- Discuss - lists.centos.org

Audit logs source of account triggering it.
by Gregory Machin 10 Apr '13

10 Apr '13

Hi. The auditd logs are full of lines referencing 28756E6B6E6F776E207573657229 , but I can't identify this account type=USER_LOGIN msg=audit(1364926580.306:249814): user pid=22565 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=127.0.0.1 terminal=ssh res=failed' What would typically cause this ? There are no other references in any of the other logs to 28756E6B6E6F776E207573657229 and its to long for our typical UID / GID . Thanks G

2 1

How to determine 64 vs 32 bit processor
by Robert Moskowitz 10 Apr '13

10 Apr '13

I have been tied up with other work and Holidays. Now back to some server work that is long overdue. I lost an old server yesterday so it is crunch time. I believe my new platform is suppose to be an x86_64. The order form says 64 bit. I booted Centos 6.3 i386 liveCD to check the system out before an install. uname -i reports i386 dmidecode -t processor reports Characteristics of 64 bit capable. The processor is an AMD duo-core Opteron. I thought that in a prior thread I found that booting with an i386 live CD and using uname would confirm the processor type. It seems not. I am going to go with the various evidence and start a x86_64 install, but what is with uname? thanks

5 5

How to patch a CentOS6 kernel
by Michael Mol 10 Apr '13

10 Apr '13

So I have a couple patches supplied to me by upstream in relation to a kernel bug[1], but I can't figure out how to patch the kernel. The CentOS wiki page discusses retrieving the kernel source[2], but doesn't describe how to apply patches. Instructions I've found apply to CentOS5, and RH has changed their kernel packaging since then. I've been banging my head on this off and on for quite a while, now. I've mucked with Gentoo and Debian packaging, but kernel RPMs are a new one for me... [1] http://bugs.centos.org/view.php?id=6343 [2] http://wiki.centos.org/HowTos/I_need_the_Kernel_Source

3 6

Re: [CentOS] How to determine 64 vs 32 bit processor
by Robert Moskowitz 10 Apr '13

10 Apr '13

On 04/10/2013 10:04 AM, Reindl Harald wrote: > > Am 10.04.2013 15:58, schrieb Robert Moskowitz: >> I believe my new platform is suppose to be an x86_64. The order form >> says 64 bit. >> >> I booted Centos 6.3 i386 liveCD to check the system out before an install. >> >> uname -i >> >> reports i386 > no wonder, you boot a i386 kernel OK. I can 'llive' with this. Just somewhere in some forgotten past I picked up that uname would still recognize that it was on a 64bit system even with the i386 kernel. > simply boot a x86_64 liveCD > hence i have not seen x86 systems since years > > Simply type "grep flags /proc/cpuinfo" and if you see lm > you have a 64 bit CPU based system thanks > > [root@rh:~]$ grep flags /proc/cpuinfo | grep lm > flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr > sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc > aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 > x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm ida arat epb xsaveopt pln pts dtherm tpr_shadow vnmi > flexpriority ept vpid >

1 0

Re: [CentOS] floppy drives
by James B. Byrne 10 Apr '13

10 Apr '13

On Tue, April 9, 2013 13:46, m.roth(a)5-cent.us wrote: > Fred Smith wrote: >> On Tue, Apr 09, 2013 at 12:21:10PM -0400, m.roth(a)5-cent.us wrote: >>> Frank Cox wrote: >>> > On Tue, 9 Apr 2013 10:19:33 -0400 >>> > m.roth(a)5-cent.us wrote: >>> > >>> >> Hmmm... didn't see it mounted, but I'll try more tonight. Last >>> night >>> >> included a) playing with system, and b) finishing up our federal >>> >> taxes.... > <snip> >>> I also can't seem to find the USB 3.5" drive I borrowed - lsusb >>> sees it >>> (at least since the last reboot), but trying to find it to mount it >>> is >>> something I'm still digging at, and I doubt mtools can find it. >> >> As far as I remember (I'm not as young as I used to be, and it's >> been a >> while), the 3.5" USB floppy drive here would recognize a (formatted) >> floppy when inserted and mount it automatically, on Centos 5.x. >> (assuming it contained a recognizable filesystem...) > > Even if there's nothing about floppies in /etc/fstab? Or is that > something I need to configure for autofs? >> Just to obtain some empirical data I have connected a usb 3.5 FDD unit to my CentOS-6.4 workstation and inserted a previously unused 3.5 HDFD. The Nautilus system automatically opened a window on my desktop and I was able to copy and removed files from the diskette without any difficulty. A peek into /media shows this: # tree /media /media └── disk 1 directory, 0 files While /etc/fstab shows me nothing that obviously relates to the fdd: # cat /etc/fstab # # /etc/fstab # Created by anaconda on Mon Sep 24 12:57:28 2012 # # Accessible filesystems, by reference, are maintained under '/dev/disk' # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info # /dev/mapper/vg_vhost04-lv_root / ext4 defaults 1 1 UUID=a9a7cc59-bd0c-4362-9ab6-f721e25df2f8 /boot ext4 defaults 1 2 /dev/mapper/vg_vhost04-lv_home /home ext4 defaults 1 2 /dev/mapper/vg_vhost04-lv_tmp /tmp ext4 defaults 1 2 /dev/mapper/vg_vhost04-lv_log /var/log ext4 defaults 1 2 /dev/mapper/vg_vhost04-lv_spool /var/spool ext4 defaults 1 2 /dev/mapper/vg_vhost04-lv_swap swap swap defaults 0 0 tmpfs /dev/shm tmpfs defaults 0 0 devpts /dev/pts devpts gid=5,mode=620 0 0 sysfs /sys sysfs defaults 0 0 proc /proc proc defaults 0 0 /dev/vg_vhost04/lv_centos_repos /var/data/centos ext4 defaults 00 /dev/vg_vhost04/lv_home_byrnejb /home/byrnejb ext4 defaults 0 0 Mount on the other hand shows this: /dev/sdb on /media/disk type vfat (rw,nosuid,nodev,uhelper=udisks,uid=500,gid=500,shortname=mixed,dmask=0077,utf8=1,flush) And udisks show this: howing information for /org/freedesktop/UDisks/devices/sdb native-path: /sys/devices/pci0000:00/0000:00:1a.0/usb3/3-1/3-1:1.0/host10/target10:0:0/10:0:0:0/block/sdb device: 8:16 device-file: /dev/sdb presentation: /dev/sdb by-id: /dev/disk/by-id/usb-Y-E_DATA_USB_Floppy_Drive by-path: /dev/disk/by-path/pci-0000:00:1a.0-usb-0:1:1.0-scsi-0:0:0:0 detected at: Wed 10 Apr 2013 09:08:55 EDT system internal: 0 removable: 1 has media: 1 (detected at Wed 10 Apr 2013 09:09:07 EDT) detects change: 1 detection by polling: 1 detection inhibitable: 1 detection inhibited: 0 is read only: 0 is mounted: 1 mount paths: /media/disk mounted by uid: 500 presentation hide: 0 presentation nopolicy: 0 presentation name: presentation icon: size: 1474560 block size: 512 job underway: no usage: filesystem type: vfat version: FAT12 uuid: label: drive: vendor: Y-E DATA model: USB Floppy Drive revision: 0601 serial: WWN: detachable: 1 can spindown: 0 rotational media: Yes, unknown rate write-cache: unknown ejectable: 0 adapter: Unknown ports: similar devices: media: floppy compat: floppy interface: usb if speed: 12000000 bits/s ATA SMART: not available -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Re: [CentOS] fail2ban problem
by Banyan He 10 Apr '13

10 Apr '13

This doesn't look enough for tracking. How about strace? Did you find anything interesting? ------------ Banyan He Blog: http://www.rootong.com Email: banyan(a)rootong.com On 4/10/2013 6:52 PM, Nikos Gatsis - Qbit wrote: > debug: > > fail2ban.server : INFO Changed logging target to > /var/log/fail2ban.log for Fail2ban v0.8.7 > fail2ban.comm : DEBUG Command: ['add', 'sasl-iptables', 'polling'] > fail2ban.jail : INFO Creating new jail 'sasl-iptables' > fail2ban.comm : WARNING Invalid command: ['add', 'sasl-iptables', > 'polling'] > > fail2ba-server starts, but dont add rures in iptables. > > Thank you > > > On 10/4/2013 1:31 μμ, Banyan He wrote: >> Try strace to follow all fork/exec to see which command is invalid. >> Or, debug log? >> >> ------------ >> Banyan He >> Blog: http://www.rootong.com >> Email: banyan(a)rootong.com >> >> On 4/10/2013 6:06 PM, Nikos Gatsis - Qbit wrote: >>> Hello list >>> I'm trying to setup fail2ban specially sasl action but I'm facing >>> problems. >>> I have centos-release-5-9.el5.centos.1 >>> and >>> fail2ban-0.8.7.1-1.el5.rf >>> installed >>> with selinux disabled >>> >>> The errors I get are: >>> INFO Creating new jail 'sasl-iptables' >>> fail2ban.comm : WARNING Invalid command: ['add', 'sasl-iptables', >>> 'polling'] >>> >>> I tried gemin against polling but I get the same error. >>> The strange thing is that if I enable ssh action, starts with no >>> problem. >>> So it appears to be problem with sasl action, witch is: >>> >>> [sasl-iptables] >>> >>> enabled = true >>> filter = sasl >>> backend = polling >>> action = iptables-multiport[name=sasl, >>> port="imap,imaps,pop3,pop3s,smtp", protocol=tcp] >>> sendmail-whois[name=sasl, dest=my@email] >>> logpath = /var/log/maillog >>> >>> The same setup I have in several mailserver (fedora and centos 6 >>> distro) >>> and all work fine. >>> >>> Does someone faced the same problem? >>> >>> Thak you in advance. >>> >> >> > > -- > Untitled Document > ------------------------------------------------------------------------ > *Γατσής Νίκος - Gatsis Nikos* > Web developer > tel.: 2108256721 - 2108256722 > fax: 2108256712 > email: ngatsis(a)qbit.gr > http://www.qbit.gr

2 4

fail2ban problem
by Nikos Gatsis - Qbit 10 Apr '13

10 Apr '13

Hello list I'm trying to setup fail2ban specially sasl action but I'm facing problems. I have centos-release-5-9.el5.centos.1 and fail2ban-0.8.7.1-1.el5.rf installed with selinux disabled The errors I get are: INFO Creating new jail 'sasl-iptables' fail2ban.comm : WARNING Invalid command: ['add', 'sasl-iptables', 'polling'] I tried gemin against polling but I get the same error. The strange thing is that if I enable ssh action, starts with no problem. So it appears to be problem with sasl action, witch is: [sasl-iptables] enabled = true filter = sasl backend = polling action = iptables-multiport[name=sasl, port="imap,imaps,pop3,pop3s,smtp", protocol=tcp] sendmail-whois[name=sasl, dest=my@email] logpath = /var/log/maillog The same setup I have in several mailserver (fedora and centos 6 distro) and all work fine. Does someone faced the same problem? Thak you in advance. -- Untitled Document ------------------------------------------------------------------------ *Γατσής Νίκος - Gatsis Nikos* Web developer tel.: 2108256721 - 2108256722 fax: 2108256712 email: ngatsis(a)qbit.gr http://www.qbit.gr

3 2

CentOS-announce Digest, Vol 98, Issue 4
by centos-announce-request＠centos.org 10 Apr '13

10 Apr '13

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2013:0725 CentOS 6 libvirt Update (Johnny Hughes) 2. CESA-2013:0727 Important CentOS 5 kvm Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 9 Apr 2013 15:19:51 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2013:0725 CentOS 6 libvirt Update To: centos-announce(a)centos.org Message-ID: <20130409151951.GA4858(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2013:0725 Upstream details at : https://rhn.redhat.com/errata/RHBA-2013-0725.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 18f6ec9e590d5048dd376c43b5285964c086859cb98c35e3fb9caf2e30fdfc27 libvirt-0.10.2-18.el6_4.3.i686.rpm aef29519bb5fd7533c8be4b2ad86c2128033b7913c60247d966c957da8a99d9c libvirt-client-0.10.2-18.el6_4.3.i686.rpm 5b7ac70b3e2b2631d8cdb2c1504c509874767c16cba666b8a2e5633b5c6c07a8 libvirt-devel-0.10.2-18.el6_4.3.i686.rpm cce875725d525c1610f5cbc5d1407ee713467a1b12639ed70969e83216ca9493 libvirt-python-0.10.2-18.el6_4.3.i686.rpm x86_64: 0e2499603eb3bbbf48788d01f45395fc36ee765b276e64e3fcf342e59c58e27d libvirt-0.10.2-18.el6_4.3.x86_64.rpm aef29519bb5fd7533c8be4b2ad86c2128033b7913c60247d966c957da8a99d9c libvirt-client-0.10.2-18.el6_4.3.i686.rpm 696686053482a427159a354a0dd3594723d4b9f99260c881eec2c09d9c24fe87 libvirt-client-0.10.2-18.el6_4.3.x86_64.rpm 5b7ac70b3e2b2631d8cdb2c1504c509874767c16cba666b8a2e5633b5c6c07a8 libvirt-devel-0.10.2-18.el6_4.3.i686.rpm 9ccca92af3bda8614cf224b1c7f31de8e168fbdbdc106382a88e351ae559635c libvirt-devel-0.10.2-18.el6_4.3.x86_64.rpm ff6369839e5db29fb3ff37f7ee99d09081c0c74229c2b1c911789e7c24b57981 libvirt-lock-sanlock-0.10.2-18.el6_4.3.x86_64.rpm c9f7884a8da76dde41a5783c28951e4355db3c555cacfa830ed1e20e257da43e libvirt-python-0.10.2-18.el6_4.3.x86_64.rpm Source: a8ba5bc49606ecacdf1c0387b52bed0fb4e88f5de0472702db2a1141beebb71c libvirt-0.10.2-18.el6_4.3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Wed, 10 Apr 2013 03:55:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0727 Important CentOS 5 kvm Update To: centos-announce(a)centos.org Message-ID: <20130410035537.GA10965(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0727 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0727.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: e8f6713cbf13b9a0e2a1a1ac747a3a112485897362662a12591b87956dc8d1b9 kmod-kvm-83-262.el5.centos.3.x86_64.rpm 33cfd1707f08f06f6f382ad193e2ebba5f0fee539b11cb19ba41512d468a0b60 kmod-kvm-debug-83-262.el5.centos.3.x86_64.rpm 7fbd4547ebbe617cae2ea9efbf58250d7deb9eb026f2ead79b310713978aa809 kvm-83-262.el5.centos.3.x86_64.rpm 49734f3733e6c696dbe36142081ecbc70dc768448f89bd4ae9f397381fdf1107 kvm-qemu-img-83-262.el5.centos.3.x86_64.rpm fd7b303cb46b00b3c147bbf2d0f127e1a415a042191036dc2b149ad5210a85a7 kvm-tools-83-262.el5.centos.3.x86_64.rpm Source: 8fdd7a43fee26f09c2bd63b31b4a2683d1cc9473420a11935c3a879ec5458fe8 kvm-83-262.el5.centos.3.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 98, Issue 4 **********************************************

1 0

Greetings
by santosh venkataswamy 10 Apr '13

10 Apr '13

Hi, I am new to this mailing list. I am an experienced Linux Corporate Trainer and Consultant. Look forward to share my views and technical info with you and participate in technical discussions,contribute and benefit from this mailing list. With Regards and good wishes. V.SANTOSH

2 1

fsck - anyway to increase verbosity to show point in process
by Max Pyziur 10 Apr '13

10 Apr '13

Greetings, I'm running CentOS 5.x on one ancient but reasonably reliable machine: root@leeloo ~> uname -a Linux leeloo 2.6.18-308.24.1.el5 #1 SMP Tue Dec 4 17:42:30 EST 2012 i686 i686 i386 GNU/Linux root@leeloo ~> cat /proc/cpu cat: /proc/cpu: No such file or directory root@leeloo ~> cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 11 model name : Intel(R) Pentium(R) III CPU family 1400MHz .. I am running some fsck's on some of the larger drives (750GB and 2TB) that are used for backups. There is a verbosity flag (-V); but because of the size of the drives along with slowness of the processor, the process is taking a long time. And there is no indication how much of the process has been completed (nothing like a %tage indicator), at least the way that I am running it. Is this expected, or is there some way of amping up the feedback? Much thanks, Max Pyziur pyz(a)brama.com

3 3

Re: [CentOS] web collaboration packages.
by Johan Vermeulen 09 Apr '13

09 Apr '13

Zarafa? I think comes with epel and works better with Android than Zimbra. verzonden m.b.v Android vandaar de beknoptheid. Александр Кириллов <nevis2us(a)infoline.su>schreef: >>> Web mail is particularly important for my wife so she can check >>> e-mail when >>> she is at work. > >roundcubemail? > >_______________________________________________ >CentOS mailing list >CentOS(a)centos.org >http://lists.centos.org/mailman/listinfo/centos

1 0

CentOS-announce Digest, Vol 98, Issue 3
by centos-announce-request＠centos.org 09 Apr '13

09 Apr '13

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CESA-2013:0714 Moderate CentOS 6 stunnel Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Mon, 8 Apr 2013 20:25:12 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0714 Moderate CentOS 6 stunnel Update To: centos-announce(a)centos.org Message-ID: <20130408202512.GA13982(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0714 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0714.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 134f6e3d27d4b52f58a537f6949978df01aaf92ff1bd354647d0d617bff4985f stunnel-4.29-3.el6_4.i686.rpm x86_64: 091e1b3670042f45f0ff0a7f5da18ee1987b5f9ae803ce92d089778c79f95c45 stunnel-4.29-3.el6_4.x86_64.rpm Source: 2670221d4b06c1c9fba776235560512a0f1ad21f55ed39cb68e255bbd5b56602 stunnel-4.29-3.el6_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 98, Issue 3 **********************************************

1 0

5.9 update error messages
by m.roth＠5-cent.us 08 Apr '13

08 Apr '13

Just updated one of our servers, and see a bunch of udevd-event[8735]: run_program: ressize 256 too short Along with Apr 8 14:57:48 <servername> kernel: Breaking affinity for irq 209 Apr 8 14:57:48 <servername> kernel: CPU 8 is now offline Apr 8 14:57:49 <servername> kernel: CPU 8 offline: Remove Rx thread Apr 8 14:57:49 <servername> kernel: CPU 9 is now offline Apr 8 14:57:49 <servername> kernel: CPU 9 offline: Remove Rx thread Apr 8 14:57:49 <servername> kernel: CPU 10 is now offline Apr 8 14:57:49 <servername> kernel: CPU a offline: Remove Rx thread Apr 8 14:57:49 <servername> kdump: kexec: failed to unload kdump kernel Apr 8 14:57:49 <servername> kdump: failed to stop Apr 8 14:57:49 <servername> kernel: CPU 11 is now offline Apr 8 14:57:49 <servername> kernel: CPU b offline: Remove Rx thread Apr 8 14:57:49 <servername> kernel: CPU 12 is now offline Apr 8 14:57:49 <servername> kernel: CPU c offline: Remove Rx thread Apr 8 14:57:49 <servername> kernel: CPU 13 is now offline Apr 8 14:57:49 <servername> kernel: CPU d offline: Remove Rx thread Apr 8 14:57:49 <servername> kernel: Breaking affinity for irq 209 Apr 8 14:57:49 <servername> kernel: CPU 14 is now offline Apr 8 14:57:49 <servername> kernel: CPU e offline: Remove Rx thread Apr 8 14:57:49 <servername> kdump: kexec: failed to unload kdump kernel This is a Sun X4640. I see, in a quick google, some posts about this from '08 or '09, with no resolution. Any ideas out there? mark

1 0

Hostname question
by Jason T. Slack-Moehrle 08 Apr '13

08 Apr '13

CentOS 6.4, clean install. Zimbra 8.0.3 I am behind a PfSense box using a virtual IP. So the IP of the box is 192.168.1.27 I entered this in /etc/hosts: 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 192.168.1.27 mail mail.meowbox.me meowbox.me but `hostname -f` says: $ hostname -f hostname: Unknown host Do I need to put the public IP for where this record resolves? Since PFSense is forwarding traffic from it to the virtual IP? Jason

4 8

Re: [CentOS] [Dovecot] Configuring dovecot to use tcp wrappers
by Max Pyziur 08 Apr '13

08 Apr '13

On Mon, 8 Apr 2013, Timo Sirainen wrote: > On 8.4.2013, at 1.31, "Max Pyziur" <pyz(a)brama.com> wrote: > >> However, once I make the changes to the configuration files, I get the >> following error when restarting dovecot: >> root@brama /etc/dovecot/conf.d> service dovecot restart >> Stopping Dovecot Imap: [ OK ] >> Starting Dovecot Imap: doveconf: Fatal: Error in configuration file >> /etc/dovecot/dovecot.conf: service(tcpwrap): executable is empty >> [FAILED] > > You most likely didn't compile Dovecot with tcpwrap support. See if you have /usr/lib*/dovecot/tcpwrap binary? Any idea, then, as to where those CentOS dovecot src.rpms are kept? Max Pyziur pyz(a)brama.com

1 1

nfs timeout
by Rita 07 Apr '13

07 Apr '13

hi, I use automounter to mount to many hosts /net/<hostname>/dir When the hostname is unavaliable it seems NFS gets stuck. I would like to set a NFS timeout (say 60 secs). If not available then error. I need to use hardmount but is there such a thing as NFS client timeout? -- --- Get your facts first, then you can distort them as you please.--

3 2

Re: [CentOS] [CentOS-virt] qemu-kvm high cpu usage with idle windows guest
by Micky 07 Apr '13

07 Apr '13

On Sun, Apr 7, 2013 at 8:32 PM, Zoltan Frombach <zoltan(a)frombach.com> wrote: > Check out these threads they may help you solve your issue with Windows VMs: Well I did. Upstream provides rpms till version 0.12.1.x. Even the RHEV srpm (the one I am using) has the same version. And I don't want to compile both libvirt and qemu-kvm from source since it is the production machine. > http://forum.proxmox.com/threads/5770-Windows-guest-high-context-switch-rat… > > http://serverfault.com/questions/146922/why-is-idle-windows-vm-using-so-muc… > > On 4/7/2013 5:18 PM, Banyan He wrote: >> Maybe you can print out what it is doing, then try to figure out if they >> are doing good. My linux works good, never tried windows. >> Did. Nothing abnormal. A quick perf shows this: # ........ ........ .................. .............................................. # 4.96% qemu-kvm [kvm] [k] kvm_arch_vcpu_ioctl_run 4.83% qemu-kvm [kvm_intel] [k] vmx_vcpu_run 4.47% qemu-kvm [kernel.kallsyms] [k] find_busiest_group 3.23% qemu-kvm [kernel.kallsyms] [k] _spin_lock 3.10% qemu-kvm [kernel.kallsyms] [k] native_write_msr_safe 1.24% qemu-kvm [kernel.kallsyms] [k] _spin_lock_irq 1.22% qemu-kvm [kvm] [k] paging64_walk_addr 1.21% qemu-kvm [kvm] [k] x86_decode_insn 1.21% qemu-kvm [kvm_intel] [k] vmcs_writel >> Banyan He

1 0

qemu-kvm high cpu usage with idle windows guest
by Micky 07 Apr '13

07 Apr '13

Windows 2k8 R2 guest with updated virtio drivers is idle inside but on the host qemu-kvm process uses 7-15% cpu. Things that have been tried without any significant success - removed tablet device - manually set cpu topology for cores per socket Is it just me or the qemu-kvm has little tolerance with windows?

1 0

Does CentOS support dual graphics cards with 2 monitors each?
by Alfred von Campe 07 Apr '13

07 Apr '13

I have a user who wants to have 4 monitors attached to his CentOS 6.4 system. I know that you can't use both on-board video and a PCI video card at the same time, but what about two PCI video cards? The system seems to recognize them as shown by the lspci -v output below, but I can't get Xorg to use the second card. Has anyone done this? If so, what is the trick to get it to work? Alfred 00:00.0 Host bridge: Intel Corporation 2nd Generation Core Processor Family DRAM Controller (rev 09) Subsystem: Dell Device 04ad Flags: bus master, fast devsel, latency 0 Capabilities: [e0] Vendor Specific Information <?> 00:01.0 PCI bridge: Intel Corporation Xeon E3-1200/2nd Generation Core Processor Family PCI Express Root Port (rev 09) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=01, subordinate=01, sec-latency=0 I/O behind bridge: 00004000-00004fff Memory behind bridge: ed000000-ee0fffff Prefetchable memory behind bridge: 00000000e0000000-00000000e9ffffff Capabilities: [88] Subsystem: Dell Device 04ad Capabilities: [80] Power Management version 3 Capabilities: [90] MSI: Enable+ Count=1/1 Maskable- 64bit- Capabilities: [a0] Express Root Port (Slot+), MSI 00 Capabilities: [100] Virtual Channel <?> Capabilities: [140] Root Complex Link <?> Kernel driver in use: pcieport 00:16.0 Communication controller: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 (rev 04) Subsystem: Dell Device 04ad Flags: bus master, fast devsel, latency 0, IRQ 11 Memory at eebb0000 (64-bit, non-prefetchable) [size=16] Capabilities: [50] Power Management version 3 Capabilities: [8c] MSI: Enable- Count=1/1 Maskable- 64bit+ 00:19.0 Ethernet controller: Intel Corporation 82579LM Gigabit Network Connection (rev 04) Subsystem: Dell Device 047e Flags: bus master, fast devsel, latency 0, IRQ 32 Memory at eeb00000 (32-bit, non-prefetchable) [size=128K] Memory at eeb80000 (32-bit, non-prefetchable) [size=4K] I/O ports at 5040 [size=32] Capabilities: [c8] Power Management version 2 Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+ Capabilities: [e0] PCI Advanced Features Kernel driver in use: e1000e Kernel modules: e1000e 00:1a.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #2 (rev 04) (prog-if 20 [EHCI]) Subsystem: Dell Device 04ad Flags: bus master, medium devsel, latency 0, IRQ 16 Memory at eeb70000 (32-bit, non-prefetchable) [size=1K] Capabilities: [50] Power Management version 2 Capabilities: [58] Debug port: BAR=1 offset=00a0 Capabilities: [98] PCI Advanced Features Kernel driver in use: ehci_hcd 00:1b.0 Audio device: Intel Corporation 6 Series/C200 Series Chipset Family High Definition Audio Controller (rev 04) Subsystem: Dell Device 04ad Flags: bus master, fast devsel, latency 0, IRQ 31 Memory at eeb60000 (64-bit, non-prefetchable) [size=16K] Capabilities: [50] Power Management version 2 Capabilities: [60] MSI: Enable+ Count=1/1 Maskable- 64bit+ Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [100] Virtual Channel <?> Capabilities: [130] Root Complex Link <?> Kernel driver in use: snd_hda_intel Kernel modules: snd-hda-intel 00:1c.0 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 1 (rev b4) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=02, subordinate=02, sec-latency=0 Capabilities: [40] Express Root Port (Slot+), MSI 00 Capabilities: [80] MSI: Enable- Count=1/1 Maskable- 64bit- Capabilities: [90] Subsystem: Dell Device 04ad Capabilities: [a0] Power Management version 2 00:1c.2 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 3 (rev b4) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=03, subordinate=03, sec-latency=0 I/O behind bridge: 00003000-00003fff Memory behind bridge: ee100000-eeafffff Prefetchable memory behind bridge: 00000000ea100000-00000000eaafffff Capabilities: [40] Express Root Port (Slot+), MSI 00 Capabilities: [80] MSI: Enable- Count=1/1 Maskable- 64bit- Capabilities: [90] Subsystem: Dell Device 04ad Capabilities: [a0] Power Management version 2 00:1c.4 PCI bridge: Intel Corporation 6 Series/C200 Series Chipset Family PCI Express Root Port 5 (rev b4) (prog-if 00 [Normal decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=04, subordinate=04, sec-latency=0 I/O behind bridge: 00002000-00002fff Memory behind bridge: eb000000-ec0fffff Prefetchable memory behind bridge: 00000000d0000000-00000000d9ffffff Capabilities: [40] Express Root Port (Slot+), MSI 00 Capabilities: [80] MSI: Enable- Count=1/1 Maskable- 64bit- Capabilities: [90] Subsystem: Dell Device 04ad Capabilities: [a0] Power Management version 2 00:1d.0 USB controller: Intel Corporation 6 Series/C200 Series Chipset Family USB Enhanced Host Controller #1 (rev 04) (prog-if 20 [EHCI]) Subsystem: Dell Device 04ad Flags: bus master, medium devsel, latency 0, IRQ 17 Memory at eeb50000 (32-bit, non-prefetchable) [size=1K] Capabilities: [50] Power Management version 2 Capabilities: [58] Debug port: BAR=1 offset=00a0 Capabilities: [98] PCI Advanced Features Kernel driver in use: ehci_hcd 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev a4) (prog-if 01 [Subtractive decode]) Flags: bus master, fast devsel, latency 0 Bus: primary=00, secondary=05, subordinate=05, sec-latency=0 Capabilities: [50] Subsystem: Dell Device 04ad 00:1f.0 ISA bridge: Intel Corporation Q65 Express Chipset Family LPC Controller (rev 04) Subsystem: Dell Device 04ad Flags: bus master, medium devsel, latency 0 Capabilities: [e0] Vendor Specific Information <?> Kernel modules: iTCO_wdt 00:1f.2 SATA controller: Intel Corporation 6 Series/C200 Series Chipset Family SATA AHCI Controller (rev 04) (prog-if 01 [AHCI 1.0]) Subsystem: Dell Device 04ad Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 30 I/O ports at 5090 [size=8] I/O ports at 5080 [size=4] I/O ports at 5070 [size=8] I/O ports at 5060 [size=4] I/O ports at 5020 [size=32] Memory at eeb40000 (32-bit, non-prefetchable) [size=2K] Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit- Capabilities: [70] Power Management version 3 Capabilities: [a8] SATA HBA <?> Capabilities: [b0] PCI Advanced Features Kernel driver in use: ahci Kernel modules: ahci 00:1f.3 SMBus: Intel Corporation 6 Series/C200 Series Chipset Family SMBus Controller (rev 04) Subsystem: Dell Device 04ad Flags: medium devsel, IRQ 18 Memory at eeb30000 (64-bit, non-prefetchable) [size=256] I/O ports at 5000 [size=32] Kernel modules: i2c-i801 01:00.0 VGA compatible controller: NVIDIA Corporation Device 104a (rev a1) (prog-if 00 [VGA controller]) Subsystem: Micro-Star International Co., Ltd. Device 809f Flags: bus master, fast devsel, latency 0, IRQ 16 Memory at ed000000 (32-bit, non-prefetchable) [size=16M] Memory at e0000000 (64-bit, prefetchable) [size=128M] Memory at e8000000 (64-bit, prefetchable) [size=32M] I/O ports at 4000 [size=128] Expansion ROM at ee000000 [disabled] [size=512K] Capabilities: [60] Power Management version 3 Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [78] Express Endpoint, MSI 00 Capabilities: [b4] Vendor Specific Information <?> Capabilities: [100] Virtual Channel <?> Capabilities: [128] Power Budgeting <?> Capabilities: [600] Vendor Specific Information <?> Kernel driver in use: nouveau Kernel modules: nouveau, nvidiafb 01:00.1 Audio device: NVIDIA Corporation GF119 HDMI Audio Controller (rev a1) Subsystem: Micro-Star International Co., Ltd. Device 809f Flags: bus master, fast devsel, latency 0, IRQ 17 Memory at ee080000 (32-bit, non-prefetchable) [size=16K] Capabilities: [60] Power Management version 3 Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [78] Express Endpoint, MSI 00 Kernel driver in use: snd_hda_intel Kernel modules: snd-hda-intel 04:00.0 VGA compatible controller: NVIDIA Corporation Device 104a (rev a1) (prog-if 00 [VGA controller]) Subsystem: Micro-Star International Co., Ltd. Device 809f Flags: bus master, fast devsel, latency 0, IRQ 16 Memory at eb000000 (32-bit, non-prefetchable) [size=16M] Memory at d0000000 (64-bit, prefetchable) [size=128M] Memory at d8000000 (64-bit, prefetchable) [size=32M] I/O ports at 2000 [size=128] Expansion ROM at ec000000 [disabled] [size=512K] Capabilities: [60] Power Management version 3 Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [78] Express Endpoint, MSI 00 Capabilities: [b4] Vendor Specific Information <?> Capabilities: [100] Virtual Channel <?> Capabilities: [128] Power Budgeting <?> Capabilities: [600] Vendor Specific Information <?> Kernel driver in use: nouveau Kernel modules: nouveau, nvidiafb 04:00.1 Audio device: NVIDIA Corporation GF119 HDMI Audio Controller (rev a1) Subsystem: Micro-Star International Co., Ltd. Device 809f Flags: bus master, fast devsel, latency 0, IRQ 17 Memory at ec080000 (32-bit, non-prefetchable) [size=16K] Capabilities: [60] Power Management version 3 Capabilities: [68] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [78] Express Endpoint, MSI 00 Kernel driver in use: snd_hda_intel Kernel modules: snd-hda-intel

7 13

Apache Issue on CentOS 6
by linuxsupport 06 Apr '13

06 Apr '13

I am facing a problem with Apache on CentOS 6 Apache 2.2.19 is complied from source. I see so many reading requests in Apache status page, as per my previous experience this "reading request" issue mainly comes when any of the internet route having any problem and it request takes time to completely reach to Apache, but this time there is no network issue. I have ran same setup on CentOS 5 it works well, but on CentOS 6 it show 60%+ reading requests, web site has 20-25 requests per second that becomes 80+ I also tried to upgrade Apache to 2.2.24 but it is same on new version as well. Anyone else has experienced this issue?

3 3

mock and iaxmodem
by James B. Byrne 05 Apr '13

05 Apr '13

I am trying to build an rpm package for iaxmodem-1.2.0. At the moment I am still trying to get a working spec file put together. I have managed to get an SRPM produced but the binary build from this fails due to there being no install task in the Makefile.in provided with the source. I have found a spec file from opensuse that provides this in the install portion: %build [ "%{buildroot}" != '/' ] && rm -rf %{buildroot} # . . . ./configure %{__make} %{?_smp_mflags} %install # install the bunch manually mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d $RPM_BUILD_ROOT/etc/iaxmodem $RPM_BUILD_ROOT/usr/bin %{__install} -m 644 %{S:1} $RPM_BUILD_ROOT/etc/logrotate.d/iaxmodem %{__install} -D -m 755 iaxmodem %{buildroot}%{_sbindir}/iaxmodem %{__install} -D -m 644 iaxmodem.1 %{buildroot}%{_mandir}/man1/iaxmodem.1 perl -pi -e 's,/usr/local/,/usr/,g' iaxmodem.init.fedora %{__install} -D -m 755 iaxmodem.init.suse %{buildroot}%{_initrddir}/iaxmodem But in mock I get a failure on the build because make has no install task. + make install DESTDIR=/builddir/build/BUILDROOT/iaxmodem-1.2.0-1.el6.x86_64 make: *** No rule to make target `install'. Stop. RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.apiDwk (%install) Bad exit status from /var/tmp/rpm-tmp.apiDwk (%install) Child return code was: 1 I have next to no experience with building on Linux and I have no idea of what I should do to resolve this. What are my options at this point? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

Re: [CentOS] mock and iaxmodem
by James B. Byrne 05 Apr '13

05 Apr '13

On Fri, April 5, 2013 15:45, Reindl Harald wrote: > > you can try my SPEC below which builds iaxmodem-packages on > Fedora since a long time, if this also does not work i suspect > a bug in mock! > Thank you very much. I had to make several small changes but with those in place your spec file works for me on CentOS-6.4. Libtiff-tools does not exist for CentOS but the requite components are included with libtiff. Libtiff needs a BuildRequires: libtiff-devel added. And as I do not have your Source2: .init file I copy the one provided in the sources for fedora instead. Name: iaxmodem Version: 1.2.0 Release: 1%{?dist} Summary: IAX software fax modem Source: http://dl.sourceforge.net/iaxmodem/%{name}-%{version}.tar.gz #Source2: %{name}.init URL: http://iaxmodem.sourceforge.net Group: Applications License: GPL BuildRoot: %{_tmppath}/build-%{name}-%{version} BuildRequires: gcc BuildRequires: glibc-devel BuildRequires: automake BuildRequires: autoconf BuildRequires: libtiff-devel Requires: libtiff %description IAXmodem is a software modem written in C that uses an IAX channel (commonly provided by an Asterisk PBX system) instead of a traditional phone line and uses a DSP library instead of DSP hardware chipsets. IAXmodem was originally conceived to function as a fax modem usable with HylaFAX, and it does that well. However IAXmodem also has been known to function with mgetty+sendfax and efax. To accomplish this IAXmodem interfaces an IAX library known as libiax2 with a DSP library known as spandsp, and then IAXmodem interfaces the DSP library with a tty device node for interfacing with modem applications. %prep %setup -q %build %configure %{__make} %{?_smp_mflags} %install mkdir -p $RPM_BUILD_ROOT/%{_bindir} mkdir -p $RPM_BUILD_ROOT/%{_mandir}/man1/ mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d/ install %{name} $RPM_BUILD_ROOT/%{_bindir} install %{name}.1 $RPM_BUILD_ROOT/%{_mandir}/man1/ #install %{SOURCE2} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name} %{__install} -D -m 755 iaxmodem.init.fedora %{buildroot}%{_initrddir}/iaxmodem %clean rm -rf %{buildroot} %files %defattr(644,root,root,755) %attr(755,root,root) %{_bindir}/* %attr(754,root,root) /etc/rc.d/init.d/%{name} %{_mandir}/man1/* %doc TODO README FAQ CHANGES *.ttyIAX %changelog * Fri Apr 05 2013 James B. Byrne <byrnejb(a)harte-lyne.ca> - Rebuild for CentOS-6.4 * Thu Feb 03 2011 Reindl Harald <h.reindl(a)thelounge.net> - Rebuild for Fedora 14 * Sat Nov 20 2010 Reindl Harald <h.reindl(a)thelounge.net> - Rebuild with GCC 4.4.5 * Sat Nov 6 2010 Reindl Harald <h.reindl(a)thelounge.net> - Build x86_64 with SSE4-Support * Wed Sep 22 2010 Reindl Harald <h.reindl(a)thelounge.net> - Downgrade to 1.1.1 because 1.2 does not work - And upgrade again to 1.2.0 because stoopid people call fax per phone * Sun Sep 19 2010 Reindl Harald <h.reindl(a)thelounge.net> - First RPM for Fedora - Add "libtiff-tools" as Requirement because it provides: - * /usr/bin/fax2ps - * /usr/bin/fax2tiff - * /usr/bin/tiff2pdf - * /usr/bin/tiff2ps Now to see if it runs. Thank you again. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

1 0

Touchpad doesn't work with C6, kernel-related...
by Marko Vojinovic 05 Apr '13

05 Apr '13

Hi folks! :-) I have a Fujitsu Lifebook U series laptop running updated CentOS 6.4 (64bit), and the touchpad doesn't work. It's a new laptop, the touchpad works correctly in Fedora 18 Live (given the kernel parameters below), no hardware problems. I searched the web all around, and it's a known issue for several laptop models. The only solution, quoted everywhere, it is to append the i8042.notimeout i8042.nomux to the kernel parameters. The problem is that the latest CentOS6 kernel (2.6.32-358.2.1.el6.x86_64) doesn't appear to recognize these. Or it otherwise ignores them. I did append the parameters, but (unlike in Fedora) the touchpad is still dead. This laptop is to be used by a noob user who needs a LTS distro and is already accustomed to CentOS, so a more modern distro like Fedora or Ubuntu is not an option. What can be done about this? Would a CentOSplus kernel work? It is somehow too lousy to tell the client "The touchpad of your brand-new laptop doesn't work because CentOS is too old, use an USB mouse instead". Any advice appreciated. TIA, :-) Marko

4 5

Using "root" Type User Via Forwarding-SSH-Tunnel Inside Non-Root SSH Connection
by Bry8 Star 05 Apr '13

05 Apr '13

Hi, QUESTION: what implications are there when using the "root" or a root type of account via a port-forwarding ssh-tunnel inside (or on top of) another non-root type of user's ssh-tunnel ? Is such double layer of encryption brings more security or system still vulnerable same as single layer of SSH encryption ? DETAILS: In CentOS (6.3 & 6.4) server side i have done these: (1) Created a user named "administrator". Then by using visudo command, i allowed "administrator" to have higher level of access & permission, similar/close to the "root" user, (not exactly same though). http://wiki.centos.org/TipsAndTricks/BecomingRoot (Basically this "administrator" user has maintenance related software running privilege). (2) Created a user named "non-root", a standard/normal user. (3) In /etc/ssh/sshd_config file i have modified the default configurations into this: # File: /etc/ssh/sshd_config port NNN10 protocol 2 SyslogFacility AUTHPRIV AllowUsers non-root root(a)127.0.0.1 administrator(a)127.0.0.1 PasswordAuthentication yes PermitEmptyPasswords no ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS X11Forwarding no Banner /etc/issue.net Subsystem sftp /usr/libexec/openssh/sftp-server # End of File: /etc/ssh/sshd_config Above config allows only "non-root" user to connect with CentOS server from internet. And "administrator" or "root" can must/only connect using local ip address 127.0.0.1. In /etc/issue file and in /etc/issue.net file i have placed such text info: *********************************** NOTICE / WARNING TO USERS * This computer system is private property of its owner, Bry8Star. * This message is shown from hostname.sld.tld * It is for AUTHORIZED use only. Any unauthorized or improper use of this system will result in CIVIL and CRIMINAL PENALTIES ... * ... * Your connection IP ADDRESS, PORT, and TIME info etc are recorded by this computer. *********************************** In /etc/profile file, i have placed these below 13 lines just above the "unset i" line, at bottom side: if [ -n "$SSH_CLIENT" ] then set $SSH_CLIENT echo "Your current connection coming from IP Address $1 using port $2, to this computer." else if [ -n "$SSH_CONNECTION" ] then set $SSH_CONNECTION echo "Your current connection coming from IP Address $1 using port $2, to this computer." else echo "Your current connection's IP Address & port could not be shown for now." fi fi In /etc/profile.local file, i have placed these below 13 lines at bottom side: if [ -n "$SSH_CLIENT" ] then set $SSH_CLIENT echo "You have connected from IP Address $1 using port $2" else if [ -n "$SSH_CONNECTION" ] then set $SSH_CONNECTION echo "You have connected from IP Address $1 using port $2" else echo "User's IP Address could not be shown" fi fi Above codes allow me to see what IP:port is currently being used. And after login opensshd by default shows last/previous connection's IP-address or reverse-domain. This helps to see instantly which IP is being used right now or who is attempting to login in simple way. Ofcourse log can show more detailed info. And in client side (user side), i'm using PuTTY or PuTTY based or other SSH client software, with such configurations: SSH-client software has 3 connection profiles. The "ssh-client-01" connection ssh-profile is configured for regular user "non-root", and connects to ip.address.numbers:port (hostname.sld.tld:NNN10) (sld = 2nd level domain, tld = top level domain). This connection profile is also configured to create one encrypted port-forwarding tunnel through the SSH-tunnel: where, local port NNN11, is port-forwarded, to the (local-)port NNN10 inside CentOS server (hostname.sld.tld). The "ssh-client-02" connection ssh-profile is configured for user "administrator", and connects to local ip address 127.0.0.1 on port NNN11 (127.0.0.1:NNN11). This connection profile itself has no port-forwarding tunnels. It uses the forwarding-tunnel of "ssh-client-01" to create SSH-tunnel, toward the ssh-server port NNN10 of CentOS server. The "ssh-client-03" connection ssh-profile is configured with user "root", and connects to local ip address 127.0.0.1 on port NNN11 (127.0.0.1:NNN11). This connection profile itself has no port-forwarding tunnels. It uses the forwarding-tunnel of "ssh-client-01" to create SSH-tunnel, toward the ssh-server port NNN10 of CentOS server. I first connect with CentOS server using "ssh-client-01", then i connect again with CentOS server using the "ssh-client-02". In this way "ssh-client-02" (for "administrator") goes through the encryption layer of "ssh-client-01" (for "non-root"). If i need to use "root" level access/privilege, i do these: sudo one-command options For multiple commands i do these: su - a-command options another-command options exit To switch into another user account (like "GUIuser1", "non-root2") without disconnecting, i do: su GUIuser1 su non-root2 The "ssh-client-03" ssh-profile i use for exceptional purpose, when i absolutely must have to use the "root" account directly, only then. QUESTION: How can i configure opensshd related settings, so that, it shows current ip-address & port used by the current user who is trying/attempting to login ? BEFORE user types in the password. I have placed a text "This is \o | Now it is \t \d | Connection is using \l" in /etc/issue file and also in /etc/issue.net file, but it does not work, just appears as verbatim, (escape sequenced special variables do not get translated/replaced by special values). I want to show the user who is attempting to login, his/her IP-address, port, time, etc to him/her, every time before typing password. QUESTION: what is/are better practice(s) (to secure CentOS server related to SSH) ? QUESTION/Possible-SOLUTION: Should i remove the "root(a)127.0.0.1" from "AllowUsers" and add "PermitRootLogin no" line in /etc/sshd_config file ? Thanks in advance, -- Bright Star.

4 4

CentOS-announce Digest, Vol 98, Issue 2
by centos-announce-request＠centos.org 05 Apr '13

05 Apr '13

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2013:0703 CentOS 6 coreutils Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Fri, 5 Apr 2013 00:47:49 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2013:0703 CentOS 6 coreutils Update To: centos-announce(a)centos.org Message-ID: <20130405004749.GA28781(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2013:0703 Upstream details at : https://rhn.redhat.com/errata/RHBA-2013-0703.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: dbce6086fa4dc0861652fc9a3cfc358c53d6b93c0004f839712fddbc0f5f3231 coreutils-8.4-19.el6_4.1.i686.rpm 19f3eece775cf975b0a4dc703f5019171cee4762c21b09d924d89e66a327234a coreutils-libs-8.4-19.el6_4.1.i686.rpm x86_64: 88a59ae4ecd2c5639586d92e1136608f4d38921b1d84b8f5b4f3bbab2548917a coreutils-8.4-19.el6_4.1.x86_64.rpm fb884eac2dea8fb7993e491468ea4c84391ca63a1bd1c6f85b794a46bd856a99 coreutils-libs-8.4-19.el6_4.1.x86_64.rpm Source: a84d2d0d516d2dd975601cd3c65e82cf7f522ed1f828f2da99bf1353d2642b6b coreutils-8.4-19.el6_4.1.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 98, Issue 2 **********************************************

1 0

What is bind97 and what are the differences to bind
by Jobst Schmalenbach 05 Apr '13

05 Apr '13

Hi, sorry if this has been covered, I searched google for this but can't find an answer (maybe I am trying the incorrect search terms). What is bind97? What are the differences between bind97 and bind? thanks Jobst -- Fortune: No such file or directory. | |0| | Jobst Schmalenbach, jobst(a)barrett.com.au, General Manager | | |0| Barrett Consulting Group P/L & The Meditation Room P/L |0|0|0| +61 3 9532 7677, POBox 277, Caulfield South, 3162, Australia

2 1

UIDs different
by m.roth＠5-cent.us 04 Apr '13

04 Apr '13

Odd problem. Two 6.4 boxes, and a user's home directory is automounted. /etc/passwd are identical... but once mounted on the other server, if we su - to that user, what we see is an old UID of his, from a while back (years?), while on the home directory server, it's the current, correct UID. Anyone have ideas? mark

1 2

C6: tcp-wrapping pop3?
by Max Pyziur 04 Apr '13

04 Apr '13

Greetings, Per the subject line, how does pop3 get tcp-wrapped when using dovecot? More specifically, when blocking email and (still) using sendmail, entries in /etc/hosts.deny look something like: sendmail: xxx.xxx. etc (depending on the depth/degree) for vsftpd it's vsftpd: xxx.xxx (where the x's are parts of an octet) for sshd it's sshd: xxx.xxx for pop3/dovecot it's? ????: xxx.xxx I'm concerned about what is to the left of the colon (":"), not to the right. Is it a dovecot.conf configuration also? Much thanks, Max Pyziur pyz(a)brama.com

3 3

Re: [CentOS] Vsftpd configuration problem - followup
by Max Pyziur 03 Apr '13

03 Apr '13

On Tue, 2 Apr 2013, Reindl Harald wrote: > > > Am 02.04.2013 01:12, schrieb Max Pyziur: >> Beginning today, I started to receive the following when ftp'ing to my >> CentOS 6 machine: >> ncftp /home/pyz2 > dir >> connect failed: No route to host. >> connect failed: No route to host. >> connect failed: No route to host. >> Falling back to PORT instead of PASV mode. >> >> I can make a connection, but I can't get a directory listing or transfer >> data/files >> >> My firewall setting has port 21 open >> >> I can remotely telnet to hostname 21 > > and you understood that ftp needs also a data-channel > and not only the control-connection? > > http://slacksite.com/other/ftp.html When ftping to the machine, the following is reported from an lsof -i: ~> lsof -i | grep ftp vsftpd 18051 root 3u IPv4 47313973 0t0 TCP *:ftp (LISTEN) vsftpd 18448 nobody 0u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) vsftpd 18448 nobody 1u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) vsftpd 18448 nobody 2u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) vsftpd 18465 pyz2 0u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) vsftpd 18465 pyz2 1u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) vsftpd 18465 pyz2 2u IPv4 47318710 0t0 TCP brama.com:ftp->pool-72-89-118-134.nycmny.east.verizon.net:50298 (ESTABLISHED) fyi, MP pyz(a)brama.com

4 8

CentOS-announce Digest, Vol 98, Issue 1
by centos-announce-request＠centos.org 03 Apr '13

03 Apr '13

Send CentOS-announce mailing list submissions to centos-announce(a)centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request(a)centos.org You can reach the person managing the list at centos-announce-owner(a)centos.org When replying, please edit your Subject line so it is more specific than "Re: Contents of CentOS-announce digest..." Today's Topics: 1. CEBA-2013:0692 CentOS 6 boost Update (Johnny Hughes) 2. CESA-2013:0696 Critical CentOS 5 xulrunner Update (Johnny Hughes) 3. CESA-2013:0697 Critical CentOS 5 thunderbird Update (Johnny Hughes) 4. CESA-2013:0696 Critical CentOS 5 firefox Update (Johnny Hughes) 5. CESA-2013:0696 Critical CentOS 6 xulrunner Update (Johnny Hughes) 6. CESA-2013:0697 Important CentOS 6 thunderbird Update (Johnny Hughes) 7. CESA-2013:0696 Critical CentOS 6 firefox Update (Johnny Hughes) ---------------------------------------------------------------------- Message: 1 Date: Tue, 2 Apr 2013 14:25:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CEBA-2013:0692 CentOS 6 boost Update To: centos-announce(a)centos.org Message-ID: <20130402142537.GA21797(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Bugfix Advisory 2013:0692 Upstream details at : https://rhn.redhat.com/errata/RHBA-2013-0692.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6a3f17870bbb92811dd4886fc308d7d20cabd17a712604559f1c4762b1938c11 boost-1.41.0-17.el6_4.i686.rpm f59960fb9396d813304defe24c4bdede149442a934c994ff5af63c935741d995 boost-date-time-1.41.0-17.el6_4.i686.rpm 7780102c45f5893e4c7fd030563427ba95481e3c2f7a48ca8d87fba2fc698d1f boost-devel-1.41.0-17.el6_4.i686.rpm c20af3a70e1e333e455eaf13c5bad2c9d4aa7f65a0e78877be7f07a1f2db1d5d boost-doc-1.41.0-17.el6_4.i686.rpm 700eef24e99b84d1fcd43101bc45e5aa2c7c2addce1c0eb399fd28e533c6c61e boost-filesystem-1.41.0-17.el6_4.i686.rpm f2cc7bf10407da92c2f990ae939099b9abcdcca29816b176e8eca375a2c85fd5 boost-graph-1.41.0-17.el6_4.i686.rpm b5ca862fdfdc3ac1c8da7e9cce4fc804796ead79db1d7e85463ee197321817c3 boost-graph-mpich2-1.41.0-17.el6_4.i686.rpm 658ed676f6feba3fe362d3f6808fc4ecc0e404647392c53b2fd92c946e6e63c9 boost-graph-openmpi-1.41.0-17.el6_4.i686.rpm 2e907650c17616a22be5524ac6aa771b6a4b308a6227928dc82574fa1cfa6eb3 boost-iostreams-1.41.0-17.el6_4.i686.rpm 5547a19e1d017018da944a009a5f925991d589dc4ea7c2d58097f3241e680ba5 boost-math-1.41.0-17.el6_4.i686.rpm b44a501828a094f49a72586579017e9b0d109ff4f1768fbe36d6999693e58129 boost-mpich2-1.41.0-17.el6_4.i686.rpm f3fda215bb380e3bf9ff8a75bfc845a64d7fc38cd5d69050c7ac742d27c606ae boost-mpich2-devel-1.41.0-17.el6_4.i686.rpm eefd0ee1ac9bef33cceaf31aab10235913465a80fb78fbf73e17a6b1d2ef71f9 boost-mpich2-python-1.41.0-17.el6_4.i686.rpm 308237f14aa3e02393404d7798f58a8dfbd9dc002db148c58c2a7d7b8c1ceff9 boost-openmpi-1.41.0-17.el6_4.i686.rpm d1ed3f323a9a2358d551bce6ffcd37358deff5cf9a4f8c9025f2910b2312f2c2 boost-openmpi-devel-1.41.0-17.el6_4.i686.rpm 30f9723381078d5b56c3f8f4f21926814e3055be91c812040f6f94859bf5d181 boost-openmpi-python-1.41.0-17.el6_4.i686.rpm 83ff052460d5875aa41731c1f0947a1f0aaf99b806de3ad1bfb616841720641d boost-program-options-1.41.0-17.el6_4.i686.rpm b69efa50b01fded1cd134668ec4434b3f4f4e31616638287ab6bcb7b4d93e430 boost-python-1.41.0-17.el6_4.i686.rpm 935ab133eda12f8acdc0391e0e0c93449591774e26a59e3a24f4b20bfdb45cea boost-regex-1.41.0-17.el6_4.i686.rpm dd770d79c0642323d34d82dc88691bd90cfad08a5d9ccce4919feb4f7bee6008 boost-serialization-1.41.0-17.el6_4.i686.rpm 3f973ac7ecb1ec95e29f77a6e8a1f6f6e46c065cb339230c567ca6ab80749da7 boost-signals-1.41.0-17.el6_4.i686.rpm b18a6ca27832c90e77b27f1f5fbec206ef54818b27b798d305f99b603a0d7393 boost-static-1.41.0-17.el6_4.i686.rpm 02f9f48c876644587fe5b91e85bce74289c46f37b1a45b75f1828aec13b63f72 boost-system-1.41.0-17.el6_4.i686.rpm 4de1ed018ae95dd2daa9b54f2ca64a055a3d7d24c66e14a35bcb9d0a1a366b70 boost-test-1.41.0-17.el6_4.i686.rpm a6947757a659321cedc585d4b74c7e738ef42f5ff68a4b59aef62ab9fd0ce35f boost-thread-1.41.0-17.el6_4.i686.rpm bd3b6c1db628d5cdf88b203b8eb7b8365816682fdb342fa7cfc0722834d0e4f7 boost-wave-1.41.0-17.el6_4.i686.rpm x86_64: 86944f00bea3725ac2e61e2ae93b7fc30b0bc2bfc454a8ce61d2a95e4c0271f5 boost-1.41.0-17.el6_4.x86_64.rpm f59960fb9396d813304defe24c4bdede149442a934c994ff5af63c935741d995 boost-date-time-1.41.0-17.el6_4.i686.rpm 193cc8b631dd07b9743ee6d01d17ac508267e4137747044303b4e738f0b8ecaa boost-date-time-1.41.0-17.el6_4.x86_64.rpm 7780102c45f5893e4c7fd030563427ba95481e3c2f7a48ca8d87fba2fc698d1f boost-devel-1.41.0-17.el6_4.i686.rpm 2f6f6f23f2cbf26cb27303a286fa77b910326a8a2108ddceeb3bfd8e9b4a66a4 boost-devel-1.41.0-17.el6_4.x86_64.rpm 96789e28220d31866ebe6d4e4001e24d3d270ade1b107eac34787de1679201bc boost-doc-1.41.0-17.el6_4.x86_64.rpm 700eef24e99b84d1fcd43101bc45e5aa2c7c2addce1c0eb399fd28e533c6c61e boost-filesystem-1.41.0-17.el6_4.i686.rpm 3bb68a23603638b05072167fd8b032b487ff8946dc31d43111bdbc4ab2176f57 boost-filesystem-1.41.0-17.el6_4.x86_64.rpm f2cc7bf10407da92c2f990ae939099b9abcdcca29816b176e8eca375a2c85fd5 boost-graph-1.41.0-17.el6_4.i686.rpm d9541028e57d3e99ec385f34ede753ea9f7cd39525c3cef8211cf10d477ce86a boost-graph-1.41.0-17.el6_4.x86_64.rpm b5ca862fdfdc3ac1c8da7e9cce4fc804796ead79db1d7e85463ee197321817c3 boost-graph-mpich2-1.41.0-17.el6_4.i686.rpm 1e0f4a6d73dcecb575b42896be8feb069e42fbb8b97a50fde8f739eba470e5d2 boost-graph-mpich2-1.41.0-17.el6_4.x86_64.rpm 9c0b4fba7299cd13568b09444ddd71b58c55d7794225fcc093ee1ad797dfa92a boost-graph-openmpi-1.41.0-17.el6_4.x86_64.rpm 2e907650c17616a22be5524ac6aa771b6a4b308a6227928dc82574fa1cfa6eb3 boost-iostreams-1.41.0-17.el6_4.i686.rpm d89a6f644fe814d38f1b57568ad17e52828cea17b095f80d17204a6cf167e4d5 boost-iostreams-1.41.0-17.el6_4.x86_64.rpm 8ec30afa4c4b8173019fc5d3fdf3f541bfad4c52ceeb5e0fd86e1dc1a3bf5fb2 boost-math-1.41.0-17.el6_4.x86_64.rpm b44a501828a094f49a72586579017e9b0d109ff4f1768fbe36d6999693e58129 boost-mpich2-1.41.0-17.el6_4.i686.rpm 4720beeb7f99bdaf70749fe8a9eb4d9789523b6d11a5826ddf5769251e24012d boost-mpich2-1.41.0-17.el6_4.x86_64.rpm f3fda215bb380e3bf9ff8a75bfc845a64d7fc38cd5d69050c7ac742d27c606ae boost-mpich2-devel-1.41.0-17.el6_4.i686.rpm 08f2e29c6b55c24ceed0eb9a9f52c96661f63b4e017addf3eb4293e54f93868a boost-mpich2-devel-1.41.0-17.el6_4.x86_64.rpm eefd0ee1ac9bef33cceaf31aab10235913465a80fb78fbf73e17a6b1d2ef71f9 boost-mpich2-python-1.41.0-17.el6_4.i686.rpm 395159d1ddf88991348cc00a5b178527bb2a050cbb1fae710930651388be4047 boost-mpich2-python-1.41.0-17.el6_4.x86_64.rpm 38a13faf691b5def011884d6d0a55bb942a2dec27e016c12436333df6d2cda4a boost-openmpi-1.41.0-17.el6_4.x86_64.rpm d1ed3f323a9a2358d551bce6ffcd37358deff5cf9a4f8c9025f2910b2312f2c2 boost-openmpi-devel-1.41.0-17.el6_4.i686.rpm 8e74afbcb4d4261be59731fa3fb47851a2a658eb74f2d26010d63e530b03c736 boost-openmpi-devel-1.41.0-17.el6_4.x86_64.rpm 0a253ec42d9995b2417cb13a9c339622941d0c27fd251aa8ef36d1fae695c279 boost-openmpi-python-1.41.0-17.el6_4.x86_64.rpm 83ff052460d5875aa41731c1f0947a1f0aaf99b806de3ad1bfb616841720641d boost-program-options-1.41.0-17.el6_4.i686.rpm c42132a36b12a585c3c24033246a653941ed9c0ffefe5383839ff2c5de974606 boost-program-options-1.41.0-17.el6_4.x86_64.rpm b69efa50b01fded1cd134668ec4434b3f4f4e31616638287ab6bcb7b4d93e430 boost-python-1.41.0-17.el6_4.i686.rpm dfe5109e82fed65544b136abbd21dcb215cf814d866b3765b0c8dbe0263a9b33 boost-python-1.41.0-17.el6_4.x86_64.rpm 935ab133eda12f8acdc0391e0e0c93449591774e26a59e3a24f4b20bfdb45cea boost-regex-1.41.0-17.el6_4.i686.rpm 22ea8cc215313dee92dea9082861c65813751cdd4bf67f6804aacbdea8a9f5fe boost-regex-1.41.0-17.el6_4.x86_64.rpm dd770d79c0642323d34d82dc88691bd90cfad08a5d9ccce4919feb4f7bee6008 boost-serialization-1.41.0-17.el6_4.i686.rpm 035d708c958c280e84e0792e77cc23f90296cc616b565746a99fc421917f3960 boost-serialization-1.41.0-17.el6_4.x86_64.rpm 3f973ac7ecb1ec95e29f77a6e8a1f6f6e46c065cb339230c567ca6ab80749da7 boost-signals-1.41.0-17.el6_4.i686.rpm 46b81147f05e002128263dc3d271ac2d4c384818b2eaf5dcc143ea3ce42d0ca3 boost-signals-1.41.0-17.el6_4.x86_64.rpm 82e0828a4f8fb84070c38db56c0fda41e26a296e791e24bc3a1e4449545b48a0 boost-static-1.41.0-17.el6_4.x86_64.rpm 02f9f48c876644587fe5b91e85bce74289c46f37b1a45b75f1828aec13b63f72 boost-system-1.41.0-17.el6_4.i686.rpm 782735948658cb91bb356b76405ff900b3040e895af2aa8a7e020611f84489c6 boost-system-1.41.0-17.el6_4.x86_64.rpm 4de1ed018ae95dd2daa9b54f2ca64a055a3d7d24c66e14a35bcb9d0a1a366b70 boost-test-1.41.0-17.el6_4.i686.rpm 00969eecba17cbe7f8eaa15a671a96ad5ff290f501864fb7aa70d32201ada493 boost-test-1.41.0-17.el6_4.x86_64.rpm a6947757a659321cedc585d4b74c7e738ef42f5ff68a4b59aef62ab9fd0ce35f boost-thread-1.41.0-17.el6_4.i686.rpm 0e34ae08acbd6cfe9e7d26cf8e877ba598bf2b2ccd265a6aee566cda3ac77dfd boost-thread-1.41.0-17.el6_4.x86_64.rpm bd3b6c1db628d5cdf88b203b8eb7b8365816682fdb342fa7cfc0722834d0e4f7 boost-wave-1.41.0-17.el6_4.i686.rpm 975eabe0c1d71c280b34f290608ee579d5ff161ad7c679ce7017165333b9772a boost-wave-1.41.0-17.el6_4.x86_64.rpm Source: 120d83c2811ce5d951e2ebf84709a232f2d072007e04eea50c45b8081165afd2 boost-1.41.0-17.el6_4.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 2 Date: Wed, 3 Apr 2013 04:34:09 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0696 Critical CentOS 5 xulrunner Update To: centos-announce(a)centos.org Message-ID: <20130403043409.GA1349(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0696 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0696.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5597aea4d37eead49f184cac9daced824d6a332f4b67b254461ddf18a77d9e83 xulrunner-17.0.5-1.el5_9.i386.rpm 88229ce133be5b613d10676ab7f0d996f260a143008f44cd1a684efd1f662ebb xulrunner-devel-17.0.5-1.el5_9.i386.rpm x86_64: 5597aea4d37eead49f184cac9daced824d6a332f4b67b254461ddf18a77d9e83 xulrunner-17.0.5-1.el5_9.i386.rpm bbe3f667ed00c4860ef80b267722c64c8fa91cd573d2d8a1fbcff3a06bd9a386 xulrunner-17.0.5-1.el5_9.x86_64.rpm 88229ce133be5b613d10676ab7f0d996f260a143008f44cd1a684efd1f662ebb xulrunner-devel-17.0.5-1.el5_9.i386.rpm ce7201c9a7842693ad51db54305e1b28cdc3e8572413f6f3fd9f7d87876bf925 xulrunner-devel-17.0.5-1.el5_9.x86_64.rpm Source: e9dfb2eb020e83b0c2ee2d23fef5500c6f70bad833cbdd29003fdd5e0b5ac597 xulrunner-17.0.5-1.el5_9.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 3 Date: Wed, 3 Apr 2013 04:39:37 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0697 Critical CentOS 5 thunderbird Update To: centos-announce(a)centos.org Message-ID: <20130403043937.GA1482(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0697 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0697.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 3c5fc2abc05ea43daf472aa1ca1a909fdff250ad1097d64887fd95819eb85647 thunderbird-17.0.5-1.el5.centos.i386.rpm x86_64: f81334bd93d83b8950946d40c092ad7c63aadde3e088eb520c76b06bad158002 thunderbird-17.0.5-1.el5.centos.x86_64.rpm Source: aa25c6cce823137c043d45a239df568b67eb5aaeadad4a9bbe79fc4ccaa6f5d3 thunderbird-17.0.5-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 4 Date: Wed, 3 Apr 2013 04:42:17 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0696 Critical CentOS 5 firefox Update To: centos-announce(a)centos.org Message-ID: <20130403044217.GA1609(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0696 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0696.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 5109c5f8f4fa396f006575dd4b6e750f46086cc5eb0660323eed5955ff2cc4b8 firefox-17.0.5-1.el5.centos.i386.rpm x86_64: 5109c5f8f4fa396f006575dd4b6e750f46086cc5eb0660323eed5955ff2cc4b8 firefox-17.0.5-1.el5.centos.i386.rpm ef8883f10686e40aa942710dc9cad2e10d22519157f6721af00884967dc9cb11 firefox-17.0.5-1.el5.centos.x86_64.rpm Source: d776604c90449284fec01988d730a832fd724c95a5b1f320c34680b8f465d7cf firefox-17.0.5-1.el5.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 5 Date: Wed, 3 Apr 2013 10:56:57 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0696 Critical CentOS 6 xulrunner Update To: centos-announce(a)centos.org Message-ID: <20130403105657.GA19569(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0696 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0696.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 26b0caa52bf4e7b4d7c261e00ee743e5685299182aeae1a42b5847b04e91caca xulrunner-17.0.5-1.el6.centos.i686.rpm 567ba526b9b75803d9db5b33293ec8c88cd61184e8d09176320c4f009b70232d xulrunner-devel-17.0.5-1.el6.centos.i686.rpm x86_64: 26b0caa52bf4e7b4d7c261e00ee743e5685299182aeae1a42b5847b04e91caca xulrunner-17.0.5-1.el6.centos.i686.rpm 896b11cd54e4ca8bd52dd4ae9efdb430e6b7e4b379d835d8a687c949e0cfe39d xulrunner-17.0.5-1.el6.centos.x86_64.rpm 567ba526b9b75803d9db5b33293ec8c88cd61184e8d09176320c4f009b70232d xulrunner-devel-17.0.5-1.el6.centos.i686.rpm 822aa2efab665cfe10d7c7a3e39c803110438c39cdeeb1c1c4e0035b574d9343 xulrunner-devel-17.0.5-1.el6.centos.x86_64.rpm Source: b6128f2140cfe782f2b9e66678cfd594e1b9e37ac754704e3c92d4aa3a539325 xulrunner-17.0.5-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 6 Date: Wed, 3 Apr 2013 10:58:05 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0697 Important CentOS 6 thunderbird Update To: centos-announce(a)centos.org Message-ID: <20130403105805.GA19665(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0697 Important Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0697.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 967a0634b5aa244be5eca52d962b8f8ba087d2f95ae74c45c506eb3d9fd6b68f thunderbird-17.0.5-1.el6.centos.i686.rpm x86_64: 2b4c51af85d29a1d83610d50322f64627aee746424db8975eca082cccfafc438 thunderbird-17.0.5-1.el6.centos.x86_64.rpm Source: 155f9596b4414f0c45fb462e194d58e8a0fe5a6666f4427bca88e94bb58c3e0d thunderbird-17.0.5-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ Message: 7 Date: Wed, 3 Apr 2013 10:58:52 +0000 From: Johnny Hughes <johnny(a)centos.org> Subject: [CentOS-announce] CESA-2013:0696 Critical CentOS 6 firefox Update To: centos-announce(a)centos.org Message-ID: <20130403105852.GA19761(a)chakra.karan.org> Content-Type: text/plain; charset=us-ascii CentOS Errata and Security Advisory 2013:0696 Critical Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-0696.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: eea9330cd29c93424557cab123a4e6b2ea8fca6dcaff337cb9185dfdfbb39492 firefox-17.0.5-1.el6.centos.i686.rpm x86_64: eea9330cd29c93424557cab123a4e6b2ea8fca6dcaff337cb9185dfdfbb39492 firefox-17.0.5-1.el6.centos.i686.rpm 4abce1b75131b50adfc1af53cb1e700412fb3ed42463da6ab3839bca786763ca firefox-17.0.5-1.el6.centos.x86_64.rpm Source: 5d1a5d079fa22e2feac5b90f0735f741654a929a49edb831ab00ea552ab71b1b firefox-17.0.5-1.el6.centos.src.rpm -- Johnny Hughes CentOS Project { http://www.centos.org/ } irc: hughesjr, #centos(a)irc.freenode.net ------------------------------ _______________________________________________ CentOS-announce mailing list CentOS-announce(a)centos.org http://lists.centos.org/mailman/listinfo/centos-announce End of CentOS-announce Digest, Vol 98, Issue 1 **********************************************

1 0

Minimal ISO: GRUB UEFI has incorrect config
by Adam Bishop 03 Apr '13

03 Apr '13

Hello, I've just tried to use CentOS-6.4-x86_64-minimal.iso, but it does not work unmodified. The grub commands used by the ISO for installation/rescue are: kernel /images/pxeboot/vmlinuz ... initrd /images/pxeboot/initrd.img These paths do not exist on disk. If I manually correct these to: kernel /images/vmlinuz ... initrd /images/initrd.img The installation is able to proceed normally. Thanks, Adam Bishop Systems Development Specialist gpg: 0x6609D460 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 2

Kickstart just create /boot, recommended swap and / with whatever is left.
by Drew Weaver 03 Apr '13

03 Apr '13

Howdy, The default partitioning scheme appears to be: swap /boot / small amount of space /home remainder of space. Is there any way via kickstart to have it just create swap with the recommended size, /boot, and then just / with the remainder without manually specifying the names of the lvs/vgs etc? I figured there would be an autopart -atomic option but that doesn't seem to exist. Any advice? Thanks, -Drew

4 4

[SOLVED] it was an iptables-config setting, was Re: Vsftpd configuration problem
by Max Pyziur 02 Apr '13

02 Apr '13

On Tue, 2 Apr 2013, Reindl Harald wrote: > > > Am 02.04.2013 02:04, schrieb Max Pyziur: >>> [root@srv-rhsoft:~]$ cat /etc/sysconfig/iptables-config >>> # Load additional iptables modules (nat helpers) >>> # Default: -none- >>> # Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which >>> # are loaded after the firewall rules are applied. Options for the helpers are >>> # stored in /etc/modprobe.conf. >>> IPTABLES_MODULES="nf_conntrack_ftp nf_nat_ftp" >> >> So, are you saying this last line is key? > > it is on my fedora machines acting as FTP behind a NAT > >> Because on the CentOS 5 setup I see: >> IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp" >> >> While on the CentOS 6 setup I see: >> IPTABLES_MODULES="" >> >> What is the correct/recommended setting? > > there is no "correct/recommended setting" > > if you are behind a NAT you need a different config as if you are > have a public IP on your machine, that is why configs exists Not behind a NAT ... > with passive FTP the server anserwers with port AND ip-address > for the data-connection (which is a idiotic design but it is how > it is) and if the client follows this response it fails > > so the way to go is translate the response in whatever > stateful filter in fornt of the FTP server > > this is called ALG (application layer gateway) and part > of any relieable stateful packet filter Adding the following line to /etc/sysconfig/iptables-config "got me home:" IPTABLES_MODULES="ip_conntrack_ftp" Along with the above dialogue, the following page helped (me): http://www.linuxquestions.org/questions/linux-networking-3/iptables-configu… Thanks. Max Pyziur pyz(a)brama.com

2 1

Re: [CentOS] Vsftpd configuration problem
by Max Pyziur 02 Apr '13

02 Apr '13

On Tue, 2 Apr 2013, Reindl Harald wrote: > > > Am 02.04.2013 01:25, schrieb Max Pyziur: >> On Tue, 2 Apr 2013, Reindl Harald wrote: >> >>> >>> >>> Am 02.04.2013 01:12, schrieb Max Pyziur: >>>> Beginning today, I started to receive the following when ftp'ing to my >>>> CentOS 6 machine: >>>> ncftp /home/pyz2 > dir >>>> connect failed: No route to host. >>>> connect failed: No route to host. >>>> connect failed: No route to host. >>>> Falling back to PORT instead of PASV mode. >>>> >>>> I can make a connection, but I can't get a directory listing or transfer >>>> data/files >>>> >>>> My firewall setting has port 21 open >>>> >>>> I can remotely telnet to hostname 21 >>> >>> and you understood that ftp needs also a data-channel >>> and not only the control-connection? >> >> I assume that you are referring to the following vsftpd configuration file setting: >> # Make sure PORT transfer connections originate from port 20 (ftp-data). >> connect_from_port_20=YES > > no - port 20 has NOTHING t do with passive FTP > >> Btw, When ftping to another user on the same machine, there is no problem in >> making a connection or in transferring data > > beause it is nor firewalled nor NAted > >> it's connections that our outside the box. > > i bet you are behind a nat > > iptables or the firewall needs to translate he answers of the servers > you need to read some documentations how FTP works and how NAT > works to undersatdn the details Ok. > [root@srv-rhsoft:~]$ cat /etc/sysconfig/iptables-config > # Load additional iptables modules (nat helpers) > # Default: -none- > # Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which > # are loaded after the firewall rules are applied. Options for the helpers are > # stored in /etc/modprobe.conf. > IPTABLES_MODULES="nf_conntrack_ftp nf_nat_ftp" So, are you saying this last line is key? Because on the CentOS 5 setup I see: IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp" While on the CentOS 6 setup I see: IPTABLES_MODULES="" What is the correct/recommended setting? >>> http://slacksite.com/other/ftp.html > > Max Pyziur pyz(a)brama.com

2 1

C5-C6 Migration problem: HTML-Formatted email in Squirrelmail disappears
by Max Pyziur 02 Apr '13

02 Apr '13

Greetings, In Squirrelmail, you can install a plugin html_mail, that allows you to compose html-formatted email. This plugin functions with Firefox and Internet Explorer; it doesn't function in Google Chrome. In CentOS 5 with PHP5.1, I could copy and paste html-formatted text with complicated html (tables, css, etc) from a text editor into the the html-formatting pane of squirrelmail, and the message would be delivered as html-formatted to the recipients. In CentOS 6, with PHP5.3, using Squirrelmail with the html_mail plugin, copying html-formatted text from a text editor into the html-window in Squirrelmail, the delivered email only shows the header information. Using pine, I see that there is an attachment, viewing the attachment, I see the original html code that was composed in a text editor. Viewing this same received email in a web-based client (Gmail or Squirrelmail), all of html-formatting disappears. Any suggestions on how to troubleshoot and resolve this? Much thanks. Max Pyziur pyz(a)brama.com

1 0

The annoying task_setrlimit
by m.roth＠5-cent.us 02 Apr '13

02 Apr '13

I found the FAQ about it. Unfortunately, it is going to worry some few of my users. The FAQ does *not* mention any way to shut it up. Clues?

2 2

Vsftpd configuration problem
by Max Pyziur 02 Apr '13

02 Apr '13

Greetings, Beginning today, I started to receive the following when ftp'ing to my CentOS 6 machine: ncftp /home/pyz2 > dir connect failed: No route to host. connect failed: No route to host. connect failed: No route to host. Falling back to PORT instead of PASV mode. I can make a connection, but I can't get a directory listing or transfer data/files. I'm flummoxed. What I had been doing is adding more directives to my /etc/hosts.deny file, today to include certain categories of ip addresses for the vsftpd service. I unwound that after I saw the problem starting to occur, and have restarted vsftpd several times. That hasn't changed the above issue. And yes, I've googled. My firewall setting has port 21 open. I can remotely telnet to hostname 21 and I get a response indicating that the port is open. Any advice would be appreciated. Much thanks. Max Pyziur pyz(a)brama.com

2 1

Re: [CentOS] Vsftpd configuration problem
by Max Pyziur 01 Apr '13

01 Apr '13

On Mon, 1 Apr 2013, lists-centos wrote: > > > ------------ Original Message ------------ >> Date: Monday, April 01, 2013 07:12:53 PM -0400 >> From: Max Pyziur <pyz(a)brama.com> >> To: centos(a)centos.org >> Cc: >> Subject: [CentOS] Vsftpd configuration problem >> >> >> Greetings, >> >> Beginning today, I started to receive the following when ftp'ing >> to my CentOS 6 machine: >> ncftp /home/pyz2 > dir >> connect failed: No route to host. >> connect failed: No route to host. >> connect failed: No route to host. >> Falling back to PORT instead of PASV mode. >> >> I can make a connection, but I can't get a directory listing or >> transfer data/files. >> >> I'm flummoxed. >> >> What I had been doing is adding more directives to my >> /etc/hosts.deny file, today to include certain categories of ip >> addresses for the vsftpd service. >> >> I unwound that after I saw the problem starting to occur, and have >> restarted vsftpd several times. >> >> That hasn't changed the above issue. >> >> And yes, I've googled. >> >> My firewall setting has port 21 open. >> >> I can remotely telnet to hostname 21 >> >> and I get a response indicating that the port is open. >> >> Any advice would be appreciated. >> >> Much thanks. >> >> Max Pyziur >> pyz(a)brama.com > > ftp uses port 21 for the "connection" and port 20 for the "data", > which includes directory listings as well as the file transfer > proper - see /etc/services. so if you have port 20 blocked that > would explain your problem. Does port 20 have to be open in the firewall? If so, this would be the first machine where I have explicitly set this. > - Richard > > > Max

1 0

Re: [CentOS] Vsftpd configuration problem
by Max Pyziur 01 Apr '13

01 Apr '13

On Tue, 2 Apr 2013, Reindl Harald wrote: > > > Am 02.04.2013 01:12, schrieb Max Pyziur: >> Beginning today, I started to receive the following when ftp'ing to my >> CentOS 6 machine: >> ncftp /home/pyz2 > dir >> connect failed: No route to host. >> connect failed: No route to host. >> connect failed: No route to host. >> Falling back to PORT instead of PASV mode. >> >> I can make a connection, but I can't get a directory listing or transfer >> data/files >> >> My firewall setting has port 21 open >> >> I can remotely telnet to hostname 21 > > and you understood that ftp needs also a data-channel > and not only the control-connection? I assume that you are referring to the following vsftpd configuration file setting: # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES Btw, When ftping to another user on the same machine, there is no problem in making a connection or in transferring data; it's connections that our outside the box. > http://slacksite.com/other/ftp.html > > MP

1 0

[Possibly OT] - General question: state of internet traffic
by Max Pyziur 01 Apr '13

01 Apr '13

Greetings, I've read reports that there has been degradation in Internet traffic over the last month. Until today, I haven't experienced any. However, getting bank record data from chase.com here in NYC seems impossible. I also noticed erratic ftp behavior today; connections can be made but data can't be transferred. This isn't consistent, though. (I have a machine in LA while being in NYC; ftp traffic is difficult to establish westbound; no problem eastbound). I haven't done any sort of consistent test, so I am not sounding alarms. I'm just trying to get a sense of where this is happening. And is there a reliable source of information. Much thanks Max Pyziur pyz(a)brama.com

3 2

Don't understand how to re-partition this setup or why it was made like this
by Yves S. Garret 01 Apr '13

01 Apr '13

Hello, I did df -h on my CentOS 6.4 machine. $ df -h Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_ysg-lv_root 47G 8.8G 36G 20% / tmpfs 948M 372K 947M 1% /dev/shm /dev/sda1 485M 62M 398M 14% /boot /dev/mapper/vg_ysg-lv_home 4.6G 2.7G 1.7G 63% /home What I don't understand is why is /home so tiny and how can I re-partition this without having to nuke and rebuild my machine?

5 5

Re: [CentOS] DNS forwarding vs recursion
by Les Mikesell 01 Apr '13

01 Apr '13

On Mon, Apr 1, 2013 at 2:54 PM, Michael H. Warfield <mhw(a)wittsend.com> wrote: >> > AFA how BIND should be shipped... Last time I looked (just a couple of > days ago) BIND ships in a fairly secure manner (local caching resolver > listening on localhost only) and the default IP tables blocks DNS > queries and response that are not on-session. The OP mentioned that his > name server was an "authoritative" name server (it was servicing a zone > for which it was configured). That's NOT a shipped configuration. You > have to configure it for a zone. Sooo... We are NOT talking about OOB > (Out Of the Box) configurations here at all. Someone had to > configuration it this way, post installation. So everyone has to add your own zones. I don't see how that leads to the conclusion that it is shipped with appropriate defaults to force/encourage separation of authoritative/recursive instances. >> > I don't think that's the answer either. >> > Establishing best practices and discouraging people from misconfiguring >> > applications would seem to be a better option and best current practices >> > now were not always considered best practices 20 years ago. It's a >> > challenge. It's a BIG challenge in my business. >> >> OK, but of course it is a challenge if you advocate using tools that >> most people don't have or understand - or don't work universally. > > Don't have: Disagree - most have. Where? I'd say it is much more common for firewalls to be separate entities that don't know much about routing. > Don't understand: I'll grant you that. They don't understand the tools, > they don't understand the problem, and they don't understand best > current practices. You got me on that one. There in lies the problem > and the challenge. Exactly. If you can't clearly define the problem or a required topology you can't expect people to re-arrange things. >> > Asymmetric >> > routes (aka triangular routing) should be severely discourage and is >> > generally considered a configuration error unless it's heavily >> > justified. > >> I don't think BGP shares this opinion. > > I'm not sure I follow you on that statement. BGP is a protocol and I've > done some coding on that (I'm the author of the MD5 signature code in > bgpd of the Quagga suite). The crowd on NANOG (North American Network > Operators Group) generally frowns upon asymmetric routing as something > that is occasionally necessary and unavoidable but not admitted to > loudly in public, much akin to an aunt that like to sit in the corner of > a room at a party and frequently farts loudly. Are you saying that something in BGP cares about anything except the best forward path seen at the moment? Or that as this changes dynamically it even tries to keep the reverse path symmetrical? > Asymmetric routing also breaks > stateful firewalls badly if they are in the way... Sure. Do you want reliability or control? Pick one. >> And I'd speculate that the >> simplicity of IP routing only needing to care about the forward route >> direction one hop at a time is the main reason that it became the >> network of choice. Well, that and a taxpayer funded directory service >> from the start. > > This was very true back then but proved to be as problematical as > spoofing attacks abusing the DNS resolvers. Both are rooted in the > early ages of the Internet. Fascinating that you bring up that point. Packets are packets - the concepts of widely distributed, widely available transports aren't going to change, we just do it faster now. > Counter point is in the policy routing present in modern systems and > that IPsec in particular is a policy oriented VPN where triangular / > asymmetric routing frequently break. Hence the continuing popularity of ssl-based VPNs that work better under real-world conditions. OpenVPN, Juniper's, etc. > I would concur with that. I think that's part and parcel of > establishing your nominal security perimeters anyways. Maybe - as organizations grow, merge, relocate, etc. it becomes hard to deal with perimeters or to assume that all the bad guys are outside. >> So you envision an internet where it is impossible to reach a >> recursive resolver outside of your own organization's control? > > Not "impossible" and not under "your own organizations control". > Certainly, ISPs provide recursers for their clients. Yeah, but they mostly do that so they can redirect failed lookups to their own search engines or link farms and show some ads. As though web browsers were the only clients for DNS. > But... What is > the purpose of an indeterminant anonymous client connecting to your > recursive server and making arbitrary queries? Use case: You provide a subscription service to institutions that like strict outbound firewalling. Your servers are located in a few contiguous ranges and you work with their firewall admins to permit access. Then you find out that the desktop clients in question don't have access to full internet DNS. > Yes, there are some of > us who are involved in Internet infrastructure and maintenance for which > some of that may be useful for diagnostic purposes but, to allow anyone > for any reason to anywhere? That's just inviting abuse. Sure, but there's not a reasonable way to distinguish a customer from anyone else at the time they need DNS. > Counter point is that some ISPs (AT&T in particular) have begun blocking > unrestrained DNS as much as they block unrestrained SMTP because of some > of the abuse that has taken place. Or because they make money when they redirect the errors... > Whatever your opinion is on THAT > debate (and I am decidedly NOT on their side, but I do agree with > organizations who do it) it's a fact and it is happening. They don't > even allow their clients to run their own name servers (unless you are a > "business client" and have an agreement to that effect) and force most > of their clients to use their name servers. And then they can charge more for the "business class" where they don't block stuff. -- Les Mikesell lesmikesell(a)gmail.com

1 0

DNS forwarding vs recursion
by John R Pierce 01 Apr '13

01 Apr '13

I have 2 CentOS servers that are both authoritative DNS for several domains and local resolvers. As configured, they are publicly visible resolvers, which I've known for awhile is not a good thing. whats the appropriate way of configuring the bind on CentOS 5.current to not allow recursion on queries from the public side, but still allow recursion locally? is it as simple as adding allow-recursion{} with the appropriate private subnets and localhost to named.conf ? -- john r pierce 37N 122W somewhere on the middle of the left coast

6 8

Re: [CentOS] DNS forwarding vs recursion
by Les Mikesell 01 Apr '13

01 Apr '13

On Mon, Apr 1, 2013 at 1:30 PM, Michael H. Warfield <mhw(a)wittsend.com> wrote: > > Actually, it's pretty easy with netfilter / iptables. Other firewalls > like pf filter on *BSD an proprietary work similar. If you know your > inside networks you merely add a rule to block incoming packets on your > external interface with source addresses that should be inside your > firewall. What does 'inside' mean to TCP/IP? Are you saying it can't work if you are all public? Or if you expect to use redundant public routing among all of your systems? > Do > we all drop BIND in favor of nscd for our authoritative name servers and > dnsmasq for our cachers? Well, first you have to come out and say that recursive resolvers are too fragile to survive in public. Or have too much potential for collateral damage and must be outlawed. Maybe define a way your network topology has to be arranged. Then move on to how BIND should be shipped. > I don't think that's the answer either. > Establishing best practices and discouraging people from misconfiguring > applications would seem to be a better option and best current practices > now were not always considered best practices 20 years ago. It's a > challenge. It's a BIG challenge in my business. OK, but of course it is a challenge if you advocate using tools that most people don't have or understand - or don't work universally. > Asymmetric > routes (aka triangular routing) should be severely discourage and is > generally considered a configuration error unless it's heavily > justified. I don't think BGP shares this opinion. And I'd speculate that the simplicity of IP routing only needing to care about the forward route direction one hop at a time is the main reason that it became the network of choice. Well, that and a taxpayer funded directory service from the start. > They're highly unreliable to begin with (you can forget > about getting through stateful firewalls). Where it can be justified, > then static rules allow it will cover things in ways that attackers can > not exploit. So what you need to establish first is the location of the firewalls in respect to recursive servers. > Perhaps. But I'm not quite so sure where the bad design is or if it's > merely a confluence of extremely powerful tools, like BIND, that can be > used in a multitude of ways. I might agree with you more if the "bad > design" you are referring to is the overall network design, > architecture, and layout. I've seen plenty of well designed tools > misused in badly designed networks. So you envision an internet where it is impossible to reach a recursive resolver outside of your own organization's control? -- Les Mikesell lesmikesell(a)gmail.com

1 0

nagios 3.5 for rpm repository for centos 5
by Eero Volotinen 31 Mar '13

31 Mar '13

Hi List, Is there any good rpm repository that provides nagios 3.5 for centos 5? br, -- Eero

2 1

ext4 deadlock issue
by Joakim Ziegler 30 Mar '13

30 Mar '13

I'm having an occasional problem with a box. It's a Supermicro 16-core Xeon, running CentOS 6.3 with kernel 2.6.32-279.el6.x86_64, 96 gigs of RAM, and an Areca 1882ix-24 RAID controller with 24 disks, 23 in RAID6 plus a hot spare. The RAID is divided into 3 partitions, two of 25 TB plus one for the rest. Lately, I've noticed sporadic hangs on writing to the RAID, which "resolve" themselves with the following message in dmesg: INFO: task jbd2/sdb2-8:3607 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. jbd2/sdb2-8 D 000000000000000a 0 3607 2 0x00000080 ffff881055d03d20 0000000000000046 ffff881055d03ca0 ffffffff811ada77 ffff8810552e2400 ffff88109c6566e8 0000000000002f38 ffff8810546e1540 ffff8810546e1af8 ffff881055d03fd8 000000000000fb88 ffff8810546e1af8 Call Trace: [<ffffffff811ada77>] ? __set_page_dirty+0x87/0xf0 [<ffffffff810923be>] ? prepare_to_wait+0x4e/0x80 [<ffffffffa01e881f>] jbd2_journal_commit_transaction+0x19f/0x14b0 [jbd2] [<ffffffff810096f0>] ? __switch_to+0xd0/0x320 [<ffffffff8107e00c>] ? lock_timer_base+0x3c/0x70 [<ffffffff810920d0>] ? autoremove_wake_function+0x0/0x40 [<ffffffffa01eef78>] kjournald2+0xb8/0x220 [jbd2] [<ffffffff810920d0>] ? autoremove_wake_function+0x0/0x40 [<ffffffffa01eeec0>] ? kjournald2+0x0/0x220 [jbd2] [<ffffffff81091d66>] kthread+0x96/0xa0 [<ffffffff8100c14a>] child_rip+0xa/0x20 [<ffffffff81091cd0>] ? kthread+0x0/0xa0 [<ffffffff8100c140>] ? child_rip+0x0/0x20 I get two of these messages in close succession, then things proceed normally. It doesn't happen often, and only under load. I'm uncertain, but think it might just happen once per boot, once it's happened, it doesn't repeat until rebooting. I'm not sure of this, however. Things otherwise seem fine, other logs, RAID controller event logs, RAID controller physical disk status and health reports are normal, etc. After getting this error once, attempting to re-write the exact same file on the filesystem gets no errors and works normally, so I doubt it's a physical thing with the drives anyway. Anyone seen anything like this before? It's not very frequent, but it's very annoying. -- Joakim Ziegler - Supervisor de postproducción - Terminal joakim(a)terminalmx.com - 044 55 2971 8514 - 5264 0864

2 7

cronie: /usr/bin/run-parts
by Max Pyziur 30 Mar '13

30 Mar '13

Greetings, Per the subject line, what controls the time of the running of scripts located in the /etc/cron.[daily|weekly|hourly] directories? Specifically with CentOS 6.* I've noticed that scripts in /etc/cron.daily and /etc/cron.weekly run at different times of the day, or on different days. In my experience on other rpm-based distributions, cron daily and weekly scripts run at 4am; those that are run weekly run at 4am on Sunday morning. Much thanks in advance, Max Pyziur pyz(a)brama.com

3 3

iptables settings for X11 forwarding in CentOS 6.2
by Pat Haley 30 Mar '13

30 Mar '13

Hi, We recently installed CentOS 6.2 on our cluster. During the installation/debugging of various secondary software, we had disabled iptables. When we re-enabled them, we found that the front-end would no longer X11 forward (although it does so when the iptables are off). What do we need to set in the iptables to permit X11 forwarding? Currently we're using iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m limit --limit 15/minute -j LOG --log-level 7 --log-prefix "Dropped by firewall: " iptables -A INPUT -i eth1 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6001 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6002 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6003 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6004 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 6005 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp --dport 177 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp --dport 6000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth1 -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Pat Haley Email: phaley(a)mit.edu Center for Ocean Engineering Phone: (617) 253-6824 Dept. of Mechanical Engineering Fax: (617) 253-8125 MIT, Room 5-213 http://web.mit.edu/phaley/www/ 77 Massachusetts Avenue Cambridge, MA 02139-4301

4 5

Re: [CentOS] a-gnome-oyences
by m.roth＠5-cent.us 30 Mar '13

30 Mar '13

Gordon Messmer wrote: > On 03/28/2013 07:00 AM, m.roth(a)5-cent.us wrote: >> Most of my users are on kde, as am I (I really don't like gnome). I've got one on gnome, though, CentOS 6.4, and I have a problem: I have to start >> an agent running ->on login<-, so that the same one is in the environment >> of every term window he opens. > That would be the normal configuration. >> In kde, no problem, I modify /etc/X11/xinit/xinitrc-common so that code >> in there calls our (newer) ssh-agent instead of the stock one. >> (And, of course, it's killed on logout, and there's only one running, >> not one every time that never go away unless killed manually.) > You're already making things more complicated than they should be. The ssh agent is supposed to be the parent process of your login session. That is, your login session should be: > ssh-agent startkde > or: > ssh-agent gnome-session Well, no. If you look at the stock /etc/X11/xinit/xinitrc-common. at the bottom of the file, that's where it sets this stuff. As I said, we *have* to use the compiled from more recent versions of ssh, because the current stock version doesn't support US gov't PIV cards for authentication. And doing this, I only get one agent, and it gets killed automagically when I log out, as expected. > With GDM, you'd modify the session file in /usr/share/xsessions. You'd a) /usr/share? Why are system-wide configuration files NOT IN /etc? b) UTF-8? What freakin' morons decided it shouldn't be plain ascii, like everything else? #$%^&*$%^&*($%^&*($%^&*(%^&*()_+ No matter what I open it in, it keeps showing up with garbage chars. So I look at /etc/gdm, as I said, and I see it sourcing /etc/X11/xinit/xinitrc-common, where I've got it set to reference our agent. Then I go further down, and see <snip>*************** case "$1" in failsafe) exec -l $SHELL -c "xterm -geometry 80x24-0-0" ;; gnome|gnome-session) # lack of SSH_AGENT is intentional, see #441123. though # the whole thing should really happen in xinitrc.d anyway. exec -l $SHELL -c gnome-session exec /bin/sh -c "exec -l $SHELL -c \"gnome-session\"" ;; kde|kde1|kde2) exec $CK_XINIT_SESSION $SSH_AGENT /bin/sh -c "exec -l $SHELL -c \"startkde\"" <snip>*************** Pause for some googling, ah, here's my answer that's less ugly, from <https://ask.fedoraproject.org/question/10225/is-it-possible-to-replace-gnom…>, which is to create /etc/X11/xinit/Xclients.d/Xclients.gnome-session.sh, whose contents are #!/bin/sh exec -l $SHELL -c "$SSH_AGENT gnome-session" > prefix the "Exec" line with "ssh-agent ", and be done. As those files would be <snip> > Xclients, which runs your session. You shouldn't need to change > anything at all, unless your newer ssh-agent is at a different path. > So, in that case, the only thing you should need to change is to > run gnome-session-properties, and uncheck "SSH Key Agent". First, of course it's in a different path. Second, no, I do *not* want to run a gnome thing - I need to a) do this from a command line, and b) fix it so it can be built that way, or updated. This isn't my machine, I've got dozens of users, and need to administer this remotely, without having to make them stop what they're doing so I can screw with this. Ok, I followed the guy's instructions, but a) I'm afraid to let the keyring not run, and b) I get the one agent running... but gnome-keyring-agent runs *after* it, and so overwrites the environment variables, which means this is the final trick I need to resolve. As a first question on that, in that created file, /etc/X11/xinit/Xclients.d/Xclients.gnome-session.sh, I've got the one line; however, in /etc/gdn/Xession (really /etc/X11/Xsession), to start gnome, it has, as you can see above, *two* execs. Any idea why, and any idea where I can start the agent so that the environment variables are *not* overwritten by gnome-keyring-agent. mark

2 3

new version of wireshark
by Steve Clark 29 Mar '13

29 Mar '13

Hello, Has anyone seen an el6 rpm of wireshark-1.8.6 Thanks, -- Stephen Clark *NetWolves* Director of Technology Phone: 813-579-3200 Fax: 813-882-0209 Email: steve.clark(a)netwolves.com http://www.netwolves.com

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss