EFLAGS: 00010206 [ 377.648925] RAX: 000000000000003f RBX: 0000000000000000 RCX: 0000000000000040 [ 377.653499] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000070 [ 377.659151] RBP: ffff8800b04cbda8 R08: 0000000000019bc0 R09: 0000000000000000 [ 377.663875] R10: 0000000000000002 R11: 0000000000000040 R12: 0000000000000000 [ 377.668679] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 377.673414] FS: 00007f57fc60f740(0000) GS:ffff880139640000(0000) knlGS:0000000000000000 [ 377.678827] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.682732] CR2: 0000000000000000 CR3: 00000000a9a11000 CR4: 00000000001407e0 [ 377.687576] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 377.692430] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 377.698824] Stack: [ 377.701875] ffff880139003be8 0000000000000206 0000000000000202 0000000000000202 [ 377.708840] ffff8800b0535080 ffffffff817167c0 ffff8801356da200 000000000000001c [ 377.716247] ffff8801356da200 ffff8800b04cbd00 0000000000000070 ffffffff81716740 [ 377.723168] Call Trace: [ 377.726482] [<ffffffff811df8c6>] ? kmem_cache_alloc_trace+0x1d6/0x200 [ 377.732479] [<ffffffff812eeea1>] x509_cert_parse+0x91/0x120 [ 377.738012] [<ffffffff812efb86>] x509_key_preparse+0x26/0x280 [ 377.743543] [<ffffffff812ee45b>] asymmetric_key_preparse+0x5b/0xd0 [ 377.749370] [<ffffffff812a57a6>] key_create_or_update+0x146/0x460 [ 377.755015] [<ffffffff812a71a9>] SyS_add_key+0x119/0x240 [ 377.760142] [<ffffffff816b4fc9>] system_call_fastpath+0x16/0x1b [ 377.765606] Code: e0 01 88 85 48 ff ff ff 74 0d 4c 3b 9d 78 ff ff ff 0f 84 99 fd ff ff 48 8b b5 78 ff ff ff 49 8d 43 ff 48 39 f0 0f 86 90 06 00 00 <41> 0f b6 04 34 48 8d 7e 01 48 89 bd 60 ff ff ff 88 45 86 83 e0 [ 377.788713] RIP [<ffffffff813510a7>] asn1_ber_decoder+0x327/0xd30 [ 377.794403] RSP <ffff8800b04cbcc0> [ 377.798198] CR2: 0000000000000000

1 0

rpc.statd is not running but is required for remote locking.
by marcos sr 16 Apr '18

16 Apr '18

Hello I'm trying to mount a nfs system. But i receive this message: mount -t nfs <IP>:/backup /backupnfs mount.nfs: rpc.statd is not running but is required for remote locking. mount.nfs: Either use '-o nolock' to keep locks local, or start statd. mount.nfs: an incorrect mount option was specified After a fews searchs on google i tried to execute the files: sbin/rpc.statd /usr/sbin/start-statd

3 2

Create CentOS 6 system as "clone" of another - with LVM and different disk sizes
by Toralf Lund 16 Apr '18

16 Apr '18

Hi, I just found myself having to set up a new CentOS 6 system with a nearly identical configuration to an existing host, so I thought I would just 1. Do a minimal install to set up partitions etc. on the new system. 2. Create an image of the existing system using Clonezilla (http://www.clonezilla.org) 3. Run a Clonezilla restore on the new system. - as I though it would be a lot simpler than replicating the exact package selection, installing the same users, doing the same manual config edits (which are required) etc. It turns out that it wasn't quite as easy, though. The problem is that the system use LVM2 volumes for the filesystems, and the new host has a slightly smaller disk than the other, and Clonezilla seems unable to restore to a volume that's smaller than the one that was cloned - even if the actual data fits. I guess I could temporarily reduce the LVM volume sizes on the existing units and clone again, but I'd rather not if I can avoid it. Just copying file-by-file could be an option, too, but I somehow feel less comfortable doing that than the above; there is something about the way I could end up with a mixture of my "minimal install" and the "cloned" data, I suppose. Does anyone have any other ideas about how I might achieve what I want? - Toralf

3 5

Wich is best for backup? nfs of iscsi?
by marcos sr 14 Apr '18

14 Apr '18

Hello I have a CentOS VM with a lots of inodes, and 500GB +/-, running under hyper-v . Which is best for backup them? What is the pros and cons? Thanks for attention.

4 4

YUM4/DNF for CentOS updates announcement
by Marek Blaha 13 Apr '18

13 Apr '18

I am pleased to announce some significant updates to our ConfigManagement Special Interest Group for YUM4. This provides YUM4, based on DNF technology, for testing on CentOS Linux 7/x86_64. These updates are based on feedback from our prior test release last October. It includes signed packages, core DNF plugins, and uses a version of RPM very similar to and compatible with the upcoming version of CentOS 7.5. This initiative is based on a partnership with the upstream YUM and DNF maintainers for the future of package management. Our testing thus far indicates no major problems, but we would love to find out how it fits into your existing YUM 3 workflows. So please consider filling out the short survey - your feedback helps us all get better. YUM 4 provides significant improvements such as fast dependency resolution and a stable, documented API. See the references below for detailed improvements. We have made every effort to preserve the existing end-user experience that is available with YUM 3. This is the primary reason for making YUM 4 available for testing now. For detailed information and instructions to install YUM4 on your CentOS machine, please visit our wiki: https://wiki.centos.org/SpecialInterestGroup/ConfigManagementSIG/YUM4 And remember to submit feedback in the short survey to help us understand how it can be improved further: https://goo.gl/forms/H1SL1HaEjdV9EUGH3 Many thanks to the CentOS Project team for their assistance in making this happen! Regards, Marek Blaha

1 0

Help with yum
by Paul R. Ganci 13 Apr '18

13 Apr '18

I just did a fresh minimal install of centos 7 on new hardware. While playing around with window systems I removed X windows like so: >yum remove "X Window system" and then tried to re install >yum group install "X Window system" which gives this error: Maybe run: yum groups mark install (see man yum) No packages in any requested group available to install or upgrade I tried running: >yum groups mark install "X Window system" and get the same message. I tried different permutations removing the "s" on groups. Nothing seems to bring back the yum "X Window system" group. Can anyone help me resolve this issue and tell me what I did wrong? Thanks for your help. -- Paul (ganci(a)nurdog.com) Cell: (303)257-5208

5 8

motion
by m.roth＠5-cent.us 12 Apr '18

12 Apr '18

Got a CentOS 7 box running motion. Selinux is complaining that one of the scripts motion runs is mislabeled. Here's what it is. system_u:object_r:nfs_t:s0 /home/motion/bin/on_move_end Now, ~motion is NFS mounted, and we've got use_nfs_home_dirs --> on, so what *would* the proper label be, or do I really need to create a policy for this? mark

1 0

Windows PC PostScript printer driver -> CUPS data import fails
by Gary Stainburn 12 Apr '18

12 Apr '18

Hi all, For some years now I have been using a simple system I found online which allows me to easily import data from Windows Programs. Hopefully others out there are using the system and already have found the answer to my problem. I have installed on my Centos server a virtual CUPS printer which receives a PS file, and then runs 'ps2pdf' and 'pdftotext -layout' to end up with a text file. On the Windows PC's it's simply a case of installing a printer pointing to this server, and using the HP Colour Laster 2800 PS drivers. Now to my problem. We have finally moved onto Windows 10, and now when I try to install the printer that model printer is no longer available. When I try similar HP Colour Laser PS drivers the ps2pdf command fails. [root@lou inet]# ps2pdf 20180412_104403_tcards.ps GPL Ghostscript 9.14: Unrecoverable error, exit code 1 [root@lou inet]# The PDF contains: ERROR: invalidfileaccess OFFENDING COMMAND: .findfont OPERAND STACK: r /usr/share/X11/fonts/Type1/UTBI____.pfa --nostringval-- true NimbusMonL-Regu Courier --nostringval-- Courier 4544317 Courier Font Courier Has anyone else had this problem, and have they managed to find a solution? Gary

3 4

Does Huawei break the license of CentOS?
by Genghuang Wang 12 Apr '18

12 Apr '18

Hello, CentOS team and everyone who cares about CentOS, Huawei release an Euler OS, which is an distribution based on CentOS. http://developer.huawei.com/ict/en/site-euleros/euleros-introduction According to CentOS's statement, CentOS is distributed under the GPLv2 License. http://mirror.centos.org/centos/7.4.1708/os/x86_64/EULA The GPL license requires the modified version to be open-source AND release in the GPL license, as well. However, Huawei break the GPL license by close-source and replace the license with their proprietary one. How do I find it? Well, I download the so-called Euler OS from http://developer.huawei.com/ict/site-euleros/euleros/repo/yum/2.2/os/x86_64… And install it in the virtual machine. From the following path: /usr/share/euleros-release/EULA /usr/share/eula/eula/eula.en_US I find that it is NOT the GPL license, but Huawei's own license. So is Huawei breaking the license of CentOS?

3 8

Ansible repository shenanigans in EL7
by James Hogarth 11 Apr '18

11 Apr '18

For those not aware ansible has been deprecated in RHEL7 from the extras repository. In the RHEL specific world it's now in an optional "product" (basically an optional subscription) that is part of any RHEL subscription, but it's opt in. As a result ansible is back in the EPEL7 repository for 2.5.0+ , having been removed for ansible 2.4.2 when it got introduced to the RHEL extras repo. I have no idea what, if anything, the CentOS team will do with the ansible in the CentOS7 extras repository.

4 5

Next major version of Firefox on RHEL/CentOS ?
by James Pearson 11 Apr '18

11 Apr '18

I know CentOS don't have inside info on what Redhat may or may not do in the future - plus Redhat don't usually announce publicly what their future plans are - but on the off-chance that someone on this list may know: Does anyone know what Redhat are likely to do with the next major release of Firefox on RHEL (and hence CentOS) ? The reason I ask, is that RHEL has been supplying the 'ESR' (Extended Support Release) version of Firefox - which Mozilla supports for about a year - and RHEL moves to each new ESR version before Mozilla drops support for the previous version. Up until the current version of ESR (52), the major versions have been mostly compatible, but the next release of ESR (60) has some major changes - which include: * No support for NPAPI plugins - except for Flash - i.e. no support for plugins like Java etc * No support for XUL/XPCOM/legacy add-ons - will only support 'WebExtensions' * Requires gtk3 run-time support - which isn't available with RHEL/CentOS 6 (currently Firefox for both el6 and el7 use the gtk2 run-time libraries) I know it's a long shot, but I'm just trying to work out what changes I will need to make when ESR 52 reaches its EOL in August this year ... Thanks James Pearson

1 1

yum excludes
by Mathy Froeyen 11 Apr '18

11 Apr '18

dear all Every yum command returns "nvidia excluding" lines, and those items are invisible for installation, see lower. I have no idea where those excludes are defined. Also, the flag "--disableexcludes=all" does not remove the excludes. any ideas? thanks mathy ------------------------------------------------------ [root@gbw-d-l0070 ~]# yum update Loaded plugins: etckeeper, fastestmirror, langpacks, nvidia Loading mirror speeds from cached hostfile * base: centos.cu.be * elrepo: ftp.nluug.nl * epel: fedora.cu.be * extras: centos.cu.be * updates: centos.cu.be [nvidia]: excluding kmod-nvidia-367.57-3.el7.elrepo.x86_64 [nvidia]: excluding kmod-nvidia-390.25-1.el7_4.elrepo.x86_64 [nvidia]: excluding kmod-nvidia-390.42-1.el7_4.elrepo.x86_64 [nvidia]: excluding kmod-nvidia-390.48-1.el7_4.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-367.57-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-390.25-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-390.42-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-390.48-1.el7_4.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-32bit-367.57-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-32bit-390.25-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-32bit-390.42-1.el7.elrepo.x86_64 [nvidia]: excluding nvidia-x11-drv-32bit-390.48-1.el7_4.elrepo.x86_64 No packages marked for update

2 1

Semi-OT: install python package in userspace
by m.roth＠5-cent.us 11 Apr '18

11 Apr '18

CentOS 7 box. As there's no package in any of the repos, we're trying to install scikit-learn in the user's space. It refuses. My late try was, after d/l a .whl from last year, hoping that would work with the numpy package in the regular repos, I did a pip install --user scikit-learn..., and it still seems to want to write to system space: OSError: [Errno 13] Permission denied: '/usr/lib64/python2.7/site-packages/numpy-1.7.1.dist-info Anyone got any pointers? mark

12 25

XScreenSaver
by Nicolas Kovacs 10 Apr '18

10 Apr '18

Hi, I'm currently moving all our local school's desktop clients from Slackware 14.1 to CentOS 7 + Xfce. Right now I'm fine-tuning the default user profile. I have a problem with XScreenSaver. The application per se works very well. Only there's a hard-coded pop-up window that reminds the user that he's not running the latest version. So, if I'm running version 5.36 as provided by the EPEL repo and not the latest and greatest 5.38 as provided upstream, I get a pestering pop-up window informing me that YOUR VERSION OF XSCREENSAVER IS VERY OLD. This functionality is apparently hard-coded, since there's no way to deactivating it. The Slackware distribution seems to have solved the problem by promising upstream to keep things up-to-date. For the moment I simply work without it, because I'm annoyed by my users phoning me and asking me what's this thing with their screensaver being too old. As far as I can tell, there would be several solutions to this problem. 1. Ask the EPEL maintainers to keep the application up-to-date. 2. Patch the darn thing so I don't get the annoying popup. 3. Maintain my own up-to-date version of XScreenSaver in my private repo. Any thoughts about this? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

11 20

CentOS-announce Digest, Vol 158, Issue 1
by centos-announce-request＠centos.org 10 Apr '18

10 Apr '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0647 Important CentOS 6 thunderbird Security Update (Johnny Hughes) 2. CESA-2018:0649 Important CentOS 6 libvorbis Security Update (Johnny Hughes) 3. CESA-2018:0648 Important CentOS 7 thunderbird Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 9 Apr 2018 23:34:21 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0647 Important CentOS 6 thunderbird Security Update Message-ID: <20180409233421.GA10451(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0647 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0647 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 8faab804fa19089343fd1e489a02b3d351cec5544ed592b6dbec7a3006af99cf thunderbird-52.7.0-1.el6.centos.i686.rpm x86_64: 647747711d64e16d5b2e1529f7e5974464bb0b510cdbcad045f08048dba0d0da thunderbird-52.7.0-1.el6.centos.x86_64.rpm Source: 5089b20a8b1521a7ff70fc6ff5f053a6c6ab5ff2f6fa7f4a0a9af812c8774933 thunderbird-52.7.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Mon, 9 Apr 2018 23:35:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0649 Important CentOS 6 libvorbis Security Update Message-ID: <20180409233522.GA10751(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0649 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0649 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 2e06e17e114f1fb82b38494b2a749d03a24ab1ad4c7bd5802ca8c7d6d604dcdb libvorbis-1.2.3-5.el6_9.1.i686.rpm 40e0518e9a1bca52011bbd00605f55bcdc2bf571dfc8b34847b3fa662c7bc55d libvorbis-devel-1.2.3-5.el6_9.1.i686.rpm d833b6e19caceb7df39ca2bcc782f73f1b7774d7bd52abd6704ac29d778bb882 libvorbis-devel-docs-1.2.3-5.el6_9.1.noarch.rpm x86_64: 2e06e17e114f1fb82b38494b2a749d03a24ab1ad4c7bd5802ca8c7d6d604dcdb libvorbis-1.2.3-5.el6_9.1.i686.rpm e2b276ee079787afa938fc33d26255a167e592670303c74656e84b96c09ace5b libvorbis-1.2.3-5.el6_9.1.x86_64.rpm 40e0518e9a1bca52011bbd00605f55bcdc2bf571dfc8b34847b3fa662c7bc55d libvorbis-devel-1.2.3-5.el6_9.1.i686.rpm e043eec9adabbada05e9229f7669b1f1de85693265dd8fb98366b36ee23886a4 libvorbis-devel-1.2.3-5.el6_9.1.x86_64.rpm d833b6e19caceb7df39ca2bcc782f73f1b7774d7bd52abd6704ac29d778bb882 libvorbis-devel-docs-1.2.3-5.el6_9.1.noarch.rpm Source: cf05cdba31b5c0bd71bbe2e333821dc586a9c2eddd8a6fe762c4d35ee836934d libvorbis-1.2.3-5.el6_9.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 10 Apr 2018 00:06:05 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0648 Important CentOS 7 thunderbird Security Update Message-ID: <20180410000605.GA24381(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0648 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0648 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 78c170024613cdf14dc70084dda0c83a321f6829959333ee0e6c518bc772c501 thunderbird-52.7.0-1.el7.centos.x86_64.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 158, Issue 1 ***********************************************

1 0

Do you blog about CentOS?
by Rich Bowen 09 Apr '18

09 Apr '18

Do you blog about CentOS? Or about Linux in general? We need your voice. As mentioned on https://blog.centos.org/2018/04/seven-centos-org-is-dead-long-life-to-blog-… this morning, authentication for blog.centos.org is tied to accounts.centos.org (through OpenID). So if you have a CentOS account, you have an account on the blog server. We would love to have your articles there - hear about what you're doing on top of this awesome platform. On the other hand, if you have your own blog, and you're writing CentOS content there, please let me know about that, too. Our aggregator - planet.centos.org - is where we collect the various sites with quality CentOS content, and we'd love to add you there. Send me an RSS/Atom URL for your content - preferably one that's filtered by tag/keyword, so that it's just the CentOS/Linux content, and not your posts about your cat and your skiing trip - and we'll get you added. There's a HUGE amount of clickbait/spammy content out there about CentOS ("How to Install Bash On CentOS In Twelve Easy Steps!") and we need to combat that with quality, substantive content. Thanks! -- Rich Bowen - rbowen(a)redhat.com @RDOcommunity // @CentOSProject // @rbowen

2 1

iscsiadm: Could not perform SendTargets discovery: encountered non-retryable iSCSI login failure
by marcos sr 09 Apr '18

09 Apr '18

Hello I know this not the place to ask help, but i can't send messages to iscsi list. :( I have 3 CentOS 6 connecting to a ISCSI server with Targecli suddenly they lost connection and i receive this error when i performance iscsiadm --mode discovery --type sendtargets --portal x.x.x.x iscsiadm: Could not perform SendTargets discovery: encountered non-retryable iSCSI login failure I have already changed the password for the ACLs. Thanks for attention.

1 0

CentOS 7 + MariaDB + phpMyAdmin
by Frank M. Ramaekers 09 Apr '18

09 Apr '18

I can't seem to get phpMyAdmin working. I got the ip address problem (permission) resolved, but now I'm getting a "Parallels H-Sphere" error "Error 404: File Not found". I've looked in all the logs and cannot determine what file is not found. Frank M. Ramaekers Jr. | Systems Programmer | Information Technology | American Income Life Insurance Company | 254-761-6649 (732-6649) ---------------------------------------------------------------------- This message contains information which is privileged and confidential and is solely for the use of the intended recipient. If you are not the intended recipient, be aware that any review, disclosure, copying, distribution, or use of the contents of this message is strictly prohibited. If you have received this in error, please destroy it immediately and notify us at PrivacyAct(a)torchmarkcorp.com.

2 1

DHCPv6 prefix delegation
by Chris Adams 08 Apr '18

08 Apr '18

Is there an DHCPv6 client in CentOS that supports prefix delegation correctly? The old version of dhclient can't set a requested prefix delegation length, so isn't very useful, and I can't get the even-older wide-dhcpv6 from EPEL to work. -- Chris Adams <linux(a)cmadams.net>

2 1

CentOS 7 + Xfce + GDM : disable "switch user" ?
by Nicolas Kovacs 07 Apr '18

07 Apr '18

Hi, I have CentOS 7 + Xfce + GDM installed on all our local school's desktop clients. I'd like to disable the "switch user" menu entry, since our desktop clients have a relatively limited amount of RAM. Most users tend to use the "switch user" functionality to log off, and at the end of the day, the computer has no RAM left. I know there is a way to disable this functionality, I vaguely remember having it done a few years ago on Slackware. Any suggestions ? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

1 1

Unable to access network from docker container
by H 07 Apr '18

07 Apr '18

I have recently installed docker and playing around with it. On a CentOS 7 machine, however, I am unable to get access to the outside internet, thus yum ... fails. The host machine runs fine. I am wondering if there are some networking setting on the host I need to modify to allow the docker container to connect to the outside?

3 4

invalid mirror .host-engine.com
by Walter H. 06 Apr '18

06 Apr '18

Hello, how can I prevent of using these mirrors? # yum clean all Loaded plugins: fastestmirror, security Cleaning repos: base extras updates Cleaning up Everything Cleaning up list of fastest mirrors # yum update Loaded plugins: fastestmirror, security Setting up Update Process Determining fastest mirrors * base: centos.den.host-engine.com * extras: centos.den.host-engine.com * updates: centos.den.host-engine.com http://centos.den.host-engine.com/6/os/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.com/6/os/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. base | 3.7 kB 00:00 http://centos.den.host-engine.com/6/extras/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.com/6/extras/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. extras | 3.4 kB 00:00 http://centos.den.host-engine.com/6/updates/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.com/6/updates/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. is there a way of setting up a DNS ZONE where requests to this domain get somewhat like 'not exist'? Thanks, Walter

2 1

Re: [CentOS] GnuPG 2.0.16?
by Karl Vogel 06 Apr '18

06 Apr '18

>> On Thu, 29 Mar 2018 10:53:05 -0700, >> Kay Schenk <kay.schenk(a)gmail.com> said: K> Does anyone know where I can find GnuPG 2.0.16 for CentOS 6.9 32-bit? Do you want something that old? 2.0.17 came out in 2011. I run Oracle Linux 6.9 (basically RHEL without the trademarks) -- if you're comfortable building from source, GnuPG-2.2.5 wasn't hard. This is what I did: Download files: site='https://gnupg.org/ftp/gcrypt' curl $site/libassuan/libassuan-2.5.1.tar.bz2 curl $site/libassuan/libassuan-2.5.1.tar.bz2.sig curl $site/libgcrypt/libgcrypt-1.8.2.tar.bz2 curl $site/libgcrypt/libgcrypt-1.8.2.tar.bz2.sig curl $site/libgpg-error/libgpg-error-1.28.tar.bz2 curl $site/libgpg-error/libgpg-error-1.28.tar.bz2.sig curl $site/libksba/libksba-1.3.5.tar.bz2 curl $site/libksba/libksba-1.3.5.tar.bz2.sig curl $site/npth/npth-1.5.tar.bz2 curl $site/npth/npth-1.5.tar.bz2.sig curl $site/gnupg/gnupg-2.2.5.tar.bz2 curl $site/gnupg/gnupg-2.2.5.tar.bz2.sig Check the tarballs against GPG signatures and unpack. Build libraries first: export CC=gcc export CXX=g++ export CFLAGS=-O2 export LDFLAGS="-L/usr/local/lib" export CPPFLAGS="-I/usr/local/include" dest=/usr/local cd /path/to/libassuan-source ./configure --prefix=$dest --mandir=$dest/man make && make check && make install && make clean cd /path/to/libgcrypt-source ./configure --prefix=$dest --mandir=$dest/man make && make check && make install && make clean cd /path/to/libgpg-error-source ./configure --prefix=$dest --mandir=$dest/man make && make check && make install && make clean cd /path/to/libksba-source ./configure --prefix=$dest --mandir=$dest/man make && make check && make install && make clean cd /path/to/npth-source ./configure --prefix=$dest --mandir=$dest/man make && make check && make install && make clean Build gnupg -- this was more interesting because I needed the realtime library (librt) as well as a local ncurses library (libncursesw) to make readline stuff work. You may not need this, depending on how your libraries are set up: export CC=gcc export CXX=g++ export CFLAGS=-O2 export LDFLAGS="-L/usr/local/lib -L/usr/lib64" export LIBS="-lreadline -lncursesw -lrt" export CPPFLAGS="-I/usr/local/include" dest=/usr/local cd /path/to/gnupg-source ./configure --prefix=$dest --mandir=$dest/man [change config.h to hold "#undef HAVE_INOTIFY_INIT" unless you have a very recent release of inotify sources] make && make check && make install && make clean It's a little tedious but it works. -- Karl Vogel / vogelke+unix(a)pobox.com / I don't speak for the USAF or my company About as useful as telling Indiana Jones to look both ways before crossing the street. --comment about Amazon IT documentation

2 1

/lib/firmware/microcode.dat update on CentOS 6
by Valeri Galtsev 05 Apr '18

05 Apr '18

Dear All, An update just brought on my CenOS 6 boxes updated microcode.dat files: /lib/firmware/microcode.dat Does anybody know off hand what (how critical) is that, as, if it is related to most famous these days trouble with CPU hardware, I will need to reboot relevant boxes to have new microcode loaded. But if it is not that critical, it can wait till next reboot. Thanks a lot and apologies for laziness (not looking into details of this particular update myself). Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

15 29

Centos 7 LAPP setup PHP 5 vs 7
by Gary Stainburn 05 Apr '18

05 Apr '18

Another questions regarding my new server setup. As with the Postgresql setup, different pages describing setting up a Centos LAPP server have differing opinions about PHP versions. The default distro's appear to still be installing PHP5 while some sites instruct on how to install PHP7. I am porting my old server which must be 10 years old, running Fedora 9 and PHP5 onto the new server, so presumably sticking with PHP5 would be the easier option. However, I am looking to give my new server as long a life as possible, so should I instead be looking at PHP7? I have literally thousonds of lines of PHP code on my existing box. How much head ache am I going to have porting into either of the two new platforms? How much difference would PHP5 vs PHP7 be? Opinions please

2 1

Centos 7 LAPP setup Postgresql version and setup
by Gary Stainburn 05 Apr '18

05 Apr '18

Hi all, I've got a nice shiny new server which I'm going to build as a LAPP platform. I've just had a quick look for suitable instructions on the best way to configure it and I have a few questions. There are many hits, some better than others. (It is replacing a Fedora 9 server so I'm expecting to have lots of *fun*) 1) 9.2 vs 9.5 Some of the instruction pages I've found install using the standard repositories and install version 9.2 (?) while some others add a postgresql repo and install 9.5 What are people's opinions? In the long term, and I going to have more admin hassle with one over the other? Will porting schemas including stored functions in pl/psql from 8.3 be easier / better with one version over the other? 2) network vs sockets I read somewhere that connecting Apache / PHP to Postgresql is faster if you use sockets rather than usling the loopback i/f. Is this correct? If it is correct, what is the correct connect string if I use the 9.2 or 9.5 RPM's as described above? There seems to be lots of Google content about sockets not working. Is it really that hard? (I use pg_pconnect() to do the connecting)

1 0

memory cgroup max_usage_in_bytes question
by Stijn De Weirdt 05 Apr '18

05 Apr '18

hi all, can someone help explaining what we are seeing? it makes no sense to us. this is a host running centos 7.4 with 3.10.0-693.17.1 kernel, and it has 192GB of ram > [] free -b > total used free shared buff/cache available > Mem: 201402642432 14413479936 75642777600 48586752 111346384896 185689632768 > Swap: 21474832384 31961088 21442871296 > [] cat /sys/fs/cgroup/memory/memory.max_usage_in_bytes > 273102151680 how can the max be so much higher than total, and this is not even memsw? either we're very tired and are overlooking something obvious, or there's something new to be learned ;) many thanks, stijn

3 4

What is the universal (world wide) understanding behind degaussing harddisks?
by Turritopsis Dohrnii Teo En Ming 02 Apr '18

02 Apr '18

Good evening from Singapore! The foremost question which I want to ask is, what is the universal (world wide) understanding behind degaussing hard drives? I work for No Secrets Agency (NSA) Pte Ltd (fictitious company name used). My sales manager Edward Joseph Snowden (fictitious individual name used) had *promised* our customer Leave Me in the Lurch (S) Pte Ltd (fictitious company name used) that we would "DEGAUSS" their hard disks after the PC replacement and data migration exercise for 15 trillion PCs (fictitious number used). PC = Personal Computer, which includes desktops and laptops Last Friday, I had already reflected to my sales manager Edward Snowden that since we are definitely NOT going to wipe our customer's data by using strong and powerful magnets (physical means), should I send an email to the IT Administrator of our customer Lady Gaga (fictitious individual name used) asking her which data sanitization method (by software means) I should use? My sales manager Edward Snowden had quickly deflected my concerns (that is, wanting to send an email to our customer Lady Gaga asking her which data sanitization method I should use). I had brought up to the sales manager Edward Snowden a number of data wiping methods by software means last Friday. (1) Very very simple 1-pass data wiping, quickest a. Using "sudo dd if=/dev/zero of=/dev/sda", overwriting harddisks from beginning to end with zeroes, where /dev/sda refers to the 500 GB harddisk, not /dev/loop0 and not /dev/sdb which refers to the bootable live operating system on thumb drive b. Using "sudo dd if=/dev/urandom of=/dev/sda", overwriting harddisks from beginning to end with random data, where /dev/sda refers to the 500 GB harddisk, not /dev/loop0 and not /dev/sdb which refers to the bootable live operating system on thumb drive Any bootable Live CD/DVD/flash media could do it. (2) 3-pass U.S. Government/Department of Defense (DoD) standard (DoD 5220.22-M) Certified commercial software required (3) 7-pass U.S. Government/Department of Defense (DoD) standard (DoD 5220.22-M) Certified commercial software required (4) 35-pass Gutmann method, slowest Certified commercial software required All these was last Friday. In the midst of our argument over the cellular network "just now", my sales manager Edward Snowden tried to cover up himself by suddenly and unexpectedly making an excuse that he had told me last Friday I was supposed to wipe user data only, not the operating system! If he had wanted me to wipe user data and retain/keep the Windows operating system, he should simply have told me to Reset the PC (for Windows 10 only) or use a =secure File Shredder=! For Windows 7, you can still wipe user data and preserve the operating system by using the Recovery Partition. On Lenovo desktops, press and hold F11 when Windows 7 is starting and reset to factory defaults. I had advised my sales manager Edward Snowden not to use BIG WORDS like "degaussing the harddisk" and market to the customer using these big words. Any person who sees the word "degauss" would have understood it to mean sanitize *ALL* data on the harddisk straight away and without question. Please refer to Figure 1. Exhibit A below for the "degaussing" instructions communicated to me by my sales manager Edward Snowden. Please click the link below. URI: https://i.imgur.com/bGOMyVs.png Please advise. Thank you very much. Regards, Mr. Turritopsis Dohrnii Teo En Ming Systems and Network Engineer Republic of Singapore 2nd April 2018 Monday 9:35 PM Singapore Time GMT+8

5 5

OT: Problems with NextCloud 13.0.1 under Centos7
by C. L. Martinez 31 Mar '18

31 Mar '18

Hi all, I have a strange problem with a clean NextCloud 13.0.1 install under CentOS 7 (fully patched): when I try to login with admin user immediately after setup, returns to login page without returning any error. An no errors in nginx or php log files ... I am using the following components: rh-php71 rh-mariadb102 nginx 1.12 Any idea? Many thanks.

4 4

How insecure is NIS ? Possible alternatives ?
by Nicolas Kovacs 31 Mar '18

31 Mar '18

Hi, In the past I've setup simple centralized authentication with NIS and NFS, without bothering about possible security implications. Over the next month I have to setup a new network in a local school, and I wonder if I should use NIS/NFS. I still have my own documentation, it's simple and somewhat bone-headed to setup, and it just works. RHEL/CentOS 7 still provide NIS, and I vaguely wonder how exactly it is insecure. So I thought I'd simply ask on this list. I know there's FreeIPA available. I gave it a spin some time ago on a local machine, but I think it's a bit overkill. Anyone here who uses central authentication (CentOS server + CentOS clients) ? Any suggestions ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

10 18

GnuPG 2.0.16?
by Kay Schenk 29 Mar '18

29 Mar '18

Hello all -- Does anyone know where I can find GnuPG 2.0.16 for CentOS 6.9 32-bit? I've already looked in the normal repos. I have 2.0.14 now and my Enigmail addon has stopped working. Thanks. -- ------------------------------------------ MzK "Ring out the false, ring in the true." -- poem "In Memoriam", Alfred Lord Tennyson

1 0

Install CentOS 7 over serial port on router board ?
by Nicolas Kovacs 28 Mar '18

28 Mar '18

Hi, I have to install CentOS 7 for a client, to act as cache & filtering proxy using Squid. I'd like to use this piece of specialized hardware : http://store.calexium.com/fr/systeme-pre-assemble/869-systeme-pre-assemble-… There is no VGA or HDMI video output, just a serial port to connect to, and then three NICs and two USB ports. I've never installed CentOS over a serial console, so I don't even know if it's possible in the first place. Has anyone ever done something like that ? Any suggestions ? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

6 10

CentOS-announce Digest, Vol 157, Issue 7
by centos-announce-request＠centos.org 28 Mar '18

28 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2018:0597 CentOS 6 tzdata BugFix Update (Johnny Hughes) 2. CEEA-2018:0579 CentOS 7 kmod-redhat-i40e Enhancement Update (Johnny Hughes) 3. CESA-2018:0592 Important CentOS 7 slf4j Security Update (Johnny Hughes) 4. CEBA-2018:0597 CentOS 7 tzdata BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 27 Mar 2018 19:26:54 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2018:0597 CentOS 6 tzdata BugFix Update Message-ID: <20180327192654.GA25156(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2018:0597 Upstream details at : https://access.redhat.com/errata/RHBA-2018:0597 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: b07bee4e9445dc2e7f28d46222cf487164102f06256a6aefcd65d52c0f7896fc tzdata-2018d-1.el6.noarch.rpm 81c03c9e3f00b0806b40797a9aaf9c3a2b0d3b6f8acc2dae63b0c3eaf299dbcd tzdata-java-2018d-1.el6.noarch.rpm x86_64: b07bee4e9445dc2e7f28d46222cf487164102f06256a6aefcd65d52c0f7896fc tzdata-2018d-1.el6.noarch.rpm 81c03c9e3f00b0806b40797a9aaf9c3a2b0d3b6f8acc2dae63b0c3eaf299dbcd tzdata-java-2018d-1.el6.noarch.rpm Source: 905226831ac71f99f6f75d3089d070aaa531628dc506eede51255003ba6ceedc tzdata-2018d-1.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 27 Mar 2018 20:20:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2018:0579 CentOS 7 kmod-redhat-i40e Enhancement Update Message-ID: <20180327202042.GA25938(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2018:0579 Upstream details at : https://access.redhat.com/errata/RHEA-2018:0579 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 973726f539d915e4d6667bcd4a551f08403e56307c00ed85032ac916e5414982 kmod-redhat-i40e-2.1.14_k_dup7.4-2.1.el7_4.x86_64.rpm c5deeb12aef29bff75a15fbf3af2d09acfd97841f64ef5a8596c4bbf09712052 kmod-redhat-i40evf-3.0.1_k_dup7.4-2.1.el7_4.x86_64.rpm Source: ef9a7cd89dea97c47b17796bb25546cb9cbc5dd11a28e74b70af8b3ec5f81a9e kmod-redhat-i40e-2.1.14_k_dup7.4-2.1.el7_4.src.rpm 9f5eb3e913cba0b1883d154f4af9b7f12936377e0977f8295b97273fab22376f kmod-redhat-i40evf-3.0.1_k_dup7.4-2.1.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 27 Mar 2018 20:22:24 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0592 Important CentOS 7 slf4j Security Update Message-ID: <20180327202224.GA26030(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0592 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0592 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 733630907981b82d45bd40cf4d3f113ff2193a4fdf1e293818669a707b739189 slf4j-1.7.4-4.el7_4.noarch.rpm d145b3bc3337e418173681eade8a1666ad7624271a6e0b10cb41a39010c0fdef slf4j-javadoc-1.7.4-4.el7_4.noarch.rpm 58f4c9dd119e297fd38fcc638d1dc1d359fa281fb425d14eaaa6ec79f548c33f slf4j-manual-1.7.4-4.el7_4.noarch.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Tue, 27 Mar 2018 20:23:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2018:0597 CentOS 7 tzdata BugFix Update Message-ID: <20180327202311.GA26075(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2018:0597 Upstream details at : https://access.redhat.com/errata/RHBA-2018:0597 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: ff9063828a3427711ac3054a7c887c06d716eb69a6717669834a4fe59b9be74f tzdata-2018d-1.el7.noarch.rpm 805ffa512bdc30131d519956773e3ad1bd5ab6b1ae94d29d3f12c67ad8b7bbed tzdata-java-2018d-1.el7.noarch.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 7 ***********************************************

1 0

centos7: pptpd vpn problem: mppe_decompress[0]: FLUSHED bit not set in stateless mode!
by Dario Lesca 27 Mar '18

27 Mar '18

I try to setup a PPTP VPN server on Centos 7 and from client a router Vodafone Station (Firmware 5.4.8.1.316.1.21) On c7 I have install this: [root@s-virt tmp]# rpm -q pptpd ppppptpd-1.4.0-2.el7.x86_64ppp-2.4.5- 33.el7.x86_64 and setup all file and firewall like howto say.This now is my config: /etc/pptpd.conf:option /etc/ppp/options.pptpd/etc/pptpd.conf:logwtmp/etc/pptpd.conf:localip 192.168.11.1/etc/pptpd.conf:remoteip 192.168.11.100- 109/etc/ppp/options.pptpd:name pptpd/etc/ppp/options.pptpd:refuse- pap/etc/ppp/options.pptpd:refuse-chap/etc/ppp/options.pptpd:refuse- mschap/etc/ppp/options.pptpd:require-mschap- v2/etc/ppp/options.pptpd:require-mppe- 128/etc/ppp/options.pptpd:lock/etc/ppp/options.pptpd:nobsdcomp /etc/ppp /options.pptpd:novj/etc/ppp/options.pptpd:novjccomp/etc/ppp/options.ppt pd:nologfd/etc/ppp/chap-secrets:myuser pptpd mypass * The connection from V.S. router to my c7 server work:mar 26 12:50:28 s- virt.ansaldi.loc pptpd[26782]: CTRL: Client x.x.x.x control connection startedmar 26 12:50:28 s-virt.ansaldi.loc pptpd[26782]: CTRL: Starting call (launching pppd, opening GRE)mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded.mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: pppd 2.4.5 started by root, uid 0mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Using interface ppp0mar 26 12:50:28 s-virt.ansaldi.loc pppd[26783]: Connect: ppp0 <--> /dev/pts/19mar 26 12:50:28 s-virt.ansaldi.loc NetworkManager[1026]: <info> [1522061428.6946] manager: (ppp0): new Generic device (/org/freedesktop/NetworkManager/Devices/40)mar 26 12:50:28 s- virt.ansaldi.loc pppd[26783]: peer from calling number x.x.x.x authorizedmar 26 12:50:31 s-virt.ansaldi.loc pppd[26783]: MPPE 128-bit stateless compression enabledmar 26 12:50:34 s-virt.ansaldi.loc pppd[26783]: local IP address 192.168.11.1mar 26 12:50:34 s- virt.ansaldi.loc pppd[26783]: remote IP address 192.168.11.100 But when I try to connect from a client (through the V. S. router) to my server via VPN, or ping it, on 4 ping only two work, and into log of server I see this error when the ping fail. > mar 26 12:00:50 s-virt.ansaldi.loc kernel: mppe_decompress[0]: > FLUSHED bit not set in stateless mode! Someone have some suggest to resolve this problem ? Many thanks -- Dario Lesca (inviato dal mio Linux Fedora 27 Workstation)

2 3

How Can I ...
by Eugene Poole 24 Mar '18

24 Mar '18

I've got a WD My Passport Ultra 1TB (USB) plugged into my router and I have 4 Windows machines, all running Windows 7, and all 4 machines can see the device as drive 'Y'. I use this device several ways, i.e. all my Windows machines use the same Firefox bookmarks and cookies I've got 5 machines running CentOS 6 x86_64 and I'd like to know what do I have to do for them to 'see' that same 1TB device? Right now I use winscp to get the data from CentOS and save it on the device via Windows. -- Eugene Poole Woodstock, Georgia

5 4

exim PAM authentication: all users unknown
by hw 22 Mar '18

22 Mar '18

Hi, how come that exim can not authenticate users using PAM? ====================== PLAIN: driver = plaintext server_set_id = $auth2 server_prompts = : server_condition = ${if pam{$auth2:$auth3}{yes}{no}} server_advertise_condition = ${if def:tls_cipher } server_debug_print = "auth: $1 $2 $3" ====================== 2969 SMTP<< AUTH PLAIN AGp2AGdsdWViaXJk 2969 PLAIN authenticator server_condition: 2969 $auth1 = 2969 $auth2 = user 2969 $auth3 = password 2969 $1 = 2969 $2 = user 2969 $3 = password 2969 auth: user password 2969 Running PAM authentication for user "user" 2969 PAM error: Authentication failure 2969 expanded string: no 2969 SMTP>> 535 Incorrect authentication data ======================== unix_chkpwd[2928]: check pass; user unknown unix_chkpwd[2928]: password check failed for user (user) exim: pam_unix(exim:auth): authentication failure; logname= uid=93 euid=93 tty= ruser= rhost= user=user ========================= It works just fine on the old server but not on the new one. I have verified that the user which is considered as unknown can log in to the console just fine, and I tried multiple users. I have found a bug report[1] which suggests that the authentication fails because exim uses its own user-ID to do the authentication. Yet the bug has probably been fixed. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=449256

1 0

CentOS-announce Digest, Vol 157, Issue 6
by centos-announce-request＠centos.org 21 Mar '18

21 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0549 Critical CentOS 6 firefox Security Update (Johnny Hughes) 2. CESA-2018:0549 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Mar 2018 16:39:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0549 Critical CentOS 6 firefox Security Update Message-ID: <20180320163922.GA16788(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0549 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0549 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0c39e8f9ce8178d7884b572f6b09979193aa48b7911fb9761e436c3852de738c firefox-52.7.2-1.el6.centos.i686.rpm x86_64: 0c39e8f9ce8178d7884b572f6b09979193aa48b7911fb9761e436c3852de738c firefox-52.7.2-1.el6.centos.i686.rpm d08188d33bb737bf691617c9de7894b19e3550325c10aa4196710c1b32650711 firefox-52.7.2-1.el6.centos.x86_64.rpm Source: 622a18de6cf2ea184ce40fa9505b3312bb407fa35ad329cf1fa3dae25c861156 firefox-52.7.2-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 20 Mar 2018 16:40:23 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0549 Critical CentOS 7 firefox Security Update Message-ID: <20180320164023.GA16890(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0549 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0549 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 90c6836eb7f11692f50299231d26262822f79d4da6e1e1cb36e6dcc68c1dd870 firefox-52.7.2-1.el7.centos.i686.rpm 5b8934a852316df6ce2fe5488c2a4ea8d78d1d2724a50be7f73f2874494918d2 firefox-52.7.2-1.el7.centos.x86_64.rpm Source: 1a16107c6ed3d75c81ac01897c88f3c82a10faa894a74b3830ee5359ea7d86e5 firefox-52.7.2-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 6 ***********************************************

1 0

Upgrade Centos 6 to Centos 7 32 Bits i686 architecture.
by Ger van Dijck 20 Mar '18

20 Mar '18

Hi , I am running Centos 6 on an old Acer S2000 PC 1Mb memory and i686 32 bits architecture. Question : Is there a possibility to upgrade to Centos 7 32 bits ? Regards , Ger van Dijck. -- Gemaakt met Opera's e-mailprogramma: http://www.opera.com/mail/

4 3

selinux: how to allow access?
by hw 20 Mar '18

20 Mar '18

Hi, how do I allow exim access to a socket in order to be able to do local deliveries to cyrus? type=AVC msg=audit(1521179280.845:1920270): avc: denied { name_connect } for pid=319 comm="exim" dest=24 scontext=system_u:system_r:exim_t:s0 tcontext=system_u:object_r:lmtp_port_t:s0 tclass=tcp_socket Yet again I could not find any documentation explaining how to do basic things like this :( Selinux is more like a curse than anything else :( Why is there not even a good documentation?

7 10

CentOS-announce Digest, Vol 157, Issue 5
by centos-announce-request＠centos.org 20 Mar '18

20 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Announcing the release for Gluster 4.0 on CentOS Linux 7 x86_64 (Niels de Vos) 2. Announcing the release for Gluster 4.0 on CentOS Linux 6 x86_64 (Niels de Vos) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Mar 2018 20:16:50 +0100 From: Niels de Vos <ndevos(a)redhat.com> To: centos-announce(a)centos.org Subject: [CentOS-announce] Announcing the release for Gluster 4.0 on CentOS Linux 7 x86_64 Message-ID: <20180319191650.GJ2528(a)ndevos-x270.lan.nixpanic.net> Content-Type: text/plain; charset="us-ascii" I am happy to announce the General Availability of Gluster 4.0 for CentOS 7 on x86_64. These packages are following the upstream Gluster Community releases, and will receive monthly bugfix updates. Gluster 4.0 is a Short-Term-Maintenance release, and will only receive updates until the next version (4.1) becomes available. The difference between Long-Term-Maintenance and Short-Term-Maintenance releases is explained on the Gluster release schedule page: https://www.gluster.org/community/release-schedule/ Users of CentOS 7 can now simply install Gluster 4.0 with only these two commands: # yum install centos-release-gluster40 # yum install glusterfs-server The centos-release-gluster40 package is delivered via CentOS Extras repos. This contains all the metadata and dependancy information, needed to install Gluster 4.0. Note that the standard centos-release-gluster (virtual) package is still available and points to the 3.12 version. This is intentional because 3.12 is a Long-Term-Maintenance version and does not require users to update the major versions avery couple of months. Some deployments may need to install the centos-release-gluster package as well as centos-release-gluster40 to fullfill dependencies for other projects (possibly for oVirt, there may be others). We have a quickstart guide specifically built around the packages are available, it makes for a good introduction to Gluster and will help get you started in just a few simple steps, this quick start is available at https://wiki.centos.org/SpecialInterestGroup/Storage/gluster-Quickstart More details about the packages that the Gluster project provides in the Storage SIG is available in the documentation: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster The centos-release-gluster* repositories offer additional packages that enhance the usability of Gluster itself. Utilities and tools that were working with previous versions of Gluster are expected to stay working fine. If there are any proboems, or requests for additional tools and applications to be provided, just send us an email with your suggestions. The current list of packages that is (planned to become) available can be found here: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster/Ecosystem-pkgs We welcome all feedback, comments and contributions. You can get in touch with the CentOS Storage SIG on the centos-devel mailing list ( https://lists.centos.org ) and with the Gluster developer and user communities at https://www.gluster.org/mailman/listinfo , we are also available on irc at #gluster on irc.freenode.net, and on twitter at @gluster . Cheers, Niels de Vos Storage SIG member & Gluster maintainer

1 0

[LEARNING OUTCOME] Wi-Fi WPA Hacking Tool is Totally Useless on New Wireless Routers
by Turritopsis Dohrnii Teo En Ming 19 Mar '18

19 Mar '18

Hi, I am sharing my learning outcomes. Recently I downloaded Kali Linux 64-bit Version 2018.1 and ran it on my HP laptop with the integrated Intel Dual Band Wireless-AC 8260 Wireless Network Card. I wanted to test if I could hack the Wi-Fi WPA password on Ruckus R700 Access Point (AP) and the Aztech DSL8900GR(AC) Wireless Router. So I started using the Reaver WPA cracking tool. I understand that the Reaver tool works because there is a bug with Wi-Fi Protected Setup (WPS). I have no luck with Reaver on the Ruckus R700 Access Point. After running Reaver, I found out that WPS is permanently disabled on the Ruckus R700 AP with no option to turn it back on at all. Hence It is not possible to hack the WPA password on Ruckus R700 AP. Understanding that I couldn't do anything further with Ruckus R700 AP, I proceeded to test Reaver on the Aztech DSL8900GR(AC) wireless router. In this case, I also found out that WPS is disabled by default on the Aztech wireless router. Reaver will not be useful at all if WPS is disabled. But there is an option to enable WPS. So I enabled WPS in the Aztech wireless router configuration page. And continued testing with Reaver. But because Aztech wireless router has the rate limiting security feature, brute force password attacks will be very slow and probably take forever. The rate limiting security feature on the Aztech wireless router is meant to slow you down when you are brute forcing the WPS pin. So here is my conclusion: Reaver Wi-Fi WPA hacking tool is totally useless on new wireless routers which have the WPS disabled or have implemented a fix for the WPS bug. Are there any other WPA cracking tools which I can use in my educational learning journey? Please advise. Mr. Turritopsis Dohrnii Teo En Ming Singapore 13 March 2018 Tuesday 4:28 PM Singapore Time ===BEGIN SIGNATURE=== Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 30 Oct 2017 [1] https://tdtemcerts.wordpress.com/ [2] http://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming ===END SIGNATURE===

2 1

xfs file system errors
by Jerry Geis 18 Mar '18

18 Mar '18

How do I fix an xfs file system error ? I searched and it says to run xfs_repair /dev/sda1 - did not work. I got an error on boot and the machine dropped into service mode by entering the PW. I entered the above command and it said couldnt load library... SO I rebooted, dropped into rescue mode. Again I entered the command above and it said teh same thing.something about could not load library What am I missing ? Thanks, Jerry

4 3

cyrus: socket options
by hw 17 Mar '18

17 Mar '18

Hi, what are the following messages supposed to tell me and does this indicate a problem? # systemctl status cyrus-imapd [...] master[3766]: unable to setsocketopt(IP_TOS): Operation not supported master[3766]: unable to setsocketopt(IP_TOS): Operation not supported [...] Exim says it can not connect to the lmtp socket even when selinux doesn´t get in the way. The configuration looks like this: cyrus.conf (none of the two options work): [...] # lmtp cmd="lmtpd -a" listen="lmtp:127.0.0.1" prefork=4 lmtpunix cmd="lmtpd -a" listen="/var/lib/imap/socket/lmtp" prefork=4 [...] exim.conf: [...] begin transports # cyrus_ltcp: # driver = smtp # protocol = lmtp # delivery_date_add # envelope_to_add # return_path_add # hosts = localhost # allow_localhost lmtp_socket: driver = lmtp socket = /var/lib/imap/socket/lmtp delivery_date_add envelope_to_add return_path_add # ls -la /var/lib/imap/socket/lmtp srwxrwxrwx. 1 root root 0 Mar 16 12:58 /var/lib/imap/socket/lmtp I have this working on the old server (which doesn´t run Centos) and am trying to migrate it to the new one (which runs Centos 7.4). The version of cyrus and sasl are the same on both machines. What´s the problem with Centos that these things don´t just work as they usually do?

2 4

spectre variant 2
by Fred Smith 17 Mar '18

17 Mar '18

Hi all! I'm running an up-to-date Centos-7 on an AMD Vishera 6300, 6 core CPU. I note that when I run the redhat script to test for spectre & meltdown I get this result for variant 2: Variant #2 (Spectre): Vulnerable CVE-2017-5715 - speculative execution branch target injection - Kernel with mitigation patches: OK - HW support / updated microcode: NO - IBRS: Not disabled on kernel commandline - IBPB: Not disabled on kernel commandline and when I run the one from github I get this: CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigated according to the /sys interface: NO (kernel confirms your system is vulnerable) * Mitigation 1 * Kernel is compiled with IBRS/IBPB support: YES * Currently enabled features * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * IBPB enabled: NO * Mitigation 2 * Kernel compiled with retpoline option: YES * Kernel compiled with a retpoline-aware compiler: UNKNOWN > STATUS: VULNERABLE (Vulnerable: Retpoline without IBPB) So, I"m wondering: 1. has RH in fact released mitigations for this issue for AMD processors, and 2. has AMD released microcode updates for this? I have no idea how to query AMD with such a question, anybody here know? Thanks in advance! -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

2 2

CentOS-announce Digest, Vol 157, Issue 4
by centos-announce-request＠centos.org 16 Mar '18

16 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0526 Critical CentOS 6 firefox Security Update (Johnny Hughes) 2. CESA-2018:0527 Critical CentOS 7 firefox Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 15 Mar 2018 18:59:48 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0526 Critical CentOS 6 firefox Security Update Message-ID: <20180315185948.GA44704(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0526 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0526 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm x86_64: 29059b6e8c894eef2944154ad9c3e5e98178bd2903a918ab1ab3b35098e1faf3 firefox-52.7.0-1.el6.centos.i686.rpm 5ab36e9cf3534cc1af6c6ee3d6e302907235e8f8dd2b00f8003ea2e3ef98d272 firefox-52.7.0-1.el6.centos.x86_64.rpm Source: ae98346dd0287b8d7fe36edd4692a1980f4fcf1d53e7633307e33e67adfe9a71 firefox-52.7.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Thu, 15 Mar 2018 19:24:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0527 Critical CentOS 7 firefox Security Update Message-ID: <20180315192433.GA58165(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0527 Critical Upstream details at : https://access.redhat.com/errata/RHSA-2018:0527 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 3d4f163b3fe61aa41272b201f56732c9352c1e12d13e85dc15f466363d0ba59b firefox-52.7.0-1.el7.centos.i686.rpm 9546d6326537d96a09245d90386164fd8786578b2c5de142e3f877c532e85612 firefox-52.7.0-1.el7.centos.x86_64.rpm Source: 0852393b938ea86a3af795b46909d5fc13cf9da3f9f9b6ff85c8b2c2ee2f3e17 firefox-52.7.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 4 ***********************************************

1 0

VirtualBox on CentOS 7 with bridged network not working
by James Pearson 16 Mar '18

16 Mar '18

I've installed VirtualBox v5.2 on a CentOS 7.4 machine, but VMs set up with bridged networking can not 'see' past the VirtualBox host machine i.e. the VM can ping the host and vice versa, but the VM can not ping anything else and other machines on the same subnet can't ping the VM There are no firewall rules configured on the 7.4 host and selinux is disabled I have a similar set up on a CentOS 6.9 host, where everything works as expected Googling doesn't show up any similar issues, so I guess I'm missing something on the host machine Does anyone have any idea what could be the issue? Thanks James Pearson

3 3

ISCSI target + LVM Problem
by marcos sr 15 Mar '18

15 Mar '18

Hello, I have a LVM with 2 ISCSI disk mounted. The partition started presents problem such " i/o error". I unmounted the device, and restarted target server in scsi, wich as having some problems. After that i mapped iscsi and trying to mount partition again but: When i run the pvdisplay i get the following erro: read failed after 0 of 4096 at 0: Input/output error And cannot mount partition.

2 4

Squid + SquidGuard : static block page not working
by Nicolas Kovacs 15 Mar '18

15 Mar '18

Hi, I've been working with Squid + SquidGuard for a few years, though only on Slackware. I'm currently transferring my proxy expertise to CentOS 7, and right now I'm having a little problem with that. Squid works perfectly so far as a transparent HTTP + HTTPS cache proxy. The next step is to add SquidGuard, so I installed it and edited the most basic /etc/squid/squidGuard.conf file possible. In this setup, my workstation (192.168.2.2) is allowed to access anything on the Web, and all other client machines on the networks are blocked and should be redirected to the avertissement.html block page for every request. --8<------------------------------------------------------------------ # /etc/squid/squidGuard.conf dbhome /var/squidGuard logdir /var/log/squidGuard src admin { ip 192.168.2.2 } acl { admin { pass any } default { pass none redirect http://nestor.microlinux.lan/avertissement.html } } --8<------------------------------------------------------------------ I appended the following lines to /etc/squid/squid.conf: --8<------------------------------------------------------------------ # SquidGuard url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf url_rewrite_children 5 --8<------------------------------------------------------------------ Now this setup sort of works. My workstation can access anything, other clients are blocked. Unfortunately, the block page avertissement.html is not displayed. Instead, I get a Squid error page: The following error was encountered while trying to retrieve the URL: https://http/* Unable to determine IP address from host name "http". Any idea why my static block page avertissement.html is not displayed? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Good work, Red Hat!
by isdtor 15 Mar '18

15 Mar '18

Delivered as per https://access.redhat.com/articles/3311301. This is good news. Backporting those updates across three gcc versions does not look like the easiest exercise to me. $ rpm -qp --changelog gcc-4.4.7-18.el6_9.2.x86_64.rpm |head -n 6 * Wed Jan 31 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.2 - Fix indirect_jump/tablejump patters for retpolines (#1535656) * Tue Jan 23 2018 Jeff Law <law(a)redhat.com> 4.4.7-18.1 - Retpoline support (#1535656) $ rpm -qp --changelog kernel-2.6.32-696.23.1.el6.x86_64.rpm ... * Sat Feb 10 2018 Jan Stancek <jstancek(a)redhat.com> [2.6.32-696.23.1.el6] - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455] - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645] - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645] - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645] ...

1 0

CentOS 6 i386 - meltdown and spectre
by Peter Wood 13 Mar '18

13 Mar '18

I have a clean install, fully updated CentOS 6 32-bit. When I run the Red Hat detection script: https://access.redhat.com/sites/default/files/spectre-meltdown--a79614b.sh it finds that the system is vulnerable. Is this false positive or there is no patches for CentOS 6 32-bit systems? Thank you, -- Peter

4 7

Squid vs. iptables redirection: exception for certain domains ?
by Nicolas Kovacs 12 Mar '18

12 Mar '18

Hi, I'm currently facing a quite tricky problem. Here goes. I have setup Squid as a transparent HTTP+HTTPS proxy in my local network. All web traffic gets handed over to Squid by an iptables script on the server. Here's the relevant section in /etc/squid/squid.conf: --8<------------------------------------------------------------- # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/amandine.sandbox.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB --8<------------------------------------------------------------- And here's the corresponding section of my firewall script: --8<------------------------------------------------------------- # Commandes IPT=/usr/sbin/iptables SYS=/usr/sbin/sysctl SERVICE=/usr/sbin/service # Internet IFACE_INET=enp2s0 # Réseau local IFACE_LAN=virbr0 IFACE_LAN_IP=192.168.2.0/24 # Serveur SERVER_IP=192.168.2.1 ... # Squid $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3128 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 80 -j REDIRECT --to-port 3128 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3129 -j ACCEPT $IPT -A PREROUTING -t nat -i $IFACE_LAN -p tcp ! -d $SERVER_IP \ --dport 443 -j REDIRECT --to-port 3129 $IPT -A INPUT -p tcp -i $IFACE_LAN --dport 3130 -j ACCEPT $IPT -A INPUT -p udp -i $IFACE_LAN --dport 3130 -j ACCEPT --8<------------------------------------------------------------- This setup works nicely for the vast majority of web sites. BUT: a handful of sites has some trouble with my local certificate. For example, I can't sync my local Github repo anymore. Or my local OwnCloud client spews back a warning message on every startup. I asked on the Squid mailing list if there was a possibility to create an exception for a list of domains, so that these can simply bypass the proxy. The problem is, according to one of the developers, I have to tackle that problem earlier in the process, e. g. in the firewall setup. So here's what I want to do, in plain words: 1. Redirect all HTTP traffic (port 80) to port 3128. So far so good. 2. Redirect all HTTPS traffic (port 443) to port 3129. Equally OK. AND... 3. DO NOT REDIRECT traffic that goes to certain domains, like: github.com credit-cooperatif.coop cloud.microlinux.fr squid-cache.org etc. Ideally, these domains should be read from a simple text file. Any idea how I could do that? I don't even know if this is theoretically possible. Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 6

SELinux breaks Squid's ssl_crtd helper
by Nicolas Kovacs 10 Mar '18

10 Mar '18

Hi, I've setup a transparent HTTP+HTTPS proxy on my server running CentOS 7, using Squid. Here's my configuration file. --8<---------------------------------------------------------------- # /etc/squid/squid.conf # Définitions acl localnet src 192.168.2.0/24 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # Règles d'accès http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost manager http_access deny manager http_access allow localnet http_access allow localhost http_access deny all # Ports du proxy http_port 3130 http_port 3128 intercept https_port 3129 intercept ssl-bump \ cert=/etc/squid/ssl_cert/nestor.microlinux.lan.pem \ generate-host-certificates=on dynamic_cert_mem_cache_size=4MB # Emplacement de ssl_crtd et du cache des certificats TLS sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1 # SSL-Bump acl step1 at_step SslBump1 ssl_bump peek step1 ssl_bump bump all # Taille du cache dans la RAM cache_mem 2048 MB # Emplacement et taille du cache sur le disque # cache_dir ufs /var/spool/squid 100 16 256 # Vidage système coredump_dir /var/spool/squid # Durée de vie des fichiers sans date d'expiration refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 --8<---------------------------------------------------------------- First, I tested the configuration in permissive mode, where it works perfectly. After running it a while, I get the following SELinux alert. # sealert -a /var/log/audit/audit.log ***** Plugin catchall (17.1 confidence) suggests ***** If you believe that ssl_crtd should be allowed read access on the index.txt file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ssl_crtd' --raw | audit2allow -M my-sslcrtd # semodule -i my-sslcrtd.pp Unfortunately the suggested solution doesn't work, because the problem reappears, and I get all sorts of errors in /var/log/squid/cache.log, all due to ssl_crtd not being able to access stuff under /var/lib/ssl_db. Any idea how I can solve this problem permanently ? Cheers, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 3

kpartx can not detach
by Leon Fauster 10 Mar '18

10 Mar '18

OS: EL6 - sometimes I use kpartx -a /mnt/.../lvdisk.img to map the partitions and mount them via /dev/mapper/loop0pX After using the disk (unmounting it) I noticed that detaching such mapping via kpartx -d does not result in freeing up the loop devices. Results: System reboots shows that the filesystem where lvdisk.img is located can't be unmounted. lsof, fuser, ps does not show any usage. Even removing the device node via dmsetup remove /dev/mapper/loop0pX does not help. Trying to unmount the underlying filesystem still shows /mnt: device is busy. Any other suggestions would be greatly appreciated! -- Thanks LF

2 2

yum list "available" versus "updates", and centosplus versioning
by Robert P. J. Day 10 Mar '18

10 Mar '18

quite possibly more a yum question than a centos question, but i'm a bit confused about the difference between listing "available" packages versus "updates" packages. short example -- listing what the yum man page suggests should be "available" for installation, restricting myself to centosplus: $ yum list available --disablerepo=\* --enablerepo=centosplus ... snip ... Available Packages kernel-plus.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-abi-whitelists.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-doc.noarch 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-headers.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus kernel-plus-tools-libs-devel.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ first, i always thought "yum list available" would list only packages that i did not *already* have installed, and if i wanted to list installed packages eligible for update, i would run: $ yum list updates --disablerepo=\* --enablerepo=centosplus Updated Packages postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus $ as you can see, the alleged updates are also listed as "available" from the first command -- has it always been this way? if so, i guess i just never noticed. (is there a way to list *only* available, uninstalled packages with some sort of filter?) more curiously, some of the available packages from the centosplus repo have a package version that says merely "centos", not "centos.plus": postfix.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-perl-scripts.x86_64 2:2.10.1-6.0.1.el7.centos centosplus postfix-sysvinit.noarch 2:2.10.1-6.0.1.el7.centos centosplus ^^^^^^ is that deliberate? it would seem to have the potential for confusion if one searches later for packages based on that string. finally, the alleged update for python-perf: python-perf.x86_64 3.10.0-693.17.1.el7.centos.plus centosplus would seem to match *exactly* the currently installed numeric version on my system: $ rpm -q python-perf python-perf-3.10.0-693.17.1.el7.x86_64 $ that is, both seem to be "3.10.0-693.17.1.el7", so how would this constitute an available "update"? perhaps there's something fundamental about version numbering and the centosplus repo i'm missing here. rday

1 0

Upcoming Dojos: Bangalore, Singapore
by Rich Bowen 09 Mar '18

09 Mar '18

I want to draw attention to two upcoming events. First, we have the CentOS Bangalore Dojo. Details are still emerging, but it will be held on March 21 at the Red Hat India office. Details are https://www.meetup.com/CentOS-India/events/248566854/ and more details will be coming very soon. Then, on the following Sunday, March 25th, we'll be holding another Dojo as part of the FOSSAsia event in Singapore, at the Lifelong Learning Institute. The schedule for that event is almost complete, and further details are available here: https://wiki.centos.org/Events/Dojo/Singapore2018 Other tentative upcoming events are listed at https://wiki.centos.org/Events If you are holding any CentOS events - or if you would like to - please get in touch with the centos-promo mailing list (or me directly, if you prefer) for assistance in producing and/or promoting those events. -- Rich Bowen - rbowen(a)redhat.com @RDOcommunity // @CentOSProject // @rbowen

1 0

Re: [CentOS] FW: Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 09 Mar '18

09 Mar '18

Le 09/03/2018 à 12:01, Patton, Eamonn J a écrit : > Just to let you know that our Office365 safelinks analyser is > categorising the link given below (regarding Squid with SquidAnalyzer > "blog.microlinux.fr") as "malicious". That usually means they have > detected (or think they have detected) some malware on the site. Thanks for reporting this. Though I bluntly admit I just ignore everything coming from Microsoft. Hotmail has been tagging my company's mailserver as a spammer for ages, so I'm tagging everything coming from Microsoft as crapware. Nothing good has ever been produced by this company. The last time I actually used MS Windows for work was around 2001, before Windows XP came out. This is the year I moved to Linux (Slackware 7.1 at the time), and I've been 100 % GNU/Linux ever since. :o) Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 2

Issues with Mirror Sites
by Kenneth Sutherland 09 Mar '18

09 Mar '18

Hi, Newbie question, is there a problem with the Centos 7 mirror sites, no matter what I do the mirror sites are reporting back the meta data in the repodata folder is wrong and I cant do a Yum Update? when I browse to a few of the mirror sites it looks to me that they sym links are broken? I apologies in advance if I got this completely wrong as am still learning Cheers in advance Ken

1 0

mate-terminal crash when using drag-n-drop tabs
by James Pearson 09 Mar '18

09 Mar '18

We're using mate-terminal (1.16.3) from EPEL on CentOS 7.4 with the Mate desktop, but mate-terminal crashes when we do the following: Start mate-terminal, open a tab (File -> Open Tab) then with the left mouse button drag a tab and drop it in the same terminal window - and the terminal window crashes ... I did a bit of Googling, and found this issue reported in earlier releases of mate-terminal - which was fixed - but no mention of issues with 1.16.x However, if I rebuild and install the package from the mate-terminal 1.16.3 SRPM from EPEL, it doesn't crash ... Which is rather bizarre Just wondering if anyone else has seen this problem and/or could explain what might be causing the issue with the binary from EPEL ? Thanks James Pearson

1 1

Memory Leak with PHP
by Alain Jean-Mairet 09 Mar '18

09 Mar '18

I understand that this problem may have very little to do with CentOs, but it happens to occur on a CentOS webserver and maybe you’ll have a clue. Since a few months, after many upgrades on several blogs (now running with PHP7), our server is eating up RAM no end. PHP processes swell to over 2 GB (each) and when the whole RAM and the whole swap are full, problems stack up and finally paralyze the system. This despite having “memory_limit = 512M" in all php.ini (there are several PHP versions on the system, selection is made via .htaccess). CenOS 6.9 on a Xeon 8 cores with now 64 GB RAM. This is a snip of a top this morning, just 2 days after the latest reboot: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 31163 apache 20 0 939m 690m 8876 S 51.5 1.1 102:16.90 php-fpm 29603 apache 20 0 1208m 961m 10m S 33.7 1.5 136:54.95 php-fpm 11858 apache 20 0 1660m 1.4g 9564 R 31.3 2.2 190:41.25 php-fpm 31207 apache 20 0 916m 668m 9636 R 18.1 1.0 101:38.72 php-fpm 31218 apache 20 0 930m 682m 9264 S 16.8 1.1 101:55.51 php-fpm 2873 apache 20 0 1694m 1.4g 9972 S 11.2 2.2 194:42.82 php-fpm 2854 apache 20 0 1657m 1.4g 10m S 9.9 2.2 191:15.43 php-fpm 2326 mysql 20 0 4993m 1.3g 6076 S 7.3 2.0 149:11.06 mysqld 2842 apache 20 0 1664m 1.4g 8996 S 4.9 2.2 191:34.00 php-fpm 17085 apache 20 0 1454m 1.2g 9824 S 1.3 1.9 167:25.43 php-fpm 13850 apache 20 0 464m 45m 5872 S 1.0 0.1 0:43.55 httpd 20044 root 20 0 15276 1496 952 R 1.0 0.0 15:05.99 top 1936 apache 20 0 1684m 1.4g 10m S 0.7 2.2 192:37.37 php-fpm 19109 apache 20 0 463m 44m 5808 S 0.7 0.1 0:18.66 httpd 24782 apache 20 0 465m 46m 5720 S 0.7 0.1 0:12.01 httpd 1848 apache 20 0 1579m 1.3g 10m S 0.3 2.1 183:02.13 php-fpm 2718 root 20 0 1074m 12m 2536 S 0.3 0.0 7:32.85 fail2ban-server 15221 apache 20 0 475m 49m 9508 S 0.3 0.1 0:22.24 httpd 16764 apache 20 0 476m 49m 9456 S 0.3 0.1 0:21.82 httpd 17757 apache 20 0 461m 42m 5784 S 0.3 0.1 0:18.26 httpd 19108 apache 20 0 463m 44m 5848 S 0.3 0.1 0:20.80 httpd 19155 apache 20 0 463m 44m 5756 S 0.3 0.1 0:17.15 httpd 24791 apache 20 0 462m 43m 5764 S 0.3 0.1 0:14.87 httpd 24794 apache 20 0 464m 45m 5780 S 0.3 0.1 0:15.07 httpd 29668 apache 20 0 459m 40m 5888 S 0.3 0.1 0:34.05 httpd 29794 apache 20 0 463m 44m 5868 S 0.3 0.1 0:35.23 httpd 31184 apache 20 0 936m 688m 9572 S 0.3 1.1 103:33.80 php-fpm 31212 apache 20 0 908m 660m 9860 S 0.3 1.0 101:27.74 php-fpm Any idea, suggestion would be greatly appreciated! --

1 0

RADIUS
by hw 09 Mar '18

09 Mar '18

Hi, I´m trying to figure out how to practically use RADIUS to authenticate users. So far, I have only found documentation explaining that the idea is that users somehow magically need to authenticate against a RADIUS server via a device like a switch or a wireless access point before they are given or being denied access to a network. I understand that I have to refer to the documentation of the switch or access point to figure out how to set up RADIUS authentication with the particular device. But how is this achieved in practice? Let´s say I have a couple laptops and a couple phones and a couple computers which connect either to a switch or to a wireless access point. Both the switch and the access point support RADIUS, and I would set them up to talk to the RADIUS server and require every device that wants to connect to the network through them to authenticate first. I also have a couple thin clients and a couple computers which use PXE-boot, and the users of those would have to provide authentication before the machines could even boot. Then what? How do I make it so that the users are actually able to authenticate? Is there any documentation about this? Or am I not supposed to use RADIUS but something else?

10 55

Squid and HTTPS interception on CentOS 7 ?
by Nicolas Kovacs 08 Mar '18

08 Mar '18

Hi, I've been running Squid successfully on CentOS 7 (and before that on 6 and 5), and it's always been running nicely. I've been using it mostly as a transparent proxy filter in school networks. So far, I've only been able to filter HTTP. Do any of you do transparent HTTPS filtering ? Any suggestions, advice, caveats, do's and don'ts ? Cheers from the snowy South of France, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

13 32

NIC naming conventions and vmware
by John Ratliff 07 Mar '18

07 Mar '18

I have a couple of CentOS 7 machines running in a vmware environment. On all the older ones I've deployed, the NIC is named ens160, but on all of the new ones, it is named ens192. I can't find any difference in the hardware that would account for this. Any suggestions on what I can do to figure out why some are named ens160 and some ens192? Thanks.

4 3

An selinux issue
by m.roth＠5-cent.us 07 Mar '18

07 Mar '18

CentUS 7.4 >From sealert: SELinux is preventing /usr/sbin/sshd from read access on the file /etc/ssh/moduli. ***** Plugin restorecon (94.8 confidence) suggests ************************ If you want to fix the label. /etc/ssh/moduli default label should be etc_t. Then you can run restorecon. Do # /sbin/restorecon -v /etc/ssh/moduli <...> Additional Information: Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 Target Context system_u:object_r:unlabeled_t:s0 Target Objects /etc/ssh/moduli [ file ] Source sshd Source Path /usr/sbin/sshd --------- Except: ls -laFZ /etc/ssh/moduli -rw-r--r--. root root system:object_r:etc_t:s0 /etc/ssh/moduli ls -laFZ /usr/sbin/sshd -rwxr-xr-x. root root system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd* And I even restarted sshd. So, what's selinux seeing that I'm not? mark

1 0

latest skype (version 8.16.0.4) on Centos 7
by Fred Smith 07 Mar '18

07 Mar '18

Hi all! I've finally been reduced to having to install Skype on my Linux box. I resisted for years, but now ended up trying it. and while the latest RPM installs just fine, it refuses to acknowledge that I have a microphone! In fact I have two: 1 in the USB web cam (it finds the cam), the second in a Plantronics USB headset, which works fine but not with skype. it is as if it doesn't exist. So, when I connect to someone I can hear them, see them, and they can see me, but I'm producing no sound output. All the web hits I can find for nonfunctional microphone on the web are for Ubuntu. GAH! running ldd against the skypeforlinux binary results in a huge list of shared libraries, including libasound (which is what the ubuntu messages say is missing). Anybody got a clue? Thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- "For him who is able to keep you from falling and to present you before his glorious presence without fault and with great joy--to the only God our Savior be glory, majesty, power and authority, through Jesus Christ our Lord, before all ages, now and forevermore! Amen." ----------------------------- Jude 1:24,25 (niv) -----------------------------

6 9

evince
by Chris Olson 06 Mar '18

06 Mar '18

We have some small networks with connectivity to the Internet through firewall routers. The smallest has one Windows 7 system and three Linux systems including both CentOS 6 and CentOS 7 machines. The Windows 7 systems have full Adobe packages that are updated regularly and are trouble free. On the Linux systems, evince has been our go to product for viewing and printing .pdf documents. This has worked well for at least four years. Some .pdf documents received recently from insurance companies and financial institutions appear to have a font problem that we have not been able to solve. Information available at the sites listed below have been no help. Previous font problems with various warnings have been solved automatically with substitution, but this does not seem to be working with these new files. The current problem leaves blank nearly half of the pages in some documents. Is there better source to look for answers than these two: http://www.gnome.org/projects/evince/ https://wiki.gnome.org/Apps/Evince Any help with this issue would be greatly appreciated. Thanks. [user@computer ~]$ uname -a Linux delle520 2.6.32-696.20.1.el6.x86_64 #1 SMP Fri Jan 26 17:51:45 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux [user@computer]$ evince Plan.pdf Error: could not create type1 face some font thing failed Error: could not create type1 face some font thing failed o o o o

6 6

Addind kmail to EPEL
by Yves Bellefeuille 05 Mar '18

05 Mar '18

I finally decided to move from CentOS 6 to CentOS 7, but was surprised to see that kmail is no longer included: Red Hat deliberately decided to omit it. How can I ask that kmail be added to EPEL? The information on EPEL's site basically says to submit it myself, but that's above my capabilities. -- Yves Bellefeuille <yan(a)storm.ca>

3 2

sqlinux weirdness
by Fred Smith 04 Mar '18

04 Mar '18

Every now and then I get an alert like this one. I have no clue what this "rear" subsystem is, or why madam would be trying to write to its log file. Can anyone enlighten me? thanks in advance! ------------------------- SELinux is preventing /usr/sbin/mdadm from write access on the file /var/log/rear/rear-fcshome.log.lockless. ***** Plugin restorecon (93.9 confidence) suggests ************************ If you want to fix the label. /var/log/rear/rear-fcshome.log.lockless default label should be var_log_t. Then you can run restorecon. Do # /sbin/restorecon -v /var/log/rear/rear-fcshome.log.lockless ***** Plugin leaks (6.10 confidence) suggests ***************************** If you want to ignore mdadm trying to write access the rear-fcshome.log.lockless file, because you believe it should not need this access. Then you should report this as a bug. You can generate a local policy module to dontaudit this access. Do # ausearch -x /usr/sbin/mdadm --raw | audit2allow -D -M my-mdadm # semodule -i my-mdadm.pp ***** Plugin catchall (1.43 confidence) suggests ************************** If you believe that mdadm should be allowed write access on the rear-fcshome.log.lockless file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'mdadm' --raw | audit2allow -M my-mdadm # semodule -i my-mdadm.pp Additional Information: Source Context system_u:system_r:mdadm_t:s0-s0:c0.c1023 Target Context system_u:object_r:cron_log_t:s0 Target Objects /var/log/rear/rear-fcshome.log.lockless [ file ] Source mdadm Source Path /usr/sbin/mdadm Port <Unknown> Host fcshome.stoneham.ma.us Source RPM Packages mdadm-4.0-5.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name fcshome.stoneham.ma.us Platform Linux fcshome.stoneham.ma.us 3.10.0-693.17.1.el7.x86_64 #1 SMP Thu Jan 25 20:13:58 UTC 2018 x86_64 x86_64 Alert Count 2550 First Seen 2016-12-13 01:30:06 EST Last Seen 2018-03-03 01:30:07 EST Local ID ce9a5be1-55a8-4ad2-bdd9-eefcb5fc7c5b Raw Audit Messages type=AVC msg=audit(1520058607.285:46041): avc: denied { write } for pid=17471 comm="mdadm" path="/var/log/rear/rear-fcshome.log.lockless" dev="md126" ino=1368832 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cron_log_t:s0 tclass=file -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- God made him who had no sin to be sin for us, so that in him we might become the righteousness of God." --------------------------- Corinthians 5:21 ---------------------------------

3 3

Web site not responding with Firefox 52.6.0 (64-bit)
by dsavage＠peaknet.net 04 Mar '18

04 Mar '18

I don't know if this is a CentOS7/Firefox problem or one with the distant web site slashdot.org. I can connect to it just fine with the latest Firefox on my Windows 10 desktop PC, but not with Firefox 52.6.0 on this CentOS 7.4 laptop. This has been an on-going problem for several weeks. Google search results are sketchy. slashdot.org may have been a DDOS target today, but as I write this network monitors say it's up and running. RC4 deprecation may be a factor, but I doubt it. I can traceroute to the site just fine, and its URL resolves with no trouble. The error message I'm getting is "The connection has timed out" The URL I've used forever is: https://slashdot.org/index2.pl?fhfilter=journal&source=autorefresh&nobeta=1 I'm stumped. Does this sound familiar to anyone in CentOS land? --Doc Savage Fairview Heights, IL

4 3

why does "rescue" mode bring me to runlevel 5 (multi-user target)?
by Robert P. J. Day 02 Mar '18

02 Mar '18

finishing a week of teaching a comptia linux+ class off of centos 7.4 and wanted to demo how to boot to "rescue" mode, so i rebooted, selected "rescue" mode at grub menu, which still booted to full multiuser, graphical mode. what am i doing wrong? or is this a dumb question? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

2 2

Going back to a minimal system : strange problem
by Nicolas Kovacs 02 Mar '18

02 Mar '18

Hi, Some time ago I wrote a little script elaguer.sh ("élaguer" means "to prune") which simply removes all packages that are *not* part of a minimal installation. First I created a list of packages that make up a minimal CentOS installation. On a fresh install, I would do something like this: # rpm -qa --queryformat '%{NAME}\n' | sort > minimal.txt Here's the resulting list of packages. I added a comment on top: https://github.com/kikinovak/centos-7-server-lan/blob/master/config/pkglist… And here's the script to prune the installation, e. g. remove everything that's not on the list. https://github.com/kikinovak/centos-7-server-lan/blob/master/elaguer.sh This script worked perfectly for some time. But now it seems like something has changed somewhere under the hood. Because when I run it now, the script fails at the final package removal stage. One curious detail: it seems like it tries now to remove 'yum' and 'systemd', so 'yum' exits with an error. But it didn't do that before, so my guess is either 'yum' behaves differently now, or package dependencies are calculated differently. Anyway, I'm a bit clueless here. Any suggestions? Cheers from the freezing South of France, Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 4

Mirror Problem
by Günther J. Niederwimmer 01 Mar '18

01 Mar '18

Hello, I have thousands of this messages on my servers ?? Is this a Problem on my site or is the infrastructure broken?? /etc/cron.hourly/0yum-hourly.cron: Could not get metalink https://mirrors.fedoraproject.org/metalink? repo=epel-7&arch=x86_64 error was 14: HTTPS Error 503 - Service Unavailable Thanks for a answer, -- mit freundlichen Grüssen / best regards, Günther J. Niederwimmer

4 4

pid_max
by Jerry Geis 01 Mar '18

01 Mar '18

I have two systems both running CentOS 7.4 one shows pid_max as 32768 the other shows pid_max as 49152 Why might that be ? I would have thought they would be the same. I have not changed them. Thanks, Jerry

3 3

CentOS-announce Digest, Vol 157, Issue 1
by centos-announce-request＠centos.org 01 Mar '18

01 Mar '18

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2018:0349 Important CentOS 6 java-1.7.0-openjdk Security Update (Johnny Hughes) 2. CESA-2018:0349 Important CentOS 7 java-1.7.0-openjdk Security Update (Johnny Hughes) 3. CESA-2018:0350 Important CentOS 7 gcab Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 28 Feb 2018 11:23:40 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0349 Important CentOS 6 java-1.7.0-openjdk Security Update Message-ID: <20180228112340.GA58274(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0349 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0349 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 25621bf1dabaf8d41c99d1442ce2cd88eb00635ac1197bc5d4af967edb640911 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.i686.rpm fd90cfe03e59ba60e0f7839ecab2320c49fc6279ea484c71a430d930c907e29a java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el6_9.i686.rpm b06939f1a4c10e735464804d50f0cb41a1b33a3f1f23652bbcfc730c3e841a17 java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el6_9.i686.rpm 8b1c571ceafaa9ef20510f0aed1b6986e5e138f9c61650c380678df7479759bb java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el6_9.noarch.rpm 0af4d015904759c1baa612ec873ff249ce01114c770961f7cb1663b7923acba1 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el6_9.i686.rpm x86_64: a2fbc3409ece060461e3078e6c89574130ef5b3c61296619a1f92f22938116e2 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm 5f9392cda539d562e03fd78928fc13e08dc7800ebbbdeefd6f10ca0f5afadffe java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm a37bab5c919e367a443d66a67959aad210f2819b7e5a16fb349b462d7347129c java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm 8b1c571ceafaa9ef20510f0aed1b6986e5e138f9c61650c380678df7479759bb java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el6_9.noarch.rpm 6fc3136630f186350a4d77543fa62048dee2da8702cbd4dad8b840d844113663 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm Source: fdf94e5cfc95f0556f3e1171ad8a2d1dc462d84ed4c611786ff058e2fe1189cb java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Wed, 28 Feb 2018 11:24:45 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0349 Important CentOS 7 java-1.7.0-openjdk Security Update Message-ID: <20180228112445.GA58396(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0349 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0349 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 6f912645f951cbaa4bdecf0e8ebf94989d449347354b523cf564cc1878f4cf6d java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 9cf6333d77597fa9105ffd9dfbda0834d1559d5c8ea96b2c534d52e351ccb22d java-1.7.0-openjdk-accessibility-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 3488e88d268a606ff504c7fce522979574840a4bc3622329d0f1937cf25809a0 java-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm db2bacd8b44684ed3ec345312a5735a30cb43522e685b6b50b7952949242b9ae java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 682a3b811be97f896cc96cacb8a0305bc36a144579868fa7db8f3b80447a319e java-1.7.0-openjdk-headless-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm 261e18e5fe67c742c69eefcdd60172d866aafd2c36e31dfe12afffdd464f22be java-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el7_4.noarch.rpm 0b80b903b2e1dda0bb1b19f5bab3f5ea56fb3ab0418004ffbc05d0169ac55677 java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el7_4.x86_64.rpm Source: 0638716bc311fcd8b41c25eb918957d9bcc8d8d90bbff6becfbad8e12a2f2805 java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Wed, 28 Feb 2018 11:25:25 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2018:0350 Important CentOS 7 gcab Security Update Message-ID: <20180228112525.GA58469(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2018:0350 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0350 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f172ac9bbbbc30f74002bfd179ca8c5e3bafdfd3932446c8f7029b1524bcf1d4 gcab-0.7-4.el7_4.x86_64.rpm 14dd5e016d3a137a398061627c36c9d39e5b48e1e90cb69ac8055bcd3b9eeeac libgcab1-0.7-4.el7_4.i686.rpm 57a7bcffe10f0f231769d7d95185c4ae9960512874b72a08616ad31943581504 libgcab1-0.7-4.el7_4.x86_64.rpm 954395631dcba4a37c80feec8cd6357ca04863ff1ae4d64f14023c64072b4d87 libgcab1-devel-0.7-4.el7_4.i686.rpm fec5a948fdae12f5a0c62bc54fde879be283e1605462e7ba834ad863ca78ee2c libgcab1-devel-0.7-4.el7_4.x86_64.rpm Source: 25fd25e04b094da2fb0bd53595f11902fcc9c784ba9d470ac7c6281fb1f8cbc0 gcab-0.7-4.el7_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Subject: Digest Footer _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce ------------------------------ End of CentOS-announce Digest, Vol 157, Issue 1 ***********************************************

1 0

Best practices to manager multiples sysadmins working as root with multiple servers?
by marcos sr 28 Feb '18

28 Feb '18

Hello In my new company they have a lot of CentOS linux servers. I was wondering what is the best practice do manage access root to a multiples sysadmin in multiple servers. Pupper? Ldap? Proxy Server with ssh? Thanks for attention.

2 1

Any alternatives for the horrible reposync
by Dennis Jacobfeuerborn 28 Feb '18

28 Feb '18

Hi, I'm currently trying to mirror a couple of yum repositories and the only tool that seems to be available for this is reposync. Unfortunately reposync for some inexplicable reason seems to use the yum config of the local system as a basis for its work which makes no sense and creates all kinds of problems where cache directories and metadata gets mixed up. Are there any alternatives? Some repos support rsync but not all of them so I'm looking for something that works for all repos. Regards, Dennis

5 6

Ubiquiti Model UAP-AC-PRO
by Gregory P. Ennis 27 Feb '18

27 Feb '18

Everyone, Have any of you installed ubiguiti wireless routers on your network? It looks like the setup requires the use of software; they have some packages that are ready made for Ubuntu and Debian, but not RedHat https://www.ubnt.com/download/unifi/unifi-ap-ac-pro Have any of you tried or succeeded in installation this on Centos 7.4? Greg Ennis

9 15

How to update modules in iniramfs fastly
by wuzhouhui 27 Feb '18

27 Feb '18

I know dracut can update modules in initramfs, but I think it is too slow. So I'm wondering what is the fastest way to update modules in initramfs of CentOS 7? Thanks!

4 6

Cloud image_index: is 1801-01 a release?
by Nicholas Timkovich 26 Feb '18

26 Feb '18

I load CentOS cloud images into our infrastructure for our users to use, and I have a script that looks at https://cloud.centos.org/centos/7/images/image-index, picking what has the highest revision, to find the new hotness. Up until the most recent image, they've all appeared in there; is this changing going forward? How can I automatically find the newest one and its revision tag? The untagged "latest" ones (linked to by the https://wiki.centos.org/Download page) don't appear in the sha256sums file, so I couldn't even compare sums. Can I petition for keeping the cloud image-index up-to-date? -- Nick Timkovich | Software Engineer | Computation Institute, University of Chicago | npt(a)uchicago.edu

1 0

lensfun-update-data on CentOS 7
by wwp 26 Feb '18

26 Feb '18

Hello there, did anybody have lensfun-update-data (*) to work on CentOS 7? Here I get, as root: $ lensfun-update-data Traceback (most recent call last): File "/bin/lensfun-update-data", line 118, in <module> read_location("http://lensfun.sourceforge.net/db/") File "/bin/lensfun-update-data", line 99, in read_location print("Reading {} \u2026".format(base_url + "versions.json")) UnicodeEncodeError: 'ascii' codec can't encode character '\u2026' in position 56: ordinal not in range(128) (*) 0.3.1 from EPEL. Regards, -- wwp

1 0

Re-enable grub boot in UEFI (Windows took over it)
by wwp 26 Feb '18

26 Feb '18

Hello there, Dell XPS-15-9560 laptop (SSD drive, UEFI, secure boot off).. Windows 10 pre-installed, CentOS7 installed in a separate partition and running for months w/o issue. Don't know what happened but at reboot yesterday (not even booted in Windows, just rebooted), grub has disappeared, booted in Windows by default, which apparently has taken over the UEFI boot. By booting from a USB drive w/ CentOS7 LiveGnome, I could use its grub command prompt to inspect the UEFI of the local SSD drive, see that the centos/ sub-directory and files are still there. /boot/efi/EFI/centos/: BOOT.CSV BOOTX64.CSV fonts grub.cfg grub.cfg.1501243846.rpmsave grub.cfg.1505469290.rpmsave grubenv grubx64.efi mmx64.efi shim.efi shimx64-centos.efi shimx64.efi maybe /boot/efi/EFI/Boot/ contents has been altered? /boot/efi/EFI/Boot/: bootx64.efi fbx64.efi I had a backup of the full efi partition (`dd`) but it's outdated and I feel it's a bad idea to restore the partition from it. Still from this "external" grub prompt, I could boot into my CentOS7 using: configfile (hd0,gpt1)/EFI/centos/grub.cfg At least I know how to get back to it :-). But now, how could I give the UEFI control back to grub? Is there a grub2 or grubby command I can run to make grub the default? I've read a lot and still cannot figure out exactly what to do or don't dare running commands that could make things worse. And I have the feeling the at next Windows boot, I may need to do it again.. Regards, -- wwp

3 9

Set LANG on CentOS 6 server
by Nicolas Kovacs 24 Feb '18

24 Feb '18

Hi, I'm having a weird problem on a CentOS 6 server. I installed the machine in french, so I have LANG=fr_FR.UTF8 defined. I'd like to define en_US.UTF8, because some output is better readable in english, like chkconfig --list. I replaced fr_FR.UTF8 in /etc/sysconfig/i18n and /boot/grub/grub.conf. Unfortunately, when I reboot the system, I still get this: # echo $LANG fr_FR.UTF-8 Any suggestions? Niki -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Site : https://www.microlinux.fr Blog : https://blog.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

2 2

Network broke for a while when libvirtd start
by wuzhouhui 24 Feb '18

24 Feb '18

When start service libvirtd by service libvirtd start the network will broke for a while and then reconnected. Following is /var/log/messages: Feb 24 13:28:51 node-0 kernel: lo: Dropping TSO features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: lo: Disabled Privacy Extensions Feb 24 13:28:51 node-0 kernel: virbr0: Dropping TSO features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: virbr0: Dropping TSO6 features since no CSUM feature. Feb 24 13:28:51 node-0 kernel: device virbr0-nic entered promiscuous mode Feb 24 13:28:51 node-0 kernel: virbr0: starting userspace STP failed, starting kernel STP Feb 24 13:28:51 node-0 kernel: ip_tables: (C) 2000-2006 Netfilter Core Team Feb 24 13:28:51 node-0 kernel: nf_conntrack version 0.5.0 (16384 buckets, 65536 max) Feb 24 13:28:51 node-0 kernel: virbr0: topology change detected, propagating Feb 24 13:28:51 node-0 kernel: virbr0: port 1(virbr0-nic) entering forwarding state Feb 24 13:28:51 node-0 kernel: 8021q: adding VLAN 0 to HW filter on device virbr0 Feb 24 13:28:51 node-0 kernel: ixgbe 0000:02:00.0: eth2: detected SFP+: 3 Feb 24 13:28:52 node-0 kernel: ixgbe 0000:02:00.1: eth3: detected SFP+: 4 Feb 24 13:28:52 node-0 kernel: bonding: bond0: link status definitely down for interface eth2, disabling it Feb 24 13:28:52 node-0 kernel: virbr0: port 1(virbr0-nic) entering disabled state Feb 24 13:28:52 node-0 kernel: bonding: bond0: link status definitely down for interface eth3, disabling it Feb 24 13:28:53 node-0 kernel: ixgbe 0000:02:00.0: eth2: NIC Link is Up 10 Gbps, Flow Control: RX/TX Feb 24 13:28:53 node-0 kernel: bond0: link status definitely up for interface eth2, 10000 Mbps full duplex. Feb 24 13:28:53 node-0 kernel: ixgbe 0000:02:00.1: eth3: NIC Link is Up 10 Gbps, Flow Control: RX/TX Feb 24 13:28:53 node-0 kernel: bond0: link status definitely up for interface eth3, 10000 Mbps full duplex. OS: CentOS 6.5 libvirt: libvirt-daemon-1.2.5-1.mira1.x86_64 Does anyone know the reason?

2 2

a few simple questions about upgrading an "official" centos 7 release
by Robert P. J. Day 24 Feb '18

24 Feb '18

again, some fairly trivial(?) questions about working with centos 7.4, given my time immersed in fedora so i want to make sure i'm not carrying over any bad habits. first, is there anything untoward in updating an installed version of centos 7.4 with a simple "yum update"? i'm well aware of keeping in mind the goal of stability with centos, so am unsure what the philosophy is of pulling in new updates as cavalierly as i do with fedora. currently, "yum list updates" shows me 206 possible updates; should i have any concern about updating packages coming from the standard centos repos? next, are there any issues replacing yum wihth dnf? i found this piece: https://www.vultr.com/docs/use-dnf-to-manage-software-packages-on-centos-7 which suggests it shouldn't be a problem. thoughts? finally, any concerns i should have about upgrading the kernel from 3.10 to 4.14 or 4.15, as explained in a number of places like this: https://www.tecmint.com/install-upgrade-kernel-version-in-centos-7/ i simply prefer to run a current kernel but i can resist the temptation if upgrading that on a centos 7.4 system would introduce more problems than are worth it. thoughts? rday

5 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss