- Discuss - lists.centos.org

Re: [CentOS] DHCP max-lease-time maximum
by Eero Volotinen 07 Jul '16

07 Jul '16

Static MAC ip mapping on dhcp server? Eero 7.7.2016 12.38 ip. "Götz Reinicke - IT Koordinator" < goetz.reinicke(a)filmakademie.de> kirjoitti: Am 06.07.16 um 18:19 schrieb John R Pierce: > On 7/6/2016 1:27 AM, Götz Reinicke - IT Koordinator wrote: >> :) ... the long lease is for some Accesspoints which we dont like to >> configure static, just plug in and run. > > why not configure reservations for those access points? > > the downside of a really long lease time is if you have to change > something like DNS, gateway, whatever, the clients with a really long > lease will not 'see' the change until 50% of hte lease time expires as > thats the default refresh. > > Hi, what do you mean with "reservations"? the APs in question just need an IP for connecting to the managemnt server which is in the same subnet. Thanks for your feedback . Götz _______________________________________________ CentOS mailing list CentOS(a)centos.org https://lists.centos.org/mailman/listinfo/centos

3 2

CentOS-announce Digest, Vol 137, Issue 2
by centos-announce-request＠centos.org 07 Jul '16

07 Jul '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Announcing Release for Gluster 3.8 on CentOS Linux 7 x86_64 (Niels de Vos) 2. Announcing Release for Gluster 3.8 on CentOS Linux 6 x86_64 (Niels de Vos) 3. CEEA-2016:1388 CentOS 5 tzdata Enhancement Update (Johnny Hughes) 4. CEEA-2016:1388 CentOS 7 tzdata Enhancement Update (Johnny Hughes) 5. CEEA-2016:1388 CentOS 6 tzdata Enhancement Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 6 Jul 2016 16:03:34 +0200 From: Niels de Vos <ndevos(a)redhat.com> To: centos-announce(a)centos.org Subject: [CentOS-announce] Announcing Release for Gluster 3.8 on CentOS Linux 7 x86_64 Message-ID: <20160706140334.GF15951(a)ndevos-x240.usersys.redhat.com> Content-Type: text/plain; charset="us-ascii" We are happy to announce the General Availability of Gluster 3.8 for CentOS Linux 7. Earlier versions (3.6 and 3.7) are still available and will keep receiving updates until the upstream Gluster Community marks them End-Of-Life. GlusterFS 3.8 brings many improvements and new functionalities. These are documented in the 3.8.0 release notes: https://github.com/gluster/glusterfs/blob/release-3.8/doc/release-notes/3.8… To install GlusterFS 3.8, only two commands are needed: # yum install centos-release-gluster # yum install glusterfs-server The centos-release-gluster content comes from the centos-release-gluster38 package delivered via CentOS Extras repos. This contains all the metadata and dependancy information, needed to install GlusterFS 3.8. Deployments that have centos-release-gluster36 or -gluster37 installed will not automatically upgrade to version 3.8. These installations will continue to stick to their current stable version with minor updates. The existing quickstart guide will still work with the new version of Gluster. In fact, we do not expect to see any issues with use-cases that work on 3.7 already. Installation and configuration is the same in the new version: https://wiki.centos.org/SpecialInterestGroup/Storage/gluster-Quickstart More details about the packages that the Gluster project provides in the Storage SIG is available in the documentation: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster The centos-release-gluster* repositories offer additional packages that enhance the usability of Gluster itself. Users can request additional tools and applications to be provided, just send us an email with your suggestions. The current list of packages that is (planned to become) available can be found here: https://wiki.centos.org/SpecialInterestGroup/Storage/Gluster/Ecosystem-pkgs These Gluster repositories and packages are provided through the Storage SIG. General information about the SIG can be read in the wiki: https://wiki.centos.org/SpecialInterestGroup/Storage We welcome all feedback, comments and contributions. You can get in touch with the CentOS Storage SIG on the centos-devel mailing list ( https://lists.centos.org ) and with the Gluster developer and user communities at https://www.gluster.org/mailman/listinfo , we are also available on irc at #gluster on irc.freenode.net, and on twitter at @gluster . Cheers, Niels de Vos Storage SIG member & Gluster maintainer

1 0

DHCP max-lease-time maximum
by Götz Reinicke - IT Koordinator 07 Jul '16

07 Jul '16

Hi, I m looking for the max value for max-lease-time. would 512640 seconds (1 year) work? Thanks . Götz

3 7

arne303 scratch in the sleep-blackboxxxx- no money
by Arne Siebert 07 Jul '16

07 Jul '16

1 0

.NET on Centos.
by Peter Q. 06 Jul '16

06 Jul '16

Hi there, I was reading about it. https://www.redhat.com/en/about/blog/net-core-now-available-and-supported-r… What will happen with Centos and .NET? In the side of security and stability.

6 7

SELinux C7 audit
by Alessandro Baggi 06 Jul '16

06 Jul '16

Hi list, I'm studying SELinux on my workstation and for this I've enforced. In a first time selinux was permissive and when switched to enforcing I had relabel some things. Due to my "nescience" about selinux and what I must configure, I'm waiting avc denied for specified services. Until today, I've configured successfully httpd, smbd. Today I've noticed that my bacula system does not work due to selinux denied because when bacula try to run pre/post job script I get access denied due to differences about context. Bacula is on bacula_t and in pre script I call commands in other context like: systemd_systemctl_exec_t ... (and other) Reading from RHEL DOC (SELinux Guide) I can accomplish to remove denied access using audit2allow and creating TE rules. I've runned: grep systemctl /var/log/audit/audit.log | audit2allow -M pol and I got 2 files pol.pp (compiled) and pol.te. pol.te reports: require { type systemd_systemctl_exec_t; type bacula_t; class file execute; } #============= bacula_t ============== allow bacula_t systemd_systemctl_exec_t:file execute; Loading this policy things "will work". Now this problem is solved by audit2allow and not by me. I don't know what is necessary to make pre/post job script to get work done. What are the meaning of rules on pol.te and why bacula can't do transiction between context? Hope in help. Thanks in advance.

2 2

OT: hardware, MegaRAID SAS 2008 (falcon)
by m.roth＠5-cent.us 05 Jul '16

05 Jul '16

I've been googling, and haven't yet found the answer: does anyone here know if a MegaRAID SAS 2008 (falcon) (rev 03) can handle drives bigger than 2TB? mark

3 5

how to set/add environment variables and make file search priority on centos
by qw 05 Jul '16

05 Jul '16

Hi, I'm using centos 6.8. In order to build gstreamer 1.8.2, I install some new packages, such as python 2.7 and yasm. And cerbero is the build system for gstreamer, and downloads some new packages from network and build them, such libtool, glib. All new packages are downloaded, built and installed in my custom directory. I want cerbero use the new packages in my custom directory. It mean that, linux will search my custom directory first, and will search others if target program or lib is not found. How to make search priority for programs, static libs, shared libs, and pkgconfig files? Thanks! Regards Andrew

2 1

A
by Duvall, Michael 05 Jul '16

05 Jul '16

A Regards, Michael Duvall Systems Analyst Concurrent Computer Corporation 2881 Gateway Drive Pompano Beach, FL 33069 c: 954-531-4538 o: 954-973-5395

2 1

how to build/install pulseaudio 6.0 on centos 6.8
by qw 05 Jul '16

05 Jul '16

Hi, Centos 6.8 comes with pulseaudio 0.9, but I want to use pulseaudio 6.0 or higher version, which is used on centso 7. How to build/install new pulseaudio on centso 6.8? Are there some dependency libs for pulseaudio? is there some rpm of pulseaudio 6.0 for centos 6.8? Thanks Regards andrew

1 0

how to use python 2.7 by default instead python 2.6 on centos 6.8
by qw 04 Jul '16

04 Jul '16

Hi, centos 6.8 comes with python 2.6. But I want to use python 2.7 to build gstreamer sdk. I have built python 2.7 and installed it into my custom directory. How to set centos to use python 2.7 by default instead of python 2.6? Thanks! Regards Andrew

5 6

netbook screen suddenly goes black
by Fred Smith 02 Jul '16

02 Jul '16

Hi all! I'm running an up to date Centos-7 on my Acer Aspire One netbook. have been for, well, ever since C7 was released. Just had an event today that also happened 2 or 3 times with earlier systems installed, but I never pursued it. What happens is that suddenly while working away on the desktop the display suddenly goes black... not black as in turned off, I can see that the backlight is still on, but no image is displayed. Nothing I can do fixes it except a reboot. I've tried CTRL-ALT-BKSP, CTRL-ALT-DEL, alt+printscreen+r+e+i+s+u+b. none of them do anything noticeable. I've been looking at system logs and don't find anything that gives me a clue what is going wrong when that happens. neither dmesg, /var/log/Xorg*, nor /var/log/messages contins much. I've tried digging thru "man journalctl" and ultimately reading thru the output of journalctl with no arguments. Can anyone of you provide further hints on what I should be looking for or at? thanks! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- But God demonstrates his own love for us in this: While we were still sinners, Christ died for us. ------------------------------- Romans 5:8 (niv) ------------------------------

8 18

Securing RPC
by Leon Vergottini 01 Jul '16

01 Jul '16

Dear Community I hope you are all doing well. Recently I have been receiving several complaints from our service provider. Please see the complaint below: A public-facing device on your network, running on IP address XXX.XXX.XXX.XXX, operates a RPC port mapping service responding on UDP port 111 and participated in a large-scale attack against a customer of ours, generating responses to spoofed requests that claimed to be from the attack target. Please consider reconfiguring this server in one or more of these ways: 1. Adding a firewall rule to block all access to this host's UDP port 111 at your network edge (it would continue to be available on TCP port 111 in this case). 2. Adding firewall rules to allow connections to this service (on UDP port 111) from authorized endpoints but block connections from all other hosts. 3. Disabling the port mapping service entirely (if it is not needed). Unfortunately, I cannot disable NFS which lies at the root of this problem. In addition, I am struggling to find a proper tutorial of moving NFS from udp over to tcp. May I kindly ask you to point me in a direction or provide me with ideas on how to nail this thing in the .... Kind Regards Leon

4 3

how to update glib-2.28.8 to glib-2.40.0 or newer version
by qw 01 Jul '16

01 Jul '16

Hi, I'm trying to build gstreamer sdk on centos 6.7. When configure is run for 'gstreamer-1.8.2.tar.xz' on centos 6.7, error messages are reported as below: checking for GLIB... no configure: Requested 'glib-2.0 >= 2.40.0' but version of GLib is 2.28.8 configure: error: This package requires GLib >= 2.40.0 to compile. The command of 'yum install glib*' can only update glib to glib-2.28.8. How to update glib to the version of >=2.40.0 on centos 6.7? Thanks! Regards Andrew

3 2

[CENTOS ]IPTABLES - How Secure & Best Practice
by Leon Vergottini 01 Jul '16

01 Jul '16

Dear Members I hope you are all doing well. I am busy teaching myself iptables and was wondering if I may get some advise. The scenario is the following: 1. Default policy is to block all traffic 2. Allow web traffic and SSH 3. Allow other applications I have come up with the following: #!/bin/bash # RESET CURRENT RULE BASE iptables -F service iptables save # DEFAULT FIREWALL POLICY iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # ------------------------------------------------------ # INPUT CHAIN RULES # ------------------------------------------------------ # MOST COMMON ATTACKS iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # LOOPBACK, ESTABLISHED & RELATED CONNECTIONS iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # SSH iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # WEB SERVICES iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT # EMAIL iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT # OTHER APPLICATIONS iptables -A INPUT -p tcp -m tcp --dport XXXXX -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport XXXXX -j ACCEPT # ------------------------------------------------------ # OUTPUT CHAIN RULES # ------------------------------------------------------ # UDP iptables -A OUTPUT -p udp -j DROP # LOOPBACK, ESTABLISHED & RELATED CONNECTIONS iptables -A OUTPUT -i lo -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # SSH iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # WEB SERVICES iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT # EMAIL iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT # OTHER APPLICATIONS iptables -A INPUT -p tcp -m tcp --dport 11009 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 12009 -j ACCEPT # ------------------------------------------------------ # SAVE & APPLY # ------------------------------------------------------ service iptables save service iptables restart To note: 1. The drop commands at the beginning of each chain is for increase performance. It is my understanding that file gets read from top to bottom and applied accordingly. Therefore, applying them in the beginning will increase the performance by not reading through all the rules only to apply the default policy. 2. I know the above point will not really affect the performance, so it is more of getting into a habit of structuring the rules according to best practice, or at least establishing a pattern for myself. How secure is this setup? Is there any mistakes or things that I need to look out for? Thank you in advance for your feedback. Kind Regards Leon

9 16

CentOS-announce Digest, Vol 137, Issue 1
by centos-announce-request＠centos.org 01 Jul '16

01 Jul '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEEA-2016:1375 CentOS 7 qla2xxx Enhancement Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 30 Jun 2016 17:45:38 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2016:1375 CentOS 7 qla2xxx Enhancement Update Message-ID: <20160630174538.GA46122(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2016:1375 Upstream details at : https://rhn.redhat.com/errata/RHEA-2016-1375.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 08a6bc752e27c15e9416e7e517f3d8196230222a0b48500feabb503a51526233 kmod-qla2xxx-8.07.00.33.07.3_k-1.el7_2.x86_64.rpm Source: 8c3640fe32a123a6f1630d3f3be4007be5c3a3bcbac94a6ea37c5ff21b921456 qla2xxx-8.07.00.33.07.3_k-1.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 137, Issue 1 ***********************************************

1 0

Does centos 6.8 support gstreamer 1.8?
by qw 30 Jun '16

30 Jun '16

Hi, I found gstreamer offcial have just announced 1.8.2 version. ("gstreamer.freedesktop.org") But centos 6 only support gstreamer 0.10. When will centos 6 support gstreamer 1.8? Thanks! Regards Andrew

3 2

CentOS-7 Screen black after boot
by Venkata Balaji N 30 Jun '16

30 Jun '16

Hello Community, This is my first ever email to CentOS community. Firstly, CentOS is a great open-source operating system. I have been using it for years and recommending the same for production use to our customers. I have installed CentOS-7 operating system couple of days ago and everything was working fine. Yesterday, the screen got struck and the whole system was unresponsive, after a long wait, i have restarted the system. Since, then, i can only see the black screen and GUI is not coming up. I can remotely login to the system from Putty and can operate without any issues, the only issue is that GUI is not coming up. I have installed CentOS-7 server-GUI. Any help would be appreciated here. Regards, Venkata B N

1 0

VNC server issue- Gnome - oh no! Something has gone wrong
by Hersh 29 Jun '16

29 Jun '16

Hi, I have been using VNC on CentOS 7 server from last couple of months and it was running all fine till last night. Unfortunately, there was an abrupt power failure and system got restarted. Now, when I try to login with VNCviwer, it thrown an error message- "*Gnome - oh no! Something has gone wrong "* with a logout option. When I click on logout, I see black/dark gray screen with 3 check boxes. I googled to figure out a solution and tried several solutions but could not fix the problem. Any suggestion would be very helpful. Regards Hersh

3 4

CentOS-announce Digest, Vol 136, Issue 6
by centos-announce-request＠centos.org 29 Jun '16

29 Jun '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2016:1349 CentOS 7 lvm2 BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Wed, 29 Jun 2016 00:12:11 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2016:1349 CentOS 7 lvm2 BugFix Update Message-ID: <20160629001211.GA46363(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2016:1349 Upstream details at : https://rhn.redhat.com/errata/RHBA-2016-1349.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 9f8f2152738415ddef6509c16881468f8abedf7488490bfe724561ee7eb582c7 cmirror-2.02.130-5.el7_2.5.x86_64.rpm e23f39c92b83682c140324b0891d426bf538fbdc68cf7f267c2a87356816d89c device-mapper-1.02.107-5.el7_2.5.x86_64.rpm 0c3dc7d9d7957e749ad019f06e0cc1c87f3db76cb500457050ce2c3e46080b8b device-mapper-devel-1.02.107-5.el7_2.5.i686.rpm 4da48171c8f599255dd47809d5ed2cdbd23afe152c44540e4e6c41bb88cf7f6b device-mapper-devel-1.02.107-5.el7_2.5.x86_64.rpm b1f004cceca52345c14d2dec35b44d989d39003d3a0e37ae14ee08210296e157 device-mapper-event-1.02.107-5.el7_2.5.x86_64.rpm 6a8203ef009bd1dae1c2575bfaa89582a5d9b402e9a450ce3a787c22ead8f4a6 device-mapper-event-devel-1.02.107-5.el7_2.5.i686.rpm a2a822a1de226771fd00b9d6bce566def68a67b5c4ef1351f7d4e756a3d23e03 device-mapper-event-devel-1.02.107-5.el7_2.5.x86_64.rpm 44d8c251698d60f8bf82d71d774652c7743515edd9077a780bb33709303188e6 device-mapper-event-libs-1.02.107-5.el7_2.5.i686.rpm 59b65674dcab344b3d219b6961722bfd40780455bc0bce6bd02edd6dd768453c device-mapper-event-libs-1.02.107-5.el7_2.5.x86_64.rpm 8475f1a20a99c5f1d041187a531b5c5406c67bf84afb926096d11810f1a53d8e device-mapper-libs-1.02.107-5.el7_2.5.i686.rpm 4d964e6a7643010f2862791e2588e08f6011e4c656540d61d3ebe937ac9ce13a device-mapper-libs-1.02.107-5.el7_2.5.x86_64.rpm b7a90ef80f4e8ddb35257802a57c07660e1ddc7e2c4a9957edf382ff67ec1567 lvm2-2.02.130-5.el7_2.5.x86_64.rpm 65a4c81480d0efba21f0da7969a2f820d69e26934af24bf4fdb8c449a2d502dc lvm2-cluster-2.02.130-5.el7_2.5.x86_64.rpm 04d6d35438ff31602702872775f9fdc758c94d1e9656319dcfa09580ef21609d lvm2-devel-2.02.130-5.el7_2.5.i686.rpm e53af702e6143a89598e64754410bbdbb079fb3e5b657091d88f44fec28fa391 lvm2-devel-2.02.130-5.el7_2.5.x86_64.rpm abafec8cbed90c9e68a796b61235bab160be70a8d0a8290041d78c155d41804e lvm2-libs-2.02.130-5.el7_2.5.i686.rpm 6c0f6537d19eecc549c1c7adf01cdee3aa6d805b30496946fbcc73cb4b3fe582 lvm2-libs-2.02.130-5.el7_2.5.x86_64.rpm 39727f939e993c9baac491080ef3901b3d18536c3c4a7e12668bf381f15f99e9 lvm2-lockd-2.02.130-5.el7_2.5.x86_64.rpm 2f3b320f5108eef429344b89416a2fcf6e15a47e014faeff5b47c6a3ebe234a3 lvm2-python-libs-2.02.130-5.el7_2.5.x86_64.rpm 53316ba2995b27f5b7a4137817a66cd811c42c4ce286e682869d565f5bae76be lvm2-sysvinit-2.02.130-5.el7_2.5.x86_64.rpm Source: 399d8210953038b445e7ac3fc91fc13b517b11dc1a849f820f17296a27477a56 lvm2-2.02.130-5.el7_2.5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 136, Issue 6 ***********************************************

1 0

Errors on yum upgrade
by henimp＠openmail.cc 28 Jun '16

28 Jun '16

During yum upgrade a couple days ago, I saw this: Cleanup : kernel-3.10.0-229.20.1.el7.x86_64 35/64 warning: file /lib/modules/3.10.0-229.20.1.el7.x86_64/modules.softdep: remove failed: No such file or directory warning: file /lib/modules/3.10.0-229.20.1.el7.x86_64/modules.devname: remove failed: No such file or directory Should I be concerned about this? What could have caused it? ------------------------------------------------- ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

2 2

Re: [CentOS] UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 28 Jun '16

28 Jun '16

On Mon, June 27, 2016 12:29, Gordon Messmer wrote: > On 06/26/2016 01:50 PM, James B. Byrne wrote: >> However, all I am seeking is knowledge on how to handle this using >> iptables. I am sure that this defect/anomaly has already been >> solved wherever it is an issue. Does anyone have an example on >> how to do this? > > > I think the bit you're missing is that you don't have to address every > detail that your auditors send you. You can label an item a false > positive. You can respond that you are aware, and that you don't > consider an item to be a security defect. Fingerprinting is an > excellent example thereof. As was already noted, the IP ID field is > just one of many aspects of IP networking that can be used to identify > Linux systems. If you don't address them all, addressing one is not a > useful exercise. I understand WRT false positive flagging. And that is exactly what I have done. However, the PCI DSS report piqued my interest in this matter and I thought to satisfy my curiosity. The other stuff flagged in the report seemed a little far-fetched to me. At least the explanation of why they were flagged did. As none of them affect our PCI status I have no interest in the rest. This one however I was previously unaware and so I wanted to discover more about it. Thank you for the information and especially for the references. Sincerely, -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Guest's Additions Virtual CD
by raving Joker 28 Jun '16

28 Jun '16

Hello to everyone I'm a new italian member so I'm sorry if my english isn't perfect. I was thinking... Why not (in CentOS 7) insert a tab in the installation phase that can permit an automatic installation of guest's additions tools (I'm using virtualbox, but it can be applied to other platforms with a menu), a little system that reveals the guest addition's cd and if isn't inserted, displays to the user a message with informations about how insert it and do the installation automatically? Thanks for all of people that want to reply, I know that this virtualization platforms are in part in discordance with the ethical free software's mindset...but why not in centos, with proper informative messages? Good afternoon Raving

1 0

Use USB2.0 Camera with KVM based VM
by Mark LaPierre 28 Jun '16

28 Jun '16

Hey All, I've been googleing this issue for hours but I can't find a workable solution. I found a reply to a bug posting that said the USB hub on the VM defaults to USB 1.1. I see this is true when I lsusb on the CentOS 7 guest. The reply to the bug post went on to say that the problem is that the USB 2.0 camera will not work with the USB 1.1 default hub and that I should change the hub from USB 1.1 to USB 2.0. I see no way to do that. Can anyone shed some light on this? Is there a way to change the USB hub from USB 1.1 to USB 2.0 inside the VM Manager? Is there a better way to get my USB 2.0 web camera to appear in my CentOS 7 guest? -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

2 1

Re: [CentOS] UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 27 Jun '16

27 Jun '16

On Fri, June 24, 2016 12:24, John R Pierce wrote: > On 6/24/2016 9:20 AM, James B. Byrne wrote: >> We received a notice from our pci-dss auditors respecting this: >> >> CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps >> the >> IP Identification field at 0 for all non-fragmented packets, which >> could allow remote attackers to determine that a target system is >> running Linux. > > > 2.4 kernels are kinda old. kinda really really old. are you still > running CentOS 4 on PCI audited systems ?!?? > > The CVE is from 2002 and the kernel mentioned refers to the original report. Linux core team said it was a non-problem and the issue remains in the kernel found in CentOS-6.8. Possibly the one in 7. Perhaps it is still present in the development branch. However, all I am seeking is knowledge on how to handle this using iptables. I am sure that this defect/anomaly has already been solved wherever it is an issue. Does anyone have an example on how to do this? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

haproxy + Apache + virtual hosts -> wrong host is displayed
by Alexander Farber 24 Jun '16

24 Jun '16

Hello, I hope my question is not off-topic here. On CentOS 7.2.1511 I have installed: haproxy-1.5.14-3.el7.x86_64 httpd-2.4.6-40.el7.centos.1.x86_64 The /etc/haproxy/haproxy.cfg binds HAProxy to ports 80 and 443 and accepts HTTPS to slova.de: defaults mode http option http-server-close option forwardfor except 127.0.0.0/8 option redispatch .... frontend public bind 144.76.184.151:80 bind 144.76.184.151:443 ssl crt /etc/pki/tls/certs/slova.de.pem reqidel ^X-Forwarded-Proto: reqidel ^X-Forwarded-For: reqadd X-Forwarded-Proto:\ https if { ssl_fc } option forwardfor default_backend apache backend apache server domain 127.0.0.1:8080 The /etc/httpd/conf/httpd.conf binds Apache to port 8080 and serves several Wordpress sites: Listen 127.0.0.1:8080 ServerName 144.76.184.151 <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/afarber.de ServerName afarber.de ErrorLog logs/afarber.de/error_log CustomLog logs/afarber.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/ruhrgebietsingle.de ServerName ruhrgebietsingle.de ErrorLog logs/ruhrgebietsingle.de/error_log CustomLog logs/ruhrgebietsingle.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/bukvy.de ServerName bukvy.de ErrorLog logs/bukvy.de/error_log CustomLog logs/bukvy.de/access_log common </VirtualHost> <VirtualHost 127.0.0.1:8080> DocumentRoot /var/www/html/slova.de ServerName slova.de ErrorLog logs/slova.de/error_log CustomLog logs/slova.de/access_log common </VirtualHost> When I open http://slova.de or https://www.slova.de they work fine. But when I try to open same URLs with "www." prepended, the browser displays http://ruhrgebietsingle.de (the 2nd site out of 4) Why does it happen? I just can not figure it out. What tool would help here to debug? Thank you Alex

1 1

UDP Constant IP Identification Field Fingerprinting Vulnerability
by James B. Byrne 24 Jun '16

24 Jun '16

We received a notice from our pci-dss auditors respecting this: CVE-2002-0510 The UDP implementation in Linux 2.4.x kernels keeps the IP Identification field at 0 for all non-fragmented packets, which could allow remote attackers to determine that a target system is running Linux. The NVD entry for which contains this note: CHANGE> [Cox changed vote from REVIEWING to NOOP] Cox> So I asked some kernel guys about this - it's not considered an issue. There are several other ways to identify Linux on the wire and people who care about this kind of thing rewrite their packets in various ways via firewall technology to trick the identifier programs. So, what packet mangling may be done in iptables to solve this without breaking udp transmission? I take it that we are talking about something in the prerouting chain but what kind of mangelling is safe? Is there an example somewhere? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

CPU Compatibility Question
by listmail 23 Jun '16

23 Jun '16

Hi All, Hopefully someone with broad overview of CentOS compatibility issues can comment on this: I am evaluating a Supermicro X10SLM motherboard with an Intel E3-1231 v3 CPU. Testing with boots from Live DVDs, the CentOS 6.x family is panicking at boot time. I have tried 6.8, 6.5, and 6.3, and each one panics at slightly different points, but they all seem to fail after udev starts up (or tries to). On the other hand, I was able to boot CentOS 7.0 1511 from the Live CD. According to the compatibility chart over here: https://access.redhat.com/support/policy/intel ...anything later than 6.3 (6.4 and up) should work with the E3-12xx v3 family of processors. But those are not the results I am seeing. Does anyone have experience or commentary on this compatibility issue? Thanks, --Bill

2 2

sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello -- We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP authentication. The ldap packages that are currently installed on the system are the following: python-sss 1.13.0-40.el7_2.4 python-sssdconfig 1.13.0-40.el7_2.4 sssd 1.13.0-40.el7_2.4 sssd-ad 1.13.0-40.el7_2.4 sssd-client 1.13.0-40.el7_2.4 sssd-common 1.13.0-40.el7_2.4 sssd-common-pac 1.13.0-40.el7_2.4 sssd-dbus 1.13.0-40.el7_2.4 sssd-ipa 1.13.0-40.el7_2.4 sssd-krb5 1.13.0-40.el7_2.4 sssd-krb5-common 1.13.0-40.el7_2.4 sssd-ldap 1.13.0-40.el7_2.4 sssd-libwbclient 1.13.0-40.el7_2.4 sssd-libwbclient-devel 1.13.0-40.el7_2.4 sssd-proxy 1.13.0-40.el7_2.4 sssd-tools 1.13.0-40.el7_2.4 I ran the following commands to set up LDAP/AD authentication: # ln -s /bin/bash /bin/PHSshell # ln -s /home /PHShome # authconfig --enablesssdauth --enablemkhomedir --enablesssd -update # chkconfig sssd on # service sssd restart Initially, I ran into problems because I had not created an sssd.conf file. Eventually I did create one, and its contents are the following: [<domain>.org] enumate = true cache_credentials = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.<domain>.org ldap_search_base = dc=<domain>,dc=org tls_reqcert = demand ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt If there are any additions or corrections that I need to make, please let me know. I reran the service sssd restart command, and the error message that I am seeing via journalctl -xe is the following: Unit sssd.service has begun starting up. Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the configuration database [5]: Input/output error. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process exited, code=exited status=4 Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel> -- -- Unit sssd.service has failed. -- -- The result is failed. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered failed state. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed. Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication Agent for unix-process:6369:52587318 (system bus name :1.2287, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Any ideas? The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the following changes to the nsswitch.conf file as suggested by another mailing-list member: Domain = <company>.org ... Method = nsswitch and I have restarted idmapd service. I checked the nsswitch.conf file, and references to sss are mentioned in the following lines: passwd: shadow: group: ... services: netgroup: ... automount: I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

2 1

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello - I have made the changes to the nsswitch.conf file as suggested, and I have restarted idmapd service. I also ran the following command syntax as root to check the sssd configuration: sssd -c /etc/sssd/sssd.conf -d2 -i The output was as follows: sssd -c /etc/sssd/sssd.conf -d2 -i (Thu Jun 23 10:44:39:600097 2016) [sssd] [add_implicit_services] (0x0040): id_provider is not set for domain [<company>.org], trying next domain. (Thu Jun 23 10:44:39:600411 2016) [sssd] [confdb_get_domain_internal] (0x0010): Unknown domain [<company>.org] (Thu Jun 23 10:44:39:600443 2016) [sssd] [confdb_get_domains] (0x0010): Error (2 [No such file or directory]) retrieving domain [<company>.org], skipping! (Thu Jun 23 10:44:39:600452 2016) [sssd] [confdb_get_domains] (0x0010): No properly configured domains, fatal error! (Thu Jun 23 10:44:39:600458 2016) [sssd] [get_monitor_config] (0x0010): No domains configured. (Thu Jun 23 10:44:39:600483 2016) [sssd] [main] (0x0020): SSSD couldn't load the configuration database. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail.

1 0

Re: [CentOS] sssd.conf file missing
by Kaplan, Andrew H. 23 Jun '16

23 Jun '16

Hello – Thank-you for your e-mail. I corrected the syntax in the file, and I have confirmed the permissions are correct: -rw-------. 1 root root 266 Jun 23 08:45 sssd.conf Unfortunately, the error condition and messages listed in my initial e-mail are still present. From: l(a)avc.su [mailto:l@avc.su] Sent: Thursday, June 23, 2016 8:34 AM To: CentOS mailing list; Kaplan, Andrew H. Subject: Re: [CentOS] sssd.conf file missing Hello Andrew. The sssd.conf should be owned by root:root, mode 0600. Also please note this line in your config: [<domain>.org] enumate = true it's enumerate, not enumate. 23.06.2016, 15:24, "Kaplan, Andrew H." <ahkaplan(a)partners.org<mailto:ahkaplan@partners.org>>: Hello -- We are running CentOS 7.2 on a virtual machine, and we are trying to set up LDAP authentication. The ldap packages that are currently installed on the system are the following: python-sss 1.13.0-40.el7_2.4 python-sssdconfig 1.13.0-40.el7_2.4 sssd 1.13.0-40.el7_2.4 sssd-ad 1.13.0-40.el7_2.4 sssd-client 1.13.0-40.el7_2.4 sssd-common 1.13.0-40.el7_2.4 sssd-common-pac 1.13.0-40.el7_2.4 sssd-dbus 1.13.0-40.el7_2.4 sssd-ipa 1.13.0-40.el7_2.4 sssd-krb5 1.13.0-40.el7_2.4 sssd-krb5-common 1.13.0-40.el7_2.4 sssd-ldap 1.13.0-40.el7_2.4 sssd-libwbclient 1.13.0-40.el7_2.4 sssd-libwbclient-devel 1.13.0-40.el7_2.4 sssd-proxy 1.13.0-40.el7_2.4 sssd-tools 1.13.0-40.el7_2.4 I ran the following commands to set up LDAP/AD authentication: # ln -s /bin/bash /bin/PHSshell # ln -s /home /PHShome # authconfig --enablesssdauth --enablemkhomedir --enablesssd -update # chkconfig sssd on # service sssd restart Initially, I ran into problems because I had not created an sssd.conf file. Eventually I did create one, and its contents are the following: [<domain>.org] enumate = true cache_credentials = TRUE id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://ldap.<domain>.org ldap_search_base = dc=<domain>,dc=org tls_reqcert = demand ldap_tls_cacert /etc/pki/tls/certs/ca-bundle.crt If there are any additions or corrections that I need to make, please let me know. I reran the service sssd restart command, and the error message that I am seeing via journalctl -xe is the following: Unit sssd.service has begun starting up. Jun 22 16:05:34 roadtest2.partners.org sssd[6384]: SSSD couldn't load the configuration database [5]: Input/output error. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service: control process exited, code=exited status=4 Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Failed to start System Security Services Daemon. -- Subject: Unit sssd.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman.../systemd-devel<http://lists.freedesktop.org/mailman/listinfo/systemd-devel> -- -- Unit sssd.service has failed. -- -- The result is failed. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: Unit sssd.service entered failed state. Jun 22 16:05:34 roadtest2.partners.org systemd[1]: sssd.service failed. Jun 22 16:05:34 roadtest2.partners.org polkitd[787]: Unregistered Authentication Agent for unix-process:6369:52587318 (system bus name :1.2287, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) Any ideas? The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. _______________________________________________ CentOS mailing list CentOS(a)centos.org<mailto:CentOS@centos.org> https://lists.centos.org/mailman/listinfo/centos

3 6

Ovirt migration
by Andrew Dent 23 Jun '16

23 Jun '16

Hi We have a Single box running Ovirt 3.5.6.2-1 + CentOS7. The Engine, VDSM Host and the Storage is all on the Single box, which contains 2 * RAID1 arrays. We are looking to purchase a second box, and I'm wondering if someone can please help me to understand of how best to migrate to a HA environment using both boxes. We do have some additional NFS storage on the network that we can temporarily move VMs to. Is it possible to migrate our current Ovirt setup to be HA using Gluster, or would we need to start again by exporting all VMs, wipe box one and reinstall CentOS & Ovirt, then install CentOS and Ovirt on box two. I'd like to move the Engine to be hosted in a VM as well. Can we do HA without Gluster? Pros/Cons.... Regards Andrew Dent

2 1

KVM HA
by Tom Robinson 23 Jun '16

23 Jun '16

Hi, I have two KVM hosts (CentOS 7) and would like them to operate as High Availability servers, automatically migrating guests when one of the hosts goes down. My question is: Is this even possible? All the documentation for HA that I've found appears to not do this. Am I missing something? My configuration so fare includes: * SAN Storage Volumes for raw device mappings for guest vms (single volume per guest). * multipathing of iSCSI and Infiniband paths to raw devices * live migration of guests works * a cluster configuration (pcs, corosync, pacemaker) Currently when I migrate a guest, I can all too easily start it up on both hosts! There must be some way to fence these off but I'm just not sure how to do this. Any help is appreciated. Kind regards, Tom -- Tom Robinson IT Manager/System Administrator MoTeC Pty Ltd 121 Merrindale Drive Croydon South 3136 Victoria Australia T: +61 3 9761 5050 F: +61 3 9761 5051 E: tom.robinson(a)motec.com.au

9 23

Install C7 VM on C6 Host
by Mark LaPierre 22 Jun '16

22 Jun '16

Hey all, Before I waste myself a bunch of time trying the impossible I figured I would ask if I can install an instance of C7 in a KVM based VM on a C6 host. -- _ °v° /(_)\ ^ ^ Mark LaPierre Registered Linux user No #267004 https://linuxcounter.net/ ****

4 4

Centos 7 boot hanging unless systemd.log_target=console is used
by James Hartig 22 Jun '16

22 Jun '16

I have multiple VMs that are hanging on boot. Sometimes they'll boot fine after 5 mins and other times it'll take over an hour. The problem seems to be related to journald but I'd like to figure out how I can get more information. The VMs are running CentOS 7.1.1503. systemd and journald are both version 208. We are reluctant to upgrade to the newest CentOS because we found that journal-gatewayd is broken on boxes that have been upgraded. If I add the kernel parameter systemd.log_target=console then they boot up fine without hanging at all. I can't seem to get into the debug shell (Ctrl+Alt+F9) while the system is hanging after enabling debug-shell. Adding systemd.log_level=debug without systemd.log_target=console seems to make the problem worse and causes a hang of over an hour. I tried deleting /var/log/journal but that didn't help and I ran fsck on the root drive with no errors. I also tried masking systemd-udev-settle but that didn't help either. While the system is hanging the last console output is "Welcome to CentOS Linux 7 (Core)!". Here's the output from dmesg without "quiet" kernel parameter and without "systemd.log_level=debug": http://gobin.io/zScc systemd-analyze blame doesn't seem to help either (top 3): 10.451s nginx.service 7.149s network.service 2.178s etcd.service What else can I do to debug this? Thanks!

1 0

CentOS-announce Digest, Vol 136, Issue 4
by centos-announce-request＠centos.org 22 Jun '16

22 Jun '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2016:1266 CentOS 6 tzdata BugFix Update (Johnny Hughes) 2. CEBA-2016:1266 CentOS 7 tzdata BugFix Update (Johnny Hughes) 3. CESA-2016:1267 Important CentOS 6 setroubleshoot-plugins Security Update (Johnny Hughes) 4. CESA-2016:1267 Important CentOS 6 setroubleshoot Security Update (Johnny Hughes) 5. CEBA-2016:1266 CentOS 5 tzdata BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 21 Jun 2016 18:43:34 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2016:1266 CentOS 6 tzdata BugFix Update Message-ID: <20160621184334.GA56003(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2016:1266 Upstream details at : https://rhn.redhat.com/errata/RHBA-2016-1266.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 27275c88c15db6a83722068e6f998d74ccc00bafbb2a80cb4590b47b6ed9e5a2 tzdata-2016e-1.el6.noarch.rpm df6503b270368fa7f3b9147637e423ca6db45485f03072e9d5e273409d782007 tzdata-java-2016e-1.el6.noarch.rpm x86_64: 27275c88c15db6a83722068e6f998d74ccc00bafbb2a80cb4590b47b6ed9e5a2 tzdata-2016e-1.el6.noarch.rpm df6503b270368fa7f3b9147637e423ca6db45485f03072e9d5e273409d782007 tzdata-java-2016e-1.el6.noarch.rpm Source: 65814adef78cc1939847dc32f5ffbce8db34fc58acd8f1a002e002f5917ea638 tzdata-2016e-1.el6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 21 Jun 2016 19:05:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2016:1266 CentOS 7 tzdata BugFix Update Message-ID: <20160621190522.GA59766(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2016:1266 Upstream details at : https://rhn.redhat.com/errata/RHBA-2016-1266.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 35e627912852d34e84ea76e5cbcadf233c7945185320fc0a8b2fa7e5e4ee2099 tzdata-2016e-1.el7.noarch.rpm 688596a9be955e0f481845db5b41da2232ef701d56967971e2fe382be32fdad4 tzdata-java-2016e-1.el7.noarch.rpm Source: 32bbb097ae98767d8b45e3b38f03ae1c205eecaef6d1bcd58912fd6f5443a5fb tzdata-2016e-1.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Tue, 21 Jun 2016 19:07:23 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1267 Important CentOS 6 setroubleshoot-plugins Security Update Message-ID: <20160621190723.GA60050(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1267 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1267.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 3b8bbdeaf83bf2ae720395dd7ea13c3946f439e85bc60731f54414d85beb8a90 setroubleshoot-plugins-3.0.40-3.1.el6_8.noarch.rpm x86_64: 3b8bbdeaf83bf2ae720395dd7ea13c3946f439e85bc60731f54414d85beb8a90 setroubleshoot-plugins-3.0.40-3.1.el6_8.noarch.rpm Source: 524e4dac899bb14f96404df56f34475e037b4c9c770db40b4e039a05b5b1804f setroubleshoot-plugins-3.0.40-3.1.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 4 Date: Tue, 21 Jun 2016 19:07:49 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1267 Important CentOS 6 setroubleshoot Security Update Message-ID: <20160621190749.GA60273(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1267 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1267.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6162d2040eee1d468be25455dff5505b881b0e843848a0d770b47f8f7b6de9fe setroubleshoot-3.0.47-12.el6_8.i686.rpm 711deca2ead9d099e1ca7f7a951902a3c7380ba0afa701870a280d23a7cbce89 setroubleshoot-doc-3.0.47-12.el6_8.i686.rpm 856cbc9cbfd54ebc46934f28aff9b56779aabc387ca4ecd5ebb0457572cf056e setroubleshoot-server-3.0.47-12.el6_8.i686.rpm x86_64: f108837ced085b3b45952528799c88f53bd1203d7e2f46e65c21a2ef9baa44ed setroubleshoot-3.0.47-12.el6_8.x86_64.rpm 0a76b22ee3f5d8bdcec67c3def7496f7c276c77db4bf23ac6cd5a208ed066260 setroubleshoot-doc-3.0.47-12.el6_8.x86_64.rpm 8a91304bb9f4f120a78858f5e18555b43027997923b0a3a73bdaa2b3c5ecabb4 setroubleshoot-server-3.0.47-12.el6_8.x86_64.rpm Source: 64dea800d736c50ce5d72c06dad0cfb36857a46254d84f01131bd2a09da549d5 setroubleshoot-3.0.47-12.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 5 Date: Tue, 21 Jun 2016 19:09:43 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2016:1266 CentOS 5 tzdata BugFix Update Message-ID: <20160621190943.GA27729(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2016:1266 Upstream details at : https://rhn.redhat.com/errata/RHBA-2016-1266.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 980470351aa45a505738913c6b98e22543d182acb91410d9d23adcd5ce22efa4 tzdata-2016e-1.el5.i386.rpm f1ab933aec64ab8335388d2dc170670e6842c1828da3d9e6761d6ea4653bb729 tzdata-java-2016e-1.el5.i386.rpm x86_64: 14eea96779590f3a0a341ac8e144377cc2f5327c6e3df6d2757daf0e6a753123 tzdata-2016e-1.el5.x86_64.rpm 27051668651683bf9255059ca73b75ad2a42dee0b97c38065f073feee90fdd25 tzdata-java-2016e-1.el5.x86_64.rpm Source: 2be0737a89567aab8fa13639cfd0f98a04e6f2b337d5604e470ca5d44740f557 tzdata-2016e-1.el5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 136, Issue 4 ***********************************************

1 0

Any further developments on CentOS7 for i386?
by Kay Schenk 22 Jun '16

22 Jun '16

Well I haven't tested out the CentOS 7 for i386 yet as sent in the message of 06/02-- https://lists.centos.org/pipermail/centos-devel/2015-June/013426.html Nor have I seen any additional information. So how is this going? I'm almost ready to jump in as I would really prefer to be on Gnome 3. -- -------------------------------------------- MzK “The journey of a thousand miles begins with a single step.” --Lao Tzu

3 7

Package NetworkManager-libreswan-0.9.8.0-5.el7.x86_64.rpm is not signed
by Jules Bashizi 21 Jun '16

21 Jun '16

How to inst that Network manager please ================ Worthy agent of Light ================ Jules Irenge MSc Student University of Liverpool

4 3

Redirecting port 8080 to port 80 - how to add in /etc/sysconfig/iptables file?
by Alexander Farber 21 Jun '16

21 Jun '16

Good evening, on a CentOS 7 LAMP (not gateway) dedicated server I am using iptables-services with the following /etc/sysconfig/iptables: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [294:35064] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp -m multiport --dports 25,80,443,8080 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 2/min --limit-burst 1 -j ACCEPT COMMIT Also I am running Jetty as user "nobody" at the port 8080 using the /etc/systemd/system/websocket-handler.service file: [Unit] Description=WebSocket Handler Service After=network-online.target [Service] Type=simple User=nobody Group=nobody ExecStart=/usr/bin/java -classpath '/usr/share/java/jetty/*' de.afarber.MyHandler 144.76.184.151:8080 ExecStop=/bin/kill ${MAINPID} SuccessExitStatus=143 [Install] WantedBy=multi-user.target However I actually need my Jetty program to run at port 80 - so that users behind corporate firewalls can connect too. The Jetty doc at https://www.eclipse.org/jetty/documentation/current/setting-port80-access.h… suggests to run the command # iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 but I can not figure out the corresponding line for the /etc/sysconfig/iptables I have tried running the above command and then "iptables -S" to see the added rule, but that didn't really work. Thank you Alex

6 11

Pulling in broadwell support for cent6u5
by jsl6uy js16uy 21 Jun '16

21 Jun '16

Hello, all. Hope all is well Is it possible to install kernel and support files from 6u7 into a base 6u5 image to achieve full broadwell support in 6u5? We are "locked", clearly not fully since willing to up jump kernels, on 6u5. Thanks for any and all help

4 7

Re: [CentOS] https and self signed
by James B. Byrne 21 Jun '16

21 Jun '16

On Mon, June 20, 2016 13:16, Gordon Messmer wrote: > On 06/20/2016 07:47 AM, James B. Byrne wrote: >> On Sat, June 18, 2016 18:39, Gordon Messmer wrote: >> >>> I'm not interested in turning this in to a discussion on >>> epistemology. >>> This is based on the experience (the evidence) of some of the >>> world's foremost experts in the field (Akamai, Cisco, EFF, >>> Mozilla, etc). I would rather look to Bruce Schneier and Noam Chomsky for guidance before I would take security advice from organisations that have already shown to be compromised in the matters of their clients' security -- the EFF being the sole exception in the list provided. Or so I presently believe. >> Really? Then why did you forward your reply a private message to a >> public mailing list if not to do exactly what you claim you wish to >> avoid? > > Accidents happen. I didn't intentionally mail you off-list, > and when I noticed that I had, seconds later, I re-sent the > message to the list, expecting that you'd notice and understand > that I intended to keep the conversation on the list. > Except that I get the list as a digest. Which means that your assumptions were wrong. Funny that think you not? > ..which isn't relevant to the question of what you consider "evidence" > of security practice implications. > > Look, go to https://www.google.com/ right now and tell me what you > see. A snoop that self-signs its own certificates? > Do you suddenly distrust the internet's single largest domain? Do you > think they implement poor security practices? > My distrust of Google developed over many years. There was nothing sudden about it. But it is deep now. >>> For someone who wants "evidence" you make a lot of unsupported >>> assertions. You do see the irony, don't you? I assert my opinions if that is what you are referring to. I do not claim them to be fact. I believe them to be true but I admit readily that I may be wrong. Indeed I most certainly must be wrong in some of them. My difficulty begin determining which ones. However, I have formed my opinions on the basis of a long term exposure to security matters both pre and post Internet. And I have seen before the same thoughtless enthusiasms for things shiny and different in the security community. Things adopted and put into practice without even the most cursory of trials and evaluations for effectiveness and efficacy -- not to mention lawfulness on some occasions --. Sometimes I have had to deal with the consequences of those choices at the pointy end of the stick. Thus if I am to adopt a different point of view then I require something in the way of supporting measurable evidence to show that I am wrong and that others are right. >> The difference is that I state this is my opinion and I do not claim >> it as a fact. Your statement claimed a factual basis. I was >> naturally curious to see what evidence supported your claim. > > Citation required. > > Allow me an example. To quote you: > "The usual way a private key gets compromised is by theft or by > tampering with its generation. Putting yourself on a hamster wheel of > constant certificate generation and distribution simply increases the > opportunities for key theft and tampering." > > Now, when you asked "what possible benefit accrues from changing > secured device keys on a frequent basis?" I pointed you to > letsencrypt's documentation, which describes the benefits of > 90-day certificates. Having actual software in the possession of users rendered unusable by a policy decision implemented in the name of security is not beneficial. Referring to others self-justification of measures they have already implemented is not evidence. It is argument. Which has its place providing that one accepts the fundamental postulates of the positions being argued. These, in this case, require evidence. Assertions that these measures solve certain perceived flaws without addressing the costs of those measures is a one-side argument and not very convincing in my opinion. Refusing to deal with that is simply ignoring the elephant in the room. > > So, please describe how I am "claiming a factual basis" while you are > not. > >> Automated security is BS. It has always been BS and it always will >> be BS. That is my OPINION. It may not be a fact for I lack >> empirical evidence to support it. However, it has long been my >> observation that when people place excessive trust in automation >> they are are eventually and inevitably betrayed by it. Often at >> enormous cost. > > This is what I consider "enormous cost": > https://en.wikipedia.org/wiki/Heartbleed#Certificate_renewal_and_revocation > > After a major security bug which exposed private keys, hundreds of > thousands of servers did not take the required action to secure their > services, and the vast majority of those that took *some* action did > it incorrectly and did not resolve the problem. > > Had those sites been using letsencrypt and renewing automatically, > the exposed keys would have been replaced within 90 days > (typically 60 max, so 30 days on average). Instead, it is likely > that the problem will remain a risk for "months, if not years, to > come." > > And that's empirical evidence, which you have yet to offer. Again, you miss the point. I am not offering evidence of something that I am claiming as fact. I am seeking evidence in support of what someone else is claiming as fact. Evading the question may be a good rhetorical technique but it is hardly science. And your 'evidence' as presented above presupposes a number of unspoken assumptions. Some of which I fear would not stand scrutiny. The consequences of Heartbleed are well known to me. I had to tear down and re-establish our entire PKI because of it. However, anecdotal references to specific cases where a particular practice might, and let us remember that HB was out in the wild being exploited for at least two years before being publicly revealed, just might have provided some protection in some cases does not prove anything. In the case cited I do not believe changing certificates on an hourly basis would have made much difference against an technically proficient attacker exploiting the weakness. It is well to recall how HB came to be. A misguided attempt at an improvement in protocol exchange which amounted to not much more than gilding-the-lily and which since has been discarded without noticeable loss. What prevents similarly motivated 'improvements' to an automated certificate authority from having equally damaging effects on the robustness of the the certificates that they provide? We trusted OpenSSL because it was open. How do you trust an organisation's internal practices once they have been automated? Does anyone here actually believe that once in production this automation is or will be adequately documented? Or that said documentation will be rigourously maintained up-to-date? Or that independent and competent audits will be regularly conducted without notice? I take particular care with my PKI. I rebuild all the moduli for ssh on all of our servers for SSH. Because I trust no-one with my security. And that includes RedHat and any other external organisation, volunteer or commercial, open-source or proprietary. Automating your certificate replacement and entrusting it to an outside provider is begging to have some state actor or other financially powerful group subvert it. Look at what the NSA pulled off with RSA. That was for just money. What about patriotism? What would a true believer do if asked by his state and they were in a position to act? Think of the security nightmare that would result from having the certificate production of an automated 90 day certificate authority tampered with and left undetected for even a modest amount of time, say 180 days. At its core security is about risk analysis. And at the core of risk analysis is cost/benefit analysis. If the cost of a security measure exceeds the value of what is being secured then it makes no sense. I am seeking that cost-benefit analysis for short term certificates. And I have not seen anything in the way of objective evidence that supports the assertion that short-term certificates, or passwords for that matter, provide any measurable security benefit other than the feel-good sense that "at least its something". For one thing, this position presupposes that the rest of your security is so bad that frequent key compromise is inevitable. For another is assumes that the cost to users having to constantly deal with change is negligible. I run a business. Let me assure you that the cost of change is never negligible. > >> This impediment however is strictly an artefact of signing code with >> short term certificates. I simply had to reset the date on my MB >> back to some future date when the certificate was valid and >> everything worked fine. > > Apple's intermediate certs have a 10 year lifetime. If you consider > that "short term" then I fear that nothing is suitable in your > opinion. Apple evidently did not use those certificates to sign their software in this case. So you point is irrelevant even if it may be true. > >> But hey, what is my time worth in comparison to the security those >> certificates provided? SECURITY that was trivially evaded in the >> end. > > Fixing your clock is not "evading" security. Setting a clock backwards in time by two years is 'fixing it'? A curious point of view in my opinion. > >> Exactly what mindless person or committee of bike-shedders decided >> that software should be distributed so that copies of it expire? > > Expiration is a fundamental aspect of x509 certificates. Do you > understand x509 at all? Expiry is a fundamental part of many things including life itself. That does not imply that shorter is better. Why sign software with an expiry date when you know that your recovery programme will fail to operate after it expires? Imagine that you are on a hospital operating table and the defibrillators fail to function because the certificate that signed the firmware has expired. And that the immediate the fix is to simply reset the computer clock in the defibrillator controller backwards in time. Which of course no-one in the OR knows. So, too bad. But, you were secure when you expired. There is absolutely no sensible reason why the recovery software could not have simply warned me that the signature had expired and then asked me if I wished to proceed regardless. Having made the design decision that it would not do so then it was incumbent on the organisation responsible to allow people to override it. Instead they offer up some weasel-worded warning about "TAMPERING" and "CORRUPTION". Just what a person in the middle of system recovery is waiting to hear. Most of what passes for informed opinion about security is folk remedy dressed up with techno-babble and pushed onto an audience mostly too embarrassed to admit that they do not understand what is being talked about. In my opinion of course. However, decisions having real consequences are made on the basis of such ignorant acceptance of received wisdom. Therefore I think it important to challenge those that assert such things to produce convincing evidence that what they say is so. I understand that you believe that short term certificates and passwords and such provide a measure of security. That very well may be the case. I am not trying to convince you otherwise. All I ask for is a reasonable explanation of how much these practices cost those that employ them, how much benefit they provide to those users and what further risks they introduce. Security is a funny sort of thing being mostly based on our fear of the unknown; our too-active imaginations; and our attraction to the spectacular at the cost of dealing adequately with the mundane. At one time an automobile had to be preceded by a pedestrian waving a red flag. This too was done for the general security of all. We do not do it any more so there must have been a reason we stopped. I suggest that it was because the evidence did not support a positive cost/benefit analysis. But it sure sounded reasonable at the time to people that had little or no experience with automobiles. YMMV. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

CentOS 6 + nux-dextop: GIMP vs. GIMP 2.8 ?
by Nicolas Kovacs 21 Jun '16

21 Jun '16

Hi, I just setup a CentOS 6 desktop with the nux-dextop repository activated. When installing GIMP (yum install gimp), I get a gimp package as well as a gimp28 package. I understand this is the Nux-Dextop GIMP 2.8 package. Unfortunately this doesn't work so well with my system. It's not localized (menus appear in english, though the system is in French), the main GTK theme (Murrina Gilouche) is not managed and the application has that ugly east german look like in the good old GTK1 days, and there are two redundant menu entries, one of which is not responsive. I'd like to be able to install the plain "official" GIMP 2.6 application on my system, but when I try to 'yum remove gimp28', it takes the whole GIMP stuff down the drain with it. Note: I'm already using the Yum Priorities plugin. Official repos (base, updates and extra) are configured with a priority of 1, the other stuff (epel, adobe, nux-dextop) has a priority of 10. Any suggestions? Cheers from the sunny South of France, Niki Kovacs -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Web : http://www.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

3 5

bad iscsi performance after upgrade to CentOS 7.2
by Ulrich Leodolter 21 Jun '16

21 Jun '16

hi all, after i upgraded a physical server (SUN FIRE X4170) from CentOS 6.8 to 7.2 i am not able to get the same iSCSI read performance. the server is connected to HP P2000 Storage via 2 x 1GbE Ethernet. CentOS 6.8 gives me full read performance on raw iSCSI devices /dev/sdxx at 115MB/s. CentOS 7.2 allows only 90-100MB/s, read performance varies and is not stable like for 6.8 the multipath performance on 7.2 is even worse. CentOS 6.8 allows to read a full speed and stable 220MB/s. CentOS 7.2 maximum was 140MB/s after i disabled readahead for multipath devices in tuned. btw. i tried many recommended optimizations in 7.2, but i am not getting the raw iSCSI read performance than on 6.8, and on 6.8 i had no special tuning für iSCSI. mtu 9000 is set and verified for both OS, other settings like network buffers are almost identical. has anyone an idea why iSCSI read performance degraded in CentOS 7.2 ? best regards ulrich

2 1

https and self signed
by Jerry Geis 21 Jun '16

21 Jun '16

I followed the instructions here https://wiki.centos.org/HowTos/Https Checking port 80 I get the file... curl http://localhost/file.html <HTML> <FORM> Working </FORM> </HTML> Checking port 443 I get and error curl https://localhost/file.html curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. How do I get past this? I was looking to just self sign for https. Yes I can added the --insecure for curl - but - my other app doesn't seem to work either - perhaps getting the same return message instead of the actual file. Thanks, jerry

13 39

Re: [CentOS] https and self signed
by James B. Byrne 21 Jun '16

21 Jun '16

On Sat, June 18, 2016 18:39, Gordon Messmer wrote: > On 06/18/2016 02:49 PM, James B. Byrne wrote: >> On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >>> https://letsencrypt.org/2015/11/09/why-90-days.html >> With respect citing another person's or people's opinion in support >> of >> your own is not evidence in the sense I understand the word to mean. > > I'm not interested in turning this in to a discussion on epistemology. > This is based on the experience (the evidence) of some of the world's > foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). Really? Then why did you forward your reply a private message to a public mailing list if not to do exactly what you claim you wish to avoid? > >> The assertion expressed in the link given above that 90-day >> certificate lives will serve to increase certificate renewal >> automation is at best a pious hope. > > You are ignoring the fact that the tool used to acquire letsencrypt > certificates automates the entire process. They're not merely hoping > that users will automate the process, they're automating it on behalf > of users. They've done everything but schedule it for their users. > >> One that is unlikely to be >> realised in my opinion for the simple reason that automated and >> therefore mostly unobserved security systems are a primary target >> for tampering. > > For someone who wants "evidence" you make a lot of unsupported > assertions. You do see the irony, don't you? The difference is that I state this is my opinion and I do not claim it as a fact. Your statement claimed a factual basis. I was naturally curious to see what evidence supported your claim. > >> Likewise the authors' opinion that pki certificates are in >> general just casually left laying around to be compromised displays >> a >> certain level of what reasonably could be considered elitist >> contempt >> for the average human's intelligence. > > Or, you know, a review of actual security problems in the real world. > >> Even as arguments I find these two positions are less than >> compelling. >> And in no respect could either opinion be considered evidence. > > That's fine. I don't really need to convince you, personally, of > anything. But for the security of the internet community in general, > I'll continue to advocate for secure practices, including pervasive > security (which means reducing barriers to the use of encryption at > all points along the process of setup). > > I know, and we put infants on no-fly lists for essentially the same religious beliefs. The benefit of so-called general security for the rest of us who do not have to bear its individual specific cost. The is no evidence that this sort of stuff works. It is just done so that if anything bad happens the authorities can claim that they did something preventative which they can point to. Regardless of how ineffectual it was. Automated security is BS. It has always been BS and it always will be BS. That is my OPINION. It may not be a fact for I lack empirical evidence to support it. However, it has long been my observation that when people place excessive trust in automation they are are eventually and inevitably betrayed by it. Often at enormous cost. Let me give you an example of stupidity in action with respect to signed certificates. I have a MacBookPro c. early 2009. There have been five or six major releases of OSX since then. Being a cautious type I download the upgrade installer apps and archive them before installing and upgrading. Over this past weekend my MB stopped booting. It would get to the Apple symbol and go black. Much trial, error, and research later I discover that this is sometimes occurs when a MB has been repeatedly upgraded and that a clean install is the recommended cure. Oh, by-the-way, if you ever have to do this then do not use the Apple Migration Assistant app when you are done. You will be sorry. So, I get out my archived Installer app, go to install it and BANG! My MB proclaims that "Somebody has tampered with the application or it is corrupted!". OH NO! This impediment however is strictly an artefact of signing code with short term certificates. I simply had to reset the date on my MB back to some future date when the certificate was valid and everything worked fine. Of course this took me a great deal of frustrating effort to discover what had happened to all of my archived copies and how to fix it. In the middle of a system recovery I might add. But hey, what is my time worth in comparison to the security those certificates provided? SECURITY that was trivially evaded in the end. Exactly what mindless person or committee of bike-shedders decided that software should be distributed so that copies of it expire? What security issue was addressed by this decision? What benefit to the public was achieved? When real people suffer real inconvenience and real loss of productive effort because of mindless adhesion to bromide based cures that are blandly offered for ills that mostly exist in the imagination of the ignorant then yes; I require evidence of their efficacy. And lining up a bunch of band-wagon pundits chanting the same vacuous refrains is not evidence. And this one is going to the list. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3 -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

why gstreamer can't use ffmpeg on centos?
by qw 21 Jun '16

21 Jun '16

Hi, I have one question about gstreamer. Why gstreamer can't use ffmpeg on centos? is there some patent issue related to ffmpeg and gstreamer? Thanks! B.R. Andrew

1 0

yum "Requires" yum-plugin-fastestmirror; why?
by Warren Young 20 Jun '16

20 Jun '16

In another recent thread,[1] someone was having trouble with the yum-plugin-fastestmirror feature, so I suggested he remove it, since it’s just a plugin and should therefore be optional. He reported that it couldn’t be removed due to package dependencies. I investigated further and found that this also affects CentOS 5.11 and CentOS 7.2. (The OP is on CentOS 6.8.) So, I reported it as a bug upstream, and they claim their yum package doesn’t do that, so they’re bouncing the problem back downstream. I checked, and they’re right insofar as CentOS’s current C7 yum.spec file has this on line 118: Requires: yum-plugin-fastestmirror I then tried to go get the RHEL SRPM for yum to compare its spec file to C7’s, but their download site just refers visitors to git.centos.org, and the yum repo there doesn’t seem to have an upstream RHEL7 branch. So, I started poking around in the yum.spec file history, and indeed, the oldest yum.spec file on the c7 branch doesn’t have that Requires line! It was introduced in checkin f1c1b982, which claims all it does is “debrand yum-3.4.3-132.el7”.[2] I realize it is in the CentOS project’s best interest if users always use the fastest mirror when downloading, but I claim that it is a bug to mark any plugin as Requires, particularly when upstream does not. [1]: https://lists.centos.org/pipermail/centos/2016-June/159933.html [2]: https://git.centos.org/blobdiff/rpms!yum/f1c1b9820b3d295cf5b44fa7fc8ff3673e…

4 4

Centos 7 install on dual SSD disk Asus
by Bachir Bachir 19 Jun '16

19 Jun '16

Dear all,I installed centos 7 on the second disk of my Asus laptop. The laptop i have has two SSD disks 240 G and 480G consecutively the fist disk (240) has already windows 10 installed on , the second disk now has Centos 7 installed on.while insalling Centos 7 i let the bootloader part and because i can see only the centos disk not the windowsWhen i turn on my pc the windows part does not boot but the linux i boot on Centos disk and it run as on normal.what would be the best way to add the windows disk so that i can boot it using the bootloader?Any help will be much more appreciated Thanks muchRegards

2 1

AAC in .m4a command line tagging ???
by Alice Wonder 19 Jun '16

19 Jun '16

Hi All, Software patents suck but but unfortunately for speech, MP3 (also still patented until end of next year) also sucks - for html5 audio served to iPhones where Safari doesn't support Ogg Opus and where bandwidth may be limited, AAC is a very attractive option. I have an AAC encoding solution for Linux but I don't have a way to tag them. Anyone know of Linux command-line tagger for .m4a files that produces tags that will work in iTunes? Preferably one that allows addition of album art as well as text tags. Something like eyeD3 (python script) would be great. Has to be command line so it can be automated on a server that does the transcoding. Thanks for suggestions.

1 1

Re: [CentOS] https and self signed
by Gordon Messmer 19 Jun '16

19 Jun '16

On 06/18/2016 02:49 PM, James B. Byrne wrote: > On Fri, June 17, 2016 21:40, Gordon Messmer wrote: >> https://letsencrypt.org/2015/11/09/why-90-days.html > With respect citing another person's or people's opinion in support of > your own is not evidence in the sense I understand the word to mean. I'm not interested in turning this in to a discussion on epistemology. This is based on the experience (the evidence) of some of the world's foremost experts in the field (Akamai, Cisco, EFF, Mozilla, etc). > The assertion expressed in the link given above that 90-day > certificate lives will serve to increase certificate renewal > automation is at best a pious hope. You are ignoring the fact that the tool used to acquire letsencrypt certificates automates the entire process. They're not merely hoping that users will automate the process, they're automating it on behalf of users. They've done everything but schedule it for their users. > One that is unlikely to be > realised in my opinion for the simple reason that automated and > therefore mostly unobserved security systems are a primary target for > tampering. For someone who wants "evidence" you make a lot of unsupported assertions. You do see the irony, don't you? > Likewise the authors' opinion that pki certificates are in > general just casually left laying around to be compromised displays a > certain level of what reasonably could be considered elitist contempt > for the average human's intelligence. Or, you know, a review of actual security problems in the real world. > Even as arguments I find these two positions are less than compelling. > And in no respect could either opinion be considered evidence. That's fine. I don't really need to convince you, personally, of anything. But for the security of the internet community in general, I'll continue to advocate for secure practices, including pervasive security (which means reducing barriers to the use of encryption at all points along the process of setup).

3 3

Centos update 6.8 to 7
by Bachir Bachir 19 Jun '16

19 Jun '16

I downloaded Centos 7 and i want to update from local usb i created using dd if=cenots7 of=/dev/sdc i dont want to reinstall, i need just to update.What would be the best way to do so pleaseThanks muchBachir

2 1

Re: [CentOS] [Fwd: Re: https and self signed]
by James B. Byrne 18 Jun '16

18 Jun '16

On Fri, June 17, 2016 13:08, Valeri Galtsev wrote: > > We do not expire accounts until the person leaves the Department > and grace period passes. Then we do lock account and after some > time person's files are being deleted. This is the policy, and > this is what we do. The only time when account expiration is being > set is for undergraduate students who temporarily work with some > professor. For them expiration is being changed when the continue > to work with the professor next academic year. > > Is this not what everybody does? > Every end-user account, including my own, is given an expiry date six to twelve months in the future and that is extended at intervals as needed. The only exception to this are the root users which have no expiry date set. A forgotten and disused user account that retains access to your system is a significant risk in my opinion. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Re: [CentOS] https and self signed
by James B. Byrne 18 Jun '16

18 Jun '16

On Fri, June 17, 2016 11:06, Walter H. wrote: > On 17.06.2016 16:46, James B. Byrne wrote: >> On Thu, June 16, 2016 13:53, Walter H. wrote: >>> On 15.06.2016 16:17, Warren Young wrote: >>>> but it also affects the other public CAs: you canât get a >>>> publicly-trusted cert for a machine without a publicly-recognized >>>> and -visible domain name. For that, you still need to use >>>> self-signed certs or certs signed by a private CA. >>>> >>> A private CA is the same as self signed; >>> >> No it is not. A private CA is as trustworthy as the organisation >> that >> operates it. No more and not one bit less. >> >> We operate a private CA for our domain and have since 2005. We >> maintain a public CRL strictly in accordance with our CPS and have >> our >> own OID assigned. > for your understanding: every root CA certificate is self signed; > any SSL certificate that was signed by a CA not delivered as built-in > token in a browser is the same as self-signed; > > > For your understanding, a self-signed certificate is one that has been signed by itself. Naturally ALL root certificates are self-signed. The self-signed root cert is then used to sign a subordinate CA issuing cert and that issuing cert is used to sign other subordinate CAs and / or end-user certs depending upon the permissions given it by the original signing certificate. This establishes the certificate trust chain. If website presents an actual self-signed cert to Firefox for example, it will refuse it. I suppose there is a way to circumvent this behaviour but I am not aware of it. If you present a certificate that is not self-signed but is signed by an authority whose root certificate chain is not in the trusted root store then Firefox gives you a warning -- as given in a preceding message 'net::ERR_CERT_AUTHORITY_INVALID' -- but it none-the-less allows you to accept the certificate as an exception and proceed to the website. If you do not want to get warnings and you trust the issuer then you can add their issuing CA cert chain to your trusted root certificate store. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

yum timeout ... (CentOS 6.8)
by Walter H. 18 Jun '16

18 Jun '16

Hello, the last times, when I tried to update, it get time outs; even when 'yum list' [root@host ~]# yum list Loaded plugins: fastestmirror, security Determining fastest mirrors epel/metalink | 13 kB 00:00 * base: centos.den.host-engine.com * epel: mirror.steadfast.net * extras: centos.den.host-engine.com * updates: centos.den.host-engine.com http://centos.den.host-engine.com/6/os/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.com/6 /os/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. base | 3.7 kB 00:00 base/primary_db | 4.7 MB 00:03 epel | 4.3 kB 00:00 epel/primary_db | 5.8 MB 00:04 http://centos.den.host-engine.com/6/extras/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://centos.den.host-engine.c om/6/extras/x86_64/repodata/repomd.xml: (28, 'Operation too slow. Less than 1 bytes/sec transfered the last 30 seconds') Trying other mirror. extras ... how or where can I reset this behavour, to have the really fastest mirros used? Thanks in advance, Walter

6 12

problem i didn't seeing list file new on centos
by alireza baghery 18 Jun '16

18 Jun '16

hi i have two server *CentOS 6.5* and *CentOS 5.9 * i have one *SAN Storage* on both servers but when i create file one of server (example Centos 6.5) Other Sever (Centos 5.9) do not see file and i must *umount* Disk to seeing files new how solve this problem format disk *EXT3* Tnx

3 2

CentOS Virtual Machine System Time
by Chris Olson 18 Jun '16

18 Jun '16

We run several CentOS 6 and CentOS 7 systems as virtual machines using VirtualBox on Windows 7. Most of these systems have continuous up time. The Windows 7 foundation platforms have no difficulty keeping accurate system time unless they are shut down for some reason, which is rare in our environment. We generally restart the Windows 7 machines at leastweekly rather than performing a complete power up restart. The CentOS virtual machines are shut down at times, usually to switch between versions that support various applications and for updates using yum. When the virtual CentOS systems are brought up, the system time always matches the Windows 7 host system time. We have recently noticed that after several hours, the CentOS system time has started to lag behind. The time difference in a week can be as much as four days. This system time lag has not always been immediately discovered by the user resulting in some annoying file date issues. Access to some web sites have also been a problem due to the "date in the future" issue. We are now on the lookout for this system time problem and restart the virtual machine to set the current date and time. Is this a common time problem when running CentOS as a virtual machine? Any suggestions regarding the cause if this problem and how to keep the CentOS system time locked to the host platform time would be greatly appreciated. Thanks.

3 2

Re: [CentOS] https and self signed
by James B. Byrne 18 Jun '16

18 Jun '16

On Thu, June 16, 2016 13:53, Walter H. wrote: > On 15.06.2016 16:17, Warren Young wrote: >> but it also affects the other public CAs: you canât get a >> publicly-trusted cert for a machine without a publicly-recognized >> and -visible domain name. For that, you still need to use >> self-signed certs or certs signed by a private CA. >> > A private CA is the same as self signed; > No it is not. A private CA is as trustworthy as the organisation that operates it. No more and not one bit less. We operate a private CA for our domain and have since 2005. We maintain a public CRL strictly in accordance with our CPS and have our own OID assigned. Our CPS and CRL together with our active, expired and revoked certificate inventory is available online at ca.harte-lyne.ca. Our CPS states that we will only issue certificates for our own domain and furthermore we only issue them for equipment and personnel under our direct control. In a few years DANE is going to destroy the entire market of 'TRUSTED' root CA's -- because really none of them are trust 'worthy' --. And that development is long overdue. When we reach that point many domains, if not most, will have their DNS forward zones providing TLSA RRs for their domain CA certificates and signatures. And most of those that do this are going to be running their own private CA's simply to maintain control of their certificates. Our DNS TLSA flags tell those that verify using DANE that our private CA is the only authority that can issue a valid certificate for harte-lyne.ca and its sub-domains. Compare that to the present case wherein any 'trusted' CA can issue a certificate for any domain whatsoever; whether they are authorised by the domain owner or not[1]. So in a future with DANE it will be possible to detect when an apparently 'valid' certificate is issued by a rogue CA. The existing CA structure could not have been better designed for exploitation by special interests. It has been and continues to be so exploited. Personally I distrust every one of the preloaded root CAs shipped with Firefox by manually removing all of their trust flags. I do the same with any other browser I use. I then add back in those trusts essential for my browser operation as empirical evidence warrants. So I must trust certain DigiCert certificates for GitHub and DuckDuckGo, GeoTrust for Google, COMODO for Wikipedia, and so forth. These I set the trust flags for web services only. The rest can go pound salt as we used to say. [1] https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-f… -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

5 6

Re: [CentOS] https and self signed
by Gordon Messmer 18 Jun '16

18 Jun '16

On 06/17/2016 07:56 AM, James B. Byrne wrote: > On Thu, June 16, 2016 14:09, Gordon Messmer wrote: >> I doubt that most users check the dates on SSL certificates, >> unless they are familiar enough with TLS to understand that >> a shorter validity period is better for security. > What evidence do you possess that supports this assertion and would > you care to share it with us? https://letsencrypt.org/2015/11/09/why-90-days.html

2 1

Re: [CentOS] https and self signed
by James B. Byrne 18 Jun '16

18 Jun '16

On Thu, June 16, 2016 14:23, Valeri Galtsev wrote: > > On Thu, June 16, 2016 1:09 pm, Gordon Messmer wrote: >> >> I doubt that most users check the dates on SSL certificates, >> unless they are familiar enough with TLS to understand that >> a shorter validity period is better for security. > > Oh, this is what he meant: Cert validity period. Though I agree > with you in general (shorter period public key is exposed smaller > chance secret key brute-force discovered), Like many things that appear to be common-sense these assumptions have no empirical basis. A properly generated RSA certificate and key of sufficient strength -- RSA k>=2048bits -- should provide protection from brute force attacks for decades if not centuries. The usual way a private key gets compromised is by theft or by tampering with its generation. Putting yourself on a hamster wheel of constant certificate generation and distribution simply increases the opportunities for key theft and tampering. Keys issued to individuals certainly should have short time limits on them. In the same way that user accounts on systems should always have a near term expiry date set. People are careless. And their motivations are subject to change. So having a guillotine date on a personal certificate makes sense from an administrative standpoint. One wants to fail safe. But modifying certificates on sealed servers?. Really, unless one has evidence of penetration and theft of the key store, what possible benefit accrues from changing secured device keys on a frequent basis? We mainly use 4096bit keys which will be secure from brute force until the advent of Quantum computing. At which point brute force attacks will become a pointless worry. Not because the existing RSA certificates and keys will withstand those attacks but because the encryption process itself will move onto quantum devices. That development, if and when it occurs, will prove more than the code breakers will ever be able to handle. Of course then one must worry about the people who build the devices. But we all have to do that already. Bought any USB devices from China recently? -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Getting hibernate to work on a new CentOS 7.2.1115 install
by Globe Trotter 18 Jun '16

18 Jun '16

Hi, I am a new CentOS user (quite familiar with Fedora 1-23+) and I decided to try a new install of CentOS on a ASUS R503U. However, I can not get hibernate to work. I try: systemctl hibenaate and I get: Failed to execute operation: sleep verb not supported Btw, the problem does not go away with super-user. I was wondering how to get around this issue. I would like the abililty to hibernate and come back in the last state. Thanks!

3 5

[Fwd: Re: https and self signed]
by James B. Byrne 17 Jun '16

17 Jun '16

On Fri, June 17, 2016 12:31, Valeri Galtsev wrote: > > On Fri, June 17, 2016 10:19 am, James B. Byrne wrote: > >> Keys issued to individuals certainly should have short time limits >> on them. In the same way that user accounts on systems should >> always have a near term expiry date set. People are careless. >> And their motivations are subject to change. > > James, though in general one is likely to agree with this, I still > consider the conclusion I came to after discussions more than decade > ago valid for myself. Namely: forcing everyone to change password > often pisses careful people off for nothing. Passwords they create > and carefully keep can stand for decades, and only can be > compromised on some compromised machine. But I never mentioned anything about passwords. I quite agree with you with respect to avoiding needless password churn. What I wrote was specifically user accounts and their expiry dates. These should be short. Say six to twelve months or so. When the account expires then it can be renewed for another six or 12 months. The password for it is not changed. One can always write a script to automatically search for and report pending expirations. There is no real need for accounts to actually expire. But, even if accounts do expire for active users then it is not much of a hardship to report the fact and to have them reactivated. On the other hand, disused accounts never get reported and remain deactivated. Also, when a person leaves our employ and somehow the cancellation of all or some their accounts gets overlooked in the out-processing then shortly their accounts will be deactivated automatically. A fail safe mechanism. -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Would centos 7 backport this libnl3 header fix
by Harry Mallon 17 Jun '16

17 Jun '16

Hello, Would CentOS7 consider adding the following patch to libnl3? https://github.com/thom311/libnl/commit/cdf2d4baf376e4a3030a2c1169516358b4f… g++ fails to build against the headers in the default devel package at the moment so I am having to package my own. The patch is very small and easily applies on top of the c7 branch from the RPM git. https://git.centos.org/summary/rpms!libnl3.git Harry Harry Mallon CODEX | Software Engineer 60 Poland Street | London | England | W1F 7NT E harry(a)codexdigital.com<mailto:harry@codexdigital.com> | T +44 203 7000 989<callto:+44%20203%207000%20989> Website<www.codexdigital.com> | Facebook<https://www.facebook.com/codexdigital> | Twitter<http://twitter.com/codexdigital> [http://www.codexdigital.com/?action=asset&id=E55D8A6F-AF62-4978-8FF1-435A85…]<http://www.codexdigital.com>

2 1

Re: [CentOS] https and self signed
by Valeri Galtsev 17 Jun '16

17 Jun '16

On Fri, June 17, 2016 10:19 am, James B. Byrne wrote: > > On Thu, June 16, 2016 14:23, Valeri Galtsev wrote: >> >> On Thu, June 16, 2016 1:09 pm, Gordon Messmer wrote: >>> >>> I doubt that most users check the dates on SSL certificates, >>> unless they are familiar enough with TLS to understand that >>> a shorter validity period is better for security. >> >> Oh, this is what he meant: Cert validity period. Though I agree with you in general (shorter period public key is exposed smaller chance secret key brute-force discovered), > > Like many things that appear to be common-sense these assumptions have no empirical basis. A properly generated RSA certificate and key of sufficient strength -- RSA k>=2048bits -- should provide protection from brute force attacks for decades if not centuries. The usual way a private key gets compromised is by theft or by tampering with its generation. Putting yourself on a hamster wheel of constant > certificate generation and distribution simply increases the > opportunities for key theft and tampering. > > Keys issued to individuals certainly should have short time limits on them. In the same way that user accounts on systems should always have a near term expiry date set. People are careless. And their motivations are subject to change. James, though in general one is likely to agree with this, I still consider the conclusion I came to after discussions more than decade ago valid for myself. Namely: forcing everyone to change password often sets careful people off for nothing. Passwords they create and carefully keep can stand for decades, and only can be compromised on some compromised machine. Now, from my (careful person) point of view, US National labs forcing me change password every 6 Months is just confirming the fact they imply their boxes are compromised often. As: my passwords (passphrases) are different everywhere, and I only connect one way ever: from trusted (maintained by me that is) machine to untrusted (maintained by someone else that is). Never from untrusted machine elsewhere. Now, simple argument we had: if you force person to change password often, even worse thing will happen: person will never remember ever changing password and the last will be written on a piece of paper stuck to the back of the screen or similar. Yes, I know about and I do use encrypted storage dedicated for passwords. Does everybody? Things change but people don't (almost don't). So, the best bet for multi-user machine is to run it under assumption that bad guys are already inside. Occasionally you see them attempting elevation of privileges, smash them, and make the user whose password was stolen change that, and change all his/her passwords everywhere, banks and other $$$ accounts first. After this sort of exercise this same person never is the one in this same sort of trouble. Yes I had these cases, not many during last decade and a half. I also have seen an opposite attitude on occasion (user didn't care his password was compromised on machine I administer), then that user had all [bad] what sysadmin can get him... > So having a guillotine date on a > personal certificate makes sense from an administrative standpoint. One wants to fail safe. But modifying certificates on sealed > servers?. Really, unless one has evidence of penetration and theft of the key store, what possible benefit accrues from changing secured device keys on a frequent basis? My point exactly. Only I usually try to say it in so short way, that my point fails to propagate to readers ;-( > > We mainly use 4096bit keys which will be secure from brute force until the advent of Quantum computing. At which point brute force attacks will become a pointless worry. Not because the existing RSA > certificates and keys will withstand those attacks but because the encryption process itself will move onto quantum devices. That > development, if and when it occurs, will prove more than the code breakers will ever be able to handle. Of course then one must worry about the people who build the devices. But we all have to do that already. Bought any USB devices from China recently? Well, I started to avoid Lenovo after they shipped laptop with malware preinstalled. It took them some time after they bought laptop line from IBM. But yes, firmware/microcode malware is something that will bite us soon. BTW, the secret known to two people is not a secret.... Who said that? Cheers, Valeri > > -- > *** e-Mail is NOT a SECURE channel *** > Do NOT transmit sensitive data via e-Mail > Do NOT open attachments nor follow links sent by e-Mail > > James B. Byrne mailto:ByrneJB@Harte-Lyne.ca > Harte & Lyne Limited http://www.harte-lyne.ca > 9 Brockley Drive vox: +1 905 561 1241 > Hamilton, Ontario fax: +1 905 561 0757 > Canada L8E 3C3 > ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++

1 0

Speaking of firefox updates
by m.roth＠5-cent.us 17 Jun '16

17 Jun '16

I haven't gone past 38, because when the 45 update came out, and video... like, say, my *required* training from work, when I tried to run it, it crashed firefox. Repeatedly. 100% of the time. Has anyone been using the current version had trouble with video, etc? I'd like to update, but not if I can't do required training.... mark

2 6

Today's firefox update
by Frank Cox 17 Jun '16

17 Jun '16

Johnny's announcement refers to: firefox-45.2.0-1.el5.centos.src.rpm firefox-45.2.0-1.el6.centos.src.rpm firefox-45.2.0-1.el7.centos.src.rpm The linked rhel webpage refers to: firefox-45.2.0-1.el5_11.src.rpm firefox-45.2.0-1.el6_8.src.rpm firefox-45.2.0-1.el7_2.src.rpm These do not appear to be the same thing. Note the numbers just before the .src part of the filenames. -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

4 4

Error: Could not find or load main class with OpenJDK and Oracle Java
by Alexander Farber 17 Jun '16

17 Jun '16

Hello fellow Linux users, on CentOS 7.2 I have successfully downloaded and installed Oracle Java [1] with: # rpm -Uvh jdk-8u91-linux-x64.rpm Also there is already OpenJDK installed: # rpm -qa | grep -i jdk java-1.8.0-openjdk-headless-1.8.0.91-0.b14.el7_2.x86_64 java-1.8.0-openjdk-1.8.0.91-0.b14.el7_2.x86_64 jdk1.8.0_91-1.8.0_91-fcs.x86_64 I can switch between the 2 using this command: # alternatives --config java There are 2 programs which provide 'java'. Selection Command ----------------------------------------------- * 1 /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-0.b14.el7_2.x86_64/jre/bin/java + 2 /usr/java/jdk1.8.0_91/jre/bin/java Enter to keep the current selection[+], or type selection number: And see the selected version with: # java -version java version "1.8.0_91" Java(TM) SE Runtime Environment (build 1.8.0_91-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.91-b14, mixed mode) # javac -version javac 1.8.0_91 Now to my problem please - I have created a simple java file named TheClassName.java: package thepackagename; public class TheClassName { public static final void main(String[] args) { System.out.println("Hello World!"); } } After successfully compiling it with "javac TheClassName.java" (which produces TheClassName.class file in the same dir) I unfortunately can not run it: # java -cp . thepackagename.TheClassName Error: Could not find or load main class thepackagename.TheClassName Here another try: # export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.91-0.b14.el7_2.x86_64/jre # $JAVA_HOME/bin/java -cp . thepackagename.TheClassName Error: Could not find or load main class thepackagename.TheClassName Setting another environment variable does not help either: # export CLASSPATH=. Similar command on Windows 7 works well and I have tried copying the TheClassName.class file from there to Linux too. The setting is SELINUX=disabled and the server was installed few weeks ago, serving (without errors) as LAMP with MySQL/PostgreSQL/Apache/WordPress. Any suggestions please, have I missed anything? Regards Alex [1]: http://www.oracle.com/technetwork/java/javase/

1 1

CentOS-announce Digest, Vol 136, Issue 3
by centos-announce-request＠centos.org 17 Jun '16

17 Jun '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Updated Vagrant Box's are now available : 1605 (Karanbir Singh) 2. CESA-2016:1217 Critical CentOS 6 firefox Security Update (Johnny Hughes) 3. CESA-2016:1217 Critical CentOS 5 firefox Security Update (Johnny Hughes) 4. CESA-2016:1217 Critical CentOS 7 firefox Security Update (Johnny Hughes) 5. CESA-2016:1237 Important CentOS 6 ImageMagick Security Update (Johnny Hughes) 6. CESA-2016:1237 Important CentOS 7 ImageMagick Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Jun 2016 15:39:58 +0100 From: Karanbir Singh <kbsingh(a)centos.org> To: CentOS Announcements List <centos-announce(a)centos.org> Subject: [CentOS-announce] Updated Vagrant Box's are now available : 1605 Message-ID: <e9c5d74b-6b6f-6e55-04b7-f6fc1a991a11(a)centos.org> Content-Type: text/plain; charset=utf-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Updated Vagrant box's are now available for CentOS Linux 7/x86_64 and for the first time for CentOS Linux 6/x86_64; We are providing box's for Livbirt provider and the Virtual Box provider. ref: https://atlas.hashicorp.com/centos/boxes/6 https://atlas.hashicorp.com/centos/boxes/7 Release Notes for these images are published at : https://seven.centos.org/2016/06/updated-centos-vagrant-images-available / regards, - -- Karanbir Singh, Project Lead, The CentOS Project +44-207-0999389 | http://www.centos.org/ | twitter.com/CentOS GnuPG Key : http://www.karan.org/publickey.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXYro+AAoJEI3Oi2Mx7xbtD0wH/258qtXogCXBwFDOId4d7PmV bRVyYp+i0wX+yG6xWrziDXjWoRB/xa+YUJX39qvhP2PGikJg7aj9K+z5DS9Y9Dfp hBMfmQ17MvIV53cfPeNnL06wSOZ+Y93awN7fr7It8nR4imAgXXouAX0YjDioOP2j GTteuu0ieyYU87sG/CZuHBGPgvsL4u5XVba19VY+0b12pv3z9kHJeHIwReQX3WVT 7C2cstXTsnEC/BYdbfPj+hFKRZGwuAiA5JDLN53eoOuQReIfnYfU2a/ugebTUH8G X12J64IaKDfCd6018DC+uUDtmaiFwXlxeaKyHqXO7m6EiCMQrhRty2CPNajVk08= =wR1K -----END PGP SIGNATURE----- ------------------------------ Message: 2 Date: Wed, 8 Jun 2016 23:13:32 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1217 Critical CentOS 6 firefox Security Update Message-ID: <20160608231332.GA55602(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1217 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1217.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: acc8466a5e2e7b4f97e476ef08608babd3957f9dea929ede45436549dd189940 firefox-45.2.0-1.el6.centos.i686.rpm x86_64: acc8466a5e2e7b4f97e476ef08608babd3957f9dea929ede45436549dd189940 firefox-45.2.0-1.el6.centos.i686.rpm 3c0badf351a25c811dce868afd434b9341a3da64018937be7bac76c39ecb5a42 firefox-45.2.0-1.el6.centos.x86_64.rpm Source: 733ca4db9bc0d6dcb4edc0d270299834e4b78b0f115025fd310146ce420380e2 firefox-45.2.0-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 3 Date: Wed, 8 Jun 2016 23:28:21 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1217 Critical CentOS 5 firefox Security Update Message-ID: <20160608232821.GA24655(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1217 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1217.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 4f682310ef08803318d69e4044446dac5beab8bc046daf8e66ac5c1c4f95e373 firefox-45.2.0-1.el5.centos.i386.rpm x86_64: 4f682310ef08803318d69e4044446dac5beab8bc046daf8e66ac5c1c4f95e373 firefox-45.2.0-1.el5.centos.i386.rpm 95a69b243ad4569af34a05fc1806d826a665a38550abe275f93de0b4378ddf95 firefox-45.2.0-1.el5.centos.x86_64.rpm Source: 02393904e04805e7f719e8b2d47d0f63a639e788a7c0f9f9df13826db83edb74 firefox-45.2.0-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: JohnnyCentOS ------------------------------ Message: 4 Date: Thu, 16 Jun 2016 15:30:39 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1217 Critical CentOS 7 firefox Security Update Message-ID: <20160616153039.GA61351(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1217 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1217.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: f79412140473a03de8d8f29357d9b4c6ce48cc2a0284c5a88f05fa28a6cf289d firefox-45.2.0-1.el7.centos.i686.rpm 4c9e18cfccc1942cc39ccb2644b308d4c381128f2ee39f4f735c34325354feb5 firefox-45.2.0-1.el7.centos.x86_64.rpm Source: 54784c2a92a040f721608d254a75f95cbab5ba33d436f63f20479145b486c334 firefox-45.2.0-1.el7.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 5 Date: Thu, 16 Jun 2016 23:05:59 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1237 Important CentOS 6 ImageMagick Security Update Message-ID: <20160616230559.GA7783(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1237 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1237.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 65c983e6e5121fe3739bef92b59f71c343a382b583ecc2ad29c536d48e354a74 ImageMagick-6.7.2.7-5.el6_8.i686.rpm 1ce7dfba86870708042cba5180c90d04e66067444192fad0c94cd89a64f8d25c ImageMagick-c++-6.7.2.7-5.el6_8.i686.rpm 3f5b4e728b60086914fb981d691bdf85c693119e4a9d4be21db3bc7c805e710a ImageMagick-c++-devel-6.7.2.7-5.el6_8.i686.rpm b84e69c4ae62329d7b39d9c872755056e08b1b749d8a527f8b77d1ce072854db ImageMagick-devel-6.7.2.7-5.el6_8.i686.rpm ae675e2b4041e3c5616f866eb200403e7a534ca485902b4216615907382fa89a ImageMagick-doc-6.7.2.7-5.el6_8.i686.rpm 78b1ee094571ea9cfe915c63cd9ad1a0406221c7428b08bd4521cc19635223c7 ImageMagick-perl-6.7.2.7-5.el6_8.i686.rpm x86_64: 65c983e6e5121fe3739bef92b59f71c343a382b583ecc2ad29c536d48e354a74 ImageMagick-6.7.2.7-5.el6_8.i686.rpm 7b18fce8ab88c27d216956e7719664cf1d4295483a2cd1558034d299f886185d ImageMagick-6.7.2.7-5.el6_8.x86_64.rpm 1ce7dfba86870708042cba5180c90d04e66067444192fad0c94cd89a64f8d25c ImageMagick-c++-6.7.2.7-5.el6_8.i686.rpm 9c64febc2372c91e557adfead3481b2d7c6c44aff7bc96061a97b3a0b3c1dcfc ImageMagick-c++-6.7.2.7-5.el6_8.x86_64.rpm 3f5b4e728b60086914fb981d691bdf85c693119e4a9d4be21db3bc7c805e710a ImageMagick-c++-devel-6.7.2.7-5.el6_8.i686.rpm 96874c4e1b25ce7dd6ab5754dae183d738f9092f128a7088fef6ba7d5df8dd2c ImageMagick-c++-devel-6.7.2.7-5.el6_8.x86_64.rpm b84e69c4ae62329d7b39d9c872755056e08b1b749d8a527f8b77d1ce072854db ImageMagick-devel-6.7.2.7-5.el6_8.i686.rpm 61b212db7fba37e77b24bdd29830da40af93bfc6fd435f14b13b48cb7fc4c99e ImageMagick-devel-6.7.2.7-5.el6_8.x86_64.rpm 2089a7c8bdec3d78fc317bf665050221a387f5388378dad3111d156733573647 ImageMagick-doc-6.7.2.7-5.el6_8.x86_64.rpm 8fb705c93e211aa5c177175c045fb848efd0fae691d8a97333508b73e06a7295 ImageMagick-perl-6.7.2.7-5.el6_8.x86_64.rpm Source: 426aa2c46e8591e4fafc55d1c7c32f5f154a0dd48b81afc1485f360c1871f565 ImageMagick-6.7.2.7-5.el6_8.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 6 Date: Thu, 16 Jun 2016 23:49:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1237 Important CentOS 7 ImageMagick Security Update Message-ID: <20160616234933.GA12051(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1237 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1237.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: c2381a8bc056204b610b111e957897b0992c3814d9a8e7dbdd304a85ac401aa8 ImageMagick-6.7.8.9-15.el7_2.i686.rpm b47a343b21df93744f88fa94eb049905763150f97804ed7971d0cdfad28e6bf8 ImageMagick-6.7.8.9-15.el7_2.x86_64.rpm 5a3ffb1e7eecb59304481181a6b0935e4fcd8ecadd0630a43934143d7c97be51 ImageMagick-c++-6.7.8.9-15.el7_2.i686.rpm 492fc944f8908199248f1fdba5b6c5a15aa1422aaece6eae899747380cb20d5f ImageMagick-c++-6.7.8.9-15.el7_2.x86_64.rpm f6f17de463a7378fc3ae7126d5d1112a26b1566c3e73051eaea4ac0dfec3408e ImageMagick-c++-devel-6.7.8.9-15.el7_2.i686.rpm 7106ca5a407e75158056c82bd2cd9ecbb112be6e29d599594d952c779bdd57f5 ImageMagick-c++-devel-6.7.8.9-15.el7_2.x86_64.rpm e0c9445f1d7a1b4a0ee97d7d1e3c6665667ebf84557f87227cbe7f1950930496 ImageMagick-devel-6.7.8.9-15.el7_2.i686.rpm 03f51bda15c581bcc6e56d5f24803c44ac46d56bf180058e93ddb39258cd1fbe ImageMagick-devel-6.7.8.9-15.el7_2.x86_64.rpm 8c5b7f5064340a04eb8cdbfb8a20d3e0cb11d6867ef64820fd9edc7be89c7329 ImageMagick-doc-6.7.8.9-15.el7_2.x86_64.rpm feb0024d0d98cb90f3dc02b08af565548ac9d6e0b9548a7af2fc0b1d66289b4f ImageMagick-perl-6.7.8.9-15.el7_2.x86_64.rpm Source: 401974be1ac1a9e64fe9a8d8a0d8ee9a32fbf8deef2ee23ad7e37c0f43a9d184 ImageMagick-6.7.8.9-15.el7_2.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 136, Issue 3 ***********************************************

1 0

Installing 6.8 from DVD1.iso, changes
by Zube 16 Jun '16

16 Jun '16

Downloaded 6.8 DVD1.iso, dd to stick. Went through same selections I have gone through since 6.2, only this time it got to the end and stated it couldn't find rear, which is under "backup client". OK, try it again without rear. This time it's yum-plugin-ovl from base (?). Then chrony, also in base (?). Then flightrecorder, libreswan, at least 2 of openmpi & co. and finally unbound, which is a rather apt description of my current mental state. So, a heap of stuff has either moved to DVD2 or is new and lives on DVD2. The same set of selections, especially if you choose all the optional packages of a group, may not work as they previously did in the install of <= 6.7. Cheers, Zube

2 1

Missing CPU Cores from 2nd Socket
by De Vito, Carmen (Carmen) 16 Jun '16

16 Jun '16

Has anyone else noticed an issue when running CentOS 7.2.1511 on ESXi 6.0, where only the first sockets worth of cores appear to be presented to the kernel? For example, I've set up a VM on an ESXi 6 node with 2 sockets, each of which has 2 cores attached. Once I start up the server I can see in dmidecode that both sockets are populated, each with a dual-core processor. But, within top, cpuinfo and numactl, I can only see the cores presented from the socket0 chip. Is there some kind of kernel restriction on multi-socket setups when virtualized? Carmen De Vito Senior Linux Analyst

1 0

remote backup
by Alessandro Baggi 16 Jun '16

16 Jun '16

Hi list, i've need to backup a partition of ~200GB with a local connection of 8/2 mbps. Tool like bacula, amanda can't help me due to low bandwidth in local server. I'm thinking rsync will be a good choice. What do you think about? Thanks in advance.

11 19

KVM issue
by John R Pierce 16 Jun '16

16 Jun '16

running centos 6... have had a KVM linux vm (also C6) going for quite awhile that depends on a USB device mapping (a external audio DAC module). I updated the host today (yum update), it had been awhile (was like 6.5 before, now its 6.8+), and rebooted. the VM won't restart. when I try and restart it, I get this Error restoring domain: internal error Did not find USB device 8bb:2704 bus:5 device:4 Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/asyncjob.py", line 44, in cb_wrapper callback(asyncjob, *args, **kwargs) File "/usr/share/virt-manager/virtManager/asyncjob.py", line 65, in tmpcb callback(*args, **kwargs) File "/usr/share/virt-manager/virtManager/domain.py", line 1125, in startup self._backend.create() File "/usr/lib64/python2.6/site-packages/libvirt.py", line 686, in create if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self) libvirtError: internal error Did not find USB device 8bb:2704 bus:5 device:4 using virsh edit mydomain, I see... <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x08bb'/> <product id='0x2704'/> </source> </hostdev> and on the host, lsusb shows... # lsusb Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 005 Device 002: ID 08bb:2704 Texas Instruments Audio Codec note the TI Audio device is bus 5, dev 2. Why is KVM insisting its bus 5 dev 4? I've deleted the device from the VM and tried to start it, same error. i've looked in every kvm/qemu related conf file I can find, no sign of bus 5 dev 4. # virsh start mydomain error: Failed to start domain mydomain error: internal error Did not find USB device 8bb:2704 bus:5 device:4 how can I fix this? -- john r pierce, recycling bits in santa cruz

2 2

Unable to mount a USB DVD drive
by Benjamin Smith 16 Jun '16

16 Jun '16

I can't seem to get an external DVD drive to show up on an CentOS 7 server. Wondering if it's just missing a driver or if I'm missing something fundamental. It's an external USB device that works fine on my Fedora 21 Laptop, but I never get a /dev/ entry (EG: /dev/sr0) on the server. What can I do to make this thing work? [root@norman ~]# tail -f /var/log/messages; # inserting the device into a port Jun 15 18:29:38 norman kernel: usb 1-3: new high-speed USB device number 5 using ehci-pci Jun 15 18:29:38 norman kernel: usb 1-3: New USB device found, idVendor=13fd, idProduct=1040 Jun 15 18:29:38 norman kernel: usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 Jun 15 18:29:38 norman kernel: usb 1-3: Product: RW/DVD_GCC-T10N Jun 15 18:29:38 norman kernel: usb 1-3: Manufacturer: Initio Jun 15 18:29:38 norman kernel: usb 1-3: SerialNumber: 0000000000000000W [root@norman ~]# lsusb Bus 001 Device 005: ID 13fd:1040 Initio Corporation INIC-1511L PATA Bridge Bus 002 Device 002: ID 413c:2107 Dell Computer Corp. Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub [root@norman ~]# usb-devices T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 8 D: Ver= 2.00 Cls=09(hub ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1d6b ProdID=0002 Rev=03.10 S: Manufacturer=Linux 3.10.0-229.20.1.el7.x86_64 ehci_hcd S: Product=EHCI Host Controller S: SerialNumber=0000:00:1c.3 C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=13fd ProdID=1040 Rev=01.06 S: Manufacturer=Initio S: Product=RW/DVD_GCC-T10N S: SerialNumber=0000000000000000W C: #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=2mA I: If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=05 Prot=50 Driver=(none) --SNIP-- This is what tail -f /var/log/messages looks like on my F21 laptop: Jun 15 18:41:35 tesla kernel: [ 913.678526] usb 1-2: new high-speed USB device number 5 using xhci_hcd Jun 15 18:41:35 tesla kernel: usb 1-2: new high-speed USB device number 5 using xhci_hcd Jun 15 18:41:36 tesla kernel: [ 913.843709] usb 1-2: New USB device found, idVendor=13fd, idProduct=1040 Jun 15 18:41:36 tesla kernel: [ 913.843713] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 Jun 15 18:41:36 tesla kernel: [ 913.843715] usb 1-2: Product: RW/DVD_GCC-T10N Jun 15 18:41:36 tesla kernel: [ 913.843717] usb 1-2: Manufacturer: Initio Jun 15 18:41:36 tesla kernel: [ 913.843718] usb 1-2: SerialNumber: 0000000000000000W Jun 15 18:41:36 tesla kernel: usb 1-2: New USB device found, idVendor=13fd, idProduct=1040 Jun 15 18:41:36 tesla kernel: usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 Jun 15 18:41:36 tesla kernel: usb 1-2: Product: RW/DVD_GCC-T10N Jun 15 18:41:36 tesla kernel: usb 1-2: Manufacturer: Initio Jun 15 18:41:36 tesla kernel: usb 1-2: SerialNumber: 0000000000000000W Jun 15 18:41:36 tesla mtp-probe: checking bus 1, device 5: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2" Jun 15 18:41:36 tesla mtp-probe: bus: 1, device: 5 was not an MTP device Jun 15 18:41:36 tesla kernel: [ 913.863969] usb-storage 1-2:1.0: USB Mass Storage device detected Jun 15 18:41:36 tesla kernel: [ 913.864035] scsi host6: usb-storage 1-2:1.0 Jun 15 18:41:36 tesla kernel: [ 913.864099] usbcore: registered new interface driver usb-storage Jun 15 18:41:36 tesla kernel: usb-storage 1-2:1.0: USB Mass Storage device detected Jun 15 18:41:36 tesla kernel: scsi host6: usb-storage 1-2:1.0 Jun 15 18:41:36 tesla kernel: usbcore: registered new interface driver usb- storage Jun 15 18:41:37 tesla kernel: [ 914.864033] scsi 6:0:0:0: CD-ROM HL-DT-ST RW/DVD_GCC-T10N 1.01 PQ: 0 ANSI: 0 Jun 15 18:41:37 tesla kernel: scsi 6:0:0:0: CD-ROM HL-DT-ST RW/DVD_GCC-T10N 1.01 PQ: 0 ANSI: 0 Jun 15 18:41:37 tesla kernel: [ 914.867503] sr 6:0:0:0: [sr0] scsi3-mmc drive: 24x/24x writer cd/rw xa/form2 cdda tray Jun 15 18:41:37 tesla kernel: [ 914.867517] cdrom: Uniform CD-ROM driver Revision: 3.20 Jun 15 18:41:37 tesla kernel: [ 914.867814] sr 6:0:0:0: Attached scsi generic sg2 type 5 Jun 15 18:41:37 tesla kernel: sr 6:0:0:0: [sr0] scsi3-mmc drive: 24x/24x writer cd/rw xa/form2 cdda tray Jun 15 18:41:37 tesla kernel: cdrom: Uniform CD-ROM driver Revision: 3.20 Jun 15 18:41:37 tesla kernel: sr 6:0:0:0: Attached scsi generic sg2 type 5

1 0

Is there popular multimedia framework supported in centos
by applemax82＠163.com 15 Jun '16

15 Jun '16

Hi, I know gstreamer is written in c Language. Is there popular multimedia framework written in c++ supported in centos? Thanks! B.R. Andrew

2 1

scp via another server
by H 14 Jun '16

14 Jun '16

I normally use ssh to log into a remote server, change directory and then use scp from there to copy files from another remote server to the first one. Now the first server has been hit by continuous error correction messages from the ECC controller, all of which are corrected, and I am unable to get a command line to issue the required commands to change directory and then run scp from the other server. I have no problems, however, getting into the first server - except for being drowned by the error correction messages and the server seems to be running "fine". Until I am able to get to the server and investigate, is it possible to accomplish the above on a single command line, thus avoiding seeing the error messages? I should add that both the first and second server are set up to accept keys and not passwords so at least I don't have to worry about that. Thank you.

7 13

Slow RAID Check/high %iowait during check after updgrade from CentOS 6.5 -> CentOS 7.2
by Kelly Lesperance 14 Jun '16

14 Jun '16

I’ve posted this on the forums at https://www.centos.org/forums/viewtopic.php?f=47&t=57926&p=244614#p244614 - posting to the list in the hopes of getting more eyeballs on it. We have a cluster of 23 HP DL380p Gen8 hosts running Kafka. Basic specs: 2x E5-2650 128 GB RAM 12 x 4 TB 7200 RPM SATA drives connected to an HP H220 HBA Dual port 10 GB NIC The drives are configured as one large RAID-10 volume with mdadm, filesystem is XFS. The OS is not installed on the drive - we PXE boot a CentOS image we've built with minimal packages installed, and do the OS configuration via puppet. Originally, the hosts were running CentOS 6.5, with Kafka 0.8.1, without issue. We recently upgraded to CentOS 7.2 and Kafka 0.9, and that's when the trouble started. What we're seeing is that when the weekly raid-check script executes, performance nose dives, and I/O wait skyrockets. The raid check starts out fairly fast (20000K/sec - the limit that's been set), but then quickly drops down to about 4000K/Sec. dev.raid.speed sysctls are at the defaults: dev.raid.speed_limit_max = 200000 dev.raid.speed_limit_min = 1000 Here's 10 seconds of iostat output, which illustrates the issue: [root@r1k1log] # iostat 1 10 Linux 3.10.0-327.18.2.el7.x86_64 (r1k1) 05/24/16 _x86_64_ (32 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 8.80 0.06 1.89 14.79 0.00 74.46 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 52.59 2033.16 10682.78 1210398902 6359779847 sdb 52.46 2031.25 10682.78 1209265338 6359779847 sdc 52.40 2033.21 10683.53 1210433924 6360229587 sdd 52.22 2031.16 10683.53 1209212513 6360229587 sdf 52.20 2031.17 10682.06 1209216701 6359354331 sdg 52.62 2033.22 10684.17 1210437080 6360606756 sdh 52.57 2031.21 10684.17 1209242746 6360606756 sde 51.67 2033.17 10682.06 1210408935 6359354331 sdj 51.90 2031.13 10684.48 1209191501 6360795559 sdi 52.47 2033.16 10684.48 1210399262 6360795559 sdk 52.09 2033.15 10684.36 1210396915 6360724971 sdl 51.95 2031.20 10684.36 1209235241 6360724971 md127 138.20 74.49 64101.35 44348810 38161468777 avg-cpu: %user %nice %system %iowait %steal %idle 8.57 0.09 1.33 26.19 0.00 63.81 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 28.00 512.00 8416.00 512 8416 sdb 28.00 512.00 8416.00 512 8416 sdc 25.00 448.00 8876.00 448 8876 sdd 24.00 448.00 8364.00 448 8364 sdf 23.00 448.00 8192.00 448 8192 sdg 24.00 512.00 7680.00 512 7680 sdh 24.00 512.00 7680.00 512 7680 sde 23.00 448.00 8192.00 448 8192 sdj 23.00 512.00 7680.00 512 7680 sdi 23.00 512.00 7680.00 512 7680 sdk 23.00 512.00 7680.00 512 7680 sdl 23.00 512.00 7680.00 512 7680 md127 101.00 0.00 48012.00 0 48012 avg-cpu: %user %nice %system %iowait %steal %idle 6.50 0.00 1.04 24.27 0.00 68.19 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 26.00 512.00 9216.00 512 9216 sdb 26.00 512.00 9216.00 512 9216 sdc 27.00 576.00 9204.00 576 9204 sdd 28.00 576.00 9716.00 576 9716 sdf 31.00 768.00 9728.00 768 9728 sdg 28.00 512.00 10240.00 512 10240 sdh 28.00 512.00 10240.00 512 10240 sde 31.00 768.00 9728.00 768 9728 sdj 28.00 512.00 9744.00 512 9744 sdi 28.00 512.00 9744.00 512 9744 sdk 27.00 512.00 9728.00 512 9728 sdl 27.00 512.00 9728.00 512 9728 md127 114.00 0.00 57860.00 0 57860 avg-cpu: %user %nice %system %iowait %steal %idle 9.24 0.00 1.32 20.02 0.00 69.42 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 50.00 512.00 20408.00 512 20408 sdb 50.00 512.00 20408.00 512 20408 sdc 48.00 512.00 19984.00 512 19984 sdd 48.00 512.00 19984.00 512 19984 sdf 50.00 704.00 19968.00 704 19968 sdg 47.00 512.00 19968.00 512 19968 sdh 47.00 512.00 19968.00 512 19968 sde 50.00 704.00 19968.00 704 19968 sdj 48.00 512.00 19972.00 512 19972 sdi 48.00 512.00 19972.00 512 19972 sdk 48.00 512.00 19980.00 512 19980 sdl 48.00 512.00 19980.00 512 19980 md127 241.00 0.00 120280.00 0 120280 avg-cpu: %user %nice %system %iowait %steal %idle 7.98 0.00 0.98 18.42 0.00 72.63 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 39.00 640.00 14076.00 640 14076 sdb 39.00 640.00 14076.00 640 14076 sdc 36.00 512.00 14324.00 512 14324 sdd 36.00 512.00 14324.00 512 14324 sdf 36.00 576.00 13824.00 576 13824 sdg 43.00 1024.00 13824.00 1024 13824 sdh 43.00 1024.00 13824.00 1024 13824 sde 36.00 576.00 13824.00 576 13824 sdj 44.00 1024.00 14104.00 1024 14104 sdi 44.00 1024.00 14104.00 1024 14104 sdk 45.00 1024.00 14336.00 1024 14336 sdl 45.00 1024.00 14336.00 1024 14336 md127 168.00 0.00 84488.00 0 84488 avg-cpu: %user %nice %system %iowait %steal %idle 7.39 0.00 1.01 19.48 0.00 72.13 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 22.00 896.00 4096.00 896 4096 sdb 22.00 896.00 4096.00 896 4096 sdc 19.00 640.00 4344.00 640 4344 sdd 19.00 640.00 4344.00 640 4344 sdf 18.00 512.00 5120.00 512 5120 sdg 18.00 512.00 5120.00 512 5120 sdh 18.00 512.00 5120.00 512 5120 sde 18.00 512.00 5120.00 512 5120 sdj 18.00 512.00 4624.00 512 4624 sdi 18.00 512.00 4624.00 512 4624 sdk 18.00 512.00 4608.00 512 4608 sdl 18.00 512.00 4608.00 512 4608 md127 57.00 0.00 27912.00 0 27912 avg-cpu: %user %nice %system %iowait %steal %idle 10.92 0.00 1.58 21.84 0.00 65.66 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 23.00 576.00 7168.00 576 7168 sdb 23.00 576.00 7168.00 576 7168 sdc 29.00 896.00 7680.00 896 7680 sdd 29.00 896.00 7680.00 896 7680 sdf 31.00 1024.00 7680.00 1024 7680 sdg 31.00 1024.00 7680.00 1024 7680 sdh 31.00 1024.00 7680.00 1024 7680 sde 31.00 1024.00 7680.00 1024 7680 sdj 30.00 1024.00 7168.00 1024 7168 sdi 31.00 1024.00 7680.00 1024 7680 sdk 32.00 1024.00 7424.00 1024 7424 sdl 32.00 1024.00 7424.00 1024 7424 md127 89.00 0.00 44800.00 0 44800 avg-cpu: %user %nice %system %iowait %steal %idle 13.89 0.03 2.63 21.54 0.00 61.91 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 30.00 960.00 7680.00 960 7680 sdb 30.00 960.00 7680.00 960 7680 sdc 32.00 1024.00 7684.00 1024 7684 sdd 32.00 1024.00 7684.00 1024 7684 sdf 31.00 1024.00 7680.00 1024 7680 sdg 31.00 1024.00 7680.00 1024 7680 sdh 31.00 1024.00 7680.00 1024 7680 sde 31.00 1024.00 7680.00 1024 7680 sdj 32.00 1024.00 8192.00 1024 8192 sdi 31.00 1024.00 7680.00 1024 7680 sdk 26.00 704.00 7680.00 704 7680 sdl 26.00 704.00 7680.00 704 7680 md127 92.00 0.00 46596.00 0 46596 avg-cpu: %user %nice %system %iowait %steal %idle 14.24 0.00 2.22 19.89 0.00 63.65 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 33.00 1024.00 7244.00 1024 7244 sdb 33.00 1024.00 7244.00 1024 7244 sdc 31.00 1024.00 7668.00 1024 7668 sdd 31.00 1024.00 7668.00 1024 7668 sdf 31.00 1024.00 7680.00 1024 7680 sdg 26.00 768.00 6672.00 768 6672 sdh 26.00 768.00 6672.00 768 6672 sde 31.00 1024.00 7680.00 1024 7680 sdj 21.00 512.00 6656.00 512 6656 sdi 21.00 512.00 6656.00 512 6656 sdk 27.00 832.00 7168.00 832 7168 sdl 27.00 832.00 7168.00 832 7168 md127 88.00 0.00 43088.00 0 43088 avg-cpu: %user %nice %system %iowait %steal %idle 8.02 0.13 1.42 23.90 0.00 66.53 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn sda 30.00 1024.00 7168.00 1024 7168 sdb 30.00 1024.00 7168.00 1024 7168 sdc 29.00 960.00 7168.00 960 7168 sdd 29.00 960.00 7168.00 960 7168 sdf 23.00 512.00 7668.00 512 7668 sdg 28.00 768.00 7680.00 768 7680 sdh 28.00 768.00 7680.00 768 7680 sde 23.00 512.00 7668.00 512 7668 sdj 30.00 1024.00 6672.00 1024 6672 sdi 30.00 1024.00 6672.00 1024 6672 sdk 30.00 1024.00 7168.00 1024 7168 sdl 30.00 1024.00 7168.00 1024 7168 md127 87.00 0.00 43524.00 0 43524 Details of the array: [root@r1k1] # cat /proc/mdstat Personalities : [raid10] md127 : active raid10 sdf[5] sdi[8] sdh[7] sdk[10] sdb[1] sdj[9] sdc[2] sdd[3] sdl[11] sde[13] sdg[12] sda[0] 23441323008 blocks super 1.2 512K chunks 2 near-copies [12/12] [UUUUUUUUUUUU] [======>..............] check = 30.8% (7237496960/23441323008) finish=62944.5min speed=4290K/sec unused devices: <none> [root@r1k1] # mdadm --detail /dev/md127 /dev/md127: Version : 1.2 Creation Time : Thu Sep 18 09:57:57 2014 Raid Level : raid10 Array Size : 23441323008 (22355.39 GiB 24003.91 GB) Used Dev Size : 3906887168 (3725.90 GiB 4000.65 GB) Raid Devices : 12 Total Devices : 12 Persistence : Superblock is persistent Update Time : Tue May 24 15:32:56 2016 State : active, checking Active Devices : 12 Working Devices : 12 Failed Devices : 0 Spare Devices : 0 Layout : near=2 Chunk Size : 512K Check Status : 30% complete Name : localhost:kafka UUID : b6b98e3e:65ee06c3:3599d781:98908041 Events : 2459193 Number Major Minor RaidDevice State 0 8 0 0 active sync set-A /dev/sda 1 8 16 1 active sync set-B /dev/sdb 2 8 32 2 active sync set-A /dev/sdc 3 8 48 3 active sync set-B /dev/sdd 13 8 64 4 active sync set-A /dev/sde 5 8 80 5 active sync set-B /dev/sdf 12 8 96 6 active sync set-A /dev/sdg 7 8 112 7 active sync set-B /dev/sdh 8 8 128 8 active sync set-A /dev/sdi 9 8 144 9 active sync set-B /dev/sdj 10 8 160 10 active sync set-A /dev/sdk 11 8 176 11 active sync set-B /dev/sdl We've tried changing the I/O scheduler, queue_depth, queue_type, read-ahead, etc, but nothing has helped. We've also upgraded all of the firmware, and installed HP's mpt2sas driver. We have 4 other Kafka clusters, however they're HP DL180 G6 servers. We completed the same CentOS 6.5 -> 7.2/Kafka 0.8 -> 0.9 upgrade on those clusters, and there has been no impact to their performance. We've been banging our heads against the wall for a few weeks now, really hoping someone from the community can point us in the right direction. Thanks, Kelly Lesperance

6 26

HFSPlus Question
by Albert McCann 11 Jun '16

11 Jun '16

In CentOS 7.2.1511 does the 3.10.0-327.18.2.el7.centos.plus.x86_64 (Plus) kernel read HFSPlus iMac drives? I don't see any hfsplus modules installed anywhere, so I suspect not. My sister's 17" iMac died, and I'm trying to recover the drive. If it spins up, I'd like to copy it with dd. I see that Elrepo has kmod-hfsplus and hfsplus-tools, will these work with the Plus kernel? I still have to pull the drive from that infernal iMac case, so can't test yet. Thank you for any clues, my Google-foo isn't finding anything on the Plus kernel and HFSPlus. --- I yam Popeye of the Borg. Prepares ta beez askimiligrated.

6 7

clamav out dated
by Andreas Benzler 11 Jun '16

11 Jun '16

Jun 10 15:47:01 h2580013.stratoserver.net freshclam[1668]: Your ClamAV installation is OUTDATED! Jun 10 15:47:01 h2580013.stratoserver.net freshclam[1668]: Local version: 0.99.1 Recommended version: 0.99.2

4 3

compiling with lsocks support on centos 6?
by Jason Welsh 10 Jun '16

10 Jun '16

im trying to compile lftp with socks support and im getting the following.. ... checking for msgfmt... /usr/bin/msgfmt checking for gmsgfmt... /usr/bin/msgfmt checking for xgettext... /usr/bin/xgettext checking for msgmerge... /usr/bin/msgmerge checking for CFPreferencesCopyAppValue... no checking for CFLocaleCopyCurrent... no checking for GNU gettext in libc... yes checking whether to use NLS... yes checking where the gettext function comes from... libc checking for main in -lsocks5... no configure: error: cannot find -lsocks5 library [jason@nibbler lftp-4.7.2]$ ive looked and cant seem to figure out where to download the libsocks stuff? I found 1 post on the innernets that said that its integrated in the kernel? How can I get this compiled with socks(5) support? Jason

2 3

for loop example
by Diego 10 Jun '16

10 Jun '16

Maybe this don't to be the best form to solve your problem, but worked,rs. #!/bin/bash #power by Diego Rodrigues totalFileOne=$(wc -l file1 | cut -d" " -f1) totalFileTwo=$(wc -l file2 | cut -d" " -f1) count=0 if [ ! "${totalFileOne}" -eq "${totalFileTwo}" ];then echo "The two files need of same number of lines" exit 1 fi for ((i=0;$i<${totalFileOne};i++)); do #add more one to some NumberLine=$(( $i+1 )) echo -en $(sed ${NumberLine}'!d' file1 ;sed ${NumberLine}'!d' file2)"\n" done Em ter, 7 de jun de 2016 às 08:42, <centos-request(a)centos.org> escreveu: > Send CentOS mailing list submissions to > centos(a)centos.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.centos.org/mailman/listinfo/centos > or, via email, send a message with subject or body 'help' to > centos-request(a)centos.org > > You can reach the person managing the list at > centos-owner(a)centos.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of CentOS digest..." > > > Today's Topics: > > 1. for loop example (Indunil Jayasooriya) > 2. remote backup (Alessandro Baggi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 4 Jun 2016 11:11:21 +0530 > From: Indunil Jayasooriya <indunil75(a)gmail.com> > To: CentOS mailing list <centos(a)centos.org> > Subject: [CentOS] for loop example > Message-ID: > <CAJF2yJSdCEysBoqGo2B+BerpgPYBmMxD=ahj4LiHN6xR8H= > 3Gg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hi list, > > Can you look in to this? > > > [root@centos67 loop]# cat file1 > firstname1 > firstname2 > > [root@centos67 loop]# cat file2 > lastname1 > lastname2 > > I need a OUTPUT like this > > > *firstname1 lastname1firstname2 lastname2* > > > But I try the below command , i get below output. what is the real command > to get the above output > > [root@centos67 loop]# for line1 in $(cat file1 ); do for line2 in $(cat > file2 ); do echo "$line1" "$line2";done;done; > firstname1 lastname1 > firstname1 lastname2 > firstname2 lastname1 > firstname2 lastname2 > > > And also, I created a file3 like this > > [root@centos67 loop]# cat file3 > firstname1 lastname1 > firstname2 lastname2 > > How can I get the same OUTPUT ? > > > *firstname1 lastname1firstname2 lastname2* > > > if I try below command, i get the below output. > > [root@centos67 loop]# for i in $(cat file3);do echo $i;done; > firstname1 > lastname1 > firstname2 > lastname2 > > > Could you pls help me to solve this ? THIS is very important to me. > > > > > > > > > > -- > cat /etc/motd > > Thank you > Indunil Jayasooriya > http://www.theravadanet.net/ > http://www.siyabas.lk/sinhala_how_to_install.html - Download Sinhala > Fonts > > > ------------------------------ > > Message: 2 > Date: Sat, 4 Jun 2016 12:34:40 +0200 > From: Alessandro Baggi <alessandro.baggi(a)gmail.com> > To: CentOS <centos(a)centos.org> > Subject: [CentOS] remote backup > Message-ID: <5752AEC0.4010609(a)gmail.com> > Content-Type: text/plain; charset=iso-8859-15; format=flowed > > Hi list, > i've need to backup a partition of ~200GB with a local connection of 8/2 > mbps. > > Tool like bacula, amanda can't help me due to low bandwidth in local > server. > > I'm thinking rsync will be a good choice. > > What do you think about? > > Thanks in advance. > > > ------------------------------ > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos > > > End of CentOS Digest, Vol 137, Issue 5 > ************************************** >

3 3

setting up auto logout in CentOS 6
by Vanhorn, Mike 09 Jun '16

09 Jun '16

I would like to have my lab workstations logout a session after the person has been idle for a certain period of time. After some searching on the web, I got into /etc/gconf/schemas/gnome-session.schemas and set the default value of max_idle_action to “forced-logout”: <schema> <key>/schemas/desktop/gnome/session/max_idle_action</key> <applyto>/desktop/gnome/session/max_idle_action</applyto> <owner>gnome</owner> <type>string</type> <default>forced-logout</default> <gettext_domain>gnome-session-2.0</gettext_domain> <locale name="C"> <short>The action to take after the maximum idle time</short> <long>The name of the action to take when the maximum allowed idle time has been reached. The Delay is specified in the "max_idle_time" key. Allowed values are: logout, forced-logout. An empty string disables the action.</long> </locale> </schema> but the system is not logging me out after the max_idle_time. Is there something I’m missing? Thanks! --- Mike VanHorn Senior Computer Systems Administrator College of Engineering and Computer Science Wright State University 265 Russ Engineering Center 937-775-5157 michael.vanhorn(a)wright.edu

3 3

Re: [CentOS] Fwd: EPEL-ANNOUNCE Re: Upcoming OwnCloud changes in EPEL
by James Hogarth 09 Jun '16

09 Jun '16

On 22 Apr 2016 18:11, "James Hogarth" <james.hogarth(a)gmail.com> wrote: > > In the event that there are CentOS users making use of the EPEL owncloud packages, but not following the EPEL mailing lists, please read the mail below with regards to your installations. > > Thanks > > James > > ---------- Forwarded message ---------- > From: "James Hogarth" <james.hogarth(a)gmail.com> > Date: 22 Apr 2016 16:21 > Subject: EPEL-ANNOUNCE Re: Upcoming OwnCloud changes in EPEL > To: "EPEL Development List" <epel-devel(a)lists.fedoraproject.org> > Cc: <epel-announce(a)lists.fedoraproject.org> > > > > > > > On 5 April 2016 at 09:22, James Hogarth <james.hogarth(a)gmail.com> wrote: > >> > >> Hi all, > >> > >> Following on the process of bringing OwnCloud up to date in Fedora we're turning our attention to the EPEL users. > >> > >> Unfortunately EL6's use of php53 means we cannot update any further there given the minimum requirement of php54. > >> > >> As such the maintenance update of 7.0.13 that is in epel-testing now for EPEL6 will be the final one there to be followed by the retiring of the package. > >> > >> If you wish to update from that please either migrate to an EL7 base system or switch to the OwnCloud upstream packages which make use of SCL to satisfy the php54+ requirement. > >> > >> On the EPEL7 side of things 8.1.6 is due to hit testing very shortly. This is a mandatory update as a precursor to the 8.2.3 update in due course. Once this reaches live please ensure that updates are carried out and your OwnCloud installation is fully tested prior to the 8.2.3 update. > >> > >> This is due to a requirement from upstream that updates follow the path 8.0 -> 8.1 -> 8.2 -> 9.0. > >> > >> Related to this when updating the EL6 install from the 7.0 version to an EL7 or upstream SCL version please do make sure you follow the upgrade chain correctly - it is not possible to skip a step. > >> > >> Once the 8.2 goal is reached a discussion will be had then for EPEL as to whether to provide owncloud82 and owncloud90 packages or to just stay on the current major update - but that discussion is some time away as of yet. > >> > >> The reason for picking owncloud82 as the possible base for this is that this is the first version that has no php libraries bundled so will be the easiest to provide the long term maintained base from in a clean fashion complying to guidelines as closely as possible. > >> > >> Kind regards, > >> > >> James > >> > >> > > > > Following on from the previous message EPEL6 has it's final update with the EOL message. Please arrange to move to the upstream SCL packages or to migrate to EL7 if you are using owncloud on EPEL6 - be aware when you do migrate off of this that it is important to follow the chain through 8.0->8.1->8.2 checking your installation at each step. > > > > EPEL7 has had some time in testing and received a positive test so the 8.1.6 update there is being pushed today. > > > > When that has gone stable an 8.2.3 update will be pushed to epel-testing. Please ensure that your installation is updated to 8.1.6 and fully tested before applying the 8.2.3 update. > > For any OwnCloud users on CentOS who utilise the EPEL packages please be aware of important changes this week: The EPEL6 package has now been retired as end of life. If using the EPEL6 packaging of OwnCloud please ensure you migrate to a supported version as discussed above. On the EPEL7 side of things 8.2.4 has just been submitted to stable. Please ensure that the previous 8.1.6 update has been applied and fully tested before carrying out the 8.2.4 update. For those willing to do some early preliminary testing of 9.0.2 it has been uploaded to my Fedora people space, along with its dependencies.

4 7

Centos 6.8 GDM possible bug: can't log into another user
by Gilbert Sebenste 09 Jun '16

09 Jun '16

Hello everyone, Since I upgraded to CentOS 6.8 last week, I am having an issue whereby I log out, and then it attempts to log me in as the same user. I then click on another user and try to log in, but it instantly blows me right out and back to the login prompt for the original user. I do have GDM set up to auto-login at boot to a particular user in /etc/gdm/custom.conf, but it has always allowed me to log into another account while on the Gnome desktop, sitting in front of the computer. Has anyone else seen this issue? Gilbert ******************************************************************************* Gilbert Sebenste ***** (My opinions only!) *** *******************************************************************************

2 1

CentOS-announce Digest, Vol 136, Issue 2
by centos-announce-request＠centos.org 08 Jun '16

08 Jun '16

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2016:1204 Important CentOS 6 spice-server Security Update (Johnny Hughes) 2. CESA-2016:1205 Important CentOS 7 spice Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 7 Jun 2016 14:48:31 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1204 Important CentOS 6 spice-server Security Update Message-ID: <20160607144831.GA65268(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1204 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1204.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 809e9d71025ce9587d91b9f2d5d9fb02534a80cacae2a99996f46e1be7187480 spice-server-0.12.4-13.el6.1.x86_64.rpm 9fbb2f0cc41fa67b76a366ef426de81d516a6514a23942ca30e97cfb52599c32 spice-server-devel-0.12.4-13.el6.1.x86_64.rpm Source: b1a32672aeb5a90664d461b30155a6f74f8d6c533750551eb3111d222e5c1a10 spice-server-0.12.4-13.el6.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ Message: 2 Date: Tue, 7 Jun 2016 15:09:48 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2016:1205 Important CentOS 7 spice Security Update Message-ID: <20160607150948.GA3459(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2016:1205 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2016-1205.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 6373aaf37d9487127df5fb1afed95d2629f63ca38209b0e550758558798ce7c5 spice-server-0.12.4-15.el7_2.1.x86_64.rpm 5cb372ceb2fdf595c7eba34b8938ad8db7e87a61bfb77c73a5afb57e559e28a4 spice-server-devel-0.12.4-15.el7_2.1.x86_64.rpm Source: 98a5551264ccbd5d1e686783186d6d36a63d375ff90f87f2b8d779b9320e9481 spice-0.12.4-15.el7_2.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net Twitter: @JohnnyCentOS ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org https://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 136, Issue 2 ***********************************************

1 0

firewall-config not functional
by Emmett Culley 08 Jun '16

08 Jun '16

I have a number of machines (hardware and VMs) running CentOS 7. I all cases firewall-config is not functional. First, the service check boxes are not functional. When you click on one, it don't change to "checked", and nothing changes on the firewall. However you do see a "Changes applied" Sometimes, f you go to permanent mode and attempt to edit a zone, the whole desktop locks up as soon as you click on the default target dropdown. When I run firewall-config from the command line I see the following: -------------------------- org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.NetworkManager was not provided by any .service files (firewall-config:5079): Gtk-CRITICAL **: gtk_tree_view_get_path_at_pos: assertion 'tree_view != NULL' failed -------------------------- with the second line repeating many times and often while attempting to interact with the GUI. We don't use NetworkManager except on laptops, and so do not install it. Though we do install NetworkManager-glib, if only because some packages require it. After seeing a similar bug on the RHEL I also installed NetworkManager-libnm, but that did not make a difference. That RHEL bug also mentioned this problem only occurs on KDE, and not Gnome. And we only install KDE when a GUI is required, or desired. Emmett

7 10

for loop example
by Indunil Jayasooriya 08 Jun '16

08 Jun '16

Hi list, Can you look in to this? [root@centos67 loop]# cat file1 firstname1 firstname2 [root@centos67 loop]# cat file2 lastname1 lastname2 I need a OUTPUT like this *firstname1 lastname1firstname2 lastname2* But I try the below command , i get below output. what is the real command to get the above output [root@centos67 loop]# for line1 in $(cat file1 ); do for line2 in $(cat file2 ); do echo "$line1" "$line2";done;done; firstname1 lastname1 firstname1 lastname2 firstname2 lastname1 firstname2 lastname2 And also, I created a file3 like this [root@centos67 loop]# cat file3 firstname1 lastname1 firstname2 lastname2 How can I get the same OUTPUT ? *firstname1 lastname1firstname2 lastname2* if I try below command, i get the below output. [root@centos67 loop]# for i in $(cat file3);do echo $i;done; firstname1 lastname1 firstname2 lastname2 Could you pls help me to solve this ? THIS is very important to me. -- cat /etc/motd Thank you Indunil Jayasooriya http://www.theravadanet.net/ http://www.siyabas.lk/sinhala_how_to_install.html - Download Sinhala Fonts

3 3

Need advice with a "hot running" graphics card
by Kay Schenk 07 Jun '16

07 Jun '16

Hello all-- I have a old Radeon HD 2400 graphics card in my desktop connected by DVI to my monitor. It may be my imagination but it seems that since upgrading to 6.8 recently, after about 4 hours of use, my system seems to run "hot". I don't think its the man power until but maybe the graphics card? I found references to odd/high power consumption with radeons an particular kernel/radeon versions. And, now I find this old post: http://crunchbang.org/forums/viewtopic.php?id=17948 So 6.8 is 2.6.32-642.1.1.el6.i686 Has anyone else experienced this? Suggestions? -- -------------------------------------------- MzK "Time spent with cats is never wasted." -- Sigmund Freud

1 1

CentOS 6, gdb
by m.roth＠5-cent.us 07 Jun '16

07 Jun '16

Got a user who claims he was running this program, then it broke recently. Almost no updates in a while, and none relevant. I'm guessing the program's compiled from fortran to c.... Anyway, the issue's on two servers. On one, I installed a couple of compat libs, and it runs. The other still fails (but it doesn't have some of the i686 libs. When it fails, it's immediate, and reports dying with a SIGKILL. ldd claims it's not a dynamic executable, but file tells me it's a 32 bit ELF.... Running it under strace gives me no more. So, as one last resort (Confess! You have three last resorts!), I'm trying to run it under gdb. On the system it runs on, I can b main, and it gets there when I tell it run. On the other... the address appears to be the same, it's in his NFS-mounted home directory - it never gets to main, it just reports the sigkill. So, what I'd *really* like to do is not tell it run, but next, or step, but I can't. Anyone heavy enough into gdb to be able to suggest where I can tell it to break during the program initialization phase, before it gets to main? mark

2 1

test please ignore
by Alexandru Chiscan 07 Jun '16

07 Jun '16

test please ignore

1 0

Testing - Is the CentOS Mailing list still working?
by Anthony K 07 Jun '16

07 Jun '16

I haven't received a single message since 3rd June and was wondering whether the mailing list is down. Cheers, ak.

2 1

CenOS 6.8 and libGL failures
by isdtor 06 Jun '16

06 Jun '16

Ever since I upgraded to CentOS 6.8, some software has stopped working alogether. This is related to OpenGL/mesa and can be demonstrated with glxgears: $ glxgears libGL error: No matching fbConfigs or visuals found libGL error: failed to load driver: swrast X Error of failed request: BadValue (integer parameter out of range for operation) Major opcode of failed request: 154 (GLX) Minor opcode of failed request: 3 (X_GLXCreateContext) Value in failed request: 0x0 Serial number of failed request: 33 Current serial number in output stream: 35 $ This appears to be a common problem, but I found no solutions that apply here since I believe everything is installed and set up correctly. It all worked with CentOS 6.x, x<8. https://www.centos.org/forums/viewtopic.php?t=56273 https://ask.fedoraproject.org/en/question/38116/issues-with-libgl-on-fedora…

7 12

Trace back related to nouveau with 6.8
by David G. Miller 05 Jun '16

05 Jun '16

Hi All - Ever since I upgraded to 6.8 I have usually been getting a trace back report for some bits related to Nouveau whenever the screensaver has been running and I get back into the system. Along the lines of: :Pid: 31, comm: events/4 Tainted: G W -- ------------ 2.6.32-642.el6.x86_64 #1 :Call Trace: :[<ffffffff8107c911>] ? warn_slowpath_common+0x91/0xe0 :[<ffffffff8107c97a>] ? warn_slowpath_null+0x1a/0x20 :[<ffffffffa00e35b6>] ? drm_helper_choose_crtc_dpms+0xa6/0xb0 [drm_kms_helper] :[<ffffffffa00e40d6>] ? drm_helper_connector_dpms+0xe6/0x1a0 [drm_kms_helper] :[<ffffffffa01e1e80>] ? nv50_crtc_dpms+0x0/0x10 [nouveau] :[<ffffffffa0134f01>] ? nvif_notify_init+0x121/0x160 [nouveau] :[<ffffffffa01dfe42>] ? nouveau_connector_hotplug+0x92/0xd0 [nouveau] :[<ffffffffa0134f40>] ? nvif_notify_work+0x0/0xc0 [nouveau] :[<ffffffffa0134f6e>] ? nvif_notify_work+0x2e/0xc0 [nouveau] :[<ffffffffa01ecf10>] ? nouveau_fence_work_handler+0x0/0x30 [nouveau] :[<ffffffff8109fdc0>] ? worker_thread+0x170/0x2a0 :[<ffffffff810a6ac0>] ? autoremove_wake_function+0x0/0x40 :[<ffffffff8109fc50>] ? worker_thread+0x0/0x2a0 :[<ffffffff810a662e>] ? kthread+0x9e/0xc0 :[<ffffffff8100c28a>] ? child_rip+0xa/0x20 :[<ffffffff810a6590>] ? kthread+0x0/0xc0 :[<ffffffff8100c280>] ? child_rip+0x0/0x20 PID 31 is: root 31 0.9 0.0 0 0 ? S Jun03 12:44 [events/4] It seems to be innocuous (everything seems to still work) but things that seem to be innocuous have a habit of coming back and biting me. Anyone else experiencing this? Anyone know how to fix it? Both kernel and xorg-x11-drv-nouveau are current as is the rest of the system. Not finding anything with Google. Cheers, Dave

1 0

Fwd: Re: EPEL-ANNOUNCE Re: Upcoming OwnCloud changes in EPEL
by James Hogarth 03 Jun '16

03 Jun '16

Please see the below if you are a CentOS user of the EPEL OwnCloud packages. ---------- Forwarded message ---------- From: "James Hogarth" <james.hogarth(a)gmail.com> Date: 3 Jun 2016 23:43 Subject: Re: EPEL-ANNOUNCE Re: Upcoming OwnCloud changes in EPEL To: "EPEL Development List" <epel-devel(a)lists.fedoraproject.org> Cc: <epel-announce(a)lists.fedoraproject.org> > > On 22 Apr 2016 16:21, "James Hogarth" <james.hogarth(a)gmail.com> wrote: > > > > > > > > On 5 April 2016 at 09:22, James Hogarth <james.hogarth(a)gmail.com> wrote: > >> > >> Hi all, > >> > >> Following on the process of bringing OwnCloud up to date in Fedora we're turning our attention to the EPEL users. > >> > >> Unfortunately EL6's use of php53 means we cannot update any further there given the minimum requirement of php54. > >> > >> As such the maintenance update of 7.0.13 that is in epel-testing now for EPEL6 will be the final one there to be followed by the retiring of the package. > >> > >> If you wish to update from that please either migrate to an EL7 base system or switch to the OwnCloud upstream packages which make use of SCL to satisfy the php54+ requirement. > >> > >> On the EPEL7 side of things 8.1.6 is due to hit testing very shortly. This is a mandatory update as a precursor to the 8.2.3 update in due course. Once this reaches live please ensure that updates are carried out and your OwnCloud installation is fully tested prior to the 8.2.3 update. > >> > >> This is due to a requirement from upstream that updates follow the path 8.0 -> 8.1 -> 8.2 -> 9.0. > >> > >> Related to this when updating the EL6 install from the 7.0 version to an EL7 or upstream SCL version please do make sure you follow the upgrade chain correctly - it is not possible to skip a step. > >> > >> Once the 8.2 goal is reached a discussion will be had then for EPEL as to whether to provide owncloud82 and owncloud90 packages or to just stay on the current major update - but that discussion is some time away as of yet. > >> > >> The reason for picking owncloud82 as the possible base for this is that this is the first version that has no php libraries bundled so will be the easiest to provide the long term maintained base from in a clean fashion complying to guidelines as closely as possible. > >> > >> Kind regards, > >> > >> James > >> > >> > > > > Following on from the previous message EPEL6 has it's final update with the EOL message. Please arrange to move to the upstream SCL packages or to migrate to EL7 if you are using owncloud on EPEL6 - be aware when you do migrate off of this that it is important to follow the chain through 8.0->8.1->8.2 checking your installation at each step. > > > > EPEL7 has had some time in testing and received a positive test so the 8.1.6 update there is being pushed today. > > > > When that has gone stable an 8.2.3 update will be pushed to epel-testing. Please ensure that your installation is updated to 8.1.6 and fully tested before applying the 8.2.3 update. > > > > OwnCloud 9.0.2 had been submitted to EPEL7 testing. > > Beyond the usual warning of ensuring your system is updated to 8.2 and fully tested before applying the 9.0 update there is an additional caveat for nginx users of OwnCloud. > > It became quickly apparent in testing recently that the nginx config snippet shipped was broken out the box and couldn't possibly work. > > There is a new nginx snippet configuration being shipped as part of this update so that nginx behaves like httpd for the path (ie it's under the /owncloud namespace and not root) and so that an install of owncloud-nginx will have working configuration without the need to craft an additional custom config, removing the shipped one in the process. > > We have also moved the php-fpm configuration to its own pool to avoid any conflicts of options. > > If using nginx for OwnCloud please carefully validate your config when updating.

1 0

CentOS 7, nfsdcltrack
by m.roth＠5-cent.us 03 Jun '16

03 Jun '16

I'm seeing the following message in my logs: <timestamp> <hostname> nfsdcltrack[39406]: sqlite_insert_client: insert statement prepare failed: table clients has 2 columns but 3 values were supplied Anyone got any ideas as to a) why this is happening, and b) what I can do about it? mark

3 3

Realtek 8111GR on C7
by Alessandro Baggi 03 Jun '16

03 Jun '16

Hi list, I'm planning to buy a mobo (z170-K) that has Realtek 8111GR (nic). I've tried to search on google about support on C7 but can't fine anything. There is a way to check if supported? Is the Realtek 8111GR supported or I must change mobo? Thanks in advance.

6 6

FYI: http
by m.roth＠5-cent.us 03 Jun '16

03 Jun '16

I just had to browse to a printer... and with https-use-strict at a server higher up, firefox *would* *not* let me get there. I don't see the circa-2012 printer offering https. Luckily, there was konqueror, which *did* let me go to http://<printer> I just *adore* SmartSoftware that Won't Let You Endanger Yourself.... Reminds me of Jack Williamson's old novel, The Humanoids. (You aren't allowed to use that sharp knife, you might cut yourself. Or drive yourself. Or....) mark

7 8

pam_sss fails to close cache files
by Anand Buddhdev 03 Jun '16

03 Jun '16

Dear folks, After updating some of our servers to CentOS 6.8, we've noticed that the ones using pam_sss.so for authentication, appear to be suffering from a leak of sorts. On these systems, the /var partition is running out of disk space, and we eventually noticed that it's because of deleted, but still open files like these: httpd 1081 apache 8r REG 253,2 6406312 6199 /var/lib/sss/mc/group (deleted) sshd 1609 root 3r REG 253,2 8406312 431 /var/lib/sss/mc/passwd (deleted) mysqld 2018 mysql 4r REG 253,2 10406312 436 /var/lib/sss/mc/initgroups (deleted) Each time any process uses pam in some way, it's opening these cache files in /var/lib/sss/mc, but not closing them, and they're accumulating. The reason they're accumulating is that the initgroups, group and password file are frequently refreshed (by sssd), and so each open() call to them looks at a new file. We traced the sshd process, and noticed this: open("/var/lib/sss/mc/passwd", O_RDONLY|O_CLOEXEC) = 3 But there is no matching "close(3)" call anywhere (all other files opened have a matching close() system call). Has anyone else seen this issue, and does anyone know a quick solution to this? Regards, Anand

1 0

Virtualbox 5.0.20 fails to build module on latest C6.8 kernel
by Robert Arkiletian 02 Jun '16

02 Jun '16

Notice: The kernel modules for Virtualbox 5.0.20 will not compile on the latest C6.8 kernel 2.6.32-642.el6.x86_64 It's a known issue. https://www.virtualbox.org/ticket/14866 Fix is coming out with Virtualbox 5.0.22 version (hopefully soon).

1 0

Minimum RAM requirement for CentOS 6.x graphic installer?
by Nicolas Kovacs 02 Jun '16

02 Jun '16

Hi, The title says it all. What's the minimum RAM requirement for the CentOS 6.x graphic installer? In our public libraries we have some old hardware running CentOS 5, and I wonder if some of these machines can be upgraded to CentOS 6. Unfortunately RHEL 5.x' nifty text mode installer got seriously crippled with version 6.x. Cheers, Niki Kovacs -- Microlinux - Solutions informatiques durables 7, place de l'église - 30730 Montpezat Web : http://www.microlinux.fr Mail : info(a)microlinux.fr Tél. : 04 66 63 10 32

4 4

Re: [CentOS] [exim] Exim not always logging Message-ID
by Always Learning 02 Jun '16

02 Jun '16

On Thu, 2016-06-02 at 13:27 +0100, Mike Brudenell wrote: > My point is that a busy sysadmin shouldn't have to rely on intimate > knowledge of Exim's internal behaviour and oddities when trying > tracing a message from the logs. Some of us, well at least 1, have written a simple PHP programme, run on Apache, which instantly searches the current log and the archived logs for anything in the logs. Tracing items in Exim could not be quicker or easier - all done from the comfort of a web page with no terminal CLI or GREP insight. -- Regards, Paul. England, EU. England's place is in the European Union.

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss