- Discuss - lists.centos.org

Still VPN
by Simone 27 May '05

27 May '05

Hi, still trying to understand one thing. I would definitely like to tell iptables to accept all packets coming from remote vpn only if they hit the $VIRTUALVPNINTERFACE. I tried -o ipsec0 but this is not working, looks like ipsec0 device doesn't exist or it is not recognized. I red on the Openswan users list, that Linux kernel 2.6 native ipsec don't create ipsec* interface (if I am not wrong this is something backported on kernel 2.4 RHEL3) just add a route to remote network through eth0, so if I want to ssh the vpn server on his internal ip from the other side of the vpn I need $IPTABLES -A INPUT -i *$EXTIF* -s $MYEXTNETWORK -d $INTIP -p tcp -m tcp --dport 22 -j ACCEPT and this is true for any other rule I would use ipsec0 in, I have to use $EXTIF. Even if I am going to set sshd to listen on a different port, I am a little worried this could harm my machine in any way. Comments are welcome Have a nice day Simone

2 2

CentOS-announce Digest, Vol 3, Issue 16
by centos-announce-request＠centos.org 27 May '05

27 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Official CentOS CD/DVD Vendor Program (Johnny Hughes) 2. CESA-2005:413 Important CentOS 4 x86_64 ImageMagick - security update (Johnny Hughes) 3. CESA-2005:413 Important CentOS 4 i386 ImageMagick - security update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 May 2005 10:03:38 -0500 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] Official CentOS CD/DVD Vendor Program To: CentOS ML <centos(a)centos.org> Cc: centos-announce(a)centos.org Message-ID: <1117119818.1469.209.camel(a)myth.home.local> Content-Type: text/plain; charset="us-ascii" All, I would like to announce our Official CentOS CD/DVD Vendor Program. We currently have 3 vendors, and 2 more who are putting together their information. (Not bad ... the official program has been going for less than 12 hours :) The details of the program (how to get in it, what they give back to the CentOS Project, etc.) are here: http://www.centos.org/images/CentOS_CD_Vendors.pdf Here is the page that contains the current vendors: http://www.centos.org/vendors The CentOS project has looked at the vendors listed, and we highly recommend them if you want to buy CentOS CDs or DVDs. They give back to the CentOS Project for every CentOS CD/DVD they sell and we greatly appreciate it. If you are a CD/DVD vendor and are interested in being in our official program, see the above guide. If you are a CentOS user looking to buy CDs or DVDs, please use our official vendors to get all your pre-made CDs or DVDs (not just CentOS products) ... and if you are buying other products from them because they are official CentOS vendors, let them know that is the reason :) Thanks, Johnny Hughes

1 0

bash 3.0 freezes
by jose luis faria 27 May '05

27 May '05

Hello centos users, I download the bash 3.0 and compile it in CentOS 4.0 with or withiut all patchs. But when I execute the comand ls -l it freezes. Any idea? -- :) cumprimentos -------------------------- José Luís Faria

2 1

mouse issues in centos 4
by Mark Elam 27 May '05

27 May '05

Hi all, I am the IT department here at my office, I take care of everything pretty much. I chose Centos4 to deploy to my 50 workstations as it was the most compatible with the RHEL. We need the RHEL compatibility for support contract for different tools we use. So far it has been great. I have noticed a few issues since having 50 machines all exactly the same installed with centos 4. I have them clustered, and generally they work well. I often see random loss of the mouse cursor, which results in having to restart X. (really pisses the engineers off) I cannot seem to track down why this is happening. Nothing in any logs give any clue to what is happening. I thought it may have to do with VMware, as this is installed on 80% of these machines, and most of the time it happened when users were using Vmware. But recently I have seen the problem on machines without VMware running or even installed. I have also noticed a similar issue with a Wacom tablet. The user will be using it for some amount of time and then it stops working. At first it is assigned /dev/input/event3, the kernel module (wacom.o) is loaded and everything is fine. It will then stop working after a while, behind the scenes the system thinks the tablet has been unplugged and replugged, then assigns it /dev/input/event4. This of course doesn't work because in the xorg.conf file it is looking for it at event3. I am not sure if these are related or not. But the symptoms seem similar. Of course the wacom tablet is USB and the mouse issues are with PS/2 mice. So they may be unrelated. Any help would be appreciated. Thanks for your time. -- ############################################################################# Mark Elam Direct: 408.869.4029 IT Administrator Cell: 408.221.2689 Mobilygen Corporation melam(a)mobilygen.com #############################################################################

4 4

can't locate /etc/ini.d/mysqld file!
by israel.garcia＠cimex.com.cu 26 May '05

26 May '05

List, I installed my server and I want to start Mysql, but I can not find the file /etc/ini.d/mysqld .. [root@netflow ntop]# rpm -qa|grep mysql mysqlclient10-3.23.58-4.RHEL4.1 libdbi-dbd-mysql-0.6.5-10.RHEL4.1 mysql-4.1.10a-1.RHEL4.1 mysql-devel-4.1.10a-1.RHEL4.1 Am I missing some mysql rpm from Cds? regards. israel

6 6

Re: [Centos] Mounting Netware Volumes
by Nels Lindquist 26 May '05

26 May '05

On 24 Mar 2005 at 19:33, Paul wrote: > Well I dug though the RH's site and in the release notes for AS 3.95 ite > mentionsed that ncpfs has been deprecated. I can't find the release > notes for 4, but assume that they must have removed support in the > kernel along with the package. Try installing the kernel-unsupported module. Both ncpfs.o and ipx.o (should you still require it) are in that module, at least for CentOS 3.x--haven't looked at 4.0 yet myself. ---- Nels Lindquist <*> Information Systems Manager Morningstar Air Express Inc.

5 6

Re: Demonizing generic Linux issues as Fedora Core-only issues -- this thread has ended ...
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > If you believe that, you have to believe that Red Hat's programmers > are always better than the original upstream program author. How do you assert that? It has _nothing_ to do with my statement. You keep thinking there is this absolute "black/white" on why developers, vendors, etc... do this or that. There are reasons to upgrade to a newer version, and there are other reasons to backport. One is _not_ better than the other, or developers are not any more or less "smart" if they do. What I said was it is _harder_ for a distro to take the take to backport fixes and minimize impact to existing compatibility than to merely just rely and ship the latest version from a developer. There are reasons to upgrade (features, project support, etc...) and there are reason to backport (minimal impact, regression tested inter-package compatibility, etc...). There is no "black/white" on which one is "better." I just merely stated _why_ SLA guaranteed distros do the "backport," which is more difficult to accommodate because the project developers/support typically are just focused on the next version, and you have to replicate much of their knowledge/expertise internally (instead of just taking their next version with the patches/fixes). > I'll agree that they are good and on the average do a good job, but > that stops far short of saying that they know better than the > perl (etc.) teams what version you should be running. And _where_ did I say that? All I said was that _backporting_ is done to _minimize_ impact to the _entire_ set of _all_ packages that have been "regression tested" into a released, SLA guaranteed distro. That's what RHEL/SLES are about. At what point are you going to stop seeing what I saw as a black/white thing and realize that RHEL/SLES have _different_ foci than what you may want, and _that's_ why you're not getting what you want in stock CentOS? Is it really that hard to understand? When you understand that there is a pro/con to "staying current" v. "backports," and why distros like RHEL/SLES are typically "anal" to the "backport" side -- which seemingly conflicts with what you want, then we can talk. Until then, you seem to want to assert that what I'm saying is something about "better" when that is _not_ what I'm saying. I'm trying to explain "why" -- _not_ "better." End of thread. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

About tunnels
by Maciej Żenczykowski 26 May '05

26 May '05

Hi folks, I have two CentOS 4 server I administrate doing routing and firewalling of two networks (one NATed and firewalled and the other one merely firewalled) and I'd like to build a tunnel to allow computers on the normal private network (and the firewall) to access the private IPs of computers behind the NAT/firewall. ie. ALPHA BETA 10.0.0.0/8 - CentOS4 - internet - CentOS4 - X.Y.Z.0/24 Private IPs Firewall Firewall Public IPs and NAT now the internet is intracity, within one provider and decently safe (6 hops), but still some sort of encryption would be nice... (otherwise I'd just use ip tunnel). How do I allow both BETA and X.Y.Z.0/24 to connect to the private IPs? Should I use CIPE? IPSEC? something else? any good howtos? Preferably something fast and reliable, doesn't need to be that easy to set up :) I'm basically looking for comments, I have looked around on google, and it seems there's _tons_ of options, but IPSEC seems to be winning out... am I correct in that assumption? Cheers, MaZe.

2 1

Re: [CentOS] Re: Official CentOS CD/DVD Vendor Program
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Chris Mauritz <chrism(a)imntv.com> > If this was going to be a 100 unit/day or 1000 unit/day affair, I'd > agree with you, but it simply isn't. One or two people with cheap CD > and DVD duplicators, a paypal merchant account, and some time on their > hands is probably still overkill for the volume of sales, especially > when the product is available for free to anyone with a broadband > connection and a burner. Capacity planning. It's better to make only $500 and miss out on $1,000 than to have orders of $10,000 and only be able to service $2,500. > No, not really. What this says to me is that the CentOS team is doing > all the labour and some unecessary middleman is skimming the cream off > the top. Wouldn't you like to see the CentOS project receive more of a > share of the take for doing most of the work? I would. No, CentOS is focusing on what it does best and tapping others to do what they do best. But as someone else pointed out, form a CD/DVD duplication reseller and make a better offer and CentOS will likely take you up on it! > Spare me the condescending remarks. You knew what I meant. You mega-oversimplified, so no I did not. It's one thing to volunteer, that's great. In fact, at first, I thought that's what you were doing. But then you started to post all these things that just were like a "slap in face." Looking from the viewpoint of those CentOS managers who "put the time" and, more importantly, the _detail_ in on this, you showed you didn't have the faintest idea of what was involved. Again, as someone else pointed out, form a CD/DVD duplication reseller and make a better offer and CentOS will likely take you up on it! In fact, although there are the "minimal requirements" of $1/set under this plan, there's _nothing_ stopping different CD/DVD duplication resellers from playing a game of "one-up-manship" to gain the title of "highest proceeds" to CentOS. So instead of being so negative on what the leaders of this project have done so far, from a standpoint that was rather "shallow," why not be constructive and go ahead and offer to be a CD/DVD duplication reseller! The terms of the program are there -- go for it! You're open to it! ;-> > Looking back at the volume in the "demonizing" thread, I think I don't > have nearly the same amount of free time to spend jousting about > something so trivial in this mailing list with you. You're obviously a > very opinionated guy Oh, very, very much so. I am extremely opinionated. As far as "free time," I write for part of my living, and much of it comes from discussions on boards like this. As far as my "day job," it's largely 8x5, one advantage of being a traveling consultant that does more "architecture/design" than "analysis/support." > and often full of very sage advice to go along with the voluminous > opinion. Opinion to one is experience to another. I have _no_problem_ taking years to gain the trust of people. I think credentials don't mean squat, and trust comes from hearing people say things and finding out if they are applicable and useful over time. Again, even years. > But I found this reply to be more than a bit obnoxious. As did I your "volunteering." It's one thing to honestly "volunteer." It's another to belittle the initiative of the managers of this project who obviously took far more time, attention to detail and actually work to get the program going. There is no reason why you can't "volunteer" under this program by becoming a CD/DVD reseller yourself, under the same terms as any other. If you honestly believe you can do it better and cheaper than the current vendors who are signed up, then please do! We would all benefit if you did. That's all I was saying. And yes, I did berrate much of what you said for the reason I just explained. > The point of my message is that it seems like the CentOS guys > are doing all the heavy lifting and companies that (at least to me) > add very little value are taking the lion's share of the revenue for > these CD/DVD sets. As are arm-chair users who don't take the time to understand the details involved on things like this. I have taken what at least one other has said and re-gurgitated what you _can_ do under the program's terms that does _exactly_ what you want to do. So I suggest you consider becoming a CD/DVD duplicator/reseller yourself then. BTW, I might not be involved with CentOS, but I'm trying to do my (small/ too-small-to-even-speak-of) part on Fedora, which affects both RHEL and CentOS. And I can fully appreciate all of what the CentOS project does. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > Thanks - as you probably know, the long-winded discussion isn't > really about CIPE specifically so much as the philosophy behind > bundling a few thousand things together and then trying to > please anyone with a blanket policy about maintaining backwards > compatibility vs bug fixes vs new features. You just can't please everyone. But it does help if people focus on "why" something is done -- the pros/cons versus doing something else -- instead of trying to assert what is "better" (as well as stopping to listen to someone and realize they are not asserting anything as "better," just trying to explain "why"). CentOS is based on RHEL. RHEL has its policies. > And while I realize that there may never be a good solution, I'll be > really happy if some new options fall out of it, like this being > included in a centos kernel-unsupported-something-or-other package. I think CentOS is optionally filling that gap between FC and RHEL quite well for those that want it. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Official CentOS CD/DVD Vendor Program
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

My $0.02 ... From: Chris Mauritz <chrism(a)imntv.com> > What's the point? Awareness, partnerships, retail notoriety and most of all, a starting point for now. You have to start somewhere. > I checked out linux cd mall. They charge $12.50 for the CD set (or DVD) > and CentOS makes ONE DOLLAR. Unless you envision tens of thousands > of people buying CDs, it hardly seems like a worthwhile endeavor I can envision that volume per year. > unless you're the CD distributor. The CD distributor has the economies-of-scale in the fact that they already have a built infrastructure, web front, relationships, etc... that CentOS can tap. For CentOS to build the same infrastructure, it would cost far more per unit sold -- at least at, again, "a starting point for now." > Why not just find a way to make it easier for people to donate directly > to the project instead of creating a needless middleman who is taking > 92% of the money for each CD/DVD set sold? Again, costs involved are relevative here. > Hell, for 92% of the profit, No, that's 92% of the _revenue_, and _not_ the "profit" (sometimes I think some Linux advocates need a refresher course in basic microeconomics ;-). There are more costs involved than just CD duplication here. > I'd be more than happy to sit at home and burn DVDs all day. And take orders? And handle shipping? And resolve issues with the site, customers, MC/VISA complaince on e-commerce, etc...? You can only do so much on your own before you need someone already doing it who can do it for much cheaper. > Where do I sign? 8-) You sign next to "I will learn how the infrastructure and operational costs of e-commerce works before I speak again." ;-> More seriously now, does everyone have to question everything around here? You don't think the management hasn't thought of these things? Why does everyone seem to believe they know better than the management who not only volunteers their time, but puts in the hours to be productive, including all the "less fun stuff" in the logistics and attention to detail? More pertinent, if you make posts like this, that are only include 5% of the actual details involved with doing such (and expose what can only be termed ignorance of the other 95%), how seriously do you think people can take your comments? I didn't. ;-ppp -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

insmod ip_conntrack_ftp
by Mickael Maddison 26 May '05

26 May '05

Hello CentOS, Is there a specific RPM that makes "insmod ip_conntrack_ftp" available? I've been using that on a number of servers fine, but the latest one I've built, running insmod ip_conntrack_ftp gives me: insmod: can't read 'ip_conntrack_ftp': No such file or directory -- Best regards, Mickael mailto:mike@kamloopsbc.com www.MickaelMaddison.com

3 3

Re: Demonizing generic Linux issues as Fedora Core-only issues -- why I hate these meta-discussions ...
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: "Bryan J. Smith <b.j.smith(a)ieee.org>" > You are indeed correct (I must have been looking at the RHEL3 dir**) First off, that's now 2 strikes for me. Small ones considering the context well outside of the points, but still it hurts my credibility. This is one of the things I hate about meta-discussions, at least how I approach them. Sometimes I just need to learn that it doesn't matter how many additional examples I give, some people aren't going to do anything but blame Red Hat. And by giving example after example, or attempting explain item after item, I'm going to eventually slip up from memory from time-to-time, which hurts my credibility -- regardless if the actual mistake was small given the context of the discussion. Sigh, there is a point where one should just resign and submit to the fact that if something doesn't work for someone, and { Microsoft, Red Hat, SuSE, even Debian as of late, etc... } is involved anywhere at all (even if it's a fork to another architecture -- e.g., anyone who has dealt with Cobalt/Sun releases, a primary reason for Red Hat's latter trademark enforcement ;-), the other person has no interest in understanding the "root" cause and will not see anyting to the contrary. My apologies for tying up the list with this non-sense. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: Demonizing generic Linux issues as Fedora Core-only issues -- MySQL 3 v. 4 linking licensing issues
by Bryan J. Smith <b.j.smith＠ieee.org> 26 May '05

26 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > RHEL-4 shipped with MySQL 4.1.x (and has a 3.23.58 client to work with > older databases) ... the latest SRPMS are mysql-4.1.10a-1.RHEL4.1.src.rpm > and mysqlclient10-3.23.58-4.RHEL4.1.src.rpm. You are indeed correct (I must have been looking at the RHEL3 dir**): ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4/en/os/i386/SRPMS/ Hmmm, that's actually a _major_ variance from Fedora Core 3: http://download.fedora.redhat.com/pub/fedora/linux/core/3/i386/os/Fedora/RP… [ **NOTE: I have not supported MySQL since the RHL9/RHEL3 series, hence why I didn't know it off-hand, just of the linking issues with version 4. ] Which begs the questions: 1) How much testing did it get in the Fedora Development/Core series? 2) How did they solve some of the linking issues I've heard about? As I mentioned before, the current Fedora Core 4 Test has it too, so I have to assume one of the following: A) Red Hat negotiated a license to redistribute as built as before but now for MySQL 4 (not likely since even FC4 has it now, unless the license also applies there, but I doubt it based on how Red Hat makes sure any FC/FE packages are always 100% redistributable by others) B) Red Hat shifted away from the few static links that it has previously used (more likely?) C) The packages causing the linking licensing issues have change their licensing? (NuSphere possibly?) D) MySQL AB changed its stance on linking in MySQL 4 as of v4.1? Anyone know the answer? I have to go back and research why Red Hat stuck with 3.23 and see how they are now redistributing 4.1x? > CentOS-4 has the identical programs {as with all other items except > LOGOS, trademarked text, and yum and where updates are done} in it's > base :) Which is why I love it. I must have just looked at the wrong directory. I'm also very disturbed that Red Hat would not give the public time to test in the leading community releases. If I had to speculate, I'd say it's because it was already testing in most other distros, but I'll have to read up in Bugzilla on why the change was made (as well as what allowed Red Hat to change it's stance on MySQL 4 in the first place). -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

CentOS-announce Digest, Vol 3, Issue 15
by centos-announce-request＠centos.org 26 May '05

26 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update (Tru Huynh) 2. CESA-2005:413 Important CentOS 3 x86_64 ImageMagick - security update (Tru Huynh) 3. CESA-2005:472 Important CentOS 3 i386 kernel - security update (Tru Huynh) 4. CESA-2005:472 Important CentOS 3 x86_64 kernel - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Thu, 26 May 2005 00:46:09 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:413 Important CentOS 3 i386 ImageMagick - security update To: centos-announce(a)centos.org Message-ID: <20050525224609.GA30869(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:413 ImageMagick security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-413.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ImageMagick-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-c++-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-devel-5.5.6-14.i386.rpm updates/i386/RPMS/ImageMagick-perl-5.5.6-14.i386.rpm source: updates/SRPMS/ImageMagick-5.5.6-14.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ImageMagick\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: Betr.: [CentOS] VPN
by Peter Farrow 26 May '05

26 May '05

Hi there, yes it was with a Nortel contivity on a few occassions and the other times with a Cisco pix. interstingly enough the Cisco VPNs often required updates to the IOS to make them 3Des compliant, As its late here in the UK (past midnight GMT+1) here is a very quick and dirty freeswan guide. Needless to say the things that cause the biggest headache for most users is the use of RSA keys and opportunistic encryption. Since this is NOT what 99.9% of the masses need or want then there is a quick and simple and just as secure alternative setup, but its not that well documented. Opportunistic encryption came in versions 2 and above of freeswan by default, this has the effect of clobbering the network default route and replacing it down the ipsec interface (what you want if you want to encrypt everything, but not really any great use in the real world). Most people want to do site <-> site vpns and these are best achieved without opportunistic encryption and by the use of preshared keys. 1)Make sure you get a version of freeswan suitable for your kernel, if you can't find one go to somewhere like rpms.pbone.net and find a kernel for which there is a freeswan version. Many people try and hunt a freeswan version to match their kernel, I do it the otherway round, find the latest freeswan compatible kernel you can for your architecture, you can always compile it from source but why my life harder for yourself. 2)get the freeswan module for the kernel you found, and the same freeswan-userland version as well. then proceed as follows: after you have installed the [from rpm] Typically to kill opportunistic encryption add these lines to your ipsec.conf file: after the config setup section near the top, conn block auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn clear auto=ignore conn packetdefault auto=ignore Doing this stops all the crap you get when ipsec starts and then kicks you off the system about 60 seconds later if you're connected remotely as this kills the opportunistic setup feature. Do the same at the other end as well. Then start the service. Then add a section for each tunnel you want to set up. if you have multiple subnets at each site which can't be encapsulated in a single subnet declaration, you will need to add a new tunnel defintion for each. Here is an example : conn site1-site2 #this is the connection name [tunnel] identifier left=21.21.100.10 #This is the ip address of the first linux box leftnexthop=21.21.100.9 #This is usually set to the defualt gateway for the first linux box leftsubnet=10.11.2.0/24 #This is the LAN subnet behind the first linux box right=21.21.100.178 #This is the IP address of the second linux box at the other end of the tunnel rightsubnet=10.11.4.0/24 #This is the LAN subnet behind the second linux box rightnexthop=21.21.100.177 #This is the IP address of the default gateway setting of the other linux box authby=secret #We are going to use a "password" or secret to encrypt/auth the link pfs=no #Turn off perfect forward security, this makes it faster and easier but less secure auto=add #Authorise but don't start esp=3des-md5-96 #encapsulating security payload setting, encryption used for auth and data Now cut and paste this and add it to the ipsec.conf file on the second machine completely as is, unmodified. Then in you /etc/ipsec.secrets file on each machine you will need to add a password [secret] for each each of the tunnels you have specified, in the above example we would have: 21.21.100.10 21.21.100.178 : PSK "a-passwordin-here-with-the-quotes" Add this to the very top of the ipsec secrets file, one entry for each pair of machines in this format leftmachineip rightmachineip : PSK "password" Then do a service ipsec restart on each machine, bring the link up with this command, it only needs to be invoked from either one of the ends ipsec auto --up site1-site2 You should get output like this if you did it right: ipsec auto --up site1-site2 104 "site1-site2" #2086: STATE_MAIN_I1: initiate 106 "site1-site2" #2086: STATE_MAIN_I2: sent MI2, expecting MR2 108 "site1-site2" #2086: STATE_MAIN_I3: sent MI3, expecting MR3 004 "site1-site2" #2086: STATE_MAIN_I4: ISAKMP SA established 112 "site1-site2" #2087: STATE_QUICK_I1: initiate 004 "site1-site2" #2087: STATE_QUICK_I2: sent QI2, IPsec SA established Remember you will need to allow the ipsec interface in your firewall and you will need to add lines like this: # Accept udp connections to port 500 for ipsec $IPTABLES -A INPUT -p udp --sport 500 --dport 500 -j ACCEPT $IPTABLES -A OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT This is just about the quickest way to set up a VPN tunnel with Freeswan, it takes minutes. If you want to make if more secure, you can tune the config once you get it running this way! Remember the only machines that can't see the full extent of the other LAN network are the linux boxes creating the tunnel. So the left linux box will not be able to ping stuff on 10.11.4.0/24 network and the right linux box will not be able to ping stuff on 10.11.2.0/24 network - don't forget this.... its commonly mistaken by some to mean the tunnel isn't working, to truly test it end to end you need hosts on the LANs at each end to ping each other. If you want to make it work through NATing gateways you will need to port forward the udp 500 setting above on your firewall. Enjoy! Pete Kennedy Clark wrote: >Any chance of getting a quick HOW-TO posted to the group for that? >;-) Sounds interesting. > >I saw your post about using it with Cisco & Nortel equipment -- I work >with both a lot at my current customer. What types of equipment have >you used it with from both vendors (e.g., Cisco: IOS, PIX, VPN3K; >Nortel = Contivity)? > >Thanks!! >Kennedy > >

3 13

Re: [CentOS-announce] CESA-2005:472 Important CentOS 3 i386 kernel - security update
by John Newbigin 26 May '05

26 May '05

The yum headers for these updates seem to be incomplete or out of date... perhaps only for non i686 arch. 0:kernel-source-2.4.21-32.EL.i386=RPMS/kernel-source-2.4.21-32.EL.i386.rpm Tru Huynh wrote: > CentOS Errata and Security Advisory 2005:472 > > kernel security update for CentOS 3 i386: > https://rhn.redhat.com/errata/RHSA-2005-472.html > > The following updated file has been uploaded and is currently syncing to > the mirrors: > > i386: > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-BOOT-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-doc-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-hugemem-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-hugemem-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-smp-unsupported-2.4.21-32.0.1.EL.i686.rpm > updates/i386/RPMS/kernel-source-2.4.21-32.0.1.EL.i386.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.athlon.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i586.rpm > updates/i386/RPMS/kernel-unsupported-2.4.21-32.0.1.EL.i686.rpm > > source: > updates/SRPMS/kernel-2.4.21-32.0.1.EL.src.rpm > > You may update your CentOS-3 i386 installations by running the command: > > yum update kernel\* > > Tru > > > ------------------------------------------------------------------------ > > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin

1 0

Re: [CentOS] Re: Centos and SAMBA
by Robert Moskowitz 26 May '05

26 May '05

At 05:14 PM 5/25/2005, Bryan J. Smith <b.j.smith(a)ieee.org> wrote: >From: Robert Moskowitz <rgm(a)htt-consult.com> > > I meant what is Centos equiv to in terms of Fedora. > > As the scripts I am using are set up for core 4. > >Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I do not know where I got that core 4. My blunder. Barrs Law of Recursive futility If you're smart enough to use one of these.... .....you can probably manage without one!

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > Yes, but... whose choice was it to ship 2.6 with lots of broken > and omitted stuff when 2.4 works better for many things? Again, 2-2-2, 6-6-6 At some point, Red Hat has to start the new series for "early adopters." That means being the first to adopt the new GLibC, GCC, kernel, etc... Looking at just the GLibC 2+ generations (post-LibC4/5)... EL0 series: GLibC 2.0, GCC 2.8.1.1, kernel 2.0 EL1 series: GLibC 2.1, GCC 2.91.66 (EGCS 1.1.2), kernel 2.2 EL2 series: GLibC 2.2, GCC 2.96, kernel 2.4 EL3 series: GLibC 2.3, GCC 3.2, kernel 2.4 EL4 series: GLibC 2.4, GCC 3.4, kernel 2.6 In each 2-4 "Community Linux" revisions of those "Enterprise Linux" series, Red Hat minimizes changes. Typically the .0 can go through a number of refinements from .0 to .1, but then they taper off in preparation for the .2 and 18 month EL series. But even what I call CL4.0 (Fedora Core 2) wasn't nearly as much of a shift as CL0.0 (Red Hat Linux 5.0), and still a bit better than CL2.0 (Red Hat Linux 7[.0]). One of my only complaint starting with Red Hat Linux 9 (_well_before_ Fedora Core) is the lack of revisions to warn us of ".0" like shifts. > Just because a developer writes some code and tacks on a higher > version number doesn't mean it's ready for prime time. Correct. I never said so and I have been _very_critical_ of Red Hat no longer using revisions to tell us that its either a major shift (.0) or an evolutionary update (.1, .2, etc...). And this was _before_ evne Fedora Core. Red Hat should have called Red Hat Linux 9 as Red Hat Linux 8.1. Yes, they added NTPL, but there have always been a few changes from a .0 to a .1 as things are more finalized. Every .0 revision has made some poor considerations in a few regards, and after the "early adopters" start using it, they are exposed. The reality is that most things are _not_ exposed _until_ people actually start using things. Even Red Hat Linux 7[.0] was regression tested to the anal power with GCC 2.96 and its ANSI C++ requirement, and it wasn't until after Red Hat released it that the projects that weren't writing ANSI C++ compliant software took note. People like to throw up the fact that Red Hat included GCC 2.91.66 (EGCS 1.1.2) for kernel building and that's why they should have gone with GCC 2.96, but I will return point out that many distros were shipping GCC 2.95 as well, and GCC 2.95 had a lot of issues with various software too. > Well, an occasional rant is therapeutic - or at least cheaper than > smashing the equipment that no longer works after you upgrade the > software. Constructive rants are good. They identify real technical issues. But "brand name" rants are typically full of ignorance, blaming companies for things outside their control, or outside their focus (e.g., features on a SLA-centric distro). Again, I think it's good to see projects like CentOS, but that doesn't mean you have to complain about Red Hat on things that are not Red Hat's doing or focus. The principles of configuration management are universal, and one must be wary of any new version, regardless of where it comes from. In the past, Red Hat made this very easy with revisions. With RHL9+, I think Red Hat really needs to bring them back. > I'm questioning the sensibility of shipping a kernel in what should be > an upgrade If Red Hat doesn't do it, another distro will. And then that distro can be chastized by people like yourself instead of Red Hat, and Red Hat will benefit from being on the trail that other distro's issues. I purposely kept my CL3.2 (Fedora Core 1) systems well after CL4.0 (Fedora Core 2) came out, and didn't upgrade until CL4.1 (Fedora Core 3) was released. I did the same of CL2.3 (Red Hat Linux 7.3) until CL3.1 (Red Hat Linux 9) came out, CL1.2 (Red Hat Linux 6.2) until CL2.1 (Red Hat Linux 7.1), etc... It's best to wait on a new distro series until 1 year after it first starts development, typically 6 months after it's first revision's release. Fedora Core 2 was _very_stable_, but it was _very_incompatible_ with many things because of its changes. Those compatibility issues will _not_ get resolved until someone finally releases an "early adopter" release and people then start throwing things at it. Heck, even SuSE does this too. And SuSE even came out with their Linux 2.6-based enterprise distro much sooner than Red Hat. So you could easily "double" your chastizing of Red Hat towards SuSE in the same regard. At some point, Red Hat has to "give up" further development on Linux 2.4, or anything else, and "move on." There's nothing stopping you from delaying your adoption for 6+ months, or even 36+ months (in the case of RHEL/CentOS). I've had this argument over and over with people -- not just Linux. You can't always blame vendors for your own professional negligence. Sometimes vendors just ship what consumers want, even when they tell them "we don't recommend this." A perfect example was Windows 95/98/Me -- something I _never_ allowed on my networks (only Windows NT 3.1, 3.50, 3.51, 4.0 and 2000). And that means you don't just go off and upgrade when the vendors says "we've changed all the core stuff" which is a definite sign that things might break. Your option is always that you can stick with the older release. Again, 6+ months for Fedora Core today, 36+ months for RHEL/ CentOS. > with many things that don't work at all that worked in > the previous version. Of course not! That's what change does! ;-> Red Hat release 2-4 revisions every 6 months before changing things up. SuSE does much of the same as well, and more distros are moving to this model too. Things break, but the idea is to maintain 2-4 revisions over 12-24 months that don't. In the case of Red Hat and SuSE, they also release a distro every 18 months based on the "most mature" revision and then support that for 60+ months under a subscription model. Otherwise, the overwhelming distros don't do such a good job, and _any_ release of theirs can dork up anything! I'd really like to find a vendor who balances "early adoption" with "anal SLA-level reliably" so well and for so long. It's the 2-2-2, 6-6-6 model that everyone, even Novell-SuSE, have adopted. > As you point out, these aren't surprises. > While I hate to complain about free software, I think that user's > experiences are relevant and should be reported even if they are > painful. That's fine, if you report them. But then people go beyond that and start "analyzing." And when I say "analyzing" I mean they "blame the vendor." And the illogic doesn't stop there -- they will blame Red Hat for issues with CentOS, or not realize that Red Hat really did take time, effort and extensive consideration to get it to work, and couldn't. And not only that, but when other distros ran into the same issues. > I'm not sure I believe that in the case of CIPE, since the 1.6 version > specifically addresses the changes in the 2.6 kernel and was available > well before FC3 or RHEL4 releases which did not include it again. Both FC3 and RHEL3 started with FC2. And FC2 has already been through 6 months of development and Fedora Core 3 was already entering into Test by the time CIPE 1.6 was finally available. And even then there were issues -- let alone issues with security and the lack of interest. At some point Red Hat crosses a threshhold where they have to say it's too close to release date. There's just not enough time to not only integrate the package, but give its "due dilligence" in package test (Rawhide/Development), distro regression test (Beta/Test) and post-release resolution. And when a package doesn't get modified to support kernel 2.6 until some 9 months after kernel 2.6 release, and still has issues, at some point, Red Hat's gotta say "this is going to cause us headaches to support." > If I were to speculate about intentions as you suggest above, I'd > guess that someone at RedHat read the one negative review published > about CIPE, decided it was no longer a selling point, and walked away > from the integration they had done before. And I'd say you haven't looked through Bugzilla. I don't know how many times I've seen people complain about Red Hat and then a few of them actually take the time to submit Bugzilla reports and then realize what happens. The few that do then change their tune. Any and every major decision on EL begins with their development of CL. And that has not varied in Fedora Core since the days of Red Hat Linux 4.0 on-ward. If you want to see something change, you have to get involved. And that means taking the time to understand what you _can_ do to see things change. It's very easy in the Red Hat Linux world. And its even easier now that Fedora Core is no longer the "product" that Red Hat Linux is, even though Red Hat Enterprise Linux has a 1:1 package relationship just like Red Hat Linux prior. > But of course I wouldn't speculate about something like that... You don't need to. Hit Bugzilla. There are people who like to complain from ignorance. And then there are people who like to complain from familiarity. I typically choose to be the latter, although I'm sure I've done the former more than once too. > It's a complicated system, and it isn't immediately obvious that other > distros have exactly the same problems. Do you know how many times I hear people say that? And I just have to shake my head because it can't be categorized as anything else but ignorance? Do you know how many times I hear someone call something a "Fedora Core 2-only issue" yet it plagues SuSE Linux 9.1, even SuSE Linux Enterprise Server (SLES) 9 and Mandrake 10.x as well? And they will actually sit there and say "it's only a Fedora Core 2 issue" no matter how many times I send them links? Red Hat has its model and it is extremely effective. But it also means that you have to understand why the "end" of 2-2-2 and 6-6-6 is more "reliable" than the "beginning." Fedora Core 2 was the beginning. Red Hat Enterprise Linux 4 was the end. At some point, if you keep introducing latest'n greatest that still have compatibility issues, you are going to affect the quality of the end. > If you follow www.distrowatch.com for a few months you'll see that they > each keep trying to improve things in different ways. Yes, and the overwhelming majority of distros on distrowatch.com don't have a good release model, and they break all sorts of things everytime they come out with a new version -- at least in comparison to Red Hat or SuSE. > Switching distros should always be an option - that's one of the > big reasons for using open source. But sometimes people switch distros out of "brand name blame" instead of actual "technical focus." I don't know how many times I've seen people argue over 2 distros that use the _exact_same_ base! I've literally had people argue to death that APT is Deb-centric, and the RPM world doesn't have anything equivalent. And sometimes I think people aren't "up-to-date" on different distros because they used one from years ago, and their preference more currently. As someone who deploys Debian, Fedora, Gentoo, SuSE and RHEL and SLES regularly, there's a lot of overlap. > But, in spite of what I consider an occasional bad choice, Like CIPE I assume? At what point are you going to recognize that CIPE was really "no choice" until Fedora Core 3 was in Test? > Fedora/RH seem to be among the best and I do give the fact that > they've been responsible for getting buggy software in front of a > vast number of people credit for it eventually being fixed. "Buggy"? Or "incompatible?" Big difference! If GNU Tar is incompatible with POSIX, and someone introduces a new version or replacement program, like Star, that is, do you know how much the "ignorant majority" absolutely derail that person? Or when LibC5 is not getting the attention it needs, has security issues, yet GLibC2 is active, solves a lot of security and compatibility issues, etc...? Or when lack of ANSI C++ compliance hurts compatibility with future code, and GCC 3 is being finally pushed? Or when the fact that GCC 2.95 was adopted by many distros even when the GCC team said they should not and stick with GCC 2.91.66 (EGCS 1.1.2) which is proven (and the kernel uses)? > If you remember the state of free software before RH 4.0 was > released you will know what I mean. I do sometimes wonder > how things would have turned out if someone had built an equally > easy to install CD based on freebsd first, though. Who says it isn't and I don't also deploy FreeBSD and NetBSD? [ If you own the book "Samba Unleashed," you might open up the Appendix on BSD UNIX and see someone's name you recognize. ;-] > Hmmm, just who would you blame for WindowsME? Oh, that was Microsoft. Although oeople professionally negligent enough to ever allow _any_ "Chicago" release on their network were the start of the issue. Windows Me was Microsoft's attempt to get their own application developers to stop using "Chicago" interfaces. The result was that they created a release that was both incompatible and unreliable. As I always said about Windows, you had your choice between incompatible (NT) and unreliable ("Chicago"). I choose the former, and I was in the minority. But I didn't have 98% of the problems other people had. > Who would you blame for the upgrade that made interfaces not > start if the hardware address in the configs didn't match > the NIC? That was bad news for my remote machines where all > the drives had been cloned and the IP addresses set before > shipping. I'd blame you because you cloned, not installed. ;-> You can't blame Red Hat for an install approach they don't test for. [ BTW, Ethernet hardware addresses are used in IPv6. ] > I'm not positive about this, but I think it happened > at about the same time across Fedora/RH/Centos updates instead > of following the scenario you mentioned for testing things that > are supposed to change behavior. What version? I can tell you exactly if it was a major or minor change. .0 always changes stuff. Sometimes .1 changes a few things that didn't make it or needed to be addressed. .2 rarely does, as well as the "enterprise" release. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Betr.: [CentOS] Centos and SAMBA
by Thom van der Boon 25 May '05

25 May '05

Hi, I've setup a SAMBA PDC on Centos 4 last weekend and migrated my NT4 PDC (Users, Groups, etc) to the new Centos Server in a matter of a couple of hours. I've used the scripts and howto from: http://samba.idealx.org/smbldap-howto.en.html#htoc89 Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> rgm(a)htt-consult.com 25.05.2005 20:03:41 >>> Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this.... _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re: Centos and SAMBA
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Robert Moskowitz <rgm(a)htt-consult.com> > I meant what is Centos equiv to in terms of Fedora. > As the scripts I am using are set up for core 4. Fedora Core 4 isn't even out yet. Test 3 just hit the other week. I've been calling it the first version (.0) of a new EL5 series (CL5.0) because it switches to GCC 4.0. I haven't looked at it deep enough to see if other things have changed, but it's safe to say at this point, with RHEL4 out, Red Hat is looking to "shake things up" so don't expect FC4 to have the same compatibility as FC2-FC3-RHEL4. [ BTW, I caught a typo in my EL0-EL4 reference I posted before. Both EL3 and EL4 use GLibC 2.3, as does this new EL5. ] -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Centos and SAMBA
by Robert Moskowitz 25 May '05

25 May '05

Is anyone here doing real use of SAMBA as an NT domain controller? I have been attempting to follow: http://web.vcs.u52.k12.me.us/linux/smbldap/ Which is set up to work with Fedora core 4 (how is this equiv to centos 4?) It looks like I am rather far along. Hit my first obvious problem with the IMC populate script. It would be nice to have a centos version of all this....

2 2

Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Les Mikesell <lesmikesell(a)gmail.com> > I'm still wondering about that... If anyone except Linus himself > even suggested that changing kernel interfaces in a way that would > break device drivers was a good thing, I can't imagine the reaction. > I could see that the changes through 2.4 were improving things, but > is there anything that is measurably better in 2.6 (at least compared > to the RH-patched 2.4)? I've been too busy trying to make some > firewire drives work as well as they did on FC1 to notice any other > changes. Agreed. But even Red Hat stands on the shoulders of Linus and the kernel developers. No matter how many people Red Hat puts on the kernel, there are still things outside of Red Hat's control. If you don't like what does or doesn't go into RHEL/CentOS, then you need to get involved with Fedora Core and make a case of what should. And one way to do that is to donate time. Because if it's not proven in Fedora Core to Red Hat's tastes, it doesn't go into RHEL/CentOS. So the most effective way you can influence RHEL, and therefore CentOS, is to get involved with Fedora Core. Red Hat is _not_ going to "force" something that it can't get to work with Fedora Core into RHEL arbitrarily. So if you don't see something in RHEL/CentOS as standard, you need to see why it didn't make it into Fedora Core. Once again, I will remind people that several people here _are_ indeed complaining about what doesn't come with RHEL, and not aware that it _does_: A) Not work in Fedora Core, and failure after failure keeps it out B) And is, subsequently, not going into RHEL where SLAs are involved C) Does _not_ come with pretty much _all_ other, similar distros Red Hat Enterprise Linux, like SuSE Linux Enterprise Server, are _not_ about features. Both 18 month releases are subsets of their 6 month revisions (even locales not supported in SLA are often removed). You are not paying for R&D and inclusion in the "Enterprise" flavor (although the funds _do_ pay for extensive GPL development, R&D and other integration attempts in Fedora Core and SuSE Linux). > Or with the logic of asking customers to pay extra to get something with > features removed... Again, the people who actually _pay_ for RHEL/SLES are _not_ paying for features. ;-> You are complaining about CentOS not coming with things standard, and then assinging blame for that to Red Hat, because you believe they are supposedly paid and should have more features. I can only label this as "ignorance" of how RHEL (as well as SLES) is developed, because anyone can go out to Bugzilla and see the detail of why something is not included. If you want the most features, then Fedora Core + { FE+Lorg, DAG, etc...} is your baby, maybe CentOS + additives if you don't mind waiting a year later. I think it's great that CentOS is trying to be the best of both worlds: SLA- quality with added features. But it really is "demonizing" when all I see is people making complaint after complaint about RHEL not having something when many, many, _many_ Fedora Development manhours were made trying to get exactly what you wanted working. At some point Red Hat has to say "this doesn't work, even if it works in 2-3 months, it still won't have time to 'bake' in usage, so we're dropping it from consideration for this version of RHEL." > I haven't seen anyone demonizing RedHat here. I see some people > reporting painful experiences, But people are going beyond reporting painful experiences. They are making conclusions and get "upset" when I give the technical details of why something wasn't included. If you care enough to want something I assume people are open enough to understand why it wasn't included. Microsoft is the company that doesn't do something unless their is at least 250,000 users. Red Hat, SuSE and others often try to do everything they can, even for maybe only 1,000 users, in their 6 month revisions. But at some point, if something really doesn't work, has security issues and just isn't something they want to stake their time and money on in a SLA (which can get _very_expensive_ for software company), they have to drop it. After all, after a thousand man-hours of attempted integration for even their Fedora Core release, are they really going to sign themselves up for yet another thousand-plus hours and nagging re-fix after re-fix when maybe only a couple hundred licenses of RHEL are actually going to hold them to it? Just remember what CentOS is based on, and how much work not only goes into that, but into making sure the distro works as advertised because SLAs are involved and that can get really costly for Red Hat if it ships something that is not well tested. Especially if only a few companies want it. > but I don't think anyone expects perfection and the best thing is to > learn from them. If people here should understand one thing from the Windows world, it is that features and quality can be mutually exclusive -- especially the farther you move away from the economies of scale. I just find it humorous that several people who use CentOS, a free redistribution of RHEL (where Red Hat doesn't see a dime), are not complaining about Linus & co. for the kernel, not complaining about the CIPE team and their lack of movement on kernel 2.6, not volunteering to even look at the Bugzilla reports to find out what issues were blantantly repeatable, let alone other distros that have the same issues ... But blaming solely Red Hat for this issue (and this is just one example). But I expect that because some people just blame Microsoft for things outside of their control too. Sometimes the only person to blame is the lack of interest by anyone. If that isn't ignorance, I don't know what is. -- Bryan J. Smith mailto:b.j.smith@ieee.org

3 2

OSS install problem
by Adrian Coman 25 May '05

25 May '05

Hi, I want to install the commercial version of OSS and test if Skype works better with it. The problem is that after I compile 2.6.9-5.0.5.EL without sound support and then install oss3992d-linux-x86-v26-regparm and make it start at boot, at boot time OSS fails because it can not find /dev/dsp /dev/mixer and some other /dev sound devices. Indeed they do not exist. What do I need to do? Did I do something wrong or I have to manually add the /dev sound devices? Thanks, Adrian

2 3

CORRECTION: I must modify/clarify my statement about .0 releases ...
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

In looking through Red Hat's FTP site, I can find no such statement with regards to "do not use on production servers" in any README or Release Notes of Hurricane, Hedwig, Guinness or Psyche (Red Hat Linux 5.0, 6.0, 7 and 8.0, respectively). What I have found in my archives is a cutting from the official Red Hat Network (RHN) announcement of Psyche (8.0) that says two things: 1) It is an "early adopter" release, and 2) Do not upgrade "production systems" from Red Hat Linux 7.3 I cannot find the full version of it on-line. I know I do have an archived copy of at least the full Guinness and Psyche release announcements from the RHN and will search for them in my archives tonight. I kept _all_ official RHN messages, although I fear they are in an archive at a former employer that I do not have a copy of. It very much bothers me that I cannot find the same in at least the "Release Notes" of Guinesse or Psyche because I could have swore I saw them on CD #1 in one of my sets (and not a Rawhide or Beta release). If anyone has the original Guinness or Psyche announcements from their RHN subscriptions, please send them to me off-line. I'd like to confirm I'm not going senile after all, although some would love to have proof of that. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > We would not build and distribute either of these things if they were > not released via the GPL. The RPMS/SRPMS that we are distributing are > indeed GPL. We firmly agree with RedHat on this issue (that only GPL > things should be distributed). The problem is that many distros are statically building MySQL 4 with some non-GPL components. Some of the terms/definitions on static v. dynamic building changed from MySQL 3 to MySQL 4. I'll look into some of the latest Fedora Development and see if they are approaching such now. But one thing Red Hat seems to be doing is avoiding a lot of the MySQL 4 developments because of MySQL AB's changes. > CentOS will also not include in our repos anything that is not allowed > to be re-distributed due to patents or US DMCA. And I've noted that. I said that's why I don't use "pure" Fedora (Core, Extras) or Debian-bases (both RHEL and CentOS fall into that as well), and avoid both Livna.ORG and DAG in a commercial environment. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Mini-centOS
by kenkensmile＠netscape.net 25 May '05

25 May '05

I am using centOS for my server and centOS is extremely stable. I almost love centOS more than my wife. However, centOS is a bit heavy to run on my notebook (P III 1G, 256MB RAM). I need gnome, firefox, openoffice, realplayer, gaim, acrobat and thunderbird on my notebook, but if I install all of them (plus base-system), my notebook becomes very slow. I wish I could have a lighter version of centOS for notebooks and old desktops. Is there any project that I could have a mini-centOS in the future??? Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

8 8

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael: I can recommend the Netgear WG511. This one has a prism chipset; ndiswrapper is NOT required! Outpost.com sells the WG511 so you can probably find it at Fry's as well for around $45. Note: I do not recommend the WG511T which is a different chipset!. --- Michael <addymin(a)pacbell.net> wrote: > Greetings: > > I'm just installed Centos-4 on an IBM T-21 laptop. So > far so good. Now > I'd like to pop in a wireless lan adapter. I'm looking > at a buying a > Linksys WPC54G adapter (although I haven't done so yet). > > After doing some searching, it looks like the best way to > get this card > working is via ndiswrapper > [http://ndiswrapper.sourceforge.net] and then > to use Windoze drivers. > > So I downloaded ndiswrapper and during the install, I > received a warning > message referring to "4K Stacks" and that NOT disabling > 4k stacks can > cause some drivers to crash. The docs went on to suggest > I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and not > create/use a custom one. Has anyone had a problem using > the Linksys > WPC54G Cardbus adapter + Centos-4 and NOT had to use a > custom kernel? > > For that matter, since I haven't purchased the card yet, > can I get a > recommendation or two about a workable wlan cardbus (g) > adapter that > could most likely be found at Best Buy/CompUSA/Fry's ? > I'd like to be > able to easily return the card if things don't work... > > I did some searching a decent card and it seems that a > number of good > wlan chipsets are discontinued or hard to find, so I'm > slightly confused > as to what to get. > > Thank you. > Michael Chinn > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Re: [CentOS] Re: Demonizing generic Linux issues as Fedora Core-only issues -- WAS: Hi, Bryan
by Bryan J. Smith <b.j.smith＠ieee.org> 25 May '05

25 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > This is not really true. We will probably never have everything that FC > has as added features ... but CentOS-4 has several added features and we > have been out for only a 3 months (so, not required to wait a year). Oh, sorry, I should have clarified. What I meant by "wait a year" was the time from the first .0 or .1 Fedora Core releases that a new version of RHEL/CentOS is based on. E.g., FC2 came out in May 2004, FC3 in November 2004. RHEL/CentOS 4 didn't follow until 2005. > We even have some features (mysql compiled postfix, NX/freeNX, > and soon MySQL-Administrator / MySQL-Query Builder) that are not > yet part of FC or FC Extras at all. Actually, some of this stuff will _never_ be included in FC/RHEL because of licensing issues with the fact that MySQL is GPL. This is well documented in a lot of places. Red Hat is the only distributor (although I haven't checked Debian) fully honoring the terms MySQL AB sets on its GPL releases of MySQL 4, which include not building and redistributing certain items. It's one of those things that Red Hat also gets chastized on, and one of the reasons I don't use DAG (or Livna.ORG) at businesses. Anything that has GPL licensing/mixing issues, "only for non-profit use" or otherwise is "questionable" use of patents is the reason why I stick with "pure" Fedora Core+Extras or Debian. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

CentOS4, KDE3.3 and 128 WEP
by John Logsdon 25 May '05

25 May '05

CentOS4 standard installation. I see that KwifiManager doesn't support 128 bit WEP which I need for other machines on the network, which is a bit of a blow - and rather surprising really as security should be quite a consideration on an enterprise level system (NB RH!). Is there a workaround? An alternative way of configuring my Belkin F5D6020 ver 2 card? eg a cvs download that I can get and copy via a stick? Or how to do it manually? I have tried regressing kdenetwork but that doesn't include kwifimanager at all. Ideas? TIA John John Logsdon "Try to make things as simple Quantex Research Ltd, Manchester UK as possible but not simpler" j.logsdon(a)quantex-research.com a.einstein(a)relativity.org +44(0)161 445 4951/G:+44(0)7717758675 www.quantex-research.com

3 9

file compatibility issue
by William Warren 25 May '05

25 May '05

I am trying to run a binary but the binary was complied on debian so the system throws me this error: libstdc++-libc6.2-2.so.3 This is Centos-4. How can i get that compatibility fixed? -- Computer House Calls, Networks, Security, Web Design: http://www.emmanuelcomputerconsulting.com What businesses are in Brunswick, Maryland? Check Brunswick First! http://www.checkbrunswickfirst.com My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD. -- carpe ductum -- "Grab the tape" CDTT (Certified Duct Tape Technician) Linux user #322099 Machines: 206822 256638 276825 http://counter.li.org/

4 12

iptables logging
by Peter Farrow 25 May '05

25 May '05

Hi All, A few years ago I was asked if I could redirect console messages from Iptables to a different virtual console, on RedHat 7.3 . I managed to do it, but can't remember how I did it, now that the same question has arisen ona Centos 3.4 box. I edited /etc/syslog.conf and redirected kern.* to /dev/tty2 for example & this didn't work I edited /etc/sysconfig/syslog and modified klogd options with -f /dev/tty2 & this didn't work either So I stopped syslogd and klogd altogether and iptables still logs to the current console (which ever one you're on). So my question is, how do I get iptables to redirect its output to another console? P. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

4 6

CentOS and HP Drivers
by Mark A. Lewis 25 May '05

25 May '05

I am debating installing CentOS on a new HP DL580 with an MSA1000 SAN. HP offers drivers that are specific to RHEL and will not install on other RH distros i.e. RH 9. Has anyone gotten the HP SupportPack to install under CentOS? Thanks! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

31 56

CentOS-announce Digest, Vol 3, Issue 14
by centos-announce-request＠centos.org 25 May '05

25 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update (Tru Huynh) 2. CESA-2005:427 Moderate CentOS 3 x86_64 ethereal - security update (Tru Huynh) 3. CESA-2005:435 Important CentOS 3 i386 mozilla - security update (Tru Huynh) 4. CESA-2005:435 Important CentOS 3 x86_64 mozilla - security update (Tru Huynh) 5. CEEA-2005:434 Important CentOS 3 x86_64 - centosplus firefox security update (Tru Huynh) 6. CEEA-2005:434 Important CentOS 3 i386 - centosplus firefox security update (Tru Huynh) 7. CESA-2005:427 Moderate CentOS 4 i386 ethereal - security update (Johnny Hughes) 8. CESA-2005:427 Moderate CentOS 4 x86_64 ethereal - security update (Johnny Hughes) 9. CESA-2005:473-01: Moderate CentOS 2 i386 lesstif security update (John Newbigin) 10. CESA-2005:427-01: Moderate CentOS 2 i386 ethereal security update (John Newbigin) ---------------------------------------------------------------------- Message: 1 Date: Tue, 24 May 2005 22:59:07 +0200 From: Tru Huynh <tru(a)centos.org> Subject: [CentOS-announce] CESA-2005:427 Moderate CentOS 3 i386 ethereal - security update To: centos-announce(a)centos.org Message-ID: <20050524205907.GA10604(a)sillage.bis.pasteur.fr> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory 2005:427 ethereal security update for CentOS 3 i386: https://rhn.redhat.com/errata/RHSA-2005-427.html The following updated file has been uploaded and is currently syncing to the mirrors: i386: updates/i386/RPMS/ethereal-0.10.11-1.EL3.1.i386.rpm updates/i386/RPMS/ethereal-gnome-0.10.11-1.EL3.1.i386.rpm source: updates/SRPMS/ethereal-0.10.11-1.EL3.1.src.rpm You may update your CentOS-3 i386 installations by running the command: yum update ethereal\* Tru -- Tru Huynh (CentOS-3 i386/x86_64 Package Maintenance) http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B

1 0

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

Michael --- Michael <addymin(a)pacbell.net> wrote: > So I downloaded ndiswrapper and during the install, I > received a warning message referring to "4K Stacks" and > that NOT disabling 4k stacks can cause some drivers to >crash. The docs went on to suggest I recompile the > kernel to disable CONFIG_4KSTACKS. > > Question: For really like to stick to the stock CentOS-4 > kernel and notcreate/use a custom one. Has anyone had a >problem using the Linksys WPC54G Cardbus adapter + Centos-4 > and NOT had to use a custom kernel? I have used ndiswrapper on FC3 with the stock kernel without a problem. If you buy the Linksys card, try it first! > Thank you. > Michael Chinn __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new Resources site http://smallbusiness.yahoo.com/resources/

1 0

packages in centos-3.3 base changed
by Leonard Ye 25 May '05

25 May '05

Hi all, Correct me if my understanding is wrong. The [base] repository of centos-3.3 will never change after release. All future updates should go into [update]. I have an autobuild system to build a production server. If the [base] repository will never change after release, then I can maintain the reproducibility of the production server by always installing from the [base] of centos-3.3. Regards, Leonard Ye

1 0

Re: [CentOS] Re: Hi, Bryan; was: Re: pronunciation? <snip> -- don't shoot the messenger ...
by Bryan J. Smith 25 May '05

25 May '05

From: Dag Wieers > Sorry to interrupt but he was describing how you appeared in previous > postings. And I have to say that I felt the same way reading some of your postings. Really? Then I'll re-read them since there's been a second confirmation. Just know that I wasn't trying to make it about good/bad. I'm just trying to make the point that companies aren't just evil/greedy, and sometimes your friend can be your worse enemy (even SCO knows that one ;-). > Maybe it's best to move these topics to another channel. I just wish people didn't feel the need to make comments about Red Hat and SCO. > Can we leave the insults out, please ? > It serves no purpose here. Sorry. I'm just still a little disturbed about the "crap" statement, and everything that went with it. I find that many people just don't believe me sometimes.

6 20

announcement topics
by Joe Pruett 25 May '05

25 May '05

i did some searching in the mailman code and have discovered that mailman uses the VERBOSE flag to the python regular expression package, which means that unescaped spaces in the regular expression are ignored. so you need to change the topics to be like: CentOS\ 4\ i386 or: CentOS[ ]4[ ]i386 i'm not sure how many backslashes will be necessary to make it through to the module correctly, so brackets may be easier. or you could change the subject line format to be more like: CentOS-4-i386 so you could match without spaces.

1 0

Recompiling kernel
by kenkensmile＠netscape.net 25 May '05

25 May '05

Recompiling kernel Hi I am using CentOS 4 and trying to recompile kernel for my AMD Thunderbird 1.4 CPU. I used a manual for fedora 3,but I can not make it. After doing #installkernel 2.6-new arch/i386/boot/bzlmage System.map My comuter says "arch/i386/boot/bzlmage no such a file or directory" Could you possibly help me where the appropriate directory is please? Thank you for your help in advance. Cheers, Joe __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

3 2

Re: [CentOS] Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Lee Parmeter 25 May '05

25 May '05

--- Chris Mauritz <chrism(a)imntv.com> wrote: > The original poster was after a 54mbit wifi card and so > far, all of the > recommendations have been for 11mbit cards. Not true, the WG511 that I recommended is a 54mbit card. > I'd also be > interested if > anyone has positive things to say about any readily > available 54mbit > wifi cards + CentOS/Linux. > > Cheers, > > C > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > -- Lee Parmeter Emperor, linXos - The Flying Penguin http://www.linXos.com Linux Registered User #337161 'It's free. It works. Duh.'" - Eric Harrison The United States is NOT a democracy, it was founded as a Republic! God is not a republican or a democrat nor is His government a democracy! - Lee Parmeter __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Custom kernel needed for ndiswrapper? (for Linksys WPC54G wireless pcmcia)
by Michael 24 May '05

24 May '05

Greetings: I'm just installed Centos-4 on an IBM T-21 laptop. So far so good. Now I'd like to pop in a wireless lan adapter. I'm looking at a buying a Linksys WPC54G adapter (although I haven't done so yet). After doing some searching, it looks like the best way to get this card working is via ndiswrapper [http://ndiswrapper.sourceforge.net] and then to use Windoze drivers. So I downloaded ndiswrapper and during the install, I received a warning message referring to "4K Stacks" and that NOT disabling 4k stacks can cause some drivers to crash. The docs went on to suggest I recompile the kernel to disable CONFIG_4KSTACKS. Question: For really like to stick to the stock CentOS-4 kernel and not create/use a custom one. Has anyone had a problem using the Linksys WPC54G Cardbus adapter + Centos-4 and NOT had to use a custom kernel? For that matter, since I haven't purchased the card yet, can I get a recommendation or two about a workable wlan cardbus (g) adapter that could most likely be found at Best Buy/CompUSA/Fry's ? I'd like to be able to easily return the card if things don't work... I did some searching a decent card and it seems that a number of good wlan chipsets are discontinued or hard to find, so I'm slightly confused as to what to get. Thank you. Michael Chinn

2 1

RealPlayer on CentOS 4
by Hugh Tollan 24 May '05

24 May '05

Any ideas folks?? have installed RealPlayer10GOLD on CentOS 4, I have tried to uninstall it with the rpm -e command but I am being told it doesn't exist...when I try to download it again I am told that it is already installed! many thanks in advance _________________________________________________________________ Want to block unwanted pop-ups? Download the free MSN Toolbar now! http://toolbar.msn.co.uk/

4 4

Release date for 3.5
by User Lists 24 May '05

24 May '05

Hi all, Somebody knows when centos 3.5 will be released?? Thank you very much. _________________________________________________________ Do You Yahoo!? Información de Estados Unidos y América Latina, en Yahoo! Noticias. Visítanos en http://noticias.espanol.yahoo.com

2 1

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > I still disable it though 'cause its a real pain.... Yes, because it's new, the defaults are immature, and the majority of both developers and system administrators don't know much about it. So disable it and let others deal with it if the want to. You have that choice. ;-> But by making it the standard in its EL4 line (including FC2+, with changes in FC3+ which RHEL4 inherited), it forces everyone to start learning it, start reporting good defaults, and get it adopted as a standard by everyone. Red Hat does this all-the-time, and doesn't blink when people start screaming about compatibility because it really only does it when it's really, really a necessary adoption. ;-> As I said before, one person I really feel for is Jorg. The guy is "on-the-ball" with POSIX developments, and reguarly gets chastized for breaking compatibility to do so -- especially when some implementations (e.g., GNU Tar) were non-standard in the first place! ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Ted Kaczmarek <tedkaz(a)optonline.net> > Thanks for the excellent post, no defense experience but dealing with > the street side for quite a while now. I've worked at banks where the developers put the same routines for "ATM withdrawl" in the same scope and access as the "back-end debits/credits." Their same attitude is, "oh, the system is secured by others." And when you don't give up, they are arguing, "oh, it'll push back the release date." Some go as far as talking to management to get an override. And then they _really_hate_you_ when you modify their code and show how easy it is to actually make sure software, or implement MACs at the system-level that do the same thing (but is incompatible with the software). In a nutshell, there are a lot of coders out there that believe their software and routines should access the entire system, no restrictions. Although UNIX is typically better than Windows, largely because Microsoft's application division still writes code for "Chicago" (including MS IE to date), there are still cases where I can't trust it. And I definitely need to make sure a compromise of one component is well outside the access and scope of a more critical item it uses. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Feizhou <feizhou(a)graffiti.net> > What is really needed is the ability to limit access to a file on a per > user account basis (acls), not by locking down via a group permission. And that's POSIX's ACLs, c/o the "Austin Group" work of the IEEE POSIX committee circa 2001 and the X/Open Single UNIX Specification (SUS) version 3. XFS on Linux has had POSIX ACL support since day one (using its own codebase), and it's largely XFS's GPL contributions (and direct port from Irix, unlike IBM who ported JFS from OS/2 and not AIX) to kernel 2.6 (POSIX ACL's were standardized as of the 2.5.3 development branch, thanx largely to SGI). Ext3 has had a varied history in the 2.4.x timeframe, and even Red Hat gave up on them in Red Hat Linux 8.0 until kernel 2.6 in FC2+. But even POSIX ACLs are _still_ Discretionary Access Controls (DAC), atop of the legacy UNIX DACs we're all used to. They just augment discretionary control, and don't solve the MAC problem. MAC limits you, not augments you with delegation, on purpose.. People tend to hate MAC when they are first presented with the conepts, because they expect them to work like DAC. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_user" does not exist
by Bryan J. Smith <b.j.smith＠ieee.org> 24 May '05

24 May '05

From: Peter Farrow <peter(a)farrows.org> > As you have pointed out it restricts the security granularity of the > system, which in turn will lead to other "work arounds" to achieve > better granlarity and those work arounds will ultimately lead to > sloppiness, making Johns point very valid indeed. First off, SELinux is _optional_ on a system-wide basis. Secondly, SELinux does not have to affect various services, different distros are free to ship different defaults. Third, in typical Red Hat fashion, they adopt "new technologies with good practices/standards" all-the-time. We have to thank for forcing us back to the GNU C Libraries and an ANSI C++ compiler which has drastically improved run-time/binary compatibility. Lastly, Red Hat, like many others, actually stick to standards. I very much dislike when people complain about "compatibility issues" when all someone is trying to do is "get back to the standard" or "be compliant with the new, universal standard." E.g., several GNU projects -- from GCC 2.x's non-ANSI C++ implementation (and especially the entire, multi-yser GCC 2.9.x "beta" merge of GCC 2.x and EGCS) to GNU Tar through 1.13 -- were forks from standards. And when people finally forced the issue of standards compliance, they get chastized. Heck, one of the people I will always appreciate is Jorg, who has gotten reamed left and right on cdrtools, star, etc... He's probably one of the best Linux developers leading full POSIX 2001 compliance (adding all the new IEEE/SUS "Austin Group" developments in various programs). Now SELinux isn't a half-bad design by the NSA and others. Linux sorely needed MAC and, to a lesser extent, Role Based Access Controls (RBAC) as it's "legacy-only" UNIX access controls was not only falling behind NT, but even most proprietary UNIX flavors. But, again, it's _optional_. Turn if off if you wish, but I think it's about time a distro offered it, and attempted some secure defaults. It is not "sloppy" or "broken," just immature in application of defaults yet -- especially since both developers and sysadmins are not used to it being enabled. So how SELinux any different than any other shift-adoption in Red Hat's history? Now my background is largely in defense with several years in financial (which is, ironically, a major overlap in systems/network accounting, as well as crypto, etc...). And a lot of my job has been to go around and ensure developers and integrators are adhering to security standards. And I'm not just one of those "complainy" types either -- because I'm also a software engineer who regularly refutes the "I have to have root" or "we have to do this" non-sense right back in their own language. Especially when such cases are not really a security issue, but an engineering workflow issue in the first place. E.g., an software engineering development system -- even with run-time and/or target on the same system -- should _never_ be designed so the development, run-time and/or target have full control of the system. All should be sandboxed in different ways so it's very easy for the developer to tear down and rebuild the run-time/target from the development tools. If not, then the development environment is incomplete. I don't know how many times I've seen engineers (and I'm one of them too, so I know how they think) waste time fighting a system mis-configuration they introduced because their development, run-time and/or target environments are not finite and contained. They believe they need full root on the system when they don't. And damn do I hate it when the network admins get on my case because someone put a NIC in permisciuous mode -- the engineer shouldn't even be able to do that! With that said, the person who said that he's worked on Classified Networks and said MAC is not a requirement needs to be re-briefed. Access controls are _always_ implemented, and if a system is unable to conform to the required standard, there is a variance or other exception, and the risk must be mitigated _and_ an "effective enough" manual procedure implemented. I _explicitly_ used the term "accountable" because there are two types of Classified Information -- "non-accountable" (typically US DoD "Confidential" and most "Secret") and then their are "accountable" (various, higher classifications). You can typically get away with common variances and other exceptions with minimal, additional manual accounting for "non-accountable." But any automation helps. When it comes to "accountable," MAC/RBAC really helps a crapload -- and the NSA really "got the ball rolling" for Linux, which was really necessary. As far as financial networks, don't even get me started. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > > On Tue, 2005-05-24 at 08:08, Micha Silver wrote: > > > > > > The best thing to do is add this to /etc/selinux/config > > > > > > SELINUX=disabled > > > > > > And then get on with the real jobs.... > > > > > > > Listening to all the pros and cons of SELinux. > > I'd like to improve the security of our regional web server > using SELinux. > > We have a main regional web site and several virtual > domains, kept up by > > private users, all on the same server. Some of the private > users want to run > > php and database apps on their websites. Up till now I > steered away from > > allowing users to run anything on their sites, since a > breakin to any > > private virtual domain would endanger the whole http > process, including the > > main regional site. I'm preparing to switch over to a new (CentOS 4) > > machine, and I thought to set up a different SELinux > context for each > > virtual domain, so that a vulnerability in someones private > web site would > > be isolated and not be able to crash the other domains. > > Is this achievable *without* SELinux?? > > The simple-minded way has always been to run a separate http > instance bound to a different port or IP address, running as > a different user. If you only have one IP address and need > to appear to be on port 80, you can arrange this with a > virtualhost on the main server that uses proxypass or a > rewriterule that results in a proxy connection to the server > running under the other uid. > Thanks Les, With several virtual domains, setting each up on a separate port with rewrite rules, and running several httpd processes under different UIDs would quickly become not so "simple-minded" Regards, Micha > --- > Les Mikesell > lesmikesell(a)gmail.com > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos >

2 1

RE: [CentOS] PostgreSQL/SELinux Error - relation "pg_catalog.pg_u ser" does not exist
by Micha Silver 24 May '05

24 May '05

> > The best thing to do is add this to /etc/selinux/config > > SELINUX=disabled > > And then get on with the real jobs.... > Listening to all the pros and cons of SELinux. I'd like to improve the security of our regional web server using SELinux. We have a main regional web site and several virtual domains, kept up by private users, all on the same server. Some of the private users want to run php and database apps on their websites. Up till now I steered away from allowing users to run anything on their sites, since a breakin to any private virtual domain would endanger the whole http process, including the main regional site. I'm preparing to switch over to a new (CentOS 4) machine, and I thought to set up a different SELinux context for each virtual domain, so that a vulnerability in someones private web site would be isolated and not be able to crash the other domains. Is this achievable *without* SELinux?? Thanks, Micha

2 1

CentOS-announce Digest, Vol 3, Issue 13
by centos-announce-request＠centos.org 24 May '05

24 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:435 Important CentOS 3 ia64 mozilla - security update (Pasi Pirhonen) 2. CEEA-2005:434 Important CentOS 3 ia64 - centosplus firefox security update (Pasi Pirhonen) 3. CESA-2005:434 Important CentOS 4 i386 firefox - security update (Johnny Hughes) 4. CESA-2005:434 Important CentOS 4 x86_64 firefox - security update (Johnny Hughes) 5. CESA-2005:435 Important CentOS 4 i386 mozilla - security update (Johnny Hughes) 6. CESA-2005:435 Important CentOS 4 x86_64 mozilla - security update (Johnny Hughes) 7. CESA-2005:435 Important CentOS 3 s390(x) mozilla - security update (Pasi Pirhonen) 8. CESA-2005:435-01: Important CentOS 2 i386 mozilla security update (John Newbigin) 9. CEEA-2005:434 Important CentOS 3 s390(x) - centosplus firefox security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 15:09:44 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:435 Important CentOS 3 ia64 mozilla - security update To: centos-announce(a)centos.org Message-ID: <20050523120944.GE1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:435 https://rhn.redhat.com/errata/RHSA-2005-435.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/mozilla-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-chat-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-dom-inspector-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-js-debugger-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-mail-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nspr-devel-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-1.7.8-1.1.3.1.centos3.ia64.rpm updates/ia64/RPMS/mozilla-nss-devel-1.7.8-1.1.3.1.centos3.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Betr.: [CentOS] VPN
by Thom van der Boon 24 May '05

24 May '05

IF you are not stuck to IPSec, you might want to take a look at OpenVPN (www.openvpn.org) I found OpenVPN easier to install than FreeSWAN (an IPSEC VPN) and have setup an OpenVPN solution between my German office and our mainoffice in a matter of hours. Thom van der Boon E-Mail: Thom.van.der.Boon(a)vdb.nl ===== Thom.H. van der Boon b.v. Havens 563 Jan Evertsenweg 2-4 NL-3115 JA Schiedam Tel.: +31 (0)10 4272727 Fax: +31 (0)10 4736620 E-Mail: info(a)vdb.nl Home Page: http://www.vdb.nl/ >>> simone72(a)email.it 23.05.2005 18:18:56 >>> Hi list, I am trying to create a VPN between two different locations. On the first location we have a cisco pix 525 Natting the internal 192.168.100.x network, while on the second location we have a Centos3 box Natting via iptables the internal 192.168.10.x netowrk. My goal is to connect this 2 over the internet via IPsec. I created the IPsec Net2Net via the network configuration graphic tool, and I configured the cisco following the howto http://www.johnleach.co.uk/documents/freeswan-pix/freeswan-pix.html . From my understanding, I should have an ipsec0 network device showing up, so that I could route all traffic from 192.168.10.x directed to 192.168.100.x through it. The thing is that when I try to ifup ipsec0 I get the following errors: modprobe: modprobe: Can't locate module ripemd160 modprobe: modprobe: Can't locate module cast128 modprobe: modprobe: Can't locate module lzs modprobe: modprobe: Can't locate module lzjh So, after googling and reading a lot with no success, I would like to ask for advice on this, and successfull story :). I really need to have this VPN running, and I am not tied to this one solution only, linux-to-linux VPN, openVPN or anything else you could suggest would be great. Thanks in advice Simone _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

5 9

Re: [CentOS] Microphone problems with Skype
by Angelo Machils 24 May '05

24 May '05

> > >I have CentOS4 and this soundcard: >00:11.5 Multimedia audio controller: VIA Technologies, Inc. >VT8233/A/8235/8237 AC97 Audio Controller (rev 60) > >I installed the Skype rpm for Fedora3 and it works but the quality of >my voice is very poor: volume is low and the voice sound doesn't have >the high frequencies. > >Did any of you made Skype work perfectly under CentOS4? How? > >Thanks, >Adrian > Hi there! I have the same card: 00:11.5 Multimedia audio controller: VIA Technologies, Inc. VT8233/A/8235/8237 AC97 Audio Controller (rev 60) and it works without problems on Skype (also the FC3 RPM). Kind regards, Angelo

4 3

access point radius authentication
by Ryan 24 May '05

24 May '05

I have a CentOS 4 running on a laptop with an orinico card. My Wireless access point supports 802.1x dynamic WEP keys, and I would like to try it in this mode. Unfortunately, its not clear to me on how to: #1: Configure free radius on a server to do the radius backend. (although I think I can solve this) #2: Configure CentOS 4 to use dynamic WEP keys. If anyone knows how to do either of the above, or has any links to relevant help sites, please pass along. thanks, Ryan

2 1

migrating from rhel 3 to centos 3
by Michael Thon 23 May '05

23 May '05

Greetings - I have a rhel 3 server that I want to migrate to centos. The FAQ: http://www.centos.org/modules/smartfaq/faq.php?faqid=19 pretty much tells me what I need to do but what is going to happen when I run yum update? Will it replace every RPM on my system with its centos counterpart or will it only upgrade RPMS as new versions are released? This is a production system and I'm trying to figure out what apps will potentially be affected by the migration. Also, should I uninstall the up2date package when I'm done? Thanks! Mike

2 1

iptables problem
by joseph medina 23 May '05

23 May '05

Some day ago, a friend post one problem for mi. whist this texts: I have a server whit 2 interfaces of network, where eth0 is the interfaces connetc to internet and eth1 to the internal network. This server hace a Squid only, but i setting the iptables for protection to the server. Iptables run from script and in this script i setting the redirection for the other server in my internal network to port 80 and 443. I follow the diferent how to and many manual, but the redirect no work, the NAT POSTROUTING work and the squid work to. My DNS is Ok, because the consult whit dig command the answer is the assigned ip. Here put the copy of my script: I was do all instruccion for that problem but I have the same problem, te server dont redirect to webserver for ports 80 and 443 all the rest services are ok only that services have problems, thanks for all now my /etc/sysconfig/iptables is this: # Firewall configuration written by redhat-config-securitylevel # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] #-A INPUT -j RH-Firewall-1-INPUT #-A FORWARD -j RH-Firewall-1-INPUT #-A RH-Firewall-1-INPUT -i lo -j ACCEPT #-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT #-A RH-Firewall-1-INPUT -p 50 -j ACCEPT #-A RH-Firewall-1-INPUT -p 51 -j ACCEPT #-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT #-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited #todo al localhost y a infocom -A INPUT -i lo -j ACCEPT -A INPUT -i eth0 -s rango_ip -d 0/0 -p all -j ACCEPT -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.1/32 -p all -j ACCEPT #negamos el ping -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP -A INPUT -i eth1 -p ICMP --icmp-type echo-request -j DROP ## SALIDA SMTP - Para que el servidor se pueda conectar a otros MTA # Permitir salida SMTP -A INPUT -p tcp -m tcp --sport 25 -j ACCEPT -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT ## DNS Completo. ACEPTADO. -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT ## SQUID -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT ## FORWARD -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -d 172.16.0.3/32 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -d 172.16.0.3/32 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT ##OUTPUT -A OUTPUT -o eth1 -p tcp --dport 80 -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 443 -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -o eth1 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] ##NAT e intranet des de el portal -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A PREROUTING -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.138/32 -o eth0 -j MASQUERADE COMMIT -------------------------------------------------------------- my /etc/sysconfig/iptables- # Additional iptables modules (nat helper) # Default: -empty- IPTABLES_MODULES="ip_nat_ftp" # Save current firewall rules on stop. # Value: yes|no, default: no #IPTABLES_SAVE_ON_STOP="no" # Save current firewall rules on restart. # Value: yes|no, default: no #IPTABLES_SAVE_ON_RESTART="no" # Save (and restore) rule counter. # Value: yes|no, default: no #IPTABLES_SAVE_COUNTER="no" # Numeric status output # Value: yes|no, default: no #IPTABLES_STATUS_NUMERIC="no" ----------------------------------------- the command iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- 200.55.135.8/29 anywhere ACCEPT all -- 172.16.0.0/24 valinor.mincex.org DROP icmp -- anywhere anywhere icmp echo-request DROP icmp -- anywhere anywhere icmp echo-request ACCEPT tcp -- anywhere anywhere tcp spt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:smtp ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:squid Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:http ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:https ACCEPT tcp -- anywhere armagedon.mincex.orgtcp dpt:http ACCEPT tcp -- anywhere armagedon.mincex.orgtcp dpt:https ACCEPT tcp -- 172.16.0.0/24 anywhere tcp dpt:domain ACCEPT udp -- 172.16.0.0/24 anywhere udp dpt:domain Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:https Chain RH-Firewall-1-INPUT (0 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited -------------------------------------------------------- and the command iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:http to:172.16.0.3:80 DNAT tcp -- anywhere anywhere tcp dpt:https to:172.16.0.3:443 ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW,ESTABLISHED tcp dpt:https Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- ariadne.mincex.org anywhere MASQUERADE all -- 172.16.0.10 anywhere MASQUERADE all -- 172.16.0.9 anywhere MASQUERADE all -- maprinter.mincex.org anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ______________________________________________ Renovamos el Correo Yahoo! Nuevos servicios, más seguridad http://correo.yahoo.es

1 0

Re: Hi, Bryan; was: Re: pronunciation? <snip> --
by Bryan J. Smith <b.j.smith＠ieee.org> 23 May '05

23 May '05

From: Feizhou <feizhou(a)graffiti.net> > I still remember the FIRST Linux GUI installer for a Linux distro. It > came on the Caldera Openlinux 2.2. It worked. It was really nice. Actually, the first distro with a GUI installer was Yggdrasil, circa 1993. It installed on 8MB of RAM using X and Athena/FVWM. > The Novell guys that were behind Caldera deserve plenty of respect for > what they have done. Despite what someone else said, I was (and still am somewhat) of a major skeptic of Novell. Novell new it had to get off of its DOS Protected Mode Interface (DPMI) OS approach, and seriously considered Linux. But instead of going Linux 10 years earlier than they did, they bought UNIX(R) from AT&T USL. That's when Ray Noorda, basically the man who made Novell who they are, broken off and founded Caldera. Novell never worked much with Caldera, and withheld pretty much all their core technologies. Ironic because had Novell not, they would be in a far stronger position on Linux than they are today. We might not even be talking about Red Hat. But, once again, this is all just fluff. What really matters is the GPL donations. Novell has pleasantly surprised me because they have basically GPL'd everything SuSE had not, as well as even a few of their technologies. Now they still have their core technologies that they will never GPL -- just like Sun, etc... and are no where near Red Hat's 100% GPL-centric focus. But unlike Red Hat, I have to say they are the first PC-centric software developer that "gets it" and whenever these "debates" go on with Microsoft and Open Source companies -- Novell always puts their arguments in terms that traditional Microsoft consumers can understand. And Novell seems to understand how to treat the distribution channel, especially system integrators, better than Red Hat too. As I've always said on other lists, it's like a replay of Apple-IBM-Microsoft. Apple thought IBM was their enemy, and partnered with Microsoft only to be blindsided. Same deal here. Sun thinks Red Hat is their enemy, and they have partnered with Novell. Novell not only has them on the OS front, but they offer a GPL implementation of .NET too (which essentially is based on Java 1.1 code -- although .NET 2.0 is now modernized with the Microsoft relicense). > I think, today's SCO bashing should really go to the current owner of > SCO and to IBM. IBM for what they did and the guy who put McBride in > place to do the stock game. I don't defend SCO's lobbying and Linux IP "smokescreen." They are a company who is fighting our right to digital assembly, and they are now an abomination. But had it not been for the rabid response by the Linux community not to stop and recognize the original March 2003 filing was about Monterey -- something even Linus, ESR and many other people themselves explicitly called a "contract dispute" in countless media interviews -- SCO wouln't have been able to put up this Linux IP "smokescreen." So many people had made SCO v. IBM into SCO v. Linux -- calling for the end of the lawsuit and whatnot -- well before SCO even introduced the Linux IP issue. We gave them the avenue to take. IBM is no better than SCO. But I will admit that in the transcripts I have read, IBM's lawyers are doing a great job of using the GPL, and making the judge aware of what it entails. The judge is really good, and isn't giving SCO anything on the Linux IP front. But unfortunately for IBM, the judge has granted several SCO motions that have everything to do with Monterey, and any Monterey code that competes with Linux. Because that's what this is about, Monterey, the withholding of Monterey/IA-64 (UnixWare 8) and the Non-Compete. And if it does make it to a jury trial in Utah, I don't see how any juror won't see this as a patent and capital giant screwing over a smaller company because it could. Especially since Caldera-SCO's strategy was no different than IBM's, and the whole reason for the contract was to protect Caldera-SCO against what IBM did. Even if IBM found a loophole, I still see Caldera-SCO winning some counts on IBM not maintaining the contract "in good faith" well before they broke it. And that's what worries me most. When Caldera-SCO wins on some Monterey counts, the media will translate that into SCO proving their IP is in Linux, largely because lots of the rabid Linux world will be screaming "why? how?" because they just don't know what the case is all about. They never have. Which is my point. Not that SCO is good / IBM is bad. But there are contract disputes and corporate strategies at work here -- they always have been -- and you can't side with one company and demonize another without realizing all the details that brought it to this. Especially the valuable lesson that even the most pro-Linux, pro-GPL company can still be competitor #1 to IBM, and IBM will destroy them. > I really don't understand why some people get so uptight about it. I > look after over 30 machines and I have had no problems moving on to > Fedora Core 1 and Fedora Core 2. In fact, I like their Fedora project > more than their RHL line. >From what I saw, once the execs "took the shakles off" the RHL developers as they no longer considered RHL a "product" anymore once it became FC, there was a lot of "clean-up" in FC. The big one was inter-dependency hell that had built up over the years. And there were other security changes (this is before SELinux) that were just sound -- especially getting rid of SUID root on a lot of things. Unfortunately, I see DAG's points on the lack of consideration of multi- version aware SPEC files. They explain a lot of issues I'm seeing in Fedora Core releases. And if the quality of FC slides, then it will affect RHEL as well. Which is why I'm either hopeful Red Hat realizes this, or maybe Novell-SuSE's version 10 strategy will offer what we've been used to in the RHL/RHEL space. > I personally don't have a problem with the Red Hat business decision ... > but I understand why some people do. I think people forget that the strategy was set the moment SuSE introduced SuSE Linux Enterprise Server (SLES). Red Hat introduced RHEL years before the Fedora Core project was even announced, and that included cutting updates to 1 year, discouraging certification on RHL in favor of RHEL (which most vendors wanted anyway -- a product good for 5+ years, with an 18 month cycle instead of 6 month), etc... Fedora(TM) was just a trademark issue -- something only Red Hat, of all vendors, had because they were the only company that had allowed people to distribute major modifications with their trademark. Even Sun had to license SuSE(R), and continued to abuse Red Hat(R) for years without a license until their SuSE-based Java Desktop came out. Why? Because Sun had legal ground to stand on claiming Red Hat never enforced their trademark. > That lifetime support you are looking at is far less than 2 years I can > assure you. It all depends. What I see people complaining about on Red Hat is typically two things: 1) Free 3-4 years of updates 2) A "brand name" that the boss will allow in the company #1 should have never happened, and why Red Hat maintained 3-4 years of updates for 6-7 simultaneous revisions is beyond me. *NO* other commercial distributor has even come close, and even SuSE rarely makes its 2 year promises on SL. #2 is probably the real complaint most people have, and it goes back to the trademark. With RHL, you used to be able to install Red Hat Linux and because your boss though Red Hat was the Microsoft of Linux, he thought it was well supported. Now that's more difficult to do with "Fedora" as the boss reads in the IT media that it's cutting edge and unstable. > CentOS offers the free and the long lifetime. I personally don't care > too much since the advantages on newer Fedora Cores outweigh a > 'supported' but static distro. However, others may not see it that way > and so it is good that CentOS is here. I think the CentOS project is a great endeavor. And I like many aspects of the Fedora Project, and Fedora Core itself. I have some increasing concerns though, but they aren't because Red Hat is "greedy," "listening to its stockholders," etc... Hell, there is a reason why Red Hat allowed major GPL projects to buy stock before the IPO -- because it wanted sharedholders who understand their GPL-centric model. > At the same time, I find it offensive when people starting saying 'Dead > Rat' just because the RHL line was pulled and they forget all the work > that Redhat puts into the Linux kernel, gcc, glibc and a host of others > that are at the core of any Linux distribution. Which is why people like yourself and myself are not popular. We ask people to stop and appreciate the CentOS project without resorting to demonizing Red Hat (or Caldera-SCO, or anyone else). That's not popular with the majority, rabid Linux community. They want to make it about Microsoft, Red Hat, SCO or whomever else. They want to interject this "hate" -- and that's what it is -- on a regular basis. We're in the minority because we don't stoop to that level. In fact, I'm sure I'm very much hated because I'm the jerk who takes the time to try to explain things. In reality, I just give these people an excuse to say I'm "OT" -- but as I said, you can't chastize me without realizing all of the OT, snide and other non-technical comments we see regularly. I just have to use Linus and many others as examples, they stay focused on the source. They keep IBM from getting patents in the kernel, they question donations from other companies as well -- giving real refutement to arguments like those from SCO -- and keep our GPL focused on what it needs to be. And that's not petty comments on whomever we hate today. I'm sure I'm going to piss a lot of people off with this next comment, but it's what I'm seeing more and more. As an opinionated American who believes strongly in capitalism (largely because we Americans are too individualistic for government mandated socialism to work), I am regularly reminded on how sometimes just an American company can be so demonized. I used to think maybe I was just paranoid, but after Utah-based Novell bought Germany-owned SuSE, I started seeing a lot of the anti-Red Hat comments start to be made of SuSE as well. Ironic because the first thing Novell started doing was GPL'ing all sorts of SuSE -- and they are even releasing the first, feature-complete, 100% redistributable ISOs as of 9.2. But before, SuSE was called a "good" company, despite their non-GPL focus at times, and I always thought it was ironic that they were not held to the same standard as Red Hat. But in reality, I have noticed in the software industry -- being that Linux is a global effort -- I have repeatedly seen American companies held to a higher standard, and many of their charity simply discarded. At the same time, companies like IBM can play "Quiz Show" type games with marketing and money, and suddenly people are fooled into thinking they are charitable. On pure dollar amounts, IBM doens't compare to Red Hat, HP or even Sun on actual GPL or even GPL compatible donations. And the reality is that only GPL or GPL compatible software is the thing that remains, no matter what changes. People tend to not understand that there is a major difference between choosing to work together in a public commons and government-mandated public organization. There is -- and it's massive. A public commons in a capitalistic society is a good thing. We choose to work together and we benefit from our efforts, which we make freely. Even Red Hat does this, as well as HP, Sun and, to a lesser extent, even IBM. But the one thing I repeatedly see is people blaming Microsoft for their problems -- which mirrors the other "absolute blames" I continually see for all sorts of things. The reality is that you can't mandate Linux or otherwise force people. People must be allowed to choose Microsoft if they wish, or anything else. The concept of "we know better than you" scares me to death. And it's the attitude I see used against companies regularly, especially against American companies. I believe strongly in public commons, as long as people choose to do so freely. And Red Hat has continually been the only commercial Linux company that has a 100% GPL focus. And they aren't some social-idealistic company in a socialistic economy -- but an American company in a capitalistic economy that believes strongly in never betraying the public trust. They understand Stallman's "moral delima" -- ironically another American. And some of us are just too busy to play the "blame game." -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Microphone problems with Skype
by Adrian Coman 23 May '05

23 May '05

Hi, I have CentOS4 and this soundcard: 00:11.5 Multimedia audio controller: VIA Technologies, Inc. VT8233/A/8235/8237 AC97 Audio Controller (rev 60) I installed the Skype rpm for Fedora3 and it works but the quality of my voice is very poor: volume is low and the voice sound doesn't have the high frequencies. Did any of you made Skype work perfectly under CentOS4? How? Thanks, Adrian

5 6

CentOS-announce Digest, Vol 3, Issue 12
by centos-announce-request＠centos.org 23 May '05

23 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:434 Important CentOS 4 ia64 firefox - security update (Pasi Pirhonen) 2. CESA-2005:435 Important CentOS 4 ia64 mozilla - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 May 2005 14:44:36 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:434 Important CentOS 4 ia64 firefox - security update To: centos-announce(a)centos.org Message-ID: <20050523114436.GC1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CESA-2005:434 https://rhn.redhat.com/errata/RHSA-2005-434.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/firefox-1.0.4-1.4.1.centos4.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

RE: [CentOS] RE: Wireless Networking
by Vaneet Sharma 23 May '05

23 May '05

Thankx I solved the problem by removing firewall and now trying to include firewall settings step by step Vaneet -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Ryan Sent: Monday, May 23, 2005 10:35 AM To: CentOS mailing list Subject: Re: [CentOS] RE: Wireless Networking > 1) I am not able to connect to my Centos Server BOX through Secure CRT > 2) I am not able to connect to my Centos using FTP. Try configuring port forwarding on the router instead of DMZ. For SSH , forward port 22 to the 192.x address our centos machine is on. Make sure iptables has 22 open in its firewall settings. Vaneet Sharma wrote: > Dear All, > > I have one centos box ( centos 4.0 ) which is connected to MSI > wireless router....... And which is connected to my ISP MODEM. I > incorporated wireless router so that I can use my laptop from any of > my rooms. > > Now this Centos 4.0 box is my home server machine. > > The MSI Wireless Router has DHCP server enabled. Wireless router has > provided each address to my machines basically internal IP address > like 192.168.1.xx TO 192.168.1.xx. The wireless router has an > external IP which can be reached at : http://84.255.28.48:8080. I > configured DMZ settings in wireless router... Which basically is > mapping my Centos Box internal IP ( 192.168.1.XX ) to public IP ( > 84.255.28.48 ) > > Now the problem is the following: > > how will my centos machine listen to this public IP ? Do I have to set > up firewall settings?> Ifconfig on centos gives me internal IP. I need > to know what routing settings I need to do and where ? > > 1) I am not able to connect to my Centos Server BOX through Secure CRT > 2) I am not able to connect to my Centos using FTP. > > Kind regards > Vaneet > > > -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Maciej Zenczykowski > Sent: Friday, May 20, 2005 5:39 PM > To: CentOS mailing list > Subject: Re: [CentOS] Iptables - PREROUTING > > > okay, first of all you shouldn't do it in a script, > instead you should be modifying /etc/sysconfig/iptables > and using /etc/init.d/iptables start/stop > > and add ip_nat_ftp to the proper spot (modules to load) in > /etc/sysconfig/iptables-config > > next you need to rewrite the following for iptables-save/restore > format > > *nat > :PREROUTING ACCEPT [0:0] > :OUTPUT ACCEPT [0:0] > :POSTROUTING ACCEPT [0:0] > > [spot for nat rules] > > COMMIT > > *filter > :INPUT DROP [0:0] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [0:0] > > [spot for filter rules] > > COMMIT > > > [in the filter rules:] > -A INPUT -i lo -j ACCEPT > > # the following is _not_ nice > -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP > > -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT > -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT > > > [above in the nat spot] > -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A > PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 > > > [again in the filter spot] > -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A > FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT > > -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A > FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT > > You _DO_ _NOT_ WANT TO ACCEPT everything from port 53 - I can break > through this firewall in 5 seconds. > -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT > -A INPUT -p udp -m udp --dport 53 -j ACCEPT > > same here, plus squid doesn't use udp > -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT > > the default should be to drop > > -A INPUT -j LOG --log-level info > -A OUTPUT -j LOG --log-level info > -A FORWARD -j LOG --log-level info > > [in nat again] > -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE > -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE > -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE > > > this should be in /etc/sysctl.conf > >>echo 1 > /proc/sys/net/ipv4/ip_forward > > > do the above changes and repost with what you have and we'll go from > there... > > Cheers, > MaZe > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos > > > Vaneet Sharma > executive manager > iDeasTank Limited > an iwg business > dolphins' court po 388 > valletta, m-malta/europe > mobile: +356 9943 8263 > skype: CALLVANEET > fax: +356 9952 8888 > phone: +356 9942 8888 > > vaneet(a)iwg.info > call me on www.skype.com - my ID is CALLVANEET > > Want a signature like this? - www.plaxo.com\signature > > iwg is a global e-mobile company creating, building and growing new > businesses. iwg founders are pioneers in creating multi-billion > dollar mobile and Internet businesses in Europe, Asia and the US. > > www.iWG.info > www.countryprofiler.com/iWG > www.visitmalta.com > www.mfc.com.mt > > > Privileged/Confidential Information may be contained in this message. > If you are not the addressee indicated in this message (or responsible > for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos > > _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos Vaneet Sharma executive manager iDeasTank Limited an iwg business dolphins' court po 388 valletta, m-malta/europe mobile: +356 9943 8263 skype: CALLVANEET fax: +356 9952 8888 phone: +356 9942 8888 vaneet(a)iwg.info call me on www.skype.com - my ID is CALLVANEET Want a signature like this? - www.plaxo.com\signature iwg is a global e-mobile company creating, building and growing new businesses. iwg founders are pioneers in creating multi-billion dollar mobile and Internet businesses in Europe, Asia and the US. www.iWG.info www.countryprofiler.com/iWG www.visitmalta.com www.mfc.com.mt

1 0

RE: Wireless Networking
by Vaneet Sharma 23 May '05

23 May '05

Dear All, I have one centos box ( centos 4.0 ) which is connected to MSI wireless router....... And which is connected to my ISP MODEM. I incorporated wireless router so that I can use my laptop from any of my rooms. Now this Centos 4.0 box is my home server machine. The MSI Wireless Router has DHCP server enabled. Wireless router has provided each address to my machines basically internal IP address like 192.168.1.xx TO 192.168.1.xx. The wireless router has an external IP which can be reached at : http://84.255.28.48:8080. I configured DMZ settings in wireless router... Which basically is mapping my Centos Box internal IP ( 192.168.1.XX ) to public IP ( 84.255.28.48 ) Now the problem is the following: how will my centos machine listen to this public IP ? Do I have to set up firewall settings?> Ifconfig on centos gives me internal IP. I need to know what routing settings I need to do and where ? 1) I am not able to connect to my Centos Server BOX through Secure CRT 2) I am not able to connect to my Centos using FTP. Kind regards Vaneet -----Original Message----- From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On Behalf Of Maciej Zenczykowski Sent: Friday, May 20, 2005 5:39 PM To: CentOS mailing list Subject: Re: [CentOS] Iptables - PREROUTING okay, first of all you shouldn't do it in a script, instead you should be modifying /etc/sysconfig/iptables and using /etc/init.d/iptables start/stop and add ip_nat_ftp to the proper spot (modules to load) in /etc/sysconfig/iptables-config next you need to rewrite the following for iptables-save/restore format *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] [spot for nat rules] COMMIT *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] [spot for filter rules] COMMIT [in the filter rules:] -A INPUT -i lo -j ACCEPT # the following is _not_ nice -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT [above in the nat spot] -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 [again in the filter spot] -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT You _DO_ _NOT_ WANT TO ACCEPT everything from port 53 - I can break through this firewall in 5 seconds. -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT same here, plus squid doesn't use udp -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT the default should be to drop -A INPUT -j LOG --log-level info -A OUTPUT -j LOG --log-level info -A FORWARD -j LOG --log-level info [in nat again] -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE this should be in /etc/sysctl.conf > echo 1 > /proc/sys/net/ipv4/ip_forward do the above changes and repost with what you have and we'll go from there... Cheers, MaZe _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos Vaneet Sharma executive manager iDeasTank Limited an iwg business dolphins' court po 388 valletta, m-malta/europe mobile: +356 9943 8263 skype: CALLVANEET fax: +356 9952 8888 phone: +356 9942 8888 vaneet(a)iwg.info call me on www.skype.com - my ID is CALLVANEET Want a signature like this? - www.plaxo.com\signature iwg is a global e-mobile company creating, building and growing new businesses. iwg founders are pioneers in creating multi-billion dollar mobile and Internet businesses in Europe, Asia and the US. www.iWG.info www.countryprofiler.com/iWG www.visitmalta.com www.mfc.com.mt Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email.

2 1

java-1.4.2-sun-compat
by John Newbigin 23 May '05

23 May '05

This is not specifically a CentOS question but it relates to a problem I am having on CentOS-3. I though someone here might have come across something similar before. I use the JPackage provided java-1.4.2-sun-compat but it has recently switched arch from noarch to i586. Yum understandably refuses to upgrade this package. Should I bother with yum or just upgrade it manually? John. -- John Newbigin Computer Systems Officer Faculty of Information and Communication Technologies Swinburne University of Technology Melbourne, Australia http://www.ict.swin.edu.au/staff/jnewbigin

2 1

Nightly housekeeping/Logwatch periodically not running
by Chris Mauritz 23 May '05

23 May '05

I've noticed something strange with a 3.4 test box that is basically just sitting here in the lab. I've got it configured to forward me the Logwatch run (which seems to go off at 4:02am by default). Every couple of days, that logwatch run goes missing. I haven't really dug down to find out if the cron job is crapping out or if postfix is dropping the report on the floor. Is anyone else having this problem? It's a completely vanilla 3.4 system with all the latest patches on a single P4 3.4ghz machine. Otherwise, the system seems to be just dandy. It's quite speedy and has never given me an instant of trouble. *scratching my head* Cheers, C

2 1

segmantation fault
by Adrian Coman 22 May '05

22 May '05

Hi, On a CentOS4 I've updated kdelibs and everything that up2date has signaled me to, and now I get segmentation fault when running xmms (installed from the Centos4 dvd) and also when running gmplayer which is installed from DAG repository for EL4. Is anyone in my position or it's just me? Do you know why? Adrian

5 12

Centos4 and Typo3
by Blaž Bogataj 22 May '05

22 May '05

Hello, Does anybody use Centos4 and Typo3 as web portal? For all functionalities (graphic) of the portal Image Magick and GD Library must be installed. Are these packets already included in any packet of php... or not? If the answer is not, where can I found these two packets compiled for Centos? Or is there any other solution ? I'dont like to compile these packets, since I have to maintain them by myself. Thanks. Blaž

2 1

Re: [CentOS] Re: mplayer repository for CentOS
by Bryan J. Smith <b.j.smith＠ieee.org> 22 May '05

22 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > I don't know if I would call it FUD ... BUT, if repos are going to work > together, they have to use consistent names for packages, so that > versioning will work properly. Agreed. Red Hat really wants to see this with the greater Fedora Project, but I there is a long way to go and a lot of concessions still to be made. I don't blame anyone for the lack of consolidation. > Just for the record, using the Fedora Core library on CentOS-4 can be > problematic (and even DAGs repo, for that matter) ... in that both can > overwrite base CentOS libraries. I find as long as I align the versions correctly, and _only_ tap Fedora Extras and Livna.ORG (and _not_ Fedora Core), I haven't had an issue. > I would highly recommend that you use a includepkg= in your yum > configuration for any external repo (even things like centosplus). I am aware of such details. In many cases, I'm maintaining my own, internal repositories anyway for multiple systems. > Karanbir Singh is working on a rebuild of FC Extras that uses > functionality already in CentOS-4 and doesn't upgrade any packages > (unless required) that are part of the base centos. Since FC is not > CentOS, and there are differences in some libraries, I would > recommend Karanbir's repo over FC Extras (for CentOS-4). I don't > have the address of this site handy right now...I'm sure someone does. One thing I'm tiring of is the inconsistency between FC/RHL and RHEL. It's one thing that is looking better about SL and NLx every day. I'm waiting to see what Novell does with SL 10.x and NLx 10. > Just be careful when using any external repo, as it can replace things you > don't want. Exactly. -- Bryan J. Smith mailto:b.j.smith@ieee.org

5 5

Re: [CentOS] Re: mplayer repository for CentOS
by Bryan J. Smith 22 May '05

22 May '05

I think DAG made a good point that if the SPEC files are only written for the latest release of a distro, it's not a RPM, APT/YUM or repository issue. Being that he has far more experience than I in maintaining the same package for multiple versions, I guess I've been a bit ignorant of that viewpoint. -----Original Message----- From: Les Mikesell Date: 05-5-21 20:35 To: CentOS mailing list Subj: Re: [CentOS] Re: mplayer repository for CentOS On Sat, 2005-05-21 at 00:58, Dag Wieers wrote: > Bryan, that's more a apt/yum issue than it is a repository issue. If you > think repository maintainers should divide their repository in all > possible permutations of what people might want (and what > cross-requirements exist between these repositories), you have not > maintained a big repository. Do any of the yum-like tools have the ability to work at the src rpm level in addition to the binary ones? That is, could you maintain a a single repository of extra packages that work with a range of distributions/versions/libraries and have a tool automatically build them on the requesting system if a matching binary rpm didn't already exist? -- Les Mikesell lesmikesell(a)gmail.com _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re: [CentOS] Re: Hi, Bryan; was: Re: pronunciation? <snip> -- don't shoot the messenger ...
by Bryan J. Smith 22 May '05

22 May '05

From: Collins Richey > Sounds pretty religious-based to me. > IBM=bad > HP,Sun, RedHat, SCO=good. > OTOH, from some of your comments, Novell=better. Are you really that shallow? IBM is our partner, not our friend. Sun has its interests too, and has 5 different entities of focus, which vary. Red Hat is a tale of two companies, cut-throat business combined with GPL-analness (like Stallman on one side, Microsoft on the other - an unique balace). And Caldera-SCO post-May 2003 is no longer a software company, and as of their lobbying of Congress as of January 2004, they are basically condeming the right to digital assembly. There is no such thing as good/bad. Companies have their reasons for doing things. But what I can't stand is people like yourself holding different companies to different standards. Trust nothing but actual community donations - because everything else can change tomorrow. > You've provided plenty of one-liners in this discussion. I don't take the time to explain things for my health. In fact, most people complain about my verbosity. And this "summary" you provided is wholly inaccurate and not even relevant. > Plus there's the underlying religious belief, > at least that's how I've read it, that IBM's efforts to make money > are inherently suspect and/or evil No. You haven't heard a word I said. I have repeatedly said that Linux people should not be shallow, and confuse money with actual donations to the community. As I call it, it's the "Linux Quiz Show" and many people squabble over many things, but apparently if IBM does the same thing or even worse, people assume they can't be bad. SCO v. IBM resulted because of two companies - or bigger than the other. Sun has been repeatedly scrutinized for things that IBM does and few (outside of Linus and other developers) seem to question. Whatever people get all hussy about, the media reports, even if its levied unevenly. And boy to some Linux people seem to get all so political and "anti" all the time. > and RedHat's attempts to do the same are blameless and > praiseworthy. Please point me to the non-GPL compatible (let alone just non-GPL) software Red Hat develops! Stallman was brilliant, because after AT&T was broken up and could now sell UNIX, he _knew_ companies can change overnight. When Red Hat kills its GPL focus, then you will hear me point out the same deals. Until then, no matter what Red Hat does commercially, we benefit from what they do. Stallman's moral delima at the foundation of _several_ companies (not just Red Hat) - the ultimate savior from themselves. IBM is still heavily non-GPL and, again, the irony is that their GPL and even GPL donations still trail even Sun if you can believe that. Does that mean IBM is bad? I could care less about such a simplication! But IBM does have a history of destroying even GPL-centric companies when they see them as a threat. Sun and HP have a long history of standards - although IBM is improving in many areas, but still scary in others. After all, if I'm CEO of IBM, the patent king, I've gotta be careful. I hold any company to the same standard. I don't thin IBM is "bad" -- but damn if they are as "good" as many other companies - at least to date. But, again, companies can change overnight, so all we're left with is what they gave in GPL or GPL compatible software. And that's the _only_ standard that is consistent. I keep a watchful eye, and hold them to actual _community_ donations. No company should feel obligated, but Linux users need to be a little less "shallow" than bad/good. And they need to hold _all_ companies to the _same_ standard. So far, I see a lot of vendor/brand-name bigotry flying around that reminds me of the Windows world. > All of this has little to do with CentOS, and fortunately > CentOS isn't into the religion/blame game. Then leave it off the list in the first place. When I see a company demonized or slandered, while another is praised, it's typically based not on actual considerations of their donation to the community, but blind vendor alignments - the whole reason AT&T became a problem, then Microsoft, etc... Don't shoot the messenger, I'm not the one slamming companies. But when I see it, I will stop to point out what assumptions are incorrect. You can't get upset with me without getting upset with those that keep proliferating the vendor non-sense. So let us make it about GPL and GPL compatible software, and not consider the private lawsuits, or the non-GPL compatible (let alone proprietary) R&D. Let's just keep focused on the community, and not make the community a place where people trash companies off-the-cuff. Your simplification is noted as your inability to comprehence anything complex, such as the fairly limited history I have tried to provide on the companies you seem to love/hate so much. I don't trust any company, I only trust the source, and I only favor companies who donate the most GPL and GPL compatible source. Because it's the only thing that remains if and when they do change.

3 2

Re: [CentOS] mplayer repository for CentOS
by Bryan J. Smith 22 May '05

22 May '05

That Red Hat exited the desktop market. -----Original Message----- From: Collins Richey Date: 05-5-21 17:34 To: CentOS mailing list Subj: Re: [CentOS] mplayer repository for CentOS On 5/21/05, Bryan J. Smith <b.j.smith(a)ieee.org> wrote: [ snips ] > ...Red Hat marketing to try to repair a lot of the damage that eWeek's > mis-quotes of Michael Tiemann did back in 2003. > An what might these misquotes and this damage be? I've done a little googling with those keywords and found nothing of interest. I haven't a clue what you're talking about. -- Collins Head teachers of the world unite: you have nothing to lose but the Start button. _______________________________________________ CentOS mailing list CentOS(a)centos.org http://lists.centos.org/mailman/listinfo/centos

1 0

Re: Hi, Bryan; was: Re: pronunciation? <snip> -- don't shoot the messenger ...
by Bryan J. Smith <b.j.smith＠ieee.org> 21 May '05

21 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > IBM has since totally changed their thoughts with regards to GNU/Linux. Actually, their cut-off of Monterey had everything to do with their current change in strategy on Linux back in 2000+. Monterey was established before IBM's interest in GNU/Linux. After IBM realized that it could use an economical complement in Linux, it saw a Monterey/IA-64 version as a thread (this was before x86-64 established itself). Hence the result. > They (like RedHat) are still a business that needs to make money ... but > both they (and RedHat) are doing many things to make GNU/Linux much > better. But in actual "meat" -- HP, Red Hat and even Sun have done far more for GPL GNU/Linux. IBM's support has been sporadic, and heavily non-GPL. Now I _have_ noted a few of their kernel contributions, and their 500 patent donation actually made me rethink my stance. But still, in comparison to even Sun, they are anemic. Especially when they yanked support for Linux on their desktops and notebooks, even at the height of their involvement. HP and even Sun have expanded in comparison. Right now IBM's involvement has been limited to certain, enterprise-specific considerations. And even their Java has not been anywhere near GPL -- not even SWT. > Would they rather you buy their hardware and software, yes (ie, AIX). > Would they rather you ran Linux on their Hardware, if you were going to > run it (vice on HP), yes. But they are actually preventing clients from going with another vendor by contract. In reality, IBM is no better than what Caldera-SCO is now doing, and IBM has actually been the "master" in that approach. > But the fact remains that IBM is put more money into Linux than > anyone else. That's the "Linux Quiz Show" I'm talking about. You're tuning in for the money, not the substance. Maturing your own product line and not sharing your developments is what IBM is doing, not HP, Red Hat or even Sun. And in most cases, IBM's licenses are no better than Sun's -- let alone IBM has not even matched 1/10th of the GPL donations of HP, Red Hat or Sun. That's what I'm talking about. > IBM is a founding member and large donor to OSDL ( http://www.osdl.org > ) ... which employs Linus Torvalds and Andrew Morton (among others) to > do Linux kernel work exclusively. And that's one of the very few highlights of IBM. They have also helped out LPI tremendously. But when it comes to actual donations and endeavors, they are very, very, _very_ proprietary. IBM's entire solutions are built upon proprietary tiers with little-to-no standards, whereas HP and Sun are at least "open standard," and HP's frameworks are increasingly open source based (with heafty donations). What I'm trying to say here is that IBM is offering "vendor lock-in" no different than Microsoft from a solutions standpoint, which matches the fact that they are porting their proprietary software to Linux and leaving it proprietary. Other than some community endeavors like OSDL, support of LPI, their entire Linux effort is 98% proprietary, and most of the remaining 2% is not "GPL compatible." While I appreciate IBM's efforts, I really find it ironic that people don't hold IBM to the same standards as Sun or Red Hat. And when it comes to a leading R&D company that is also a tier-1 OEM, HP is far more of a community donator than IBM. IBM has only stood behind the GPL when it has favored them, like in the Caldera-SCO lawsuit (although I admit their legal team _does_ seem to "get" the GPL, and are using it well in the lawsuit). > They also employ Andrew Tridgell (samba creator). Where is Linux > without OSDL and IBM? Many companies are involved with OSDL. It's not just IBM. In fact, last time I checked, HP and Red Hat were also heavily involved. I know Sun is now participating (although I'm sure no where near the other 3). In fact, Red Hat has continually been the company that has solved many GPL issues when the have arisen, instead of just complaining about them. E.g., Qt/KDE -- instead of fighting it, they created GNOME. The new Java reliance on OpenOffice.org 2.0? Red Hat has been the catalyst for renewed GCJ development. > Whatever people want to talk about is fine with me :) Same here. But I don't want people complaining about my posting factual information in response to snide comments. They can ignore it if they don't like it. If you embrace it, I think you'll find why I get a lot of the work I do as a Linux architect all over the US. Because I don't demonize companies and products with 1-liners. I explain their strategies and their technologies in a very technical and legal way. Trust me, I don't know how many times I've gone into a client and the one business developer or mid-executive who has veto'ed every other consultant finally gives his approval to the technical leads. Because he knows I'm not going to take the company down a religious-based solution. I'm going to architect a solution that is about mitigating risk, and factoring in the vendor interests into minimizing that risk. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Re: mplayer repository for CentOS
by Bryan J. Smith <b.j.smith＠ieee.org> 21 May '05

21 May '05

From: William Warren <hescominsoon(a)emmanuelcomputerconsulting.com> > considering the FUD fedora talks about mixing repositories. It's not FUD, it's an issue with Debian as well. >From what I've seen, for the most part, as long as you pick one or the other repository, you're okay. E.g., either DAG or FE+Lorg. One of the reasons for the greater Fedora Project (outside of the Fedora Core name change and trademark issues) was the continued sprawling of repositories. Fedora Extras was supposed to address this, but even I'll admit that it seemed a little too much "you're on your own" in the first 18 months of its existance. I.e., the former U of Hawaii Fedora Project didn't do much to help anyone but their own, existing project set, and the new Livna.ORG repository fork (for legal reasons). But as of this year, there is now a formal submittal process. And being a software engineer myself with a lot of experience in formal lifecycle and testing, I kinda prefer the quality I see out of Red Hat's regression and other testing. Maybe it's because I had horrors with FreshRPMS before I switched to Fedora.US (before Red Hat's involvement), and instantly saw many issues go away. But FE/Lorg seems to have everything I want. Only a couple times have I tapped DAG, and then I only did it temporarily in my APT/YUM files to avoid "repository mixing" issues anytime I did an upgrade later. BTW, just so everyone know, this e-mail was _not_ to argue the merits of "which repository is better / sucks." I was just interested in finding out if anyone is like me, tapping FE/Lorg, or if most everyone is just using DAG. That's all. I might try a few systems under test and see how it all goes. -- Bryan J. Smith mailto:b.j.smith@ieee.org

6 7

Software RAID CentOS4
by Gerald Waugh 21 May '05

21 May '05

Hi, I have a system with two IDE controllers running RAID1. As a test I powered down, removed one drive (hdc), and powered back up. System came up fine, so powered down installed a new drive (hdc) And powered back up. /proc/mdstat indicatd RAID1 active with hda only. I thought it would Auto add the new hdc drive... Also when I removed the new drive and added The original hdc, the swap partitions were active hda and hdc but only hda on the other partitions. I has to add the other hdc partitions with mdadm -a. My mdadm.conf looks like; # mdadm.conf written out by anaconda DEVICE partitions MAILADDR root ARRAY /dev/md1 super-minor=1 ARRAY /dev/md0 super-minor=0 ARRAY /dev/md3 super-minor=3 ARRAY /dev/md2 super-minor=2 Shouldn't there be more information for mdadm to work with? How do you replace a failed drive and have it auto-configured? TIA Gerald

3 3

[Out of Office] Re: CentOS Digest, Vol 4, Issue 20
by alex＠parallaxsystems.com.au 21 May '05

21 May '05

I am on annual leave until Monday 23rd May, 2005. If you have an urgent support matter, please log in to the helpdesk site with your support agreement ID and create a ticket.

2 1

Firefox 1.04?
by Matt Bottrell 21 May '05

21 May '05

Just curious if we're likely to see Firefox 1.04 coming out shortly!? 1.03 has some *nasty* vulnerabilities.... and it would be nice to get a new build of 1.04. yeah yeah... I know... wait for the upstream *rant* Geez.... they are dragging there feet on this one. :-(

8 11

Promise FastTrak series
by Steven Moix - Axianet.ch 21 May '05

21 May '05

Hello, In some weeks I'm going to reinstall some old RedHat9 based servers with Promise FastTrak TX2000 "semi-hardware" RAID1 controllers. I just tried to install CentOS 4.0 on a computer with a spare card and as usual both HDD attached to the RAID1 controller are seen separately by the installer because the specific driver for the TX2000 wasn't loaded. Nothing new here, it was always like this on every distro as far as I know. Now I googeled a bit and have some questions: 1. In some forums I could read that the FastTrak series in RAID mode wasn't supported anymore in the 2.6 kernel (was PDCRAID module in the later 2.4 kernels). Quoted apparently from the linux kernel mailing list: >>In 2.6, Promise software RAID support does not exist. In conversations >>with Promise, we all agreed to encourage and support the standard Linux >>RAID, md. So does this mean that I have to use software RAID in linux if I don't want to load the drivers provided by Promise (see question 2)? 2. On the other hand Promise provides the partial source code for their driver, but there is a silly problem with this...I want to install my OS directly on the RAID array :) So I guess that I would have to: - Install CentOS on another computer, compile the driver provided by Promise, make a driver disk (don't ask me how). - Boot CentOS on the server with the controller and type "linux dd" to load this driver disk. - Pray and correct bugs for the next 2 weeks. Is this the right way to go? Any feedback with FastTrak TX2000 or TX4000 controllers would be very welcome, let me know which solution you choosed. Thanks Steven

3 3

Car Performance Tuning
by Alex White 21 May '05

21 May '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 List, I googled on this, and despite getting some hits (due more to the terms performance and tuning I think than anything) I was unable to locate useful links for actual software. I'm seeking software that will run on CentOS (or really any linux install period) that will assist me in testing and tuning my vehicle. I'm involved in import racing and would like to glean as much information from my car as possible while making modifications. Any ideas? Sincerely - -- Alex White prata(a)kuei-jin.org Fingerprint = 58DC 9199 CE73 74E8 B2C1 442E ACF5 92E0 E068 C46C gpg key location: http://www.kuei-jin.org/GPG-KEY-PRATA ~From the withered tree, a flower blooms --Zen Proverb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org iD8DBQFCiywArPWS4OBoxGwRAiE/AKCSk3uaSRjGhXwcPGV11n/bkZay6ACbBv0X LrZqrQsV06sIOPMeWBQDF5Q= =hCiK -----END PGP SIGNATURE-----

3 3

CentOS-announce Digest, Vol 3, Issue 11
by centos-announce-request＠centos.org 21 May '05

21 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2005:xxx CentOS 3 ia64 - lot of updates for U5 (Pasi Pirhonen) 2. CESA-2005:294 CentOS 3 i386 kernel - updated package (Tru Huynh) 3. CESA-2005:294 CentOS 3 x86_64 kernel - updated package (Tru Huynh) 4. CESA-2005:256 CentOS Low 3 i386 glibc - security update (Tru Huynh) 5. CESA-2005:256 CentOS Low 3 x86_64 glibc - security update (Tru Huynh) 6. CESA-2005:106 CentOS Low 3 i386 openssh - security update (Tru Huynh) 7. CESA-2005:106 CentOS Low 3 x86_64 openssh - security update (Tru Huynh) 8. CESA-2005:074 CentOS Low 3 x86_64 rsh - security update (Tru Huynh) 9. CESA-2005:074 CentOS Low 3 i386 rsh - security update (Tru Huynh) 10. CESA-2005:238 CentOS Low 3 x86_64 evolution - security update (Tru Huynh) 11. CESA-2005:238 CentOS Low 3 i386 evolution - security update (Tru Huynh) 12. CEBA-2005:xxx CentOS 3 s390(x) - lot of updates for U5 (Pasi Pirhonen) 13. CESA-2005:256 CentOS 3 Low i386 glibc - security update (Tru Huynh) 14. CESA-2005:256 CentOS 3 Low x86_64 glibc - security update (Tru Huynh) 15. CESA-2005:106 CentOS 3 Low i386 openssh - security update (Tru Huynh) 16. CESA-2005:106 CentOS 3 Low x86_64 openssh - security update (Tru Huynh) 17. CESA-2005:074 CentOS 3 Low x86_64 rsh - security update (Tru Huynh) 18. CESA-2005:074 CentOS 3 Low i386 rsh - security update (Tru Huynh) 19. CESA-2005:238 CentOS 3 Low x86_64 evolution - security update (Tru Huynh) 20. CESA-2005:238 CentOS 3 Low i386 evolution - security update (Tru Huynh) ---------------------------------------------------------------------- Message: 1 Date: Fri, 20 May 2005 16:05:42 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CEBA-2005:xxx CentOS 3 ia64 - lot of updates for U5 To: centos-announce(a)centos.org Message-ID: <20050520130542.GA1929(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CEBA-2005:xxx https://rhn.redhat.com/errata/rhel3as-errata.html The following updated files have been uploaded and are currently syncing to the mirrors: lot of files. Should be rest of the U5-batch. updates/ia64/RPMS/MyODBC-2.50.39-12.1.ia64.rpm updates/ia64/RPMS/am-utils-6.0.9-2.4.ia64.rpm updates/ia64/RPMS/anaconda-9.1.5.8-1.RHEL.1.centos.ia64.rpm updates/ia64/RPMS/anaconda-runtime-9.1.5.8-1.RHEL.1.centos.ia64.rpm updates/ia64/RPMS/autofs-4.1.3-130.ia64.rpm updates/ia64/RPMS/bash-2.05b-41.4.centos.0.ia64.rpm updates/ia64/RPMS/bzip2-1.0.2-11.EL3.1.ia64.rpm updates/ia64/RPMS/bzip2-devel-1.0.2-11.EL3.1.ia64.rpm updates/ia64/RPMS/bzip2-libs-1.0.2-11.EL3.1.ia64.rpm updates/ia64/RPMS/cdda2wav-2.01.0.a32-0.EL3.2.ia64.rpm updates/ia64/RPMS/cdrecord-2.01.0.a32-0.EL3.2.ia64.rpm updates/ia64/RPMS/cdrecord-devel-2.01.0.a32-0.EL3.2.ia64.rpm updates/ia64/RPMS/chkconfig-1.3.13.2-0.3.ia64.rpm updates/ia64/RPMS/control-center-2.2.0.1-15.ia64.rpm updates/ia64/RPMS/devlabel-0.48.03-10.ia64.rpm updates/ia64/RPMS/dos2unix-3.1-15.EL.22.ia64.rpm updates/ia64/RPMS/dump-0.4b37-1E.ia64.rpm updates/ia64/RPMS/dvd+rw-tools-5.21.4.10.8-0.EL3.2.ia64.rpm updates/ia64/RPMS/elinks-0.4.2-8.ia64.rpm updates/ia64/RPMS/gdm-2.4.1.6-10.ia64.rpm updates/ia64/RPMS/gedit-2.2.2-4.ia64.rpm updates/ia64/RPMS/gnome-applets-2.2.2-2.1E.ia64.rpm updates/ia64/RPMS/gnome-media-2.2.1.1-4.3.ia64.rpm updates/ia64/RPMS/gnome-vfs2-2.2.5-2E.3.2.ia64.rpm updates/ia64/RPMS/gnome-vfs2-devel-2.2.5-2E.3.2.ia64.rpm updates/ia64/RPMS/grep-2.5.1-24.4.ia64.rpm updates/ia64/RPMS/hotplug-2002_04_01-20.4.ia64.rpm updates/ia64/RPMS/httpd-2.0.46-46.ent.centos.1.ia64.rpm updates/ia64/RPMS/httpd-devel-2.0.46-46.ent.centos.1.ia64.rpm updates/ia64/RPMS/hwdata-0.101.17-1.noarch.rpm updates/ia64/RPMS/initscripts-7.31.22.EL-2.centos.ia64.rpm updates/ia64/RPMS/iscsi-initiator-utils-3.6.2-7.ia64.rpm updates/ia64/RPMS/jpackage-utils-1.5.38-1jpp_5rh.noarch.rpm updates/ia64/RPMS/kernel-utils-2.4-8.37.12.ia64.rpm updates/ia64/RPMS/kudzu-1.1.22.11-1.centos.0.ia64.rpm updates/ia64/RPMS/kudzu-devel-1.1.22.11-1.centos.0.ia64.rpm updates/ia64/RPMS/laus-0.1-70RHEL3.ia64.rpm updates/ia64/RPMS/laus-devel-0.1-70RHEL3.ia64.rpm updates/ia64/RPMS/laus-libs-0.1-70RHEL3.ia64.rpm updates/ia64/RPMS/libwnck-2.2.3-1.ia64.rpm updates/ia64/RPMS/libwnck-devel-2.2.3-1.ia64.rpm updates/ia64/RPMS/lsof-4.63-4.1.ia64.rpm updates/ia64/RPMS/lvm-1.0.8-12.2.ia64.rpm updates/ia64/RPMS/mailx-8.1.1-31.EL3.ia64.rpm updates/ia64/RPMS/man-pages-ja-20041215-1.EL3.noarch.rpm updates/ia64/RPMS/mikmod-3.1.6-21.3.ia64.rpm updates/ia64/RPMS/mikmod-devel-3.1.6-21.3.ia64.rpm updates/ia64/RPMS/mkinitrd-3.5.13.3-1.ia64.rpm updates/ia64/RPMS/mkisofs-2.01.0.a32-0.EL3.2.ia64.rpm updates/ia64/RPMS/mktemp-1.5-18.2.ia64.rpm updates/ia64/RPMS/mod_auth_mysql-20030510-2.ent.ia64.rpm updates/ia64/RPMS/mod_ssl-2.0.46-46.ent.centos.1.ia64.rpm updates/ia64/RPMS/net-snmp-5.0.9-2.30E.15.ia64.rpm updates/ia64/RPMS/net-snmp-devel-5.0.9-2.30E.15.ia64.rpm updates/ia64/RPMS/net-snmp-libs-5.0.9-2.30E.15.ia64.rpm updates/ia64/RPMS/net-snmp-perl-5.0.9-2.30E.15.ia64.rpm updates/ia64/RPMS/net-snmp-utils-5.0.9-2.30E.15.ia64.rpm updates/ia64/RPMS/net-tools-1.60-20E.7.ia64.rpm updates/ia64/RPMS/netdump-0.7.7-2.ia64.rpm updates/ia64/RPMS/netdump-server-0.7.7-2.ia64.rpm updates/ia64/RPMS/nss_ldap-207-15.ia64.rpm updates/ia64/RPMS/ntsysv-1.3.13.2-0.3.ia64.rpm updates/ia64/RPMS/pam_krb5-1.75-1.ia64.rpm updates/ia64/RPMS/procps-2.0.17-13.7.ia64.rpm updates/ia64/RPMS/psacct-6.3.2-31.rhel3.ia64.rpm updates/ia64/RPMS/psmisc-21.3-2.ia64.rpm updates/ia64/RPMS/pstack-1.2-3.EL.2.ia64.rpm updates/ia64/RPMS/quota-3.10-7.ia64.rpm updates/ia64/RPMS/raidtools-1.00.3-8.EL3.ia64.rpm updates/ia64/RPMS/redhat-config-httpd-1.1.0-4.30.2.noarch.rpm updates/ia64/RPMS/redhat-config-users-1.1.18-5.noarch.rpm updates/ia64/RPMS/rmt-0.4b37-1E.ia64.rpm updates/ia64/RPMS/shadow-utils-4.0.3-23.08.ia64.rpm updates/ia64/RPMS/squid-2.5.STABLE3-6.3E.9.ia64.rpm updates/ia64/RPMS/strace-4.5.9-2.EL3.ia64.rpm updates/ia64/RPMS/sysklogd-1.4.1-26_EL3.ia64.rpm updates/ia64/RPMS/sysreport-1.3.7.2-4.noarch.rpm updates/ia64/RPMS/unix2dos-2.2-19.EL.25.ia64.rpm updates/ia64/RPMS/usermode-1.68-5E.3.ia64.rpm updates/ia64/RPMS/usermode-gtk-1.68-5E.3.ia64.rpm updates/ia64/RPMS/vixie-cron-3.0.1-76_EL3.ia64.rpm updates/ia64/RPMS/ypbind-1.12-5.21.6.ia64.rpm updates/ia64/RPMS/ypserv-2.8-13.ia64.rpm updates/ia64/RPMS/zsh-4.0.7-1.EL.2.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

Re: [CentOS] mplayer repository for CentOS
by Bryan J. Smith <b.j.smith＠ieee.org> 21 May '05

21 May '05

From: Adrian Coman <adi.coman(a)gmail.com> > Is there a CentOS yum repository for mplayer&dependencies? From: Ralph Angenendt <ra+centos(a)br-online.de> > http://dag.wieers.com/home-made/apt/> I'm kinda curious. I'm typically tapping the Livna.ORG archives for RHEL3Ux/CentOS3.x (Fedora Core 1 repository) and RHEL4Ux/CentOS4.x (Fedora Core 3 repository) for MPlayer and a number of other programs that Livna.ORG provides. Nothing against DAG, but I typically like to use Fedora Extras/Livna.ORG first, unless I can't find something or have an issue. Does anyone else do this as well, or is DAG the preferred option among most? -- Bryan J. Smith mailto:b.j.smith@ieee.org

6 5

Centos4 web hosting Control Panel
by Bob Pierce 20 May '05

20 May '05

I'm looking for a nice Open Source web hosting Control Panel. Is anybody using VHCS with Centos4? Any other suggestions for good control panels? We'd really prefer a panel with a MySQL backend for user settings and such. Bob Pierce Systems Analyst Westman Communications Group pierceb(a)westmancom.com

3 3

iptables port forwarding
by Mark Quitoriano 20 May '05

20 May '05

i'm having a problem viewing logs on forwarded ports from the firewall to another server, i forwarded mail(port 25) from the firewall to an internal server. The problem is when i try to view the logs it just shows the firewall ip as the sender and not the original sender. -- Regards, Mark Quitoriano, CCNA http://www.atamanetworks.com

4 13

clamav in the yum repository
by ljacobs 20 May '05

20 May '05

Has anyone made a version of clamav for CentOS 4? For x86_64 servers? Thanks. --Len Jacobs ________________________________________________________________ Sent via the WebMessaging system at mandala-designs.com

5 4

CentOS 3 / tg3 driver on an HS20 Blade
by Brendon Colby 20 May '05

20 May '05

Greetings: I know it's been mentioned before that the tg3 driver in CentOS 3.4 is buggy. I had to revert to 3.4 today from 4 (fresh install) and now I have no link and thus no network. I'm wondering if this is caused by this bug and what the work-around is. Thanks. Brendon Colby

3 3

How NOT to have a disk recognized by grub?
by Michael 20 May '05

20 May '05

Greetings: I'm upgrading a fileserver running 3.4 (upgrade to a larger disk). I backed up the data from the "old" disk and slapped in a newer, larger disk and installed Centos-3.4. No problems. Now, there are some files on the "old" disk that I forgot to move to the back-up disk, so I'd like to mount the "old" disk as /dev/hdd and reboot the system and transfer the files [hdd (old disk) --> hda (new disk)]. However, the old disk still has Grub on the MBR and when I boot, the system tries to mount the "/boot" and "/" partitions from BOTH disks! I get errors about duplicate partitions and that those dups won't get mounted.The fileserver does boot but with a configuration combination of both systems. Question: Grub is correctly installed and configured on hda. How do I get the boot process to ignore the old disk (and MBR) on hdd??? I tried google but I can't seem to find this fix. Thanks, Michael Chinn

5 6

Re: [CentOS] Re: mplayer repository for CentOS
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

From: Paul Heinlein <heinlein(a)madboa.com> > FWIW, under RH/FC I typically used Fedora Extras and Livna, grabbing DAG > packages only when I was in a real hurry. I haven't yet tried to > integrate either repo into CentOS 4. I've pretty much just stuck with FE+Lorg for RHEL3Ux/CentOS3.x (EL3) and RHEL4Ux/CentOS4.x (EL4) out of "default," because like yourself, I'm already using them with Fedora Core (I use FC1 for EL3, FC3 for EL4). It's just one of those things where I'm already doing configuration management of my FC systems and integrating in packages from FE (although not MPlayer or most of Lorg, for legal reasons in a corporate environment), so I'm just adopting the same for my EL systems as well. So at home, I do the same (only with more packages from Lorg too). But also like yourself, I have used DAG from time-to-time. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: mplayer repository for CentOS -- oops, send wrong signal ...
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

Maciej Zenczykowski wrote: > is there stuff in livna which isn't in dag/dries > hmm... will have to take a look Preston Crawford wrote: > I haven't found much that I needed that wasn't in dag's repository. > Only two items. Here's what I've found. > gtkpod - for iPods, obviously > xine > mplayer > mplayer-plugin > bittorrent > gkrellm > irssi - ncurses IRC client > mozilla-flash > xmms-mp3 > centericq - ncurses Jabber client > pine, even (yes, I still sometimes use that) > Almost everything I've needed has been there. > And that's a wide range of stuff. Oops, I guess I sent the wrong signal. First off, by far, DAG is going to be the most comprehensive. No way would I dispute that. Secondly, my preference for Fedora Extras/Livna.ORG is because of my experience with Fedora Core and "repository mixing." Nothing against DAG, how he manages to keep up, I have no idea, but I've had better luck with Fedora Extras/Livna.ORG in the past. Now I know many people view it as a catch-22 -- the Fedora Extra team seemed to "keep it itself" in the past, and didn't open up a lot of things. All while Red Hat expected the same level of regression testing on Fedora Extras without putting anyone really on it (and leaving it to the former U of Hawaii team). But as of January of this year, Red Hat has really opened up the formal submission process for including things in Fedora Extras, and put people on regression testing submissions. I'm thinking about submitting several of my own RPMs (e.g., IMAP). Which is why I personally prefer to use Fedora Extras/Livna.ORG by default. I only tap DAG when he clear super-set of packages has something that FE/Lorg doesn't. > The only thing I've installed from downloaded binaries has been Java > stuff, jdk, eclipse, tomcat, etc. And I like to install that stuff > manually anyway. Well, there are some serious licensing issues with some of that (like Java -- far more than "patent" ones), so that is expected. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: iptables port forwarding -- name resolution and not forwarding/routing?
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > What I do is have an internal DNS server that does internal IPS for my > domain (it is listed as Primary, no secondaries, for my domain). > Internally, mail.hughesjr.com has the internal address .... externally > it real address. > Internal clients point to the internal DNS server (and internal IP) ... > external clients point to the external IP. Exactomundo. In many cases, it's not a fowarding/routing issue, but a name resolution issue. Private systems are resolving to public addresses, and you want to intercept those from ever reaching a public DNS server. That way you can replace the public name/IP everyone else sees with just the private name/IP that the private LAN should access. That means using private DNS servers and _only_ having the private systems resolving to them. Use "forwarder" and other DNS configuration on the private systems to do external resolution for the internal systems anyway. In addition to solving this issue, you get 2 additional benefits: - DNS cache pooling (all systems are resolving to 2-3 private DNS servers) - UDP/53 restriction (only allow UDP/53 through firewall to those 2-3 private DNS servers) -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] RPM dependency graph?
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

From: Christian Nygaard <chris(a)math.uu.se> > Do people know of a tool to generate a visual RPM dependency > graph either in ASCII or with Graphics? Several came out from various Red Hat developers when the "shackles were taken off" and the Red Hat Rawhide team "had at it" with renamed Fedora Core 1 Test in removing years and years of built-up "inter-dependency hell." If you search the [now] Fedora Development lists from August-September 2003, you should see several of them. Some are CLI and some web (PHP?). You can even use them to build pre-assembled package lists for use in Anaconda -- which is really nice if CentOS wants to add its own installation types. E.g., I've always wanted to create a Kerberos Key Distribution Center (KDC aka "key server") install that is rather a minimal package list. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Iptables - PREROUTING
by David González Romero 20 May '05

20 May '05

I have a server whit 2 interfaces of network, where eth0 is the interfaces connetc to internet and eth1 to the internal network. This server hace a Squid only, but i setting the iptables for protection to the server. Iptables run from script and in this script i setting the redirection for the other server in my internal network to port 80 and 443. I follow the diferent how to and many manual, but the redirect no work, the NAT POSTROUTING work and the squid work to. My DNS is Ok, because the consult whit dig command the answer is the assigned ip. Here put the copy of my script: --------------- Begin the Script #Delete Rules iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -t nat -F ## Modules install modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp ## FLUSH of Rules iptables -F iptables -X iptables -Z iptables -t nat -F ## Default policy iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT ##Filter Begin ##Note: eth0 is the network interface connect to router and ## eth1 comnect to lan ## The localhost full iptables -A INPUT -i lo -j ACCEPT ## DROP the ping for eth0 iptables -A INPUT -i eth0 -p ICMP --icmp-type echo-request -j DROP ## All pack of router acept. iptables -A INPUT -i eth0 -s rango_ip/29 -d 0/0 -p all -j ACCEPT iptables -A INPUT -i eth1 -s 172.16.0.0/24 -d 172.16.0.211/32 -p all -j ACCEPT ##Redirect server web iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 172.16.0.3:80 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 172.16.0.3:443 iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 80 -j ACCEPT iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 443 -j ACCEPT iptables -A FORWARD -i eth1 -p tcp -s 172.16.0.0/24 --dport 53 -j ACCEPT iptables -A FORWARD -i eth1 -p udp -s 172.16.0.0/24 --dport 53 -j ACCEPT ## DNS Full. ACEPT. iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT ## SQUID iptables -A INPUT -p tcp -m tcp --sport 3128 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT iptables -A INPUT -p udp -m udp --sport 3128 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 3128 -j ACCEPT # Close range of port know iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p tcp --dport 1:1024 -j DROP iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p udp --dport 1:1024 -j DROP # Close the port of webmin iptables -A INPUT -s 0.0.0.0/0 -i eth0 -p tcp --dport 10000 -j DROP ## FORWARD # Do log all forward iptables -A INPUT -j LOG --log-level info iptables -A OUTPUT -j LOG --log-level info iptables -A FORWARD -j LOG --log-level info ## Fnish of table FILTER ## General of MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.6/32 -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.10/32 -o eth0 -j MASQUERADE #iptables -t nat -A POSTROUTING -s 172.16.0.1/32 -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -s 172.16.0.9/32 -o eth0 -j MASQUERADE ## Do forward to the interfaces of network # Enable of forwarding echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/iptables -L -n > /etc/sysconfig/show /usr/bin/less /etc/sysconfig/show -----------------------------End of Script The output of command "iptables -L -t nat" show me this: Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere anywhere tcp dpt:www to:172.16.0.3:80 DNAT tcp -- anywhere anywhere tcp dpt:https to:172.16.0.3:443 Some solution?? Regards, David _________________________________________ Tec. David Gonzalez Romero Network/System Administrator CNAP- Centro Nacional Áreas Protegidas Linux counter: 242534 _________________________________________ _________________________________________ Tec. David Gonzalez Romero Network/System Administrator CNAP- Centro Nacional Áreas Protegidas Linux counter: 242534 _________________________________________

2 1

centos-announce spam
by Maciej Zenczykowski 20 May '05

20 May '05

Could we please keep the centos-announce messages in the correct format? Not centos low 3 but low centos 3? Cheers, MaZe

4 3

Re: pronunciation? -- loving CentOS doesn't mean you have to bash Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 20 May '05

20 May '05

From: Martyn Drake <martyn(a)drake.org.uk> > To be quite honest with you - that's been and gone so quickly I can't > ever remember what my position was at that time. It actually happened over the span of 2 years before any name change. With the introduction of RHEL as a separate product, RHL was having an identity crisis. It used to be that ".2" was the "enterprise release" (and they even sold SLAs as RHL6.2E), but now there was a 2nd product. Some suits insisted that RHL was still a product -- and some even viewed it as a "competiting" product. I noticed this first hand when RHL7.3, RHL8.0 and RHL9 were "missing" a few things that suddenly "reappeared" later with FC1. Most developers wanted the "shackles off" because RHEL was now the "SLA" product, and RHL was just the incubator for that product now. There was also the continuing nags from CompUSA and other resellers about selling a product that is outdated every 6 months. The result is that Red Hat Linux was deprecated to a project, no longer a product. Vendors largely stopped certifying on RHL after RHL7.3 as the announcements came that updates would only be released for 1 year. Then there were the other projects that added RPMs, etc... and all that finally came to a head in the grand re-design. > I seem to remember it had something to do with Progeny and them > supporting the releases as part of their transition solution. Had _nothing_ to do with Progeny. Progeny just decided to take advantage of the situation and offer $5/month subscriptions in the absence of RHN as of 2003Dec31 (RHL6.2-7.3 EOL) and 2004Apr31 (RHL8.0-9 EOL). Of course, anyone who follows Fedora Legacy knows that even RHL7.3 continued to have updates -- and more ".0" releases like RHL8.0 were dropped due to lack of popularity. > Usually I've gone down the route of using dedicated server providers > that can supply RHEL with the system. That's _exactly_ one of the markets Red Hat was tapping. Red Hat either wants system integrators to use Fedora Core and support their own, or buy RHEL and share the burden with them. > What prompted me to buy my own subscription was that there > were at least two providers that had issues with getting their > RHN satellites/proxies/whatever working and left the machine in > a potentially vunerable state if their install image was a fair a bit > old. That doesn't sound like a Red Hat issue, but a system integrator one. Furthermore, the system integrator _could_ have provided you a YUM repository in the meantime. > Again, I've no problems with this whatsoever. I just wish I could > have purchased a cheaper service with less frills. When Red Hat reaches the economies-of-scale that Microsoft does, then that will happen. But right now, Red Hat has to sell at a price point that is 10x that of Microsoft to get equivalent operating funds for just development. People forget economies of scale is everything. ;-> Most of Red Hat's move into the black came from their Cygnus purchase, and not sales. It wasn't until the subscription model later that they started making a profit atop of their already profitable developer/services unit that Cygnus bought them. > Yggdrasil was my first too. I then worked my way up to Caldera > (spit! spit! spit!) Why? Caldera was a _good_ company until May 2003 (2 months after the original lawsuit, prior to the addedum). Caldera bought SCO and was going to have a split Monterey/IA-64 and Linux/x86 solution. 20 days after the purchase, IBM pulled out of Monterey, yet started to sell their Monterey/Power platform (aka AIX 5L). IBM essentially _squashed_ a _good_ Linux company overnight because it wanted to be the _only_ dual-UNIX/Linux vendor. It saw Monterey/IA-64 (UnixWare 8) as a competitor so it squashed it while it could. Caldera-SCO tried to continue for 18 months, but their entire future was built on low-volume, but high-end sales of UnixWare 8 while their Linux volumes increased. The result was the March 2003 filing, one that I questioned at first, _until_ I read items #50-55. That's when I realized Caldera-SCO was suing for: A) Breach of Contract: Withholding Monterey/IA-64 B) Breach of Non-Compete: Developing Linux/IA-64 Caldera-SCO figured IBM would want the rights to UNIX(R), and IBM would settle in short order. When IBM didn't, they expanded the lawsuit and put up a "smokescreen." They want people to believe their various contractual disputes with IBM, Autozone, Chrysler, etc... are about Linux IP, when they have _no_ ground to stand on. So far, the gambit has worked, largely thanx to the rabid Linux populous who knows nothing about Monetery, and the fact that even the most pro-Linux company is _not_ IBM's friend if you threatened their Power/AIX platforms. Just ask IBM customers who can't buy Linux/x86-64 systems from IBM because IBM tries to sell them Power/AIX, and what IBM does to them if they buy HP Linux/x86-64 systems. ;-> I felt a bit vindicated when Ransom Love, co-founder of Caldera, came out in a Fall 2003 interview with eWeek and basically verified it was all about Monterey, and he didn't agree at all with the May 2003 change of strategy. What really scares me is if and when Caldera-SCO _does_ win on a few counts against IBM, that people will think Caldera-SCO has asserted IP rights on Linux. So far, in all the rulings, on anything Linux, Caldera-SCO has gone no where. But on anything having to do with IBM's Monterey dealings, and possibly "non-compete" violation in the Linux/IA-64 space, the rulings have gone Caldera-SCO's way. I'm afraid a ruling on "non-compete" terms with regard to Linux might be taken as a Linux IP by the media -- and that is very justified given the type of articles we have seen (short of Ransom's interview). To date, Red Hat, Sun and HP have donated about 10x as much in GPL than IBM. People scrutinize Sun for their non-GPL licenses, but don't seem to do the same of IBM -- who has several "non-GPL compatible" licenses on the _majority_ of their so-called "donations." It's like there is the "Linux Quiz Show" and people are tuning in for the money, not the substance. The $1B went to maturing IBM's product line, not Linux donations. The latest $100M is to port 100% proprietary IBM software to Linux, but not open source it. IBM is not our friend. Thank God Linus & co. have watched every donation into the kernel, and made sure no IP was attached (which has held up many of IBM's donations). > but found my footing and went over to Red Hat from that point > onwards. These days I help look after many render farm boxes > and workstations running a combination of Red Hat 7.2 and Fedora Core > 1. We're still converting to FC1 and it's a long and laborious > process given the number of machines that need updating. I adopted APT-RPM for all Red Hat Linux 7+ systems a long time ago. I largely use APT repositories for configuration management. On x86-64, I try to use APT-RPM, but when I need to load both i386 and x86_64 packages, YUM-RPM gets the call. > From that point we'll then going to have to look at 64bit support. YUM-RPM does an outstanding job. My only complaint is that Red Hat stupidly doesn't put the i386 version of Firefox in its repositories alongside the x86_64 packages (it does both for Mozilla though). > Much of our needs are dictated by the software we run, and our > vendors will only support certain distributions. Which is why Studio > Linux http://www.studio-linux.org was born. Why not base it on Fedora Core x86-64? That's one of the things that I'm seeing in Fedora Core like Debian. Instead of just forking from Red Hat Linux never to return (such as Caldera, Mandrake, SuSE, etc... did), people are now forking, but returning to Fedora Core as a base for the next version. That's largely how Debian-based distros work too. > Difficult since we don't have CompUSA here in the UK ;) Or whatever superstores you do have. > The last time I saw a shrink-wrapped Red Hat anything was back in the > days of RH 7, 8 and 9. I even bought some of them to support Red Hat. I have Red Hat Professional Workstation from both RHEL 2.1 and 3. They renamed it (and added volume licenses) the Red Hat Desktop to get the IT media to stop mis-quoting Tiemann that Red Hat _never_ left the desktop. > I'll be good. Has nothing to be with "being good." ;-> I just find that people have an intrinsic feeling that they must define their choice in not only a like of their choice, but a dislike for another. It's not only self-defeating, but many times the facts are not correct. Or my personal favorite, I've seen people state things about Red Hat that actually affect their distro too. I've just seen far too many bugs listed as "Fedora Core-only" when they have been Linux 2.6, Parted, GRUB, cdrecord, etc... issues. -- Bryan J. Smith mailto:b.j.smith@ieee.org

5 5

mplayer repository for CentOS
by Adrian Coman 20 May '05

20 May '05

Hi, Is there a CentOS yum repository for mplayer&dependencies? Thanks, Adrian

2 1

CentOS-announce Digest, Vol 3, Issue 10
by centos-announce-request＠centos.org 20 May '05

20 May '05

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2005:238 Low CentOS 3 ia64 evolution - security update (Pasi Pirhonen) 2. CESA-2005:238 Low CentOS 3 s390(x) evolution - security update (Pasi Pirhonen) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 May 2005 21:33:00 +0300 From: Pasi Pirhonen <upi(a)iki.fi> Subject: [CentOS-announce] CESA-2005:238 Low CentOS 3 ia64 evolution - security update To: centos-announce(a)centos.org Message-ID: <20050519183300.GI13577(a)core.upi.iki.fi> Content-Type: text/plain; charset="us-ascii" CentOS Errata and Security Advisory CEBA-2005:238 https://rhn.redhat.com/errata/RHSA-2005-238.html The following updated files have been uploaded and are currently syncing to the mirrors: files: updates/ia64/RPMS/evolution-1.4.5-14.ia64.rpm updates/ia64/RPMS/evolution-devel-1.4.5-14.ia64.rpm -- Pasi Pirhonen - upi(a)iki.fi - http://iki.fi/upi/

1 0

What I miss in yum.conf
by Petr Klíma 20 May '05

20 May '05

Is there an chance how to include an package from "checking" of repository? I can do exclude, but especialy from so big repositories as DAG I want include just a that few which are interesting for me. Is there any way how to do it? [dag] name=Dag RPMs for RHEL-3 exclude=mozilla* baseurl=http://apt.sw.be/redhat/el3/en/$basearch/dag -- Petr Klíma JIHOMILK a.s. Rudolfovská 246/83 370 50 České Budějovice Czech Rpublic phone: +420 389 136 209 e-mail: petr.klima(a)jihomilk.cz

4 3

Timezone Configuration
by kracker 19 May '05

19 May '05

Greetings All, How to does one go about reconfiguring centos's time zone configuration (to the eastern time zone (us)), via the command line? I have tested other GNU/Linux distribution's documentation, tools, files and relevant details with centos and have thus far been unable to find a compatible solution. My apologies if my question is very simple, I have done a fair amount of searching on the subject but have yet to find the command or text file which to use to achieve my goal. Also, I am using Centos 4 (C4) Respectfully, //kracker Sole: Dumb This Down

4 6

OT mod_security
by Franki 19 May '05

19 May '05

Hi guys, I've planning out my upgrade to CentOS4 and one of my plans for security is to impliment the mod_security apache module to filter out unwanted malicious intent. Not having used it before, I wanted to see if anyone here has implimented it and did it block any legit traffic or cause resource traffic/serious slowdowns of their systems? I've asked on the forum about secure virtual hosting and have considered many options but what I have decided on is a combination of vsftp/TLS to chroot users and mod_security to reduce the risk of outside intrusion attempts via HTTP. Is mod_security available as a package on CentOS4/RHEL4 ? I found packages for 3 but thus far none for 4. many thanks rgds Franki

4 6

Re: [CentOS] RE: pronunciation? -- loving CentOS doesn't mean you have to bash Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 19 May '05

19 May '05

From: Martyn Drake <martyn(a)drake.org.uk> > When I did try that support, it didn't give me a favourable > impression. However, that's just my opinion. It's good enough that HP is losing lots of clients because HP (among other tier-1 OEMs short of IBM) is finding that Linux their support is sub-par. Even Dell and others are just farming support out to Red Hat. > Others wil no doubt have really benefitted from it. What I really > needed was the errata and updates rather than support, The Fedora Core and Legacy do a fine job for several years. Just not 5+ years like RHEL or SLES. Other than the Debian Project, I've yet to see another distro break 2 years of support. Red Hat used to support the last ".2" for a long time. Unfortunately, by RHL7, they got very popular. Companies where standardizing on ".1" and even, gasp, ".0" relesaes. At one point Red Hat was supporting Red Hat Linux 6.2, 7[.0], 7.1, 7.2, 7.3, 8.0 and 9 _simultaneously_. That was overkill and a waste. I like the current Core-Legacy strategy now. Basically the latest 2 versions are supported as "current," and the Legacy team supports the most popular of the old versions. Companies who want more than 1 year of guaranteed updates on any arbitrary version can now pay for it. > and an overall better overall lifecycle that RHEL promises and indeed, > delivers. I could have gone down the Fedora route, but wasn't too > thrilled with it's overall lifecycle. How was it any different than when Red Hat announced it would no longer support Red Hat Linux more than 1 year _well_before_ the Fedora Project was announced or Red Hat Linux became Fedora Core? I honestly don't blame Red Hat for not wanting to simultaneously support 6-7 revisions simultaneously. Dead beat companies who want to standardize on a release for 2+ years should pay for it. Those of us who either "keep current" _or_ use a very stable/popular release (e.g., Red Hat Linux 7.3, or Fedora Core 1) can stick with Fedora Legacy instead. > I'm a non-commercial user (but neither a charity or educational > establishment) and that $300 per year is a lot of money to pay for a > stable and constantly updated OS. You are paying for subscription, not a license. If you don't want the subscription, run a stable version of Fedora Core that will be supported by Fedora Legacy for a long time. That's what I do with my Fedora Core 1 systems. > You could argue I could use Debian or some other free distribution, Debian, like Fedora, is supported on contributors, in addition to the commercial companies that put paid development on it. Fedora Core is still primarily developed by Red Hat because Red Hat Enterprise Linux's stability is based on it. As such, a lot of Fedora Legacy packages are released by people at Red Hat along side RHEL package releases (although they are often in "testing" because it's up to the community to support them). I have no problem with this sub-1 year "official" support model, and it was announced well before the "name change." Red Hat got tired of expecting people them to support their free product for 3+ years. > but having been a Red Hat Linux user for many years it's what I know > best and feel the most comfortable around. You're talking to someone who started on Yggdrasil and, later, Slackware, and has been installing Red Hat Linux on corporate networks for more than just web services since Red Hat Linux 4.2. I have installed both RHEL as well as RHL/FC at financial companies. I've put a lot of Fedora Core into pilot production, and then when SLAs were required, we switched to RHEL. FC also makes a great "next RHEL generation" evaluation platform, and thanx to Fedora Core 2/3 deployments, many of my clients were able to evaluate how RHEL 4 would operate well in advance. > Now I didn't actually mind PAYING for RHEL, of course not, but I just > find they need to find a sweet spot price for those that may not need > the install/configuration support (like me), Haven't you see the $99 Red Hat Professional Workstation / Red Hat Desktop at your local CompUSA? It's RHEL WS in a shrink wrap package. > or the SLAs, but want the lifecycle the product delivers and the stability > it offers. Is $340 per year worth it for that? Actually, subscriptions are just $179/year. I haven't checked to see if it's only $99 for people who buy the retail shrink-wrapped version at CompUSA or other superstores. > I was paying ï¿½65 a year for the RHN for the last available versions of > the Red Hat Linux and that suited me just fine. That price is now > ï¿½184, and includes features I don't actually need or want. Again, check out your local CompUSA and look for the shrink wrapped version of RHEL WS for $99. ;-> As Michael Tiemann said (and was mis-quoted), at the volume right now, it is cheaper to give away their time in developing Fedora Core and not charging for it than to make a boxed product like Red Hat Linux. The expectations of support at the volume they sell is just not worth their bother. It's cheaper to give away Fedora Core and support it for less than a year, even if they still put people on Fedora Legacy and release updates for longer than that based on popularity and testing support (which they leave to the community). And I don't blame them. > Of course CentOS has now came along, and that's meeting my needs just > fine. Hence why I'm more than happy to make the odd donation when I can. And that's great! But just don't feel the need to demonize Red Hat at the same time. > I'm not bashing Red Hat. Bashing Red Hat would be something along the > lines of "Red Hat sucks; they've done nothing for the community; > they're just another greedy organisation" which would be wrong on all > accounts. Red Hat is also a business and needs to be profitable like > any other business. I recognise that. I also recognise what they've > done for the community as well. They are a good company. Okay. But don't make statements like the one you did then. ;-> > I'm sorry to have come across 'bashing' Red Hat. Not my intention, > most definately. Understood. -- Bryan J. Smith mailto:b.j.smith@ieee.org

2 1

Re: [OT] FOSS or Freedomware? -- WAS: pronunciation/Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 19 May '05

19 May '05

From: Johnny Hughes <mailing-lists(a)hughesjr.com> > MUCH more FOSS oriented I've been taking an informal survey on this for awhile now. I know the new, official acronym is Free and Open Source Software (FOSS). But even before that acronym was popular, I had long argued that Stallman's insistence on calling it "Free Software" when that could be confused with "Freeware" or, worse yet, "Shareware" was a disseervice. I liken that problem to people who like to use the term "Hacker" in general, even though the original term was used to designate someone of creative or other technical skill. "Open Source" doesn't dictate that the source code is free of IP either. And the whole term "open" is overused, especially when people are thinking of "Open Systems" (at least one major Microsoft executive had an entire interview when he confused "Open Source" with "Open Systems") and people argue standards. Which is why I like the term, which I have been using for a long time, of "Freedomware." It conveys that it isn't free of cost, while conveying that it is freedom from many things in the way that at least Americans (if not many others) typically understand -- not always positive either. I actually have a slew of license categorizations on a 2D plot against source and standards: - Freedomware (open source, open standard) - Standardware (proprietary source, open standard) - Sourceware (open source, proprietary standard**) - Commerceware (proprietary source, proprietary standard) **NOTE: E.g., IP or other requirements. I like to differentiate between vendors who adhere to open standards but with proprietary source. E.g., I call the nVidia "nvidia" driver as "Standardware" because it is a standard GLX implementation. I also want to differentiate between "good" vendors who maintain proprietary standards over time, because they value their customers and their own property, and those who purposely don't even maintain internal, proprietary standards, and purposely change file formats regularly, and incompatibily. The former I call "Commerceware." The later is what I call intentional Hostageware: - Hostageware (unmaintainable source, unmaintainable standard) Any software can become Hostageware. If it is unmaintained, eccentric, etc..., that's a risk to the data contained in/produced by the software. Open Source doesn't necessarily mean Open Standard, or that the software will be a common standard. There are a lot of Open Source programs out there with eccentric formats. So any software is really about mitigating risk and not some philosophical non-sense. And I find that sells much better to clients than anything. And most seem to like the term Freedomware too. Because freedom can be both great, and a burden at the same time. -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

Re: [CentOS] RE: pronunciation? -- loving CentOS doesn't mean you have to bash Red Hat
by Bryan J. Smith <b.j.smith＠ieee.org> 19 May '05

19 May '05

> Ubuntu and Knoppix can say they use Debian sources ... SLAX can say it > uses Slackware sources. Those guys have trademarks too. Debian and Slackware don't sell "enterprise" products. And many such projects are non-profit or otherwise. Unless Debian plans to establish itself as a commercial player, they don't need to defend their trademark. In fact, the commercial entity behind Debian is not named Debian, but Progeny. Ian Murdock was smart in this regard. Red Hat was not. Before Red Hat changed their trademark rules and introduced Fedora(TM), Sun could _legally_ distribute anything it wanted and call it "Red Hat(R) Enterprise Linux." Why? Because Sun had grounds to state that Red Hat had failed to enforce their trademark. Especially given the fact that Sun now owned Cobalt, and could show that history directly under their own ownership. That's the reality of US Trademark Law. And because German Trademark Law is even worse (Remember the KIllustrator issues? They weren't even brought to court by Adobe either -- but companies are allowed to sue on behalf of another company without being so empowered), SuSE used to do the same. However, it's becoming clear that Novell may be turning SuSE into a more "Fedora-like" trademark and has publicly made comments on possibly turning it into a non-product project too. The first 100% freely redistributable version of SuSE Linux was 9.2 -- available in full ISO format, and not just FTP without many things. The reality is that Red Hat needed 2 trademarks: One to defend, one to still allow free redistribution, hence Fedora Core. Most of the endeavors in the greater Fedora Project were already set 1-2 years before the name change. With the SuSE purchase, Novell now has 2 as well. The Novell Linux 10 and SuSE Linux 10.x releases will be interesting to watch. In fact, it's funny to see Red Hat and SuSE flip-flop back and forth, following each other's lead (e.g., SLES first, then RHEL, 18-month RHPW/RHD replaced 6-month RHL Prof. on the retail shelf, now 18-month NLD is replacing 6-month SL Prof., etc...). > If Toyota and Honda both got an engine for a car from the same place ... > Honda could certainly say: > Uses the same engine as the Toyota XXXX ... even if Toyota provided them > with the engine. However, Honda or Toyota could _not_ brand the car as the original company without a license. Furthermore, they cannot market the engine as that company, not without a license to do so. Lastly, Honda and Toyota would likely have already had to license the engine in the first place, and such rights to use of the trademark probably would have been included. Red Hat is the first and _only_ (and the last ;-) majority Linux distributor to allow anyone to use their trademarks without a license, and they have an entire history of profilerated forking without enforcement they now much fight retro- actively. That's the reality of the US trademark system and the burden they created for themselves. No one else will ever do the same. What Red Hat reguarly ran up against -- especially with Cobalt and Sun -- is that people assumed they were distributing Red Hat's product, unmodified. They were not and actually distributing a radically different version that was heavily modified. I even had this discussion with a guy who hates RPM and Red Hat, and once he finally realized that his _entire_ viewpoint was based on Cobalts, he _finally_ saw the whole reason for the trademark issues Red Hat now has. It was quite an epiphany. ;-> -- Bryan J. Smith mailto:b.j.smith@ieee.org

1 0

RE: [CentOS] web.vcs.u52.k12.me.us/linux/smbldap problems
by Marc Powell 19 May '05

19 May '05

> -----Original Message----- > From: centos-bounces(a)centos.org [mailto:centos-bounces@centos.org] On > Behalf Of Johnny Hughes > Sent: Thursday, May 19, 2005 8:48 AM > To: CentOS ML > Subject: Re: [CentOS] web.vcs.u52.k12.me.us/linux/smbldap problems > > On Thu, 2005-05-19 at 09:41 -0400, Robert Moskowitz wrote: > > I am perhaps going about this the hard way of getting SAMBA all running > on > > my Centos 4 install... > > > > These scripts are set up to work with Fedora Core 3 or K12LTSP 4.2 > > > > I got the install to work. It did not seem to hard. > > > > Then the docs tell me to install apt from Fedora project. Well I am > using > > yum so I ignore that. > > > > Next step is to run: > > > > perl -MCPAN -e -shell > > > > perl -MCPAN -e shell > > > (but using CPAN to update perl will break things) I use CPAN all the time and haven't had any problems. Are you saying this because yum/rpm wouldn't know they were installed? Can you expand on your concerns? -- Marc

4 3

pronunciation?
by Todd Blake 19 May '05

19 May '05

Anyone know how centos is actually pronounced? When people I work with ask me which linux I run, I say it like the word scent - oh - s, with a sharp S on the end. How's everyone else say it? How's it supposed to be said?

12 14

Re: [CentOS] Installing CentOS on RAID PATA not SATA - A8V
by Bogdan Nicolescu 19 May '05

19 May '05

Thanks for the detailed information. Starting to make sense. Bogdan --- "Bryan J. Smith" <b.j.smith(a)ieee.org> wrote: > On Wed, 2005-05-18 at 20:23 -0700, Bogdan Nicolescu > wrote: > > My first attempt at RAID... > > I purposely call it Fake/Free RAID (FRAID) for a > reason. > It is a _regular_ ATA controller with *0* extra > hardware. > There is a "trick" 16-bit BIOS that can setup some > RAID > organization. > > It is _useless_ once a 32/64-bit OS boots. > > > Tried a different distribution with the latest > kernel, > > and indeed the PTA drives on the Promise > controller > > were recognized but they were recognized as two > > separate drives while the controller was in RAID > mode > > (rather than IDE mode). > > Correct. Because the system sees the "raw" ATA > channels. > There must be a "trick" 32/64-bit driver to match > the > "trick" 16-bit BIOS. > > This "trick" 32/64-bit driver contains _all_ of the > RAID functionality. *0* is in the hardware, because > the > hardware has *0* RAID firmware other than the > ultra-simple > stripe/mirror access when the 16-bit BIOS is > booting. > > About the same 2-3 companies write these drivers, > and > _all_ vendors license that code. Because it is the > core > IP of those companies, they will _never_ release it. > As such, the drivers are _always_ "closed source" > and > really only available for Windows. The few > companies that > do release Linux drivers release kernel > version-specific > ones that are binary-only, no source code. > > There is a "clean-room" GPL ATA RAID driver in > ataraid.c. > And then interface drivers in hptraid.c, pdcraid.c > and > silraid.c, but they _rarely_ work with most "FRAID" > cards accept for very old ones. And they are > _slower_ > than the OS' RAID (NT LDM, Linux LVM/MD, etc...). > > > Are you saying that even if the drives are > recognized, > > I will not be able to implement RAID in hardware > mode? > > There is _no_ "hardware" mode. The system _always_ > sees > the drives. There must be a "trick" driver to > "hide" the > drives and make them seem organized. > > A _true_ hardware RAID controller _always_ has > on-board > intelligence that directly controls the drives, and > has > the RAID firmware on-board. In those cases, the > system > talks to that on-board intelligence (e.g., > microcontroller > or ASIC) and _never_ actually sees the drives. > Because > all of the RAID intelligence is in the firmware, the > OS > driver is just a basic block driver, so they are > GPL. > > Examples of true hardware ATA RAID include Promise > SuperTrak > (_not_ the FastTrak), Adaptec 2400A/2800A, some (but > not > all) LSI Logic MegaRAID and 3Ware Escalade products. > > These cards cost between $125-$500+. You will _not_ > find a _true_ hardware RAID controller on a > mainboard. ;-> > > > Any other options installing CenOS 4 on > unsupported hd > > controller besides: > > a. install CentOS 4 while drive in recognized hd > > controller > > b. get new kernel > > c. compile/install new kernel (without pulling my > hair > > out) > > d. move drives to unsupported hd controller > > e. set controller to IDE mode > > f. boot using new kernel (while praying) > > g. do software RAID > > Yes, software RAID is typically _faster_ than these > FRAID cards. > Why? Because instead of using the logic of the > FRAID controller, > you get the logic of the OS' buffering. The OS' > buffering will > commit writes and interleave reads far better than a > FRAID > controller's "trick" driver logic. > > > -- > Bryan J. Smith > b.j.smith(a)ieee.org > ----------------------------------------------------------------- > > Beware of those who define their preference in terms > of hate of > another option, and not on the positive merits of > their selection > > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > http://lists.centos.org/mailman/listinfo/centos >

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss