- Discuss - lists.centos.org

What is a client certificate?
by Timothy Murphy 25 Oct '14

25 Oct '14

A very ignorant question, sans doute. I get my certificates from cacert.org, to whom I am very grateful. I follow what I take to be the official procedure, first creating <server>.key and <server>.csr on my server and then getting <server>.crt by going to Server Certificate=>New at the cacert site. I then place the key certficate *.key in /etc/pki/tls/private/ and what I call the client certificate *.crt in /etc/pki/tls/certs/ . But I notice that there at www.cacert.org there is a Client Certificate folder as well as the Server Certificate folder, and it seems that one can create a "client certificate" there. My quesion is: what is the purpose of this second client certificate? And while I am on the topic, what are the recommended file permissions for PKI certificates? I was a little surprised to find my <server>.key has permission 640, while <server>.crt has permission 644. The folder /etc/pki/tls/private/ on my server does not seem to have any special security; it is owned by root but can be opened and listed by anybody. Is that the recommended setup? -- Timothy Murphy e-mail: gayleard /at/ eircom.net School of Mathematics, Trinity College, Dublin 2, Ireland

3 2

How to update
by Néstor 25 Oct '14

25 Oct '14

HI people, I am using centos 5 and I am confused on what file to put in my yum.repo.d to update my centos. Can some one provide me with a link or an example file. Thanks, rotsen

5 13

And now for something completely different. Win7 on KVM
by James B. Byrne 24 Oct '14

24 Oct '14

As you can probably guess by now I am working my way down through my outstanding issue list trying to get as many deferred items closed out as I can before the next security storm hits. We have a Win7pro KVM guest that has been giving us networking issues since it was created. The last problem was that it was picking up its network address from the virtio DHCP service, with predicable results. This turned out to be an issue with how the virtual nic was configured (it was using NAT instead of the br0 bridge. We have adjusted the settings on the guest so the the nic is configured as a shared device / br0 / Device Model=virtio. Now after it boots the thing says that it does not have a driver for Ethernet adaptor at all. Is there a different setting for the model that I should be using? I have to point out that this thing was originally installed from cd-rom and then updated from the internet. So at some point it must have had a working network connection. Any ideas as to how to get it to find the network interface again? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

setting background on the command line
by Jerry Geis 24 Oct '14

24 Oct '14

I have centos 7 I am using: gsettings set org.gnome.desktop.background picture-uri file:///usr/share/backgrounds/gnome/Wood.jpg to set the background from the command line... dconf-editor shows the command worked. But the picture is not updated??? How do I get the desktop to re-draw? Thanks, Jerry

1 0

CentOS-announce Digest, Vol 116, Issue 13
by centos-announce-request＠centos.org 24 Oct '14

24 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2014:1679 CentOS 7 perl-Authen-SASL FASTTRACK BugFix Update (Johnny Hughes) 2. CEBA-2014:1681 CentOS 7 mgetty FASTTRACK BugFix Update (Johnny Hughes) 3. CEBA-2014:1700 CentOS 7 rsh FASTTRACK BugFix Update (Johnny Hughes) 4. CEBA-2014:1701 CentOS 7 systemd BugFix Update (Johnny Hughes) 5. CEBA-2014:1698 CentOS 7 kexec-tools BugFix Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Oct 2014 12:21:18 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2014:1679 CentOS 7 perl-Authen-SASL FASTTRACK BugFix Update Message-ID: <20141023122118.GA51755(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:1679 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1679.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 1c0de42b7e9c425bbe61b7ebf40c18881c3d08a61d2bb02dcb9cab89c2aebc49 perl-Authen-SASL-2.15-10.el7.noarch.rpm Source: 0a45c8765d2a5b8a5c76604aab4f810c45d630b5a8406d2e51b3d5ae1b734eb1 perl-Authen-SASL-2.15-10.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 23 Oct 2014 12:21:33 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2014:1681 CentOS 7 mgetty FASTTRACK BugFix Update Message-ID: <20141023122133.GA51836(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:1681 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1681.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 332062d7298e7edaaf4d0ce1698c4bec4cc09c11dc37afdae4803a753eac7416 mgetty-1.1.36-28.el7.x86_64.rpm 018a513a4699cdebee014c191558f6cb4f98261cac829d7f6c1aa434027b90b2 mgetty-sendfax-1.1.36-28.el7.x86_64.rpm acecec45586002eec6e8385a876a79c79bd74e66c52eb4095bbca64d41640878 mgetty-viewfax-1.1.36-28.el7.x86_64.rpm 4b2673228520e9ecfbcbf8c51d260e2ad976169b6e04012e9d21b0fdee60e413 mgetty-voice-1.1.36-28.el7.x86_64.rpm Source: f3223be0272301efdc6ff4fa1b508dae5fc6c05334d83506bf9cc6b20e555dde mgetty-1.1.36-28.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Thu, 23 Oct 2014 12:21:45 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2014:1700 CentOS 7 rsh FASTTRACK BugFix Update Message-ID: <20141023122145.GA51905(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:1700 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1700.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: cfb6a5f750485d0e34be98cc3adcc5c57016ed38627af1cec13355b7553697bb rsh-0.17-76.el7.x86_64.rpm e26027244ee995280b8cf16a5d56e5bf19ac8e869fc65b50382aa46f72475722 rsh-server-0.17-76.el7.x86_64.rpm Source: b12dd8aca7997b57abb656a4c4240731f041264b5ce033cb3d6fcbe364ffe249 rsh-0.17-76.el7.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Thu, 23 Oct 2014 12:22:06 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2014:1701 CentOS 7 systemd BugFix Update Message-ID: <20141023122206.GA52015(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:1701 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1701.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 47e2ae858a3ad8f46593faab1d8213d33aaa6b327acb4dc2890bade41cb151a4 libgudev1-208-11.el7_0.4.i686.rpm ae05177c20bc9cfa1e772f32550fb3164be94573f018c1c3898a6a5e68193678 libgudev1-208-11.el7_0.4.x86_64.rpm bd0ac9e271e3b926d44dae75d54c1d23668ecd3a5da70ae2130d9f09ccb7b820 libgudev1-devel-208-11.el7_0.4.i686.rpm b0b3cf5fbe41bbbfb0b68eafdccf23e4783f61893e1432f6ff3ce3fc8fc425b4 libgudev1-devel-208-11.el7_0.4.x86_64.rpm cde27c553e96c27edc123099365d12d67d66f2c2028f3b919c59f95a32eaf87b systemd-208-11.el7_0.4.x86_64.rpm 1bb2412e0b7318d14ecc0b4c5a05e1f12c7e1532cbbed1267bccc89175918b77 systemd-devel-208-11.el7_0.4.i686.rpm c3a1ccd0d2d8f917369fbeb5285f12075e6d9601cd22d86da59263eb0429b0b3 systemd-devel-208-11.el7_0.4.x86_64.rpm 368c32eb6b38e2892c2b8827be7a6992b0693a3c0b27adb8c2b2b1d5b7d328fa systemd-journal-gateway-208-11.el7_0.4.x86_64.rpm b70041d37d2e19bba37f04da50be9693a4fe535c15d6b91aa04fefce8912adad systemd-libs-208-11.el7_0.4.i686.rpm 83178f01c882d4e84e339a0b162f0bab008cb143199ab7f4d052a289a299933b systemd-libs-208-11.el7_0.4.x86_64.rpm b7205eb655a08171cb6ab1b7a2ffc3675146603734647cefd906fdb987e68336 systemd-python-208-11.el7_0.4.x86_64.rpm 1088daf08db228a9534c3f5ee4cf56b1761cc1033495b227b6606570ad0de3b5 systemd-sysv-208-11.el7_0.4.x86_64.rpm Source: fade2f982be47395fbc6d17a6aea3b036bd6306cd8844a449569d3575a22d356 systemd-208-11.el7_0.4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Thu, 23 Oct 2014 12:22:37 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEBA-2014:1698 CentOS 7 kexec-tools BugFix Update Message-ID: <20141023122237.GA52096(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2014:1698 Upstream details at : https://rhn.redhat.com/errata/RHBA-2014-1698.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: fd3ba6ad69239b25013b7345f2522c584a56cefb67d308c355a40e1775e4f336 kexec-tools-2.0.4-32.el7.centos.5.x86_64.rpm f93f8c9bc1e6bd2cf552d7170db9941eebe66e0b9c28da4c30a3af3363a3b792 kexec-tools-eppic-2.0.4-32.el7.centos.5.x86_64.rpm Source: c3410cc99a649aad6c8acb5ea9cd7ac069a908151462384acf3c4423b82d987a kexec-tools-2.0.4-32.el7.centos.5.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 116, Issue 13 ************************************************

1 0

lynx only shows : FRAME: wlmframe
by Johan Vermeulen 24 Oct '14

24 Oct '14

Hello, when I log in through ssh to a remote site and open the web interface from a ( new ) printer using Lynx, it only displays : FRAME: wlmframe I suspect this is some unfriendly coding, that will cost me time in opening Firefox instead of Lynx or w3m. Does anybody know of a way around this? Greetings, Johan -- Johan Vermeulen IT-medewerker Caw De Kempen johan.vermeulen(a)cawdekempen.be 0479.82.01.41 Powered by Linux.

4 5

pidgin-sipe on Centos-6/64
by Fred Smith 24 Oct '14

24 Oct '14

Hi! Wondering if anyone here has been able to get the (3-rd party) SIPE plugin (pidgin-sipe) working on Centos-6 with the C6 version of pidgin? I've just started looking at it and after a little messing around have no joy. Before I waste more time on it I thought I'd ask. what I've done so far: --download the latest binary from the Suse build service, allegedly one built for EL-5. installs (along with libpurple-sipe) without errors, but when I attempt to create a new account for SIPE there is no listing of it in the list of protocols in the "add user" dialog. --figuring I had the wrong version (since the pidgin in C6 is now rather old) I downloaded the source and built it, again with no errors. but having installed it, I get the same symptom. I'd appreciate any helpful hints. thanks! -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- But God demonstrates his own love for us in this: While we were still sinners, Christ died for us. ------------------------------- Romans 5:8 (niv) ------------------------------

2 4

Loss of Ethernet adaptor
by James B. Byrne 24 Oct '14

24 Oct '14

This is a return to an issue I first raised back in June. We had a similar occurrence in September while I was away and so I am revisiting the entire matter. Steve Clark on 6 Jun 16:02 2014 wrote: > Hi, > > We ran into this problem also - the interface would disappear. > There is newer e1000e driver that fixes it or you could > add pcie_aspm=off to your kernel command line. > > HTH, > Steve I have run into other reports of similar occurrences and some of these refer to this bug report: https://bugzilla.redhat.com/show_bug.cgi?id=632650 However, that report is closed as being a duplicate of: https://bugzilla.redhat.com/show_bug.cgi?id=562273 Which is not available to viewing by the great unwashed. Nonetheless, following the discussion thread in the bug report that I can view it appears that this issue was supposedly resolved sometime in late 2012. >From what I can gather the fix was to disable ASPM L1 for this model adaptor in the e1000e driver module. * Upstream commit d4a4206ebbaf48b55803a7eb34e330530d83a889 - e1000e: Disable ASPM L1 on 82574 However, when I run lspci -vvv on the host that exhibited the problem I see this: . . . 03:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection Subsystem: Super Micro Computer Inc Device 10d3 Physical Slot: 0-2 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0, Cache Line Size: 64 bytes Interrupt: pin A routed to IRQ 17 Region 0: Memory at feae0000 (32-bit, non-prefetchable) [size=128K] Region 2: I/O ports at ec00 [size=32] Region 3: Memory at feadc000 (32-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 2 Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+) Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=1 PME- Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Address: 0000000000000000 Data: 0000 Capabilities: [e0] Express (v1) Endpoint, MSI 00 DevCap: MaxPayload 256 bytes, PhantFunc 0, Latency L0s <512ns, L1 <64us ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- DevCtl: Report errors: Correctable+ Non-Fatal+ Fatal+ Unsupported+ RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+ MaxPayload 128 bytes, MaxReadReq 512 bytes DevSta: CorrErr+ UncorrErr- FatalErr- UnsuppReq+ AuxPwr+ TransPend- LnkCap: Port #0, Speed 2.5GT/s, Width x1, ASPM L0s L1, Latency L0 <128ns, L1 <64us ClockPM- Surprise- LLActRep- BwNot- ############ LnkCtl: ASPM L0s L1 Enabled; RCB 64 bytes Disabled- Retrain- CommClk+ ############ ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt- LnkSta: Speed 2.5GT/s, Width x1, TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt- Capabilities: [a0] MSI-X: Enable+ Count=5 Masked- Vector table: BAR=3 offset=00000000 PBA: BAR=3 offset=00002000 Capabilities: [100 v1] Advanced Error Reporting UESta: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol- UEMsk: DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol- UESvrt: DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol- CESta: RxErr+ BadTLP+ BadDLLP+ Rollover- Timeout+ NonFatalErr+ CEMsk: RxErr- BadTLP- BadDLLP- Rollover- Timeout- NonFatalErr+ AERCap: First Error Pointer: 00, GenCap- CGenEn- ChkCap- ChkEn- Capabilities: [140 v1] Device Serial Number 00-25-90-ff-ff-61-74-c1 Kernel driver in use: e1000e Kernel modules: e1000e . . . lsmod . . . e1000e 267701 0 . . . The host is running CentOS-6.5 with all updates applied to date. My question is: Has this issue been addressed in the official e1000e module or not? if not then does the recommendation to "add pcie_aspm=off to your kernel command line" hold? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 3

Re: [CentOS] Gnome 3 on centos 7
by Jerry Geis 23 Oct '14

23 Oct '14

On Thu, Oct 23, 2014 at 2:50 PM, <m.roth(a)5-cent.us> wrote: > Note that I still can't post to the list.... > > Jerry Geis wrote: > > Hi all - almost have my migration to Centos 7 done... > > > > My last piece is finding a way to keep menus away from users on Gnome 3. > > > > gsettings took me pretty far, to remap gconf-tool to gsettings. > > > > I also removed two packages > > gnome-shell-extension-places-menu > > gnome-shell-extension-app-menu > > > > This removed the Places and Apps menu options in the top panel. > > > > However - when doing this now I see the menu choice for "Activities". > > > > I am wondering if anyone knows how to remove that or make it > > non-functional... > > You can click on it and run a "terminal" which I do not desire. > > I missed the beginning of this - is this supposed to be like a kiosk? The > only things the users can do is click on icons, and those are all they're > allowed to do? If so, I think there's a kiosk setup. > > And don't forget to disable screen, or whatever it is, that lets me to > <f[2-x], and get to a text-mode login.... > > mark > > Mark - it is basically a Kiosk. I really dont want any icons on the screen - I am remotely controlling the box and what is on the screen for viewing. if someone connected a mouse I dont want them to be able to do anything. I have disable the function keys and such... thanks, Jerry

1 0

Gnome 3 on centos 7
by Jerry Geis 23 Oct '14

23 Oct '14

Hi all - almost have my migration to Centos 7 done... My last piece is finding a way to keep menus away from users on Gnome 3. gsettings took me pretty far, to remap gconf-tool to gsettings. I also removed two packages gnome-shell-extension-places-menu gnome-shell-extension-app-menu This removed the Places and Apps menu options in the top panel. However - when doing this now I see the menu choice for "Activities". I am wondering if anyone knows how to remove that or make it non-functional... You can click on it and run a "terminal" which I do not desire. Thanks, jerry

1 0

Centos 7 - How To set text console resolution to 80x24
by Dario Lesca 23 Oct '14

23 Oct '14

Like subject say ... hot to configure the resolution of text console to standard 80x24 ? Many Thanks -- Dario Lesca (inviato dal mio Linux Fedora 20 con Gnome 3.10.4)

2 6

Re: [CentOS] Q. LUKS or ecryptfs-utils ?
by James B. Byrne 23 Oct '14

23 Oct '14

On Wed, October 22, 2014 18:52, Nux! wrote: > Do you also run the hypervisor? Because if you are not, then the > host can dump your guest's memory and retrieve the luks passphrase > from there AFAIK. Who are you hiding from? The issue is backstopping a physical security breach. We run the hypervisor host and have physical control over access to the hardware. Should the storage device be removed from our premises by unauthorised means then we wish assurance that the data thereon is not readily accessible to anyone. We are also cognisant that it is conceivable that a external threat might find some way to scan/copy the data without actually removing the device physically. I am under the impression that encryption 'should' work to prevent 'drive-by' surveillance in that case as well, but I am not entirely convinced that is true. I am starting with the mail spool because that is a fairly straight-forward case. Our mail spool is mounted at /var/spool/imap and is an LVM volume. We have sufficient surplus space to easily create an equivalently sized or even larger LVM as an encrypted whatever. I am not sure of the correct terminology in this case; device/partition/something else? My thinking is that we set up an encrypted LV, take the imapd service down, copy the imap spool files and directory structure to the encrypted volume. Dismount both, remount the encrypted volume in place of the original and restart the imapd service. Is this a sound approach? We may want to have the imapd service started manually after the encrypted volume is made accessible. If so then both actions probably belong in an admin script (to be written). -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

epel repo
by Steve Clark 23 Oct '14

23 Oct '14

Hi, Has anyone else had trouble trying to reach the epel repo. I can only get to it if I change the https to http in the epel.repo file. -- Stephen Clark *NetWolves Managed Services, LLC.* Director of Technology Phone: 813-579-3200 Fax: 813-882-0209 Email: steve.clark(a)netwolves.com http://www.netwolves.com

1 1

httpd on centos 7
by Jerry Geis 23 Oct '14

23 Oct '14

I have read the info on apache 2.4... I added to the bottom of httpd.conf these lines (and restarted httpd) ------------------------- <Directory /var/www/html> # old 2.2 config # Order Allow,Deny # Allow from all AllowOverride None Require all granted </Directory> <Directory /home/silentm/public_html/gifs> AllowOverride None Require all granted </Directory> SuexecUsergroup silentm silentm ------------------ So now I have access to the index.html page in /var/www/html so that is good. However, I do not have access to the user gifs /home/silentm/public_html/gifs The user silentm exists. I get a 404 error. 127.0.0.1 - - [23/Oct/2014:08:14:21 -0400] "GET /~silentm/gifs/smlogo.jpg HTTP/1.1" 404 222 "-" "curl/7.29.0" All the files are there - all owned by silentm. What did I miss to access the gifs? Thanks Jerry

2 3

KDE C6.5+cr : heads-up screens renamed after update
by Patrick Bervoets 23 Oct '14

23 Oct '14

Just for your information: after applying the cr-updates to a C6.5 my screens on my laptop renamed from VGA1 and eDP1 to VGA-0 and eDP-0. And since X insists that my VGA is left to my eDP (and my scripted xrandr was confused by the renaming) I had to go to the left to reach my right screen. I needed some more coffee this morning. Patrick

1 0

upgrade dhcpd failover set from centos 5.x ->7.x
by Les Mikesell 23 Oct '14

23 Oct '14

Is there a less drastic way to upgrade a pair of dhcpd servers on Centos 5.x than forklifting the old boxes out and hoping the replacements work?. The failover protocol seems to be incompatible so I just upgrade one at a time.... Has anyone been through this with a clever solution - like compiling a new dhcpd on the old boxes for an easy rollback? -- Les Mikesell lesmikesell(a)gmail.com

3 2

Testing "dark" SSL sites
by lists＠benjamindsmith.com 22 Oct '14

22 Oct '14

So, with all the hubbub around POODLE and ssl, we're preparing a new load balancer using HAProxy. So we have a set of unit tests written using PHPUnit, having trouble validating certificates. How do you test/validate an SSL cert for a prototype "foo.com" server if it's not actually active at the IP address that matches DNS for foo.com? For non-ssl sites, I can specify the url like http://1.2.3.4/path and pass an explicit "host: foo.com" http header but that fails for SSL certificate validation. You can also set a hosts file entry, but that's also rather painful. Is there a better option?

5 9

Re: [CentOS] Loss of Ethernet adaptor
by James B. Byrne 22 Oct '14

22 Oct '14

On Tue, October 21, 2014 14:02, Marcelo Ricardo Leitner wrote: > On 16-10-2014 13:47, Akemi Yagi wrote: >> On Wed, Oct 15, 2014 at 8:41 AM, James B. Byrne <byrnejb(a)harte-lyne.ca> >> wrote: >>> This is a return to an issue I first raised back in June. We had a similar >>> occurrence in September while I was away and so I am revisiting the entire >>> matter. >>> >>> Steve Clark on 6 Jun 16:02 2014 wrote: >>>> Hi, >>>> >>>> We ran into this problem also - the interface would disappear. >>>> There is newer e1000e driver that fixes it or you could >>>> add pcie_aspm=off to your kernel command line. >>>> >>>> HTH, >>>> Steve >>> >>> I have run into other reports of similar occurrences and some of these >>> refer >>> to this bug report: https://bugzilla.redhat.com/show_bug.cgi?id=632650 >> >> I'm the one who did the submission. Some of my comments (which I >> thought were helpful) have been hidden by Red Hat. >> >>> However, that report is closed as being a duplicate of: >>> https://bugzilla.redhat.com/show_bug.cgi?id=562273 >>> >>> Which is not available to viewing by the great unwashed. >> >> I don't have access, either. >> >>> The host is running CentOS-6.5 with all updates applied to date. My >>> question >>> is: Has this issue been addressed in the official e1000e module or not? if >>> not then does the recommendation to "add pcie_aspm=off to your kernel >>> command >>> line" hold? >> >> My suggestion for you is to give ELRepo's kmod-e1000e a try. It has >> the latest version from Intel (3.1.0.2) as opposed to the version in >> the EL kernels (2.3.2-k). There are known cases in which a later >> version resolved issues. > > Both BZs above are RHEL 5 specific, being 562273 a "driver update" one. > Did you report this against any RHEL6 too? > > Marcelo No, I did not. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

CentOS-announce Digest, Vol 116, Issue 12
by centos-announce-request＠centos.org 22 Oct '14

22 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:1671 Moderate CentOS 5 rsyslog5 Security Update (Johnny Hughes) 2. CESA-2014:1669 Low CentOS 7 qemu-kvm Security Update (Johnny Hughes) 3. CESA-2014:1655 Moderate CentOS 7 libxml2 Security Update (Johnny Hughes) 4. CESA-2014:1676 Moderate CentOS 7 wireshark Security Update (Johnny Hughes) 5. CESA-2014:1677 Moderate CentOS 5 wireshark Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 21 Oct 2014 16:39:04 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1671 Moderate CentOS 5 rsyslog5 Security Update Message-ID: <20141021163904.GA7073(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1671 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1671.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: dc2949c2525c1a78b1869cd2f532e935ce8660072216b291d7b412e3124c80ab rsyslog5-5.8.12-5.el5_11.i386.rpm 7d02145ccd645aff9dbb04dec8e0f493922f58ba6cb8f01b9e15c60acf9fc6df rsyslog5-gnutls-5.8.12-5.el5_11.i386.rpm 7a13dfee4c8e7fd4353e0b52be3a431ec8fdc59a1c883330538cac72dd743420 rsyslog5-gssapi-5.8.12-5.el5_11.i386.rpm 81563a2162db486b9de155424dd63ae28d42ecfe20cf99533aab17a674e21fb2 rsyslog5-mysql-5.8.12-5.el5_11.i386.rpm 3e8c7182485370bd260746b85fd258622b22dde2d9f8b91a7b0300b87728b6e9 rsyslog5-pgsql-5.8.12-5.el5_11.i386.rpm 7ed3b710754ee85623605be96cd7b60d8c311ef4b8f7a95f38c7f0ad95cce9fe rsyslog5-snmp-5.8.12-5.el5_11.i386.rpm x86_64: 8b0241bca0769484a6692ea68ddbf43f354ef0cff3469d87d5823f02a0282c0d rsyslog5-5.8.12-5.el5_11.x86_64.rpm 4863b240e157bbf930d31af230e7ba49f89c38e6aef2ccd1bdda9ada5f1ea5a0 rsyslog5-gnutls-5.8.12-5.el5_11.x86_64.rpm ad86eb442222f4ffb02ea307cb2e5c5ea2eba924622cb0c975c6f4a6d5d22045 rsyslog5-gssapi-5.8.12-5.el5_11.x86_64.rpm e0be6a0b2cb21dc7a9a92aa52d9061e0a7c7a685b1cf2193046549c9d8426422 rsyslog5-mysql-5.8.12-5.el5_11.x86_64.rpm c268b872920776a75a738d10bc8a71976cb6de501460b740e80b67bd21288e7d rsyslog5-pgsql-5.8.12-5.el5_11.x86_64.rpm 41ce2b483017cfc030c60caa0d5e2ad72997d2882aab789f81ee4ec729f6cd91 rsyslog5-snmp-5.8.12-5.el5_11.x86_64.rpm Source: aea9eb2bdad66c7385e88b973ee5d51bc86a10ed462be58d8e32690cbfae6f99 rsyslog5-5.8.12-5.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Tue, 21 Oct 2014 17:21:12 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1669 Low CentOS 7 qemu-kvm Security Update Message-ID: <20141021172112.GA19229(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1669 Low Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1669.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: fb80d3eed43c292045f789a7975233d8370f81ab44ed7533c89e9285cdaaf76b libcacard-1.5.3-60.el7_0.10.i686.rpm 8a596137622c6ed6113f60a09264fea4af9163939d481faacc0446b69d7e4ccf libcacard-1.5.3-60.el7_0.10.x86_64.rpm 3652b540146a2346ddfa29b44020b35e73cf07eb7dbc34d263b3cbb0fd6d67a4 libcacard-devel-1.5.3-60.el7_0.10.i686.rpm 62812d12eaf3446b88f9d4fc28fd030794de0a4cc374ba0280ff2166ac8638f7 libcacard-devel-1.5.3-60.el7_0.10.x86_64.rpm 2ec8eafc99d8f2ec49e16ecfb2962992f215a0def44faa91438cb42045957f17 libcacard-tools-1.5.3-60.el7_0.10.x86_64.rpm a0c730b45988fa40b5757164d3a9db73a5a1b258501d400b1110ee7d2d859be0 qemu-guest-agent-1.5.3-60.el7_0.10.x86_64.rpm fdc3370f8f691de28013d749c99e500a72db65708e867016824dde55e63597d7 qemu-img-1.5.3-60.el7_0.10.x86_64.rpm ca55fa4cf9cdf4d5d45ab30afeedc4378161c9ada913f3b8d7da189a8eca7f86 qemu-kvm-1.5.3-60.el7_0.10.x86_64.rpm 7e1f62cdac4f199e8f31751ee937ace975d025556cdb3c654ea53c02e0f387d2 qemu-kvm-common-1.5.3-60.el7_0.10.x86_64.rpm e4082072fd75bb8166d954062928ab0c16439dd491535e0c8e329da6c6b7f1c9 qemu-kvm-tools-1.5.3-60.el7_0.10.x86_64.rpm Source: 6821bb25b385c0ad5e25cf715cba8244836e8ab3b969c431f0aa2f1245d74461 qemu-kvm-1.5.3-60.el7_0.10.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Tue, 21 Oct 2014 17:21:29 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1655 Moderate CentOS 7 libxml2 Security Update Message-ID: <20141021172129.GA19311(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1655 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1655.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: fc837a4e2b3b952bb6e0ec91eec3720b02fe7415a4baaddf0bcd5ff15bf6067e libxml2-2.9.1-5.el7_0.1.i686.rpm 157e1167f06c646e4a07e442523af74c8fc99252ffa1e2eadf58278be9ae89ea libxml2-2.9.1-5.el7_0.1.x86_64.rpm b436dee56e93dd9997ee55b3c4f6fe136ac69c4c515cdb68fa9db6ee51abded9 libxml2-devel-2.9.1-5.el7_0.1.i686.rpm 78aead85ea11bb764824d4a48bdc74c32792424584fec634c6c669079fa43713 libxml2-devel-2.9.1-5.el7_0.1.x86_64.rpm 26f5e7225af4df0c5be969f3946b01db741a8ae130e10cc6684609bf656faa7e libxml2-python-2.9.1-5.el7_0.1.x86_64.rpm 6ba3f9e569d8e88f3f62c9f01de9a0c03df3dcb421f5115c99b6cbde49f4c810 libxml2-static-2.9.1-5.el7_0.1.i686.rpm 9c6d6f67c5fc34a28a60fabf6813ff9355b7f8453a82399e178e06bd85cd580b libxml2-static-2.9.1-5.el7_0.1.x86_64.rpm Source: d0c32e4869401f37357010f431e2c651bdc5189095999d7d1c5d3a57d3ad4a03 libxml2-2.9.1-5.el7_0.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Tue, 21 Oct 2014 19:49:27 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1676 Moderate CentOS 7 wireshark Security Update Message-ID: <20141021194927.GA34083(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1676 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1676.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: fad646f49ad9452ca4c3b1ddcffa641ded2e57d3380c6f740e6a4230abb1eb37 wireshark-1.10.3-12.el7_0.i686.rpm 4fa9d699585791b216e9953927a0115038b8a492b9b29260c6d956b9db157833 wireshark-1.10.3-12.el7_0.x86_64.rpm 099df5f29f923d2c476231d88960ef5284af6e7fefdf5ea492535ba54cdf8267 wireshark-devel-1.10.3-12.el7_0.i686.rpm 86c1b4bf2d6c0fa63a094410febe3e0e19633590119cbe2679b95c94723b1aed wireshark-devel-1.10.3-12.el7_0.x86_64.rpm fc7cfeef19cbe4bdd4b190b0f3f7fd41b36e23e1f4fc8530c9458ad251578b01 wireshark-gnome-1.10.3-12.el7_0.x86_64.rpm Source: 57e3b564c93d03d425fcf708c93b3270771605cb8037c6785eaf829efcf79bbc wireshark-1.10.3-12.el7_0.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Tue, 21 Oct 2014 23:32:37 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1677 Moderate CentOS 5 wireshark Security Update Message-ID: <20141021233237.GA26962(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1677 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1677.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 90c9794ecc6fbc42724223acfd5b16d2d22ac6585f8981cacfd347d58ee999f4 wireshark-1.0.15-7.el5_11.i386.rpm 123eaab95ce85af02e83aa2a49802ac7c00f698b144c9840fc52c57232741eab wireshark-gnome-1.0.15-7.el5_11.i386.rpm x86_64: 0971e5b9e2371e4aa70e7e5722a304b8b1926bf1be346e2776288da1c84e2a0f wireshark-1.0.15-7.el5_11.x86_64.rpm bc7446fc9ea394869c1df985e58305a0236eee12e567b07d59c1ea4e2d787147 wireshark-gnome-1.0.15-7.el5_11.x86_64.rpm Source: d56080e1059682ffb593c36c458a82991317ba1e8114e650df32d07cddfe9a7d wireshark-1.0.15-7.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 116, Issue 12 ************************************************

1 0

Conduct on the CentOS List
by Karanbir Singh 21 Oct '14

21 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The recent anti-social content on the list including threats and support of harassment needs to stop immediately. The CentOS Board will work with the list admins to enforce moderation and if needed removal and bans from the list should people continue this behaviour. This is a large, diverse, and respected community and none of us should need to tolerate any form of uncivilised behaviour, such as harassment and threats. The topic of harassment and online threats has been at the top of mind lately, and in light of the conversation we would like to make it clear that the CentOS Project is not a place for abuse or hostility. There is no excuse for this behaviour, no matter what the intention. Discouraging and banning anti-social behaviour in the CentOS Project has been part of an ongoing effort for a while, and now we feel it's time to come forward with a clear statement. As with any open community, we have disagreements on technical matters. It's part of the natural exchanges needed for a vibrant community, but we must keep the discussions civil. Have consideration and respect for other people. The power of an open source project is in the community. If the community gets broken, the project loses its fundamental reason-for-being. Code alone does not make open source, and community is made through people treating each other with respect. * Do not make personal attacks * Do not threaten people * Do not harass people * Do debate ideas on the merits of the idea alone * Do help each other keep a civil tone while remaining civil * Do treat others with respect In your communication on CentOS Project forums such as IRC, mailing lists, Web forums, or any other medium, we will not tolerate personal attacks, threats, or harassment of any individual or group. We reserve the right to moderate or ban anyone who violates our guidelines without notice or discussion. Thank you for your attention to this important matter. - -- Karanbir Singh, CentOS Project Leader on behalf of the CentOS Project Board -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iQEcBAEBAgAGBQJUNxUDAAoJEI3Oi2Mx7xbtDnsH/0UqAu2xN8M6pxkkx+oS8geX 8rFJpsHt2tYB06lVrBXrXUsUx7LzGcBe78C3ZnTUBVjG9H7kLEnKjXTDk4JObiH6 e2FMTEgBc62tiLFrCZEYIFgYrfcRSg8PciZQbr4DQ9kd/Q3TbQvzcs6yAU8xZn75 yJ1tRadRbXNZzz2dwgNMVfcRpVBTWSogivRvYtYzx1mB0EPiFzCrTQ8Cw9CqFilx DADtJFiIBuuUhfhNV3iOVIgmgSBBnoaPqUsru0PSs6UZlxKLT0R37oiE/ZTPCLCY 2GHELWMJ3R9UMvL+oQvP0dhOtgLUv+sX592aCaHAruGUGIfBCI7TO2aR0At2hYQ= =3AX4 -----END PGP SIGNATURE-----

5 4

Fwd: A CentOS list favor, please: an ethtool question
by Les Mikesell 21 Oct '14

21 Oct '14

---------- Forwarded message ---------- From: <m.roth(a)5-cent.us> Date: Tue, Oct 21, 2014 at 2:33 PM Subject: A CentOS list favor, please: an ethtool question To: Les Mikesell <lesmikesell(a)gmail.com> Hi, Les, May I ask you to forward this to the list? I know I got one email from Karanbir after he modded me so that I couldn't post to the list... but in the last week, I've tried emailing Johnny, and I also sent one to Karanbir, figuring that if he was moderating me, I'd send a post to him to moderate, and got a response from neither... and I'm suspecting that any email I send to *any* address at centos.org goes to /dev/null, and he seems to have forgotten me altogether. Anyway, I'm rsyncing directories over the net, from a 6.5 box to a 6.5 box, and it's going *very* slowly, hours for < 100G. Trying to see if there was a network issue, I tried ethtool on the older box that I'm pulling from, and the relevant lines that surprised me are these: Advertised auto-negotiation: Yes Speed: Unknown! Duplex: Unknown! (255) Port: Twisted Pair PHYAD: 1 Transceiver: internal Auto-negotiation: on Note it's a tg3 driver. mark

2 1

IP aliasing on CentOS 7
by Boris Epstein 21 Oct '14

21 Oct '14

Hello all, is there a good wirte-up on how edit script files in the /etc/sysconfig/network-scripts directory on Centos & to assign multiple IP addresses to the same NIC on boot? Thanks for any and all help. Cheers, Boris.

2 2

creating a floppy image from a linux file
by Dan Hyatt 21 Oct '14

21 Oct '14

Hi, I am still trying to get kick-start centos in my vmware5 because pxe cannot find the pxe server. I do not control the dhcp or pxe server. I have both my kickstart file and my iso image for centos6.5 on my vmware datastore, but am trying to run my kickstart file from VMware guest. Can I tell the command line to run from the datastore in VMWare? Or must I convert my kickstart file to a floppy image to run from VMware console? I have the centos image on the DVD mounted from my datastore. Now I need to convert the kickstart file to a floppy image to mount on the server from my datastore This is what google and VMWare keeps telling me but it does not make sense unless I am copying off a floppy.... What I am trying to do is turn the kickstart file into a floppy image so I can kickstart off the floppy in vmware. Create a disk image from the physical drive: cat /dev/fd0 > imagefile.img Copy image to the physical drive: cat imagefile.img > /dev/fd0 Help figuring out that silly little piece that is keeping me from building a VM guest from my kickstart file is much appreciated. Dan

5 8

Samba 4.1.6
by Bowie Bailey 21 Oct '14

21 Oct '14

I just installed a CentOS 7 server and ran into a problem with Samba and the "force user" option. Apparently, there was a fix for some "force user" issues in the 4.1.6 release. Is there any likelihood of an update from upstream? If not, is there another repo that provides a more up-to-date version of Samba? -- Bowie

6 11

Re: [CentOS] rsync question: building list taking forever
by James B. Byrne 21 Oct '14

21 Oct '14

On Mon, October 20, 2014 10:49, Denniston, Todd A CIV NAVSURFWARCENDIV Crane wrote: > > [OP: `they don't allow ssh between the datacenters` ...but... they nfs between > them...??? ME: much head scratching.] We have a Value Added Network (VAN) provider who insists on a similar thing. We were given sftp access to our transaction files but not ssh. They also will not run an rsync daemon for us. We ended up locally mounting the remote host directories with fuse-ssh (sshfs) over sftp using RSA keys to bypass the interactive logins. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

CentOS-announce Digest, Vol 116, Issue 11
by centos-announce-request＠centos.org 21 Oct '14

21 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. Continuous Release (CR) Repository updates are released for CentOS-6.6 (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 21 Oct 2014 06:28:28 -0500 From: Johnny Hughes <johnny(a)centos.org> To: CentOS-Announce <centos-announce(a)centos.org> Subject: [CentOS-announce] Continuous Release (CR) Repository updates are released for CentOS-6.6 Message-ID: <5446435C.6080703(a)centos.org> Content-Type: text/plain; charset="utf-8" We have released the following updates into the 6.5/cr repository: http://lists.centos.org/pipermail/centos-cr-announce/2014-October/thread.ht… The updates include everything that will be on the 6.6 ISO Sets and also everything to date that will be in 6.6 Updates. We will continue to put updates into 6.5 CR until we actually release CentOS-6.6. For information on the CR repository, see this link: http://wiki.centos.org/AdditionalResources/Repositories/CR Thanks, Johnny Hughes

1 0

rsync question: building list taking forever
by Tim Dunphy 21 Oct '14

21 Oct '14

Guys, I've setup an rsync between two directories that I've mounted locally on a jump box. Long story short, the two directories are both NFS shares from two different hosts. Our security dept won't allow us to SSH between the two data centers, directly. But the jump host can contact both. So what I've done is mount the NFS shares from one host in each data center on the jump box using sshfs. The directory I'm trying to rsync from has 111GB of data in it. I don't think I've ever setup an rsync for quite so much data before. But I started the rsync at approx. 7pm last night. And as of now the rsync is still building it's file list. [root@sshproxygw ~]# rsync -avzp /mnt/db_space/timd/www1/ /mnt/db_space/timd/www2/svn2/ building file list ... So my question to you is, is this a normal amount of time to wait for the file list to be built? Considering the amount of data involved. I have it running in a screen session I can attach to to find out what's going on. Thanks Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

10 18

Change default font size in terminal
by Yawei Guo 21 Oct '14

21 Oct '14

Hello, I want to change default font size in terminal. The size is too small for a 1920x1080 screen. Thank you very much. Yawei

3 2

Continuous Release (CR) Repository updates are released for CentOS-6.6
by Johnny Hughes 20 Oct '14

20 Oct '14

We have released the following updates into the 6.5/cr repository: http://lists.centos.org/pipermail/centos-cr-announce/2014-October/thread.ht… The updates include everything that will be on the 6.6 ISO Sets and also everything to date that will be in 6.6 Updates. We will continue to put updates into 6.5 CR until we actually release CentOS-6.6. For information on the CR repository, see this link: http://wiki.centos.org/AdditionalResources/Repositories/CR Thanks, Johnny Hughes

1 0

Amazon Marketplace AMI
by Thorsten Höger 20 Oct '14

20 Oct '14

Hi, the updated Amazon Web Service AMI (ami-4ac6653d) has a serious bug. It is not possible to resize a disk after creating a new volume with a size greater than 8GB. resize2fs does nothing. The previous AMI worked perfectly but is no longer available. This bug is a show stopper for using CentOS on AWS. Regards, Thorsten PS: It would also be great to have a CentOS 6 AMI with HVM virtualisation.

3 3

how to identify build options
by kqt4at5v＠gmail.com 20 Oct '14

20 Oct '14

If using the standard CentOS packages is there a way to print the options that were specified when the package was built? For example # rpm -qi at Name : at Relocations: (not relocatable) Version : 3.1.10 Vendor: CentOS Release : 44.el6_5.2 Build Date: Tue 07 Oct 2014 03:35:22 AM CDT Install Date: Fri 17 Oct 2014 02:38:44 PM CDT Build Host: c6b9.bsys.dev.centos.org Group : System Environment/Daemons Source RPM: at-3.1.10-44.el6_5.2.src.rpm Size : 86228 License: GPLv2+ Signature : RSA/SHA1, Tue 07 Oct 2014 07:57:22 AM CDT, Key ID 0946fca2c105b9de Packager : CentOS BuildSystem <http://bugs.centos.org> URL : http://ftp.debian.org/debian/pool/main/a/at Summary : Job spooling tools Description : At and batch read commands from standard input or from a specified file. At allows you to specify that a command will be run at a particular time. Batch will execute commands when the system load levels drop to a particular level. Both commands use user's shell. You should install the at package if you need a utility for time-oriented job control. Note: If it is a recurring job that will need to be repeated at the same time every day/week, etc. you should use crontab instead. What options were used to build this package? Richard

3 2

Re: [CentOS] CPAN dependency on CentOS 7
by Luigi Rosa 20 Oct '14

20 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reindl Harald wrote on 20/10/2014 17:52: > that may be true but you need to report that *upstream* CentOS is a package > for package and bug for bug clone > > https://bugzilla.redhat.com/enter_bug.cgi Been there, done that https://bugzilla.redhat.com/show_bug.cgi?id=1154741 Ciao, luigi - -- / +--[Luigi Rosa]-- \ There is a difference between knowing the path and walking the path. --Morpheus, Matrix -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJURTeFAAoJEO5WT/qgw4yKNLcP/At99DT64R0ilYielXqECIua tP6zZcnr4PygGOSsolHbb6Mkix1kxzC2fAFTDAz1WOFFwQa2kRfWdPaED1FCzfip WyvDNBhax5yECH0fBADigLR7aU6Z/5+AepRNM28n7f12zIHz91rsRwJ+w0zPefRA /rsGImw0KvR0VWUkv2FF5KghTvJAAziYKVT0kiHpSs2X8W03ivJYrEI1Or+odP+D YgsfYUSqfhnRliO8Xs7s8dm+7QFcMwKcDgnjF8xO2R2roQnvRzJaCEqjsYNLvxgG aeQmnfu18GtX5fSL99OeL6Qsy7pPtNWlv1MOAlY//PKyNLZBcjTs3ZdU+JtDAqNd fe7EAgG1mYrdasIiWRR8TlqCiV6bYkNSuG6A7RSLEFktUOAlaLe/MYzTUiDk6MSh 1tKnZinlozAbiO31uilf7quOzJ0Ur5NZ3YC0lyhlTObFAblfpaKBgiw6epXgVxHL GsWs1Ed2Nc9ndUGkoUJmuFWQ/ivEzOANYM8fKaGNPl4b0lh1BuvP/OO675PFxcFH 6BRwSwpgtCw0+lIwJgxSIRYdILKKklWosV4RMXHkak4Pi1c+2fDJ8lYZy1e75Swj rgpNQTW7eJouCXmrzzk0mZbt6nYzq56U+rifBDz8tx2RFrk+yCv6n+OPMs56EpPh T5FFnphYrzY7cjS1PZ1R =4XbR -----END PGP SIGNATURE-----

1 0

CPAN dependency on CentOS 7
by Luigi Rosa 20 Oct '14

20 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Una a CentOS 7 with minimal install if I install perl-CPAN the first time I execute cpan to download a mduel, the automatic configuration of CPAN fails for missing Time/HiRes The package perl-Time-HiRes should be installed as a dependency of perl-CPAN The exact error is: Would you like me to automatically choose some CPAN mirror sites for you? (This means connecting to the Internet) [yes] Trying to fetch a mirror list from the Internet Fetching with HTTP::Tiny: http://www.perl.org/CPAN/MIRRORED.BY Looking for CPAN mirrors near you (please be patient) Can't locate Time/HiRes.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/sha re/perl5 /root) at /usr/share/perl5/Net/Ping.pm line 313. Ciao, luigi - -- / +--[Luigi Rosa]-- \ Naeser's Law: You can make it foolproof, but you can't make it damnfoolproof. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJURS59AAoJEO5WT/qgw4yKFEMP/1nYHUr5SC0IUQ6kiSEsQVBB MO6YWy7DQZ5zgHCgLed2A6IjPqSy1fXq6JWkM4UmnAHEJWVyx+H0x+2onUixTDnv cy+KnRMHD5A+wytPcKgWXGUzxYhYg8lmD18eTeZEPPI2qiQqdOhOOP+9UZv1f3Ku QJRBdoThbUM5SJ338DkIOz9waedqgjBk0uxn8vzxVp8+xHDffvxFYzvt2SmXjrWc RuGeltDBDgPxiTLWZfTFhA2aIyyEilUQ2zHAICZJ71sGAASQF/8+DVE2AINfP43A VW5PGBFKySJ0US1an+RQ0gVoYb2Un8/249odLJUJZ94zdess87QcPmsF0YMdEdaB 6PSJZMOcm3XZzlt3Pld/CA8TSuvhMs5gVnmgCp95mpSKbzrr0v9Gz6ErpGmWUWc9 6hNeC8Bc9myE3+JgiA4oQOFPV+TMSG+OqYuOVPj7IuKes+XnOPxCxlM8g3qH07nD rg100obawcwMUHCqCDdw+uIRO+ai/1F27SNKbrlI+ma66lbTV7CqxDE1jTA9UP3S wK1QE0W9TvptkzsrS5PTVNPOiH/wfWAhvCHpw4w9gQXideu2m9P5SWXuAxv814Ze sEYohjginoO9AdxXnlSiwz1rZqHoODXmLAULnkG6Zx+mW05KHa0r9rZJd7/MkDI9 LvQiKCQTroQOko0sPTgV =zL/I -----END PGP SIGNATURE-----

1 0

CentOS 5.11 / Firefox 31 -- totally borked...
by Robert Heller 20 Oct '14

20 Oct '14

OK, I just updated my two CentOS 5 boxes (my laptop and by desktop) and discoved that FF 31 is totally borked -- it seems not to be possible to install either Firebug (either 2.0.4 or 1.12.8) or Firefox 2, the theme reloaded (1.0.8). These two addons are critical to me. So I have snaged the FF 24.8.0 rpms from the CentOS 5 vault and downgraded to this version and blocked further updates of FF. Where is the best place to report this problem? -- Robert Heller -- 978-544-6933 Deepwoods Software -- Custom Software Services http://www.deepsoft.com/ -- Linux Administration Services heller(a)deepsoft.com -- Webhosting Services

6 10

djbdns under CentOS7: startup and socket issues
by Boris Epstein 20 Oct '14

20 Oct '14

Hello all, I am trying to get djbdns ( http://en.wikipedia.org/wiki/Djbdns ) running on CentOS 7. So far I have wirtten the djbdns.service and djbdns.socket files. The sockets (TCP and UDP 53) for some reason would not start and I don't know how to debug that; the service does start but only when I start it manually by running systemctl start djbdns So, I am a real noob when it comes to systemd, hence any advice on how to proceed will be much appreciated. Cheers, Boris.

4 7

Re: [CentOS] [CentOS-announce] CESA-2014:1652 Important CentOS 6 openssl Security Update
by David Hrbáč 20 Oct '14

20 Oct '14

Hi, This announcement has different body scheme than the rest of announcement messages. Is it a new scheme? It breaks the importing scripts... Thanks, DH Dne 16.10.2014 v 22:48 Johnny Hughes napsal(a): > CentOS Errata and Security Advisory 2014:1652 > > The following updated files have been uploaded and are currently > syncing to the mirrors: ( sha256sum Filename ) > > ----------------------------- > i386 > ----------------------------- > > 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm > dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm > dc42eb136b3cfef78d590d4ab29d36e5e5951bc9433d20d5ca633033d960a00d openssl-perl-1.0.1e-30.el6_5.2.i686.rpm > 95e67f00f7d58348e5f0df6ac74d7baecb9d5fc214d58ad257a14bec353219a3 openssl-static-1.0.1e-30.el6_5.2.i686.rpm > > ----------------------------- > X86_64 > ----------------------------- > > 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm > 17bfdb52afcb2ebaa16875819b9d8d2f3dc84eb061ee3e194da14e286bc76029 openssl-1.0.1e-30.el6_5.2.x86_64.rpm > dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm > 7c390aab888c07887fc783686f42216711665738e58c2b23029748292dd0f96d openssl-devel-1.0.1e-30.el6_5.2.x86_64.rpm > dfdcf88163743d5f4fda06a69cba00b822b73ba66aa5841faf8c0e9841b91bcb openssl-perl-1.0.1e-30.el6_5.2.x86_64.rpm > 0f8cc0615d96d4d7e74b5ffc109143873510406dbb6be679d4ab94bd4f731cdb openssl-static-1.0.1e-30.el6_5.2.x86_64.rpm > > ----------------------------- > Source: > ----------------------------- > > 1a1c3ed0d8eb5775d89b726e7f19ff2d8b52b7ef27f6e36260e83ffc40328460 openssl-1.0.1e-30.el6_5.2.src.rpm > > ===================================================== > > The following upstream security issues are addressed in this update: > > https://rhn.redhat.com/errata/RHSA-2014-1652.html > > ===================================================== > > NOTE: This update is released into the CentOS-6.5 tree and has a .el6_5 dist > tag, *NOT* the .el6_6 dist tag that Red Hat used for RHEL in the link above. > > This update was built against 'CentOS-6.5 + updates' and that is where it is > intended to be used. > > The CentOS team will build and release a openssl-1.0.1e-30.el6_6.2.src.rpm as > a zero day update to CentOS-6.6 when that is released as we are currently > building CentOS-6.6 from the released Red Hat Enterprise Linux sources. > > Please also note that even after installing this update, further action is > required to mitigate the POODLE issue on CentOS-6. Please see this link for > steps to take and ways to test for both the POODLE and TLS_FALLBACK_SCSV issues. > > http://wiki.centos.org/Security/POODLE > > -- > Johnny Hughes > CentOS Project { http://www.centos.org/ } > irc: hughesjr, #centos at irc.freenode.net > > _______________________________________________ > CentOS-announce mailing list > CentOS-announce(a)centos.org > http://lists.centos.org/mailman/listinfo/centos-announce

2 2

Your experience with os hardening tool - Bastille?
by Rafał Radecki 19 Oct '14

19 Oct '14

Hi All:) I would like to start using a tool for automating of os hardening. I found some informations about Bastille. One things which attracted my attention is that in http://bastille-linux.sourceforge.net/news_updates.htm the last post is from January 29th, 2012 :D Is the tool ready to use at the moment with CentOS 6/7? Are there any alternatives which you can recommend? Thanks for all info :) BR, Rafal.

3 3

CentOS-6 updates
by Johnny Hughes 19 Oct '14

19 Oct '14

We are currently building and testing our CentOS-6.6 release. It normally takes about 2-4 weeks for us to get a full point release out. We can not release updates that are based on 6.6 until we get 6.6 out. All current updates will be released on the same day as the release. We have a CR repo ( http://wiki.centos.org/AdditionalResources/Repositories/CR ) and we are likely going to release the CR repo around 7-10 days after the release of RHEL-6.6. All updates will also be released into there when it is released. Please remember, there are around 350 Source RPMs that need to be built and tested for 6.6 and it normally takes 7-10 days for CR and 14-28 days for the full release. We are going as fast as we can, but point releases take time. Thanks, Johnny Hughes

5 5

KVM does not start anymore
by Bernd Bartmann 19 Oct '14

19 Oct '14

Hi, I had a C7 virtual machine running on a C7 host for several weeks without any problems. Today I rebootet the host and now the virtual machine does not start anymore. I can see grub coming up and starting the kernel. After some seconds the last thing that is visble on the VM console is "ss perfctr msr (MSR c1 is0)" then the screen goes blank with just a blinking cursor in the upper left corner. After that nothing happens anymore. The CPU load on the host is nearly 0%. Any ideas what could be the reason and how to solve this? Best regards, Bernd

1 1

Centos 7 tmpwatch
by Frank Cox 18 Oct '14

18 Oct '14

I have noticed that tmpwatch isn't automatically installed with Centos 7, or at least it wasn't when I set up this computer. I further noticed that the Centos 7 tmpwatch rpm no longer includes /etc/cron.daily/tmpwatch I suspect that at least part of the reason for this is because the /tmp directory is now mounted as a tmpfs by default, so it's automatically cleared when the machine is rebooted. However, this does nothing to maintain /var/tmp and /var/cache Installing the Centos 7 tmpwatch rpm and copying the /etc/cron.daily/tmpwatch file from a Centos 6 installation onto a Centos 7 machine might not be particularly wise because the excluded directories listed in the Centos 6 tmpwatch script don't include such things as the systemd-private* directories that should probably not be made to disappear on a Centos 7 installation. This leads to two questions: Is tmpwatch even required on Centos 7 anymore, or has it been superseded somehow? And if it is required (or a good idea), is there an updated script to put into /etc/cron.daily that accounts for directories and files that should not be molested by tmpwatch? -- MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com

2 2

Re: [CentOS] curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Reindl Thank you for your post. I am sorry for the second post, my transition to evolution is ... I like to have a better understanding of this problem before I open a bug report. Looking at the report openssl 1.01h has the cipher which support www.kraxel.org certificate specifically the OpenSSL 1.0.1h TLS 1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) FS It appears my cipher, openssl 1.01e, accepts the certificate used by kraxel, the output of sslscan: Accepted TLS12 256 ECDHE-RSA-AES256-GCM-SHA384 So why does this not work? Why would this be a bug if I just need to upgrade openssl to 1.01h from 1.01e? Thank for your assistance, Aaron On Sat, 2014-10-18 at 18:25 +0200, Reindl Harald wrote: > Am 18.10.2014 um 18:15 schrieb Aaron Siegel: > > I am stumped. I am trying to us the kraxel qemu repository, it appears > > the repository moved to secure server since then I have not been able to > > configure this properly. https://www.kraxel.org/repos/jenkins/ > > I receive the following error when I try to use the repository > > curl: (35) Cannot communicate securely with peer: no common encryption > > algorithm(s) > > "no common encryption algorithm" should be pretty clear: > > a) the server only offers weak ciphers you no longer support > b) the server only offers modern ciphers you don't support > > in fact b) is the case here and so you should open a bugreport against > NSS/Curl and not dig around in manually compile things and ruin your setup > > https://www.ssllabs.com/ssltest/analyze.html?d=kraxel.org > that server only accepts TLS1.2 > > [harry@srv-rhsoft:~]$ sslscan www.kraxel.org:443 | grep Accept > Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384 > Accepted TLS12 256 bits DHE-RSA-AES256-SHA256 > Accepted TLS12 256 bits AES256-GCM-SHA384 > Accepted TLS12 256 bits AES256-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256 > Accepted TLS12 128 bits DHE-RSA-AES128-SHA256 > Accepted TLS12 128 bits AES128-GCM-SHA256 > Accepted TLS12 128 bits AES128-SHA256 > > >

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Hello I am stumped. I am trying to us the kraxel qemu repository, it appears the repository moved to secure server since then I have not been able to configure this properly. https://www.kraxel.org/repos/jenkins/ I receive the following error when I try to use the repository curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s). I have discovered this problem on my fedora 20 computer, the fedora mailing list will not accept my email, I am experiencing this problem with curl on both my Centos and fedora systems. I receive the same error with centos 7 minimal installation and fedora 20. What am I doing wrong, I have recently switch to the Fedora platform, I have not read all the manuals but trying. I have imported the gpg keys that Kraxel has posted on his blog using rpm --import. I can only download file through my web browser. I was going to clone his git repository and set up a local repository, bit git report the same error. Which leads me to believe the problem is with my certificates. I have even tried the firefox-db2pem.sh, I am not sure it did anything. Does curl need to be recompiled with nss support? Is there a package I need to compile? nss 3.17.2 is installed, non of the man page work. Looking deeper into the nss, # certutil -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. I think there is something wrong with my nss certificates, but I have run out of time. Any suggestions. This is on a brand new installation Fedora 20 and Centos 7, I have not had time to break anything. The openssl command connect with the server, is $ openssl s_client -connect www.kraxel.org:443 The curl output is posted below in fedora system the output for the centos is the same with the exception of the curl and nss versions: $ curl -v https://www.kraxel.org/repos/jenkins/repodata/repomd.xml * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x6bea60) send_pipe: 1, recv_pipe: 0 * About to connect() to www.kraxel.org port 443 (#0) * Trying 217.197.83.6... * Connected to www.kraxel.org (217.197.83.6) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Error in TLS handshake, trying SSLv3... > GET /repos/jenkins/repodata/repomd.xml HTTP/1.1 > User-Agent: curl/7.32.0 > Host: www.kraxel.org > Accept: */* > * Connection died, retrying a fresh connect * Closing connection 0 * Issue another request to this URL: 'https://www.kraxel.org/repos/jenkins/repodata/repomd.xml' * About to connect() to www.kraxel.org port 443 (#1) * Trying 217.197.83.6... * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 1 (0x6bea60) send_pipe: 1, recv_pipe: 0 * Connected to www.kraxel.org (217.197.83.6) port 443 (#1) * TLS disabled due to previous handshake failure * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Closing connection 1 curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

1 0

curl: (35) Cannot communicate securely with peer:
by Aaron Siegel 18 Oct '14

18 Oct '14

Hello I am stumped. I am trying to us the kraxel qemu repository, it appears the repository moved to secure server since then I have not been able to configure this properly. https://www.kraxel.org/repos/jenkins/ I receive the following error when I try to use the repository curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s). I have discovered this problem on my fedora 20 computer, the fedora mailing list will not accept my email, I am experiencing this problem with curl on both my Centos and fedora systems. I receive the same error with centos 7 minimal installation and fedora 20. What am I doing wrong, I have recently switch to the Fedora platform, I have not read all the manuals but trying. I have imported the gpg keys that Kraxel has posted on his blog using rpm --import. I can only download file through my web browser. I was going to clone his git repository and set up a local repository, bit git report the same error. Which leads me to believe the problem is with my certificates. I have even tried the firefox-db2pem.sh, I am not sure it did anything. Does curl need to be recompiled with nss support? Is there a package I need to compile? nss 3.17.2 is installed, non of the man page work. Looking deeper into the nss, # certutil -L certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format. I think there is something wrong with my nss certificates, but I have run out of time. Any suggestions. This is on a brand new installation Fedora 20 and Centos 7, I have not had time to break anything. The openssl command connect with the server, is $ openssl s_client -connect www.kraxel.org:443 The curl output is posted below in fedora system the output for the centos is the same with the exception of the curl and nss versions: $ curl -v https://www.kraxel.org/repos/jenkins/repodata/repomd.xml * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x6bea60) send_pipe: 1, recv_pipe: 0 * About to connect() to www.kraxel.org port 443 (#0) * Trying 217.197.83.6... * Connected to www.kraxel.org (217.197.83.6) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Error in TLS handshake, trying SSLv3... > GET /repos/jenkins/repodata/repomd.xml HTTP/1.1 > User-Agent: curl/7.32.0 > Host: www.kraxel.org > Accept: */* > * Connection died, retrying a fresh connect * Closing connection 0 * Issue another request to this URL: 'https://www.kraxel.org/repos/jenkins/repodata/repomd.xml' * About to connect() to www.kraxel.org port 443 (#1) * Trying 217.197.83.6... * Adding handle: conn: 0x6bea60 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 1 (0x6bea60) send_pipe: 1, recv_pipe: 0 * Connected to www.kraxel.org (217.197.83.6) port 443 (#1) * TLS disabled due to previous handshake failure * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP) * Cannot communicate securely with peer: no common encryption algorithm(s). * Closing connection 1 curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

1 0

POODLE and TLSv1
by James B. Byrne 17 Oct '14

17 Oct '14

I read this on the RHN commentary respecting cve-2014-3566: https://securityblog.redhat.com/2014/10/15/poodle-a-ssl3-vulnerability-cve-…: . . . The first aspect of POODLE, the SSL 3.0 protocol vulnerability, has already been fixed through iterative protocol improvements, leading to the current TLS version, 1.2. It is simply not possible to address this in the context of the SSL 3.0 protocol, a protocol upgrade to one of the successors is needed. Note that TLS versions before 1.1 had similar padding-related vulnerabilities, which is why we recommend to switch to TLS 1.1, at least. (SSL and TLS are still quite similar as protocols, the name change has non-technical reasons.) . . . If run nmap to view the ciphers on a host running apache-2.2.15 I see this: # nmap --script ssl-enum-ciphers -p 443 inet09 Starting Nmap 6.01 ( http://nmap.org ) at 2014-10-17 12:48 EDT Nmap scan report for for x.y.z.a Host is up (0.00034s latency). rDNS record for x.y.z.a PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.0 | Ciphers (5) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL | TLSv1.1 | Ciphers (5) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL | TLSv1.2 | Ciphers (9) | TLS_RSA_WITH_AES_128_CBC_SHA - strong | TLS_RSA_WITH_AES_128_CBC_SHA256 - strong | TLS_RSA_WITH_AES_128_GCM_SHA256 - strong | TLS_RSA_WITH_AES_256_CBC_SHA - unknown strength | TLS_RSA_WITH_AES_256_CBC_SHA256 - unknown strength | TLS_RSA_WITH_AES_256_GCM_SHA384 - unknown strength | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - unknown strength | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA - unknown strength | TLS_RSA_WITH_RC4_128_SHA - strong | Compressors (1) | NULL |_ Least strength = unknown strength . . . If read the advisory aright then TLSv1.0 suffers from exactly the same flaw as SSLv3. So, how do I configure apache-2.2.15 to deny TLSv1.0 and keep service TLSv1.1+? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

What happens to in-use files when I restart samba?
by Patrick Bervoets 17 Oct '14

17 Oct '14

One of the services that has to be restarted after the openssl update is samba. And now I wonder if I can safely restart samba when there are possible files in-use (ie writes could be happening). I can't find an answer on Google (could be me asking the wrong questions) Thanks for any pointers Patrick

2 1

CentOS-announce Digest, Vol 116, Issue 10
by centos-announce-request＠centos.org 17 Oct '14

17 Oct '14

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2014:1653 Moderate CentOS 5 openssl Security Update (Johnny Hughes) 2. CEEA-2014:1649 CentOS 7 kpatch Enhancement Update (Johnny Hughes) 3. CESA-2014:1652 Important CentOS 7 openssl Security Update (Johnny Hughes) 4. CESA-2014:1653 Moderate CentOS 5 openssl Security Update (Johnny Hughes) 5. CESA-2014:1652 Important CentOS 6 openssl Security Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Oct 2014 15:21:39 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1653 Moderate CentOS 5 openssl Security Update Message-ID: <20141016152139.GA19436(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1653 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1653.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0c3787137a7d1a0402612833b173693910eb27f79e0c4f8cedf6185b4f7141f9 openssl-0.9.8e-31.el5_11.i386.rpm 5ef64e16dd1349a254a96e91cfdfdd6215fb9daa846360d2efff515bbb6a56b8 openssl-devel-0.9.8e-31.el5_11.i386.rpm b98e5df6d59eddee85d544ca35bf0b7ca469a4c7032138465189c4c7bc27e5e6 openssl-perl-0.9.8e-31.el5_11.i386.rpm x86_64: 85ee93123052e86fd4204694e3ac52fad6797b3f7009d8bce8e1f908bfed5352 openssl-0.9.8e-31.el5_11.x86_64.rpm 5ef64e16dd1349a254a96e91cfdfdd6215fb9daa846360d2efff515bbb6a56b8 openssl-devel-0.9.8e-31.el5_11.i386.rpm 11362d4d6755f5e33609a8adf6fbd0002f1343e72cd5e06ddbf2c8e99cf0d514 openssl-devel-0.9.8e-31.el5_11.x86_64.rpm 4aa6b35c036489a83a193ceb26fea4d1b5da93e7fddc08245fe59ffde0d7f509 openssl-perl-0.9.8e-31.el5_11.x86_64.rpm Source: 1741388be54beb7176f7b5d90a3ddd1be99e1fcd5296725f4999c446a30c35c5 openssl-0.9.8e-31.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Thu, 16 Oct 2014 16:22:22 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CEEA-2014:1649 CentOS 7 kpatch Enhancement Update Message-ID: <20141016162222.GA58256(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Enhancement Advisory 2014:1649 Upstream details at : https://rhn.redhat.com/errata/RHEA-2014-1649.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 51d8cfeb1a49efd3d778fcbf00537076b2d68f6ebcd0098fa174cd885c29dc6a kpatch-0.1.10-3.el7_0.noarch.rpm Source: 4d7cb8146fc0433167cd8e18f439d3b3cf7748649ce21b509b501fd46cc45c58 kpatch-0.1.10-3.el7_0.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Thu, 16 Oct 2014 16:22:42 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1652 Important CentOS 7 openssl Security Update Message-ID: <20141016162242.GA58353(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1652 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1652.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 982ba4376041d2d99d4b84dc05fbeac6b925777aa34d631aceeedb598bb98413 openssl-1.0.1e-34.el7_0.6.x86_64.rpm 426ba8dc7ac74f8b71f7965ec2e6e6b398ab466dc892394e8d1d5bd80ca4a4e6 openssl-devel-1.0.1e-34.el7_0.6.i686.rpm 7fdf24148ed86f0abb2618d92741d5c8f0769de6136b4ed9df2a60b8c795abe3 openssl-devel-1.0.1e-34.el7_0.6.x86_64.rpm ebc0fc79108a67efd64da36669c90865b4a75a38b4c07a5316078edd98b65da9 openssl-libs-1.0.1e-34.el7_0.6.i686.rpm 5d0607c487922602ae315f62d9d3c0eb8ca76a65c288e6c8fc61f688dad59593 openssl-libs-1.0.1e-34.el7_0.6.x86_64.rpm 4b092081206a1140a5d2901c2f5513c8155ec2b57a05cafdd6c9011ccdde78f5 openssl-perl-1.0.1e-34.el7_0.6.x86_64.rpm d664f61543bb84773467300c726d870700584f5af616df7a9f29922822773dd8 openssl-static-1.0.1e-34.el7_0.6.i686.rpm c57075f8c198ec81db1936eb2dea8ff210de317f76047ffa601eefd8230d3bae openssl-static-1.0.1e-34.el7_0.6.x86_64.rpm Source: 6638e94c18b6961748e7986823b7115d852b25883ccff03ec89a16234cbca517 openssl-1.0.1e-34.el7_0.6.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Thu, 16 Oct 2014 17:53:19 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1653 Moderate CentOS 5 openssl Security Update Message-ID: <20141016175319.GA26372(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1653 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2014-1653.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 0f38fea6d167a87276c20f5a4d56c2f41faf7fc08d9c76e28329ecadbe0de51f openssl-0.9.8e-31.el5_11.i386.rpm c9660117d38961e5388d2fd72b0a68816b2047dc828a7438b0f6a4c74da4f27b openssl-0.9.8e-31.el5_11.i686.rpm 6244227177fb88cf9db43d1ffe086014c5786f8764c1d161d7ff5c0e4b4bcb78 openssl-devel-0.9.8e-31.el5_11.i386.rpm 33e546cd8897b47e2ddf836f07ad103a2ebb2f4282cd32c7b730d39ab462b67b openssl-perl-0.9.8e-31.el5_11.i386.rpm x86_64: c9660117d38961e5388d2fd72b0a68816b2047dc828a7438b0f6a4c74da4f27b openssl-0.9.8e-31.el5_11.i686.rpm 802ed9a049e7ae8c417c2bb108348cc9bd132698e805aa68795862276a320493 openssl-0.9.8e-31.el5_11.x86_64.rpm 6244227177fb88cf9db43d1ffe086014c5786f8764c1d161d7ff5c0e4b4bcb78 openssl-devel-0.9.8e-31.el5_11.i386.rpm 70cc0ab04b906816a2b8db05603c96fb709cb45473b116c73da1e5569295672b openssl-devel-0.9.8e-31.el5_11.x86_64.rpm cd7303f6689aac1013530cc766a70b6fdae56dc3b87960ecdec567ed68bfb168 openssl-perl-0.9.8e-31.el5_11.x86_64.rpm Source: 2d15a9cccc5453a329e53986061386de39e6e512af147b84354c3473b39a957b openssl-0.9.8e-31.el5_11.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Thu, 16 Oct 2014 20:48:09 +0000 From: Johnny Hughes <johnny(a)centos.org> To: centos-announce(a)centos.org Subject: [CentOS-announce] CESA-2014:1652 Important CentOS 6 openssl Security Update Message-ID: <20141016204809.GA19739(a)n04.lon1.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2014:1652 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) ----------------------------- i386 ----------------------------- 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm dc42eb136b3cfef78d590d4ab29d36e5e5951bc9433d20d5ca633033d960a00d openssl-perl-1.0.1e-30.el6_5.2.i686.rpm 95e67f00f7d58348e5f0df6ac74d7baecb9d5fc214d58ad257a14bec353219a3 openssl-static-1.0.1e-30.el6_5.2.i686.rpm ----------------------------- X86_64 ----------------------------- 5898ac3179dfdd904c352badd79b6f5ec702315f4bc7b8989de8f114304fbd78 openssl-1.0.1e-30.el6_5.2.i686.rpm 17bfdb52afcb2ebaa16875819b9d8d2f3dc84eb061ee3e194da14e286bc76029 openssl-1.0.1e-30.el6_5.2.x86_64.rpm dcc5d47340d69f53af592a92282df89ef3bd4705ce34f4a57a93d211e93cfd7d openssl-devel-1.0.1e-30.el6_5.2.i686.rpm 7c390aab888c07887fc783686f42216711665738e58c2b23029748292dd0f96d openssl-devel-1.0.1e-30.el6_5.2.x86_64.rpm dfdcf88163743d5f4fda06a69cba00b822b73ba66aa5841faf8c0e9841b91bcb openssl-perl-1.0.1e-30.el6_5.2.x86_64.rpm 0f8cc0615d96d4d7e74b5ffc109143873510406dbb6be679d4ab94bd4f731cdb openssl-static-1.0.1e-30.el6_5.2.x86_64.rpm ----------------------------- Source: ----------------------------- 1a1c3ed0d8eb5775d89b726e7f19ff2d8b52b7ef27f6e36260e83ffc40328460 openssl-1.0.1e-30.el6_5.2.src.rpm ===================================================== The following upstream security issues are addressed in this update: https://rhn.redhat.com/errata/RHSA-2014-1652.html ===================================================== NOTE: This update is released into the CentOS-6.5 tree and has a .el6_5 dist tag, *NOT* the .el6_6 dist tag that Red Hat used for RHEL in the link above. This update was built against 'CentOS-6.5 + updates' and that is where it is intended to be used. The CentOS team will build and release a openssl-1.0.1e-30.el6_6.2.src.rpm as a zero day update to CentOS-6.6 when that is released as we are currently building CentOS-6.6 from the released Red Hat Enterprise Linux sources. Please also note that even after installing this update, further action is required to mitigate the POODLE issue on CentOS-6. Please see this link for steps to take and ways to test for both the POODLE and TLS_FALLBACK_SCSV issues. http://wiki.centos.org/Security/POODLE -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos at irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 116, Issue 10 ************************************************

1 0

POODLE on CentOS
by Johnny Hughes 17 Oct '14

17 Oct '14

The following updates address POODLE on CentOS: CentOS-5: http://lists.centos.org/pipermail/centos-announce/2014-October/020696.html CentOS-6.5: http://lists.centos.org/pipermail/centos-announce/2014-October/020697.html CentOS-7: http://lists.centos.org/pipermail/centos-announce/2014-October/020695.html Please note that the CentOS-6.5 updates are built from: openssl-1.0.1e-30.el6_5.2.src.rpm This is the version that Red Hat released for RHEL 6.6 as openssl-1.0.1e-30.el6_6.2.src.rpm. Notice that the dist tag is different for our release. The reason is that we are currently working on CentOS-6.6 and it will not be released for several more days. Rather than wait on the POODLE issue, the CentOS team decided to build a version of this update for 6.5: (the current release, built from openssl-1.0.1e-30.el6_5.2.src.rpm) as well a version based on openssl-1.0.1e-30.el6_6.2.src.rpm as a zeroday update for CentOS-6.6 when it is released. You must also take action to disable SSLv3 as well as installing these update to mitigate POODLE on CentOS-5, CentOS-6 and/or CentOS-7, please see this link for details: http://wiki.centos.org/Security/POODLE Thanks, Johnny Hughes

2 1

needs-restarting: one server reports nothing te restart (after updating openssl) C6.5
by Patrick Bervoets 17 Oct '14

17 Oct '14

Hi, After updating openssl on most of my C6.5-servers needs-restarting reports at least sshd, ntpd and sendmail. But on 1 server needs-restarting reports nothing. And yes, sshd, ntpd and sendmail are running. All yum-utils are latest yum-utils-1.1.30-17.el6_5.noarch. openssh-clients-5.3p1-94.el6.x86_64 ntp-4.2.6p5-1.el6.centos.x86_64 sendmail-8.14.4-8.el6.x86_64 At least ssh and ntp are straight out of distro and all my sendmails have the same configuration. How reliable is needs-restarting? Or how can this be explained? Thanks Patrick

1 0

POODLE on CentOS
by James B. Byrne 17 Oct '14

17 Oct '14

According to the centos wiki: Validating Changes You can use Qualys SSL Labs to verify that your web server is no longer vulnerable to POODLE or TLS_FALLBACK_SCSV once all action is complete. You might also want to only use TLSv1.2 for httpd on CentOS-6.5 (or higher) and CentOS-7, while using TLSv1 on CentOS-5. However, on my up-to-datestock CentOS-6.5 the httpd version is 2.2.15 and attems to use SSLProtocols greater than v1 yield this error: Syntax error on line 101 of /etc/httpd/conf.d/ssl.conf: SSLProtocol: Illegal protocol 'TLSv1.1' I presume that the wiki is in error but I would like confirmation of that or instructions on how to enable TLSv1.1 and 1.2 on CentOS-6.5. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

3 2

Filesystem writes unexpectedly slow (CentOS 6.4)
by Joakim Ziegler 16 Oct '14

16 Oct '14

I have a rather large box (2x8-core Xeon, 96GB RAM) where I have a couple of disk arrays connected on an Areca controller. I just added a new external array, 8 3TB drives in RAID5, and the testing I'm doing right now is on this array, but this seems to be a problem on this machine in general, on all file systems (even, possibly, NFS, but I'm not sure about that one yet). So, if I use iozone -a to test write speeds on the raw device, I get results in the 500-800MB/sec range, depending on write sizes, which is about what I'd expect. However, when I have an ext4 filesystem on this device, mounted with noatime and data=writeback, (the filesystem is completely empty) and I test with dd, the results are less encouraging: dd bs=1M if=/dev/zero of=/Volumes/data_10-2/test.bin count=40000 40000+0 records in 40000+0 records out 41943040000 bytes (42 GB) copied, 292.288 s, 143 MB/s Now, I'm not expecting to get the raw device speeds, but this seems at least to be 2-3 times slower than what I'd expect. Using conv=fsync oflag=direct makes it utterly pathetic: dd bs=1M if=/dev/zero of=/Volumes/data_10-2/test.bin oflag=direct conv=fsync count=5000 5000+0 records in 5000+0 records out 5242880000 bytes (5.2 GB) copied, 178.791 s, 29.3 MB/s Now, I'm sure there can be many reasons for this, but I wonder where I should start looking to debug this. -- Joakim Ziegler - Supervisor de postproducción - Terminal joakim(a)terminalmx.com - 044 55 2971 8514 - 5264 0864

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss